Launch HN: Sqreen (YC W18) – Securing Web Apps - <AUTHOR> Hi HN! I'm Pierre, the co-founder of Sqreen (https://www.sqreen.com/).
Sqreen is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. Pretty much what an Application Performance Management tool (like New Relic) is doing, but for security.
Before founding Sqreen, I led the Red Team (Offensive Security team) at Apple. I was brought on in 2006, so we're talking iMacs and iTunes at the time. The focus was initially on breaking DRM implementations (FairPlay). Over time, I had a team of 4-5 people, and had to cover most of Apple's portfolio. We needed to provide security assessments to hundreds of developers at Apple in ways that they could trust and find useful. We faced two major issues time and time again: scale (single digit team serving hundreds), and usefulness (how could we make security something that devs felt was actionable and relevant for them?). So why were these obstacles so hard to overcome?
First, security culture is broken. My team and I had to act in secrecy for years - like most security teams in companies. Our job was to break things (and we did a pretty good job there!), but we were mainly blockers instead of enablers. As is the norm, the way things were set up, our job was to say "no" - for the sake of product security—not to work collaboratively with developers on improving security together.
Second, most of the tools the industry is using today were invented in the 90's and haven't changed much since. Legacy security solutions rely on lists of known signatures of attacks that can't keep up and that generate a high number of false positives. They slow down releases and are nearly impossible to properly maintain for security teams.
The function of security within companies today is where Ops was 15 years ago, before the DevOps "revolution".
Security as a function has yet to make the leap that Ops has. For small and mid-sized teams, security is either not present, or is bottlenecked by a one or two person team. For large companies, their security teams are flooded by irrelevant security alerts. And there aren't enough security professionals to improve the situation by just increasing headcount.
We saw a need for a self-service solution that brings security and developers closer together, so that security can better scale and become more useful for developers. My co-founder JB and I started Sqreen to build that solution.
Sqreen's microagent is a lightweight library that can be added in just a few commands to any web application, API, or microservice. We support Ruby, Node, PHP, Go, Java and Python. Our microagents use dynamic instrumentation [1] to automatically monitor sensitive app routines (Database calls, I/O processing, rendering of pages and more) and they use the execution context of the app to identify how the request is being processed and detect if it's triggering a vulnerability. The attack can be blocked at runtime (stopping the execution) and stack traces are provided on a dashboard. We embed a sandboxed VM inside the applications, so the CPU footprint is limited and we can't mess up with the app. Sqreen is built as a platform and security modules like Runtime Application Self-Protection (RASP), in-app WAF, or account takeover can be turned on or off.
We protect over 600 companies in production today. We've blocked SQL injections just hours after being deployed, we've identified massive account takeover tentatives, we're helping engineering teams with no security resources kickstart their security efforts, and we're helping security teams scale their security efforts without slowing down developers.
We would love to hear your feedback about Sqreen, as well as answer any questions you might have!
[1] - https://blog.sqreen.com/building-a-dynamic-instrumentation-a... <comment><USER2> Congrats on the launch! I've actually tried this out, and both the developer experience and dashboard user interface are very slick.

The main concern I've heard from senior security experts that have advised us is about __your__ access. By embedding Sqreen to intercept all web server traffic at the gateway (e.g. WSGI in Python), your solution adds a worry about an attack vector -- if Sqreen itself is compromised, everything about our website is compromised. Or, any general server errors at Sqreen will bring down the entire web application, possibly without warning (web app won't be able to trigger 500s), with no way to remedy except removing Sqreen and re- deploying. That actually happened for us for 12+ hours during the one month we tried out Sqreen.

I think the problem you're addressing is definitely a very real and huge problem. Would love to hear your response to the above.

<comment><AUTHOR> That's a fair point (which is raised regularly) so we architectured Sqreen in a way that we have a very low security footprint. We stream security metadata (as APM solutions stream performance metadata) so we don't need to redirect traffic. Business information/data are usually not required to investigate a security issue, so we strip scalars from SQL queries whenever we detect SQL injection for instance, and we collect as little as we can.

Re attack vectors: agreed that more code leads to more attack surface, but that's the same rationale with frameworks, other agents (APM, error/log monitoring, etc.) and often less transparent, when running on pre-packaged containers, or even on an appliance (code running on Firewalls / web app firewalls solution can usually not be audited). Our agents are not (yet) open source but are audited regularly by our users.

Sorry to hear about the bug you've hit when you tried Sqreen. Would love to know more directly (PM?) so we can debug it and provide a better experience there. The agents are using a v8 virtual machine to avoid problems of that type (we can't mess up with the original app logic), so it acts as a sandbox there.

<comment><USER3> "very low security footprint" \-- that's great.

But tell me this: if I buy Sqreen's services, will you guarantee to make my customers (and me) financially whole should you be the source of a compromise?

Will you make us financially whole if we integrate you properly but you don't do your job?

<comment><USER4> > Will you make us financially whole if we integrate you properly but you > don't do your job?

No-one would guarantee that. That would require them to be 100% perfect (never have any bugs) and know about all possible attack types _before_ they happen. That's just not possible. New attack techniques are being invented all the time.

> will you guarantee to make my customers (and me) financially whole should > you be the source of a compromise?

while possible, it'd also potentially make them instantly insolvent. Think about all the "damages" and "losses" the music industry claimed from single uploads of ripped CDs. Even if you could get a company to agree to that (not likely) the compromised people are motivated to inflate damages and the people who were the "source" of the compromise would find themselves with the options of litigating you to death for years (cheaper than a payout on inflated "damages") or going bankrupt.

</comment></comment></comment></comment><comment><USER5> I am unfortunately involved in a magento2 deployment. Sqreen blocked a critical zero day sql before the official patch was out. Keep up the good work!

<comment><AUTHOR> Thanks! Your support means a lot to us

</comment></comment><comment><USER6> I haven't read through the landing page yet, but running js from third party sources without SRI and having a very lax CSP[1] (allowing 235 host/resource combinations) does not exactly scream "security" to me. See for example [https://dmsec.io/hacking-thousands-of-websites-via-third- par...](https://dmsec.io/hacking-thousands-of-websites-via-third-party- javascript-libraries/) which is also on the frontpage right next to you.

The CSP on your login screen is slightly more restricted, but still allows 102 host/resource combinations through (not counting the host hosting the page itself).

Personally when evaluating a security product I'll check this stuff since if a company does not take proper security measures for themselves then how can I trust them to do it for their clients?

[1]: [https://pastebin.com/RvUypSYP](https://pastebin.com/RvUypSYP)

<comment><USER7> You are correct, our content security policy is not perfect, and we are gradually improving it. Security is a journey and there is no such thing as perfect security. We are striving to incrementally improve everything we are doing as our team is scaling.

<comment><USER6> My question is: If you talked to a customer and they said "we have around 200 hosts not controlled by us running code and reading data from our systems, is that a problem?" would you say "no, that is totally fine"?

It doesn't need to be perfect, but I think that for a security firm we should be able to do better.

</comment></comment></comment><comment><USER8> I have been using sqreen for the last 5 months. It has possibly been the best addition to our stack. It helps us identify users who keep trying an incorrect password and to proactively send them a password reset email with info that they have unsuccessfully tried to login. Or to identify users who login from multiple ips in disparate geographical areas (a compromised user possibly). One of the greatest uses has been to mitigate the vulnerability scans which are constant and consistent. Since our app is a bit long in the tooth, we have not had the time or the opportunity to circle back and properly pay off our technical debt. Sqreen makes sure that we have some decent p[protection without a lot of overhead or maintenance.

What we spend for the subscription far outweighs what I would have had to spend to implement this. In short, a great investment.

<comment><USER9> > It helps us identify users who keep trying an incorrect password and to > proactively send them a password reset email with info that they have > unsuccessfully tried to login.

It's fascinating to see our users come up with such interesting solutions!

> Since our app is a bit long in the tooth, we have not had the time or the > opportunity to circle back and properly pay off our technical debt

At Sqreen we're very pragmatic and while we'd dream to see everyone be up to date we realise that this cannot realistically be the case - and even futile in face of zero day vulns. Thrilling to see it put to good use :)

</comment></comment><comment><USER10> I'm blown away by the website itself. It looks like you guys really know what you're doing (or at least place product first, which opens up a lot of doors)! I wish I could invest.

How has your experience been going through Y Combinator?

EDIT: I just looked at Crunchbase and it says Sqreen went through an $14M Series A and YC was involved in both seed and Series A rounds (which I'm guessing is why it looks more polished). I'm guessing this is the Series A launch then (?)

<comment><USER11> I'm blown away as well. I actually know a company here in NL that runs the same product (more or less) but their website landing page [1] would make me choose sqreen. Their product page [2] is somewhat better but on mobile still not much compared to sqreen. Shows the power of a proper landing page.

[1] [https://bitsensor.io/](https://bitsensor.io/)

[2] [https://bitsensor.io/product/](https://bitsensor.io/product/)

<comment><USER12> I actually like BitSensor's website. What specifically would you say makes you choose Sqreen over Bitsensor?

<comment><USER11> The very first thing I see on the Sqreen landing page is an animation that gives me an idea of what the product looks like. When I scroll down I see the supported languages that tell me if my environment is supported. Images are large enough to understand, even on my phone. When I browse to their product page I get more screenshots of the product annotated with the functionality Sqreen brings. Again images are properly sized.

When I land on Bitsensor I see a bunch of text so I have to start actually parsing and understanding that text. Everything is very bright and images don't say a lot. When I browse to their product page I see a lot of white space and only a tiny actual product image that is hard to see. The remainder are not product images which make it harder for me to parse how this content is offered to me, which is a big deal when choosing a product.

</comment></comment></comment></comment><comment><USER13> Hey this looks really cool I am going to schedule a demo.

I've been looking for someone to fill the gap of 'npm audit' and paying auditors for code breaches and monitoring data breaches.

The thing is even if this tool doesn't work in every case this is still likely worth my time integrating it.

Definitely want to see you more involved in contributing back to some of those open source projects you build on like node

<comment><AUTHOR> Thank you. I'm definitely biased, but this solution does work :)

</comment></comment><comment><USER14> Congrats on the launch! The solution is simple yet effective. I have been exploring this space for a while and you are absolutely right that the infosec space is due for an overhaul like what is happening with devops. Even the CTO of Amazon said the one thing he is keeping an eye out in the next 5 years is security.

</comment><comment><USER15> Hi Pierre, Kudos for writing such an _outstanding_ intro and overview. The signal:noise ratio, content and tone are all exemplary. If it's indicative of the quality of your solution, I think Sqreen is going to be very, very successful. Congrats and good luck!

</comment><comment><USER16> It's a nice concept. Your webpage says "Sqreen blocks attacks without false positives." What's behind that claim?

<comment><USER9> (Sqreen Ruby engineer here) Since the agents execute inside the application/service, we have full context of the operations going to be performed (e.g whether a fragment of a SQL query a) will be executed and b) comes from user input). Therefore we're not basing detection of contextless patterns and any false positive/false negative of those classes of attacks is deemed a bug.

</comment></comment><comment><USER17> Very cool, will try it out. As a startup experimenting with a free plan, I found the "Badge required" to be a cool idea to get some promotion from free users

Also do you mind saying what network graph library you use? (first gif on home page) Looks like neo4j but unsure, we do Slack network analysis and have been exploring different libraries

<comment><USER18> We used D3.js and WebCola to build the graph. Hope that helps!

</comment></comment><comment><USER19> Kudos on launching, sounds very exciting. I personally wonder how sales/marketing works in this industry as I often found it tough to convey (necessary) investments that are a bit intangible and more in the cost center / risk reduction side than in the profit center. Anyone has thoughts on this?

<comment><AUTHOR> Thanks! Marketing and sales in the security space was traditionally always fear-driven - "Buy our product. If not, you're going to get breached". An ROI would be built using an "average breach cost".

Today Sqreen is inbound-driven and the marketing/sales process is focused on the positive of how to make security better and more transparent, rather than attempting to stoke fear or play up the negative side.

We never had to build any dubious ROI calculation. Tech audience usually understands the need for security and we present a technical solution that is transparent and easy to use and deploy.

</comment></comment><comment><USER20> Took a quick look at your product - looks neat - and unfortunately your description of the infosec space lines up with my experiences. I'm excited to give it a go.

Any chance of a self-hosted offering?

And any ETA on when the .NET integration (presumably support for .NET as well as .NET Core?) will be available/in beta?

<comment><AUTHOR> Thank you! Sqreen can be deployed on any cloud or on-premise platform. The agent just needs to communicate to our infrastructure (to send security metadata to your dashboard). .Net should be available early next year.

</comment></comment><comment><USER21> Any plans to launch an Agent for .NET?

<comment><AUTHOR> .Net is planned for early next year.

</comment></comment><comment><USER22> First heard of Sqreen from their SaaS CTO security checklist[1]. Keep up the good work :-)

[1] [https://www.sqreen.com/checklists/saas-cto-security- checklis...](https://www.sqreen.com/checklists/saas-cto-security-checklist)

</comment><comment><USER23> Looks useful!

FYI, Your Java install example points to a broken link (no version specified)

$ curl [https://download.sqreen.com/java/sqreen-.jar](https://download.sqreen.com/java/sqreen-.jar) -o sqreen.jar

<comment><USER24> Thanks for reporting that! The broken link has been fixed.

The correct link is '[https://download.sqreen.com/java/sqreen.jar'](https://download.sqreen.com/java/sqreen.jar') (thus without the extra '-'.

</comment></comment><comment><USER25> We use Sqreen and it's great. Best of luck!

<comment><USER9> Thanks, much appreciated!

</comment></comment><comment><USER26> Hi Pierre, congrats on the launch! I'm following your progress since the beginning (2015) and your product is impressive. I saw you have Le Monde among your customer, did you notice than more and more media companies are investing in security?

</comment><comment><USER27> Aside from the very slick website, I found the problem statement articulated in your description above super convincing. Really resonated with me. Congrats on building something that's really needed. I'll be signing up for a trial now!

</comment><comment><USER28> Congrats on the launch. Does sqreen do code analysis? How is it different from whitesource?

<comment><AUTHOR> We don't cover code analysis (SAST). We sit in production applications and the microagents inspect the execution flow of requests inside apps.

If we detect that a vulnerability is being triggered we will virtually patch it and send remediation details to developers. We wrote a blog post [1] that explains how we detect these vulnerabilities.

[1] - [https://blog.sqreen.com/block-sql-injections-not- customers/](https://blog.sqreen.com/block-sql-injections-not-customers/)

</comment></comment><comment><USER29> Prediction: Sqreen will be acquired by New Relic or GitHub/MSFT in 12-18 months.

</comment><comment><USER30> The idea is quite foreign to me so I need to fully digest - but - real sexy website!!

<comment><USER31> I'm not the best expert at this, but I followed a couple of security courses, so I do have some understanding.

From my understanding: it is a monitoring system that detects malicious activity.

How do they do this? Attackers need to find weaknesses. Where these weaknesses are is a pretty well-known topic. Database calls and I/O processing are weaknesses because if you can manipulate that you have a system compromise. Rendering pages is a weakness because of cross-site scripting issues or cross- site request forgery issues. (Duckduckgo is your friend if I am speaking in an ancient magic language ;-) )

An attacker needs to do some crazy stuff in order to exploit these weaknesses. In a lot of cases you can detect divergent behavior. For example, Let's say that an attacker successfully performs an SQL injection in the username. Then upon processing by the server, it executes an SQL command. This means that the server needs to execute a child process via a system call (system calls are an API exposed by the operating system to do stuff like file I/O or spawning processes and underly all of the I/O functions in any framework that you use). So what you could do is monitor these system calls and do a check on where they come from (you could do many more complicated things, I'm making this up as I write this, e.g. see [1]).

Since this system call has to go through the monitoring, you could detect that this is coming from an HTTP login request, for which database writes are not allowed. On that moment you could halt execution.

I am not saying that this is what they are doing, but upon reading it. It seems this is kind of what they are doing.

Here is a paper on it. It might seem daunting, but it isn't since the paper describes the architecture [1]. The implementation might be more daunting depending on. your familiarity with C.

[1] [https://www.cs.vu.nl/~giuffrida/papers/dsn-2016.pdf](https://www.cs.vu.nl/~giuffrida/papers/dsn-2016.pdf)

<comment><USER9> (Sqreen Ruby engineer) You're right about the basic premise, (but not about the details, we don't monitor syscalls): since we stand within the application we have context of the operations performed and can pinpoint whether some query fragment is a) executable and b) coming from a user, and therefore reliably conclude the action is malicious.

<comment><USER30> Interesting! The performance of string matching (or even more exotic things like real-time AST generation or even ML) must be better than interfering with every call to system APIs. Thanks for posting.

</comment></comment></comment></comment><comment><USER32> This looks great! Just went through onboarding process for PhotoStructure (a node app using ExpressJS). It was simple to install, the getting-started app was clear, and the resulting dashboard was impressive. Kudos to the team.

</comment><comment><USER11> Congrats on the launch! Impressive product.

Seems to be a minor issue on your website when accessed from a mobile device. On my iOS + chrome the pricing page, detailed features tabs all show only the stats for the first (free) tier.

<comment><AUTHOR> Good catch! We will fix that

</comment></comment><comment><USER33> Congrats on launching. A question. How do you update the Sqreen micro agents deployed within a microservices architecture? As security threats evolve one would need to patch Sqreen too, right?

<comment><USER9> (Sqreen Ruby engineer here) Agents are mostly glue to bind to and instrument code on the specific runtime/framework as well as communicate security metadata to our servers. Most of the event detection logic is dynamically pushed to the agents and runs isolated. This means security logic can usually be updated without having to update the agents themselves (although we do improve the agents themselves on a regular basis!) or even restart the app/service.

</comment></comment><comment><USER34> I'm curious — how does this compare to Contrast Security?

See [https://www.contrastsecurity.com/](https://www.contrastsecurity.com/)

</comment><comment><USER35> The free trial does't tell me anything about how much time, etc.

<comment><AUTHOR> Indeed, we'll fix this asap - thanks for catching!

</comment></comment><comment><USER36> This looks very cool. No Swift or Erlang/Elixir? :)

</comment><comment><USER37> Is your tool HIPAA compliant ? would love to use it on my secure messaging system we wrote for the Medical community

</comment><comment><USER38> Sqreen is awesome we have been using it for over a year and have loved all the new features they have put out!

</comment><comment><USER39> I look forward to reviewing your platform.

A minute ago, I visited the site, but was distracted by the logo. It looks a lot like webpack's logo ([https://webpack.js.org/](https://webpack.js.org/)) so I went to see if you two are connected. Looks like you're not.

I'll have to check back later. Good luck.

</comment><comment><USER40> Any plans on a bug bounty program?</comment>


Visa removes retailer's right to rebill cards online . . . - <AUTHOR> http://news.cnet.com/8301-31001_3-20003489-261.html?tag=newsEditorsPicksArea.0

<comment><USER2> Title is a bit misleading.. If I'm understanding this correctly, it means the retailer cannot submit your credit card information to another service. Basically, you can't buy something, and be automatically signed up for a third party service at the same time.

That's pretty different then preventing retailers from rebilling your card automatically (like for a subscription).</comment>


Ask HN: Which one should I learn deeper, Node.JS/Express.JS or Ruby on Rails? - <AUTHOR>

Recently, I've been investigating jobs in the Web industry and startups and to go further, I would to learn deeper one of those.
Many offered positions asks for Rails knowledge but looks like Node is getting a nice spot in Web development for the very near future, also due to it's traction and the always improving Express.JS web framework, I'm still uncertain which one I should learn deeper.
I already know a little bit of both and been fiddling with Node recently.
Any tips on which one I should delve into? Maybe both?
Thanks <comment><USER2> What are the jobs and projects you want looking for? When I decide to commit most of my learning time to a certain language, it's because that's the language I want to and like programming in the most. For instance, right now I'm trying to branch out and do less frontend work, so I'm learning more Ruby on Rails and Django and concentrating less on JavaScript.

</comment><comment><USER3> You already know a little bit of both, so why not just make the call yourself? I feel you already made up your mind and now you're seeking reinforcement. It's a technology trap and hurts your business. Good luck.

<comment><AUTHOR> Maybe you are right. Recently I've been playing with Node and some of my recent projects (they are on <http://github.com/carlosedp> ) are made with Node.

Also, every time I think about learning Rails deeper I think "damn, I already know how to do this on Node. Why bother..." but the industry wants Rails experience and every Rails developer I read loves it.

That's where the question came. Should I go with the current market or should I invest in a "promise" for the future?

<comment><USER3> For that matter, I hated Rails.

Also, it seems to me you're starting your own company. Why does it matter what the current market demands then?

<comment><AUTHOR> Actually I`m thinking about what could I build myself... maturing some ideas but in the meantime, I'm been looking at the market if there are opportunities for me to move and work in USA since I'm from Brazil.

</comment></comment></comment></comment><comment><USER4> I like playing with JS. It's nice to have JS on both ends.

</comment><comment><USER5> I found Express.js and it's sister-framework Connect to be a complete mess. I had trouble following what was going on, major problems debugging, it uses the factory pattern in the wrong places, and the Rack-style middleware is inefficient and unnecessary for most projects. But NodeJS itself is great, and to learn it best I think it's worth the time to write your own simple framework and utilize libraries where appropriate (like db libraries, formidable, and websocket.io).

Rails is over. It's a bloated meta framework that requires enormous amounts of peripheral knowledge to understand.

<comment><AUTHOR> I thought the same about Express the beginning but as I learned my way thru it I found it very simple indeed. You can build a Web App on a couple lines and never worry about protocols and stuff. Easily integrated with Websockets using Socket.io too.

About Rails, I think that seems like there is too much happening behind the curtains with magic. Express seems more objective.</comment></comment>


Baseball Bat With an Axe Handle Brings More Power, Fewer Injuries - <AUTHOR> http://www.wired.com/2014/08/axe-bat/

<comment><USER2> The Suit is Back!

[http://paulgraham.com/submarine.html](http://paulgraham.com/submarine.html)

I wonder if we should start putting [Advertisement] tags onto submissions like this, in the same way we do for Videos, PDfs, YC submissions, and old blog posts.

</comment><comment><USER3> The handle is very similar to an Irish Hurley; [http://upload.wikimedia.org/wikipedia/commons/d/d4/Hurling_B...](http://upload.wikimedia.org/wikipedia/commons/d/d4/Hurling_Ball_and_Hurley.JPG) , which has been around a few hundred years. ([https://www.youtube.com/watch?v=ajeagHCk15g](https://www.youtube.com/watch?v=ajeagHCk15g) for a taste of the game itself).

<comment><USER4> If it is very similar, it shouldn't be patented as it's public domain technology.

You should definitely submit this to the USPTO as a prior art they may not have considered. They are able to re-open examination for this sort of thing.

<comment><USER5> Err, also, a err, axe?

<comment><USER4> Haha - yes, but it's probably safe to assume they knew about that already when the patent was granted and they overcame it. Perhaps because it's solving a long-standing problem or because the axe is a very different application of force, or something.

The above is basically a sports bat so might be close enough to warrant a different perspective.

</comment></comment></comment></comment><comment><USER6> > Its latest composite bat, the Avenge L140B, has special construction that > allows the hitting side to flex like a spring.

I'm not familiar with baseball (Belgian here) and was wondering how these things are regulated? Does each player have its own bat? So one team can already be at a technological disadvantage when the game starts?

<comment><USER7> The spec for baseball is available. [0]

Regarding the bat itself, the regulations say it must be "round" (1.10), which probably rules out this particular handle. Other than round, the maximum weight, length, and diameter are specified. While bats close to these maximums were once widely used, almost all modern bats are well shy of those figures. Presumably the lighter, smaller bats of today more than make up in control and speed what they lack in mass.

[0] [http://mlb.mlb.com/mlb/downloads/y2010/official_rules/2010_O...](http://mlb.mlb.com/mlb/downloads/y2010/official_rules/2010_OfficialBaseballRules.pdf)

<comment><USER8> The big market for these wont be with MLB players. It's going to be amateur softball and baseball leagues. They have rules about bats but they are much more generous and not as rigorously enforced. Though what you say about the bat being round must not apply to the handle as the article says these bats are already in use by at least one MLB player.

I saw them for the first time this summer. We were in the US for a bit and I had the chance to get my son some batting instruction. (We live in Hungary and he plays little league here but it's harder to find coaches and such.) We did it with a friend and his son uses these bats. They are expensive. The wooden Axe bat he was using is around $100. And those only last so long. But anyway - when you have people dropping $300 - $500 on softball bats it's not hard to see how a company can do well selling to recreational players.

<comment><USER7> Sure enough, it's been MLB-approved! One thing in particular that might be useful for non-pros is that the handle is CNC-cut to orient the grain in the correct way.

<comment><USER9> This will help in soooo many ways. This will reduce the following dangers: 1)broken and splintered bat shards 2)bats flying out of a hitter's hand and endangering fans, player, and coaches 3)potential to reduce hammett bone injuries.

If the power and accuracy claims hold up then it could also help level out the current status of the game being tilted in favor of pitching since the end of the steroid era. There had been talk of lowering the mound in the MLB to help level the playing field, mind the pun :)

It is definitely an interesting concept. I'm not sure how well the bat will hold up over time vs a traditional bat since you are hitting the ball the on the same side every time. This is going to slightly flatten the face of the bat over time and it will be interesting to see how that plays out.

</comment></comment></comment></comment></comment><comment><USER10> Reminds me of a hurley, the bat used to play the Irish game of hurling [https://en.wikipedia.org/wiki/Hurling#mediaviewer/File:Hurli...](https://en.wikipedia.org/wiki/Hurling#mediaviewer/File:Hurling_Ball_and_Hurley.JPG) . Notice the metal band to keep the end from breaking.

The ball is about as hard as a baseball. It can be caught in the hand, without a glove. Within the last few years they've had to wear (light) helmets. Hurling follows the Dodgeball approach of "If you can dodge a wrench...".

</comment><comment><USER11> The product is available at [http://www.axebat.com](http://www.axebat.com), for anyone curious. The price for a maple bat ($99) is comparable to any decent maple bat from other manufacturers.

<comment><USER12> >patented axe handle

If like others have alluded to, that this is far from new. Should they have a patent on it?

<comment><USER13> The handle design is not new but applying the design to a baseball bat does appear to be a new idea and I would say it appears to be novel as no one else in the baseball bat industry has come up with it (To the point of patenting) in the past hundred or so years.

<comment><USER4> just posted a bit about this upstairs ^

</comment></comment></comment></comment><comment><USER14> It's interesting the inverse would also be true: "Baseball Bat With an Axe Head Brings Less Power, More Injuries"

</comment><comment><USER15> I love the bit about the bat being 3D printed and then tested out by actual baseball players!!

<comment><USER16> Yeah that was interesting. I'm sort of curious what they were printed out of (plastic?) and how that's cheaper or better than just machining wood, or even machining a blank and rounding out the handle with and hand tools.

<comment><USER17> I'm guessing it's a question of iteration time rather than price. Printing out 20 bats where each bat has one parameter tweaked slightly, and then iterating based on feedback is probably a lot quicker and easier using 3D printers rather than wood blanks and hand tools.

<comment><USER18> It would almost certainly be quicker to crank out a wooden prototype from a CNC lathe than to print one in plastic. A bat made out of ABS plastic isn't really going to work anyway, so it's not much of a prototype.

</comment></comment></comment></comment><comment><USER19> 'tis a round hurley

</comment><comment><USER20> I've got a novel idea -- what if we made baseball bats out of aluminum instead of wood?

If we're going to say technological improvements to the bats are out of bounds, why are improvements to the handle part of the bats OK?

<comment><USER21> Every bat has a "sweet spot," the part where the least vibration through the bat is produced on contact -- hitting the ball off the sweet spot means less "stinging," which you may have experienced if you've ever been to a batting cage and taken a bad swing at a ball. It's also the part of the bat where you get the biggest exit speed off the bat, and faster balls tend to be fielded less, so more exit speed means a better hit ball.

Aluminum bats have a significantly larger sweet spot than wooden bats, and they also have a higher coefficient of restitution -- that's the measure of "springiness" that a bat has, which is another factor in ball exit speeds. (Although aluminum bat manufacturers have been "deadening" their aluminum bats for college use because of safety concerns.)

Altogether, aluminum bats are substantially different from wood bats, and what you get is a game with a lot less skill involved and a lot more well-hit balls. This Axe Bat, meanwhile, is a pretty modest tweak that is allowed under the current rules for what players can use.</comment></comment>


Seabird Poop Is Worth More Than $1B Annually - <AUTHOR> https://www.smithsonianmag.com/science-nature/seabird-poop-worth-more-1-billion-annually-180975504/ <comment><USER2> The guano (seabird poop) trade was a really big deal in the 19th century, Spain even tried to steal some islands from Peru because they had significant guano deposits ([http://www.environmentandsociety.org/tools/keywords/guano- wa...](http://www.environmentandsociety.org/tools/keywords/guano-war-perus- chincha-islands)).

Eventually guano became less valuable since artificial fertiliser was cheaper. I don't think there's any significant guano trade now, and definitely not in the range of $1B / year. The article seems to be suggesting that the indirect benefits of guano (birds dropping it over fields) is worth $1B / year. Somewhat misleading title IMO.</comment>


8OD – Arduino form factor Intel 8086 - <AUTHOR> http://tech.mattmillman.com/projects/8od/ <comment><USER2> The UDOO X86 [https://www.udoo.org/udoo-x86/](https://www.udoo.org/udoo-x86/) is a single-board computer with an Atom/Celeron/Pentium and Arduino-compatible headers.

(On the minus side, though, the Arduino-layout headers are connected to an Intel Curie, which at this point is now orphaned. The Curie is attached to the main CPU via USB.)

<comment><USER3> In a similar vein: [http://www.86duino.com/?page_id=11](http://www.86duino.com/?page_id=11)

</comment></comment><comment><USER4> Can you still buy 8086's or is he filching these from old PC hardware?

<comment><AUTHOR> Yes, you can still buy them:

[https://www.mouser.com/Search/Refine.aspx?Keyword=CP80C86](https://www.mouser.com/Search/Refine.aspx?Keyword=CP80C86)

Intel doesn't make them anymore, but Intersil does (and the '286 too), and is mainly targeting the military/aerospace market.

However a used/NOS one will be cheaper.

</comment></comment><comment><USER5> This seems timely with this other recent post:

[https://news.ycombinator.com/item?id=16938029](https://news.ycombinator.com/item?id=16938029)

</comment><comment><USER6> Clever. Sadly not a lot of detail in the article about how it was designed, or how it works, or.. well... anything.

Shame - feels like there's a lot they could say about it.

<comment><AUTHOR> Look at the links on the page; this, for example, provides a schematic among other things:

[http://tech.mattmillman.com/projects/8od/hardware/](http://tech.mattmillman.com/projects/8od/hardware/)</comment></comment>


One-quarter of Uber's business happens in just five cities - <AUTHOR> https://slate.com/business/2019/04/uber-ipo-nyc-london-risks.html <comment><USER2> 2017 GDP Figures (Trillions USD)

      USA: 19.39
      NYC: 1.72
      LAX: 1.04
      CHI: 0.68
      DFW: 0.54
      DCA: 0.53

OMG, almost a quarter of the US's GDP (23%) comes from just five metropolitan areas!

<comment><USER3> DCA is surely about something other than real productive activity? (I guess people in DC might be making money, I thought they were spending it)

<comment><USER4> The Washington DC MSA is, by population, the 6th largest MSA in the United States[1]. It also the 2nd most highly educated MSA in the US, by some measures[2]. The top three- and four of the top 6- richest counties in the country are part of the Washington DC MSA[3].

Given (2) and (3), the fact that it produces more than the fifth largest MSA by population in the country (Houston) should not surprise. The top four MSA's by population and by GDP are the same, in the same order- the one that is truly punching above its weight is the Bay Area, which is the 6th largest by GDP but the 12th by population.[4]

[1]: [https://en.wikipedia.org/wiki/List_of_metropolitan_statistic...](https://en.wikipedia.org/wiki/List_of_metropolitan_statistical_areas) [2]: [https://www.cnbc.com/2018/07/26/the-10-most-and-least- educat...](https://www.cnbc.com/2018/07/26/the-10-most-and-least-educated- cities-in-the-united-states.html) [3]: [https://en.wikipedia.org/wiki/List_of_highest- income_countie...](https://en.wikipedia.org/wiki/List_of_highest- income_counties_in_the_United_States) [4]: [https://en.wikipedia.org/wiki/List_of_U.S._metropolitan_area...](https://en.wikipedia.org/wiki/List_of_U.S._metropolitan_areas_by_GDP)

<comment><USER3> TIL. Thanks! I wondered if it was IPR income declared in the DC area but activity elsewhere but it looks like things happen beyond lobbying and CEO decision making there. I've only ever dealt with NFPs In the beltway.

</comment></comment></comment></comment><comment><USER5> How is this a vulnerability? Shouldn't one expect something like a Pareto distribution to emerge here anyways?

<comment><USER6> The last line in the article answers that pretty well:

"One thing the filing makes clear: It wouldn't take a global movement to stress the company's business model. A couple big-city mayors could do that all on their own. "

<comment><USER7> Their business model is unconstrained growth to funnel money into side projects. That can't persist forever. If they just stuck to their core business they could easily be profitable as taxi 2.0.

<comment><USER8> Is the net cost of these "side projects" greater than the $1.8B Uber is losing? I'm missing that in the S-1 if so.

</comment></comment></comment></comment><comment><USER9> What I'm interested in out of this information (but not interested enough to look it up myself): These five cities account for 1/4 of their business, but how does the population of these five cities compare to all of the cities they do business in? Is this just a straight-line distribution?

Basically, do these five cities account for 1/4 of the total population of the cities they do business in?

<comment><USER4> According to [https://en.wikipedia.org/wiki/List_of_urban_areas_by_populat...](https://en.wikipedia.org/wiki/List_of_urban_areas_by_population) Tokyo and Seoul (not on the top five Uber list but have Uber presence) are both larger than any city on Uber's top 5 list. Sao Paulo (on Ubers list) is just barely larger than Mexico City (not on the list). Los Angeles (18th largest urban area by population) and London (35th largest urban area by population) are significantly smaller, and the Bay Area is all the way down at 61st, right behind Dallas-Fort Worth (not on Uber's list).

So no, those five cities do not make up a disproportionate amount of the total urban population that Uber covers, just a disproportionate amount of the riders.

</comment></comment><comment><USER10> Looking at this another way, this one-quarter revenue coming from users in five cities probably is showing these users as the power users of the app so these are probably the least likely to suddenly give up Uber because they already have a habit and Uber is already such a big part of their life.

<comment><USER11> NYC has definitely always had a taxi "habit" despite their transit. I think London is similar. On the other hand Tokyo (which has one of the best transit systems) has lots if taxis as well, but I guess Über hasn't had much traction compared to local taxis (they've always been clean and offered good service).

<comment><USER12> About 3 years ago I've had issues multiple times in Tokyo with taxi drivers not speaking english at all, thus not being able to communicate the destination. I assume Uber would smooth over that aspect as there is literally no need for communication.

<comment><USER11> I don't doubt that, but foreigners who don't speak some Japanese is a real small percentage of the people who use taxi services. If this were a general problem, then I think Über would likely do better in a place like Tokyo.

<comment><USER13> Uber is not allowed to compete in Tokyo. When you use Uber, it just calls a normal licensed taxi. The advantage is presumably the fact that it shows your destination to the driver without you having to explain it, but for locals there's literally no advantage.

</comment></comment></comment></comment></comment><comment><USER14> Alternatively: one quarter of Uber's annual losses come from those cities :D

More seriously: if they increased the cost or reduce pay rate in just those cities they could have a significant profit impact while not impacting market acquisition in the rest of the world.

</comment><comment><USER15> 1\. New York

2\. Los Angeles

3\. San Francisco

4\. London

5\. São Paulo

<comment><USER16> How did you get that ordering? LA is listed first in the S1.

<comment><USER17> Not OP, but that's the order presented in the article.

</comment></comment></comment><comment><USER18> Why is this a surprise? Its part of the reason it was even invented in the first place...

</comment><comment><USER19> Looking at that list, the biggest threat to Uber is good (and not overcrowded) public transportation.

</comment><comment><USER20> Why are these 5 cities Uber's top markets? Particularly Sao Paolo.</comment>


Programmer Migration Patterns - <AUTHOR> https://apenwarr.ca/log/20190318 <comment><USER2> > A surprisingly large fraction of the new people come from the scientific and > numerical processing world, because of modules like SciPy and then > Tensorflow. Python is honestly a pretty weird choice for high-throughput > numerical processing, but whatever, those libraries exist, so that's where > we go. Another triumph of python's easy integration with C modules, I guess. > And python 3 is also made with the web in mind, of course.

From what I understand (which, admittedly, isn't _that_ much) those bindings, along with projects like Jupyter, really can't be understated. They really are incredibly high-quality projects.

That being said, I'm honestly surprised to see so little mention of Rails in this article. I would have honestly expected at least an arc from Java and PHP to Ruby, simply because of how its adoption skyrocketed around 2009.

</comment><comment><USER3> Not perfect, but a lot of it rings pretty true. The most significant difference I see is that I'd consider C++ a terminal node. It's not that I like C++. In fact I loathe it with the heat of a thousand quasars (much more energetic than mere suns). But it seems like there's an awful lot of new code, especially at Very Large Internet Companies, still being written in it. There's no sign that those whose job security rests on knowing how to navigate the swamp that is the C++ standard are _ever_ going to move on. It's terminal, all right.

<comment><USER4> I can sort of see that, although I've managed to escape to the sunlit uplands of C# through a hidden arc of "Microsoft desktop development". Turns out these days if you want to modernise an MFC app C# is a good replacement, and you can even construct horrible chimeric systems where some of the windows are C# and some are C++ within the same process.

</comment></comment><comment><USER5> There's an interesting missing link from the real world here: Javascript -> Go.

Despite the intentions of Go's creators, Go continues to be seen more as a naive alternative to Javascript than a high-level replacement for C++ (at least in the sense of users migrating). I've observed far more Javascript developers excited about Go than I have native C++ developers - who tend to gravitate more towards Rust for it's similar feature set [generics, no need for garbage collector, etc], and it's focus on low-level safety and performance.

<comment><USER6> I honestly haven't seen many "groups" move from JS to Go. I've seen individuals do it, but not a ton of "organizations" make that kind of move.

I've seen a LOT more go from Python to Go, and a few go from Java to Go.

Do you have any examples or places that have written about a switch from JS to Go? I'd be super interested in reading their experiences!

<comment><USER7> I work in an async python microservices shop and the second language we added was Elixir for anything that needed to be more performant. We're just starting to play around with Go. I haven't touched Elixir yet, so I'll probably go from Python straight to Go as soon as I get the chance.

<comment><USER8> I would highly recommend trying Elixir out. There's a little bit of a hump to get over at first if you're not familiar with functional programming, but after that it's mostly smooth sailing.

The language has it's own built-in process manager capable of running thousands of concurrent processes with a small footprint.

Things like function arity and pattern matching are core concepts and core parts of how the language works. I've found that when comparing 2 simple web applications, one Python 3 and one elixir, that the Elixir codebase ends up being a bit larger because of the required boilerplate. However, as an application becomes larger, the disparity swings the other way and the Elixir codebase will remain smaller over time.

In addition, writing Elixir code just feels clean. Nothing really feels hacky, even if it is.

<comment><USER9> I agree. In fact, I'll plug my blog series "Learn with Me: Elixir" where I'm writing about Elixir as I learn it and anyone can learn it along with me. It's the first functional language I've learned, and I'm really enjoying it so far.

[https://inquisitivedeveloper.com/tag/lwm- elixir/](https://inquisitivedeveloper.com/tag/lwm-elixir/)

</comment></comment></comment></comment></comment><comment><USER10> Where the diagram diverges from reality is interesting. I've heard it said several times that Rust is surprisingly popular with Ruby programmers and surprisingly unpopular with C++ programmers.

<comment><USER11> There's some stronger similarities between Ruby and Rust than some might expect. Ruby is obviously a lot less strict, but both seem obsessed with providing every method that could possibly save you time. Ruby's Enumerators and Rust's Iterators in particular are almost excessively comprehensive. You don't write many loops in either language.

Also they both use this_casing_style for most identifiers and ThisOne for types.

</comment></comment><comment><USER12> > you're going to need to write a web app, and then it's super annoying that > your frontend code is in a completely different language than the backend, > with completely different quirks

It's a shame that there's nothing about Clojure(script), because it does fix many problems mentioned: Javascript is ugly, yada-yada

<comment><USER13> On one hand, I really like Clojure (and Lisp in general). On the other, I find that I have to have a much higher level of focus to get anything done in a Lisp, and 90% of my time I'm fighting to stay on task anyhow. When I was doing Clojure, it wasn't uncommon for me to have days of struggling to understand the (very terse) code punctuated by a few hours here and there of _extremely_ productive programming.

Those productive hours were very, very satisfying, but the biggest thing I took away from the experience was that it underscored my ADD. If I didn't have ADD, I think I would be spending a lot more of my time in Clojure/Lisp.

</comment></comment><comment><USER14> I'm pretty sure node.js isn't a language...

Other than that, this is an interesting idea. Obviously it is going to be pretty inaccurate because it is just one guy's opinion. I wonder if you could construct a similar graph based on actual measurements of people's Github commits or Stackoverflow questions.

<comment><USER6> >I'm pretty sure node.js isn't a language...

While you are technically correct, I think the distinction between server-side and client-side matters here.

Many people started with javascript out of necessity, but then began using it in many areas outside of scripting for web pages. And server-side JS is very different than client-side JS in many ways.

Take something like Ruby for another example. I wouldn't find it out of place to see something like this with "Ruby [without rails]" and "Ruby On Rails" listed as 2 different things.

</comment></comment><comment><USER15> Sorry but... what kind of evidence did you gather to make this post? It looks like a graph of similar/related languages and nothing else. I mean it's trivial to assume that assembly developers would gravitate toward C and not Javascript, but it's pure speculation.

</comment><comment><USER16> This depends a lot on how old one is. For instance, in 90s the big transition was from C to perl. Almost all perl devs that I know started in Turbo C, Turbo Pascal or quickbasic.

<comment><USER17> I think also the transitions are totally different depending on what decade you started.

I suppose the amount of people starting with C now is massively lower than even 10 years ago, let alone 20 or 30 - so that's where the graph falls flat for me and a lot of people my age who grew up "with the internet" and migrated upwards in this graph (and downwards the stack).

Then again I never migrated, I guess. There are 27 languages on this graph and I've been paid to write 13 of them, read 1 (rewriting from this to something else), used 2 more professionally on a lower scale and dabbled with 3 or 4 on my own.

</comment></comment><comment><USER18> Unavoidably arbitrary of course. I don't see why people would mostly move from Python, Ruby and PHP to Javascript. Well, I can see PHP, but mostly, people move from HTML to Javascript.

Also, about 10 years ago or so, I believe there was a rather big exodus from Java to Ruby.

If I had to describe my own journey, it's Basic -> Modula2 -> Prolog -> C -> C++ -> Java -> Javascript -> Ruby -> Groovy -> Node.js -> Typescript.

</comment><comment><USER19> I was surprised to see that C# isn't considered a end-node for languages. I'm a game programmer; games make up a lot of applications being developed (nearly 100% for consoles, roughly 25% of mobile apps[0]). The Unity 3D game engine may be used for half of all games[1], and it uses C#. (It did support variants of python and javascript, but they are now deprecated). [My experience suggests that a large chunk of the remaining games are written in C++.]

(I was also surprised, when doing a job interview in C# recently, to see how behind-the-times the version Unity supported for so long is -- mostly surprised by the nicer string interpolation that is now possible.)

[0]: [https://mindsea.com/app-stats/](https://mindsea.com/app-stats/) (see point 4)

[1]: [https://techcrunch.com/2018/09/05/unity-ceo-says-half-of- all...](https://techcrunch.com/2018/09/05/unity-ceo-says-half-of-all-games- are-built-on-unity/)

</comment><comment><USER20>
        C# -> TypeScript -> node.js

I'm really trying but I can't see how/why you would go from C# to JavaScript?

<comment><USER21> One example would be SharePoint, which has shifted fundamentally from full trust farm solutions over to client side SPFx solutions running through APIs due to Office 365.

Another example would be UWP, which has pretty robust JavaScript support, meaning someone could switch from C#/XAML over to a JS app that more closely matches the web front ends of their site.

And really Angular is a pretty simple leap for anyone familiar with ASP.NET MVC.

<comment><USER22> In what way does UWP have JavaScript support?

<comment><USER23> [https://docs.microsoft.com/en-us/windows/uwp/get- started/cre...](https://docs.microsoft.com/en-us/windows/uwp/get- started/create-a-hello-world-app-js-uwp)

<comment><USER22> Interesting. After the Html5/JS disaster a few years ago I would be reluctant to bet on this. Also makes me wonder why no TypeScript.

<comment><USER11> No TypeScript? Anywhere there is JS there is also TS, since it compiles to JS.

</comment></comment></comment></comment></comment></comment><comment><USER24> Is this just based on personal observations/opinions, or on data? If on data, what's the methodology or data source?

<comment><USER25> My thoughts exactly! I imagine there is some kind of migration from every language to every other language, e.g. at least some developers migrating from any major web backend language (Java, PHP, Ruby, Node.js etc.) to Go. It would be far more interesting to have also a quantitative information, like in this graph: [https://qz.com/192440/where-everyone-in-the-world-is- migrati...](https://qz.com/192440/where-everyone-in-the-world-is-migrating-in- one-gorgeous-chart/) But for that you would of course need actual data...

</comment></comment><comment><AUTHOR> > Yes, I forgot your favourite language.

I would be interested about the position of Julia in a hypothetical future version of that article. On a first glance, one would expect migrations from MATLAB, R and Python 3, but maybe it will be mostly C++ programmers wanting some more interactivity?

<comment><USER26> Yes, we do indeed see a surprising number of C++ programmers in the user base (essentially people who are stuck in C++ because of performance considerations, but would like to iterate faster). MATLAB/Python/R users tend to come to Julia when they outgrow the performance constraints of their older systems.

<comment><USER27> On the other hand, the scientific community certainly does not carry out an ongoing switch between JavaScript and Python, as the author percieves in the web world.

Python is an ideal example of a scripting language that got so popular in so many areas that it is hard to say who uses it for what. Pupils use it for getting familiar with programming. Many standard linux distribution tools are written in Python. There is so much beyond web development and scientific applications.

</comment></comment></comment><comment><USER28> > And I skipped Haskell, because... well, I considered just depicting it as a > box floating off to the side, with no arrows into or out of the box, but I > figured that would be extraneous.

        Elm -> Haskell
        F# -> Haskell
        Scala <-> Haskell

<comment><USER8> Where does Erlang/Elixir fit into this in your opinion?

<comment><USER9> I've gotten the sense that the most common migration path is Ruby->Elixir. It seems that many of the people using Elixir previously used Ruby. The creator of Elixir was active in the Ruby world and Elixir has similar syntax to Ruby.

That said, I started getting into Elixir while doing C# and Javascript development, but I suspect that's a pretty uncommon path.

</comment></comment></comment><comment><USER29> The pun on Haskell was quite fun, but overall a lot of it rang true to me. As someone who is constantly bouncing between Python 3 and JavaScript with Go and Java waiting in the wings and .NET boiling away underneath, the whole thing was entirely too on point for me.

</comment><comment><USER10> Is Ada also a terminal node? Once you've written code for NASA you're forever tainted and are lost to the bureaucracy? :)

</comment><comment><USER30> This migration pattern remember me an other blog post [https://erikbern.com/2017/03/15/the-eigenvector-of-why-we- mo...](https://erikbern.com/2017/03/15/the-eigenvector-of-why-we-moved-from- language-x-to-language-y.html)

</comment><comment><USER31> There's been a pretty solid migration from Ruby to Elixir -- since Elixir was envisioned as a Ruby-style dev-friendly version of Erlang.

</comment><comment><USER32> Once I'm in a "terminal" node what happens? I dying the only way out ;)

</comment><comment><USER33> It misses the transitions such as

Java-> Go, Java > Python, PHP > rust and so on

</comment><comment><USER34> Where is Lisp or Clojure?

<comment><USER13> > I also omitted the Lisp family, because it never really got popular, > although a certain subgroup of people always wished it would. And I would > have had to add a fifth category of programmer specialization, "configuring > emacs."

</comment></comment><comment><USER35> Judging by the title I expected the graph to have cycles in it.

<comment><USER36> There is, between Python 3 and JS</comment></comment>


Who Do You Believe, Randall Stross or Your Own Lying Eyes? - <AUTHOR> http://daringfireball.net/2009/12/stross_lying_eyes

<comment><USER2> I think people need to stop jumping to conclusions. Maybe the "problem with the network" is that "there are too many iPhones on the network." This deals with every actual piece of evidence that people are putting forward to try to refute the original article. Is it really so hard to believe that Apple could put out a piece of hardware that does not behave nicely to others?

I'm not saying that the nytimes article is right, but just that people who say it's wrong are wrong.

As an analogy, you can take the routers that were stupidly configured to use stratum 1 NTP servers. These misbehaving devices placed too much strain on the NTP "network" because they used it inappropriately. But it was only the NTP servers that a lot of these routers were configured for that were having problems. Yet no one would claim that it's the NTP network's fault for the issues.

<comment><USER3> > As an analogy, you can take the routers that were stupidly configured to use > stratum 1 NTP servers. These misbehaving devices placed too much strain on > the NTP "network" because they used it inappropriately. But it was only the > NTP servers that a lot of these routers were configured for that were having > problems. Yet no one would claim that it's the NTP network's fault for the > issues.

A poor analogy:

\- AT&T sells the iPhone.

\- AT&T sells the service.

ergo,

\- AT&T is responsible for providing quality service to the iPhone.

<comment><USER2> Right, I'm not saying that AT&T isn't responsible or that people don't have good cause to be dissatisfied with them. All I'm trying to say is that it's possible that the root technical cause of the bad service issues isn't in AT&T's network, but in bad behavior from iPhones that manifests itself when you have a large concentration of them in one area.

</comment></comment></comment><comment><USER4> We can answer this pretty easily by looking at AT&T Blackberries. If 3G Blackberries also have issues, then it's the network. If not, it's Apple's problem.

Anybody out there with a BB care to comment?

<comment><USER5> I have an LG phone with at&t, and a droid with verizon. Verizon gets where at&t can't, even if you just compare non-3g.

<comment><USER4> That's interesting, but not quite what I'm looking for. I'm trying to find out if the iPhone is a good phone on a crappy network, or a crappy phone on a crappy network.

How does your LG perform in urban areas like SF, Seattle, or NYC? How's the 3G performance in those situations?

<comment><USER5> Sorry, I am pretty short of information--mostly here in Chicago area, and don't yet have a handle on the 3g performance.

</comment></comment></comment></comment><comment><USER6> I don't think this piece is very well-argued. For one thing, I've been trying out a new android phone (my iPhone is on the back burner but I doubt I will be making a permanent switch) and the signal quality does seem to be a little better with the Android phone.

Many of the points rely on comparisons to other countries, but analytical people will recognize that problems can be caused by interactions in systems that otherwise work fine on their own too. For example, I had an old wireless router that worked fine with my Windows computers, but not with my Macbook Pro. But my Macbook Pro worked fine with other b/g access points. Without better information, how could we possibly tell which one is at fault? But Gruber (fanboy that he is) is drawing the conclusion that AT&T must be at fault.

As for the "Apple would have fixed it" assertion, or the question of why the number of complaints have gone up as iPhone users have, Gruber's blindness to his own biases is truly startling. You could as easily argue that AT&T has had three years to fix their network, so it must be Apple's fault because if the blame lay at AT&T's door it would have been fixed by now. And _of course_ the number of complaints will rise as iPhone users rise if the problem is some interaction between the iPhone specifically and AT&T's network: there are more iPhone users in existence to complain!

All in all this is very, very poorly done. I have no idea who's at fault but I do know that I won't be going to Gruber for anything more than entertainment if I'm reading about this whole fiasco.

</comment><comment><USER7> All of the major SmartPhone operating systems allow you to see GSM signal quality in an exact dB measurement. It should be pretty easy for someone with access to many GSM handsets to do field testing. Arguing back and forth with anecdotal evidence is pointless when it's so easy to obtain the facts.

</comment><comment><USER8> My own little data point fwiw - I'm using an iPhone 3GS in Perth, Australia on the Vodafone network. The reception is definitely worse than my old Nokia on the same network. I've heard similar things from friends using iPhones on Optus which has a separate network from Vodafone.

I definitely think there's an issue with the iPhone's reception, but it's not so bad that I'd go back to my old "dumb phone".

</comment><comment><USER9> When the problem is limited to highly populous areas like New York and Chicago and the phones work better if not flawlessly in suburbs and smaller cities the network most definitely is the problem.

<comment><USER10> Happy iPhone user here in North Eastern US, but I think your logic (and the TFA's) is faulty:

It is completely possible that it is a problem with the iPhone, but one that is only visibly affecting the network when there's a high density of iPhones being used in a small geographical area.

It's like the whole controversial 'pre-fetch' setting on Fasterfox and other 'web accelerators'. It's fine for individual users, but it violates the contract of how network clients (browsers) are expected to act.

Once there's a sizable number of people using the technology it becomes a problem that affects everyone.

To say that the issues only occur in large metropolitan areas does not completely exclude the iPhone itself from being a contributing factor.

<comment><USER9> See I understand where you are coming from but the comment about Hawaii's network makes me think otherwise. (Usually the AT&T complaints are limited to Chicago California and New York so that also brings to question why isn't everyone else experiencing such issues.)

</comment></comment></comment><comment><USER11> Every smart phone I've owned, mostly T-mobile Sidekicks and now an iPhone, has had slightly worse reception than a 'normal' phone on the same network. So I take it as a given that the iPhone trades a bit of reception strength for better battery life, but not to the point of dropped calls. Those fall strictly on AT&T shoulders in my eyes.

</comment><comment><USER12> More importantly, I couldn't care less whose problem it is. I paid $70/mo to T-Mobile for three lines on a family plan, in addition to three free (admittedly crappy) phones, and had a stellar reception everywhere. Now I pay $80/mo to AT&T/Apple for a single line, in addition to $250 cost for the phone, and I can't make a single call without problems in 90% of the places I go to. The important message is "shut up, stop pointing fingers, and fix it", not a guessing game about whose problem it is. It will only become interesting to me from a purely intellectual, technical perspective when they fix the problem. For now, I couldn't care less who's at fault.

</comment><comment><USER13> I'm in Portland. We're not exactly a thriving metropolis. However, I've been living without 3G simply due to the horrible reception, the astonishing number of dropped calls and - even worse - the calls that I just never get. Edge, it turns out, is way more reliable for those of us here.

I never had any of these problems on T-Mobile, nor do those I know who currently have jailbroken phones on that network.

</comment><comment><USER14> This reminds me of the advertising DSL-based ISPs used to run claiming that 'data hogs' on cable ISPs destroyed the experience for everyone else. Even if the iPhone was inefficient, that's something you compensate for with more aggressive network upgrades. If a communications network consistently provides poor service, that's not bad technology - it's poor management.

</comment><comment><USER15> It's both. I hear from some friends at mobile operators that the radio network code on the iPhone is pretty troublesome compared to other vendors. At the same time iPhone users use more bandwidth than certain operators planned for.

Operators need to boost capacity. Apple needs to improve their networking code.

</comment><comment><USER16> I am in AU and have terrible coverage with my iphone, as do several of my friends/colleagues. However, just as in the US it seems that some of the other networks are much better. I wonder if there is actually some issue or incompatibility in the infrastructure that leads to some problems.

</comment><comment><USER17> I get much better AT&T coverage away from San Francisco. And AT&T customers _not_ on iPhones don't seem to have the same level of complaint. (Lower expectations, or better on-phone radio-link-management?)

Perhaps it's a little of both: AT&T's network is somewhat thin and overloaded exactly where media and tech-influentials most notice, and the iPhone is more fragile when facing that than other devices.

<comment><USER18> iPhone users use data more than users of other phones, so if there are problems they will notice them proportionally more than users of other phones.</comment></comment>


When powerful people tweet, markets move - <AUTHOR> https://medium.com/ennate/tweets-from-the-president-elon-musk-kylie-jenner-and-the-hollywood-reporter-created-and-b7b79cfc8d63 <comment><USER2> To sign up for the TweetTraders beta and see screenshots of the app go to - [https://tweettraders.com/](https://tweettraders.com/)</comment>


Show HN: A radial menu at the tip of your fingers - <AUTHOR> https://github.com/victorqribeiro/radialMenu <comment><USER2> Your samples dont work, you only get 3 menu choices in the left corner, no menu, just a black page, chrome and ff.

<comment><AUTHOR> after clicking the example, right click the page or long press if you're on mobile</comment></comment>


Massive Google Play Privacy Issue - <AUTHOR> http://phetdreams.tumblr.com/post/42959902001/massive-google-play-privacy-issue#notes <comment><USER2> [https://plus.google.com/106557483623231970995/posts/Bed6WUJp...](https://plus.google.com/106557483623231970995/posts/Bed6WUJpNi4)

"With apple's app store you buy the apps from apple. With google play you buy the apps from the developer. If you are the merchant of record you need to know the address to correctly compute sales tax.

This is documented on [http://support.google.com/googleplay/android- developer/bin/a...](http://support.google.com/googleplay/android- developer/bin/answer.py?hl=en&answer=138000).

Google cannot give tax advice, so we have to give you the data to make the determination yourself"

<comment><USER3> In other words, Google, the huge corporation, would rather that the app developer, who may not even be a corporation at all, be the merchant of record?

I guess I can kinda sorta see this from one point of view: they are trying not to be Apple. But they are still taking 30% of the money.

<comment><USER4> And while they give you the burden of being the merchant of record, they also give you capabilities Apple doesn't (e.g. carrier billing, control of refunds, ability to reply to reviews, etc.). It's a different bundle, with different trade-offs.

</comment></comment></comment><comment><USER5> Doesn't sound all that unusual. Anyone selling anything via a credit card is going to get the same info....perhaps even more...

<comment><USER6> The difference is that if you go to, say, Best Buy, and buy a Samsung TV, a Sony Blu Ray player, and a game for your Wii, your personal information doesn't go to Samsung, Sony, and the Wii game maker. The store, Best Buy, gets your info, not the makers of the products sold in the store.

This is what people generally expect from stores that sell a variety of items from many different manufacturers.

<comment><USER7> The thing about Google Checkout is that it's more of a "credit card processor" than the merchant. They consider the developer as a merchant (maybe because Google might have first designed Google Checkout to be payment processor, like Paypal) which basically makes transfer of goods between a customer vs. developer, as opposed to customer vs. Play store.

Aside the argument if it's good or bad, it seems to be consistent with that notion -- if Google is considering Google Play to be more of a promotion service with payment processing built-in, as opposed to curated content store.

<comment><USER8> Uh, the name is Play _Store_.

It used to be called _Market_ , but they changed it to _Store_.

</comment></comment></comment></comment><comment><USER9> Coming from developing iOS apps first I thought it was strange that I received these user details when they purchased my Android app. I assumed it had already been brought up though and was decided to not be an issue.

</comment><comment><USER10> If you buy something from me, even via Google, you enter a mutual contract. And as such you have to provide sufficient information to identify yourself. Same with me. Pretty normal for any law protected contracts.

</comment><comment><USER11> Its interesting to note that the email address wasn't always included, they used to be [random]@checkout.google.com before they made the switch to Google Wallet

</comment><comment><USER12> Kinda like Paypal.

<comment><USER13> Yes, exactly like that service everyone hates. ;)

</comment></comment><comment><USER14> ZDnet interview with the guy who found the issue: [http://www.zdnet.com/google-play-privacy-slip-up-sends- app-b...](http://www.zdnet.com/google-play-privacy-slip-up-sends-app-buyers- personal-details-to-developers-7000011249/)

<comment><USER15> It's not a "guy that found an issue". Nothing has every been hidden and it's not a privacy slipup. Come on.</comment></comment>


Dragtable: drag-and-drop reorderable columns for an HTML table - <AUTHOR> http://ajaxian.com/archives/dragtable-drag-and-drop-reorderable-columns-for-an-html-table

<comment><USER2> Pretty neat stuff!!!</comment>


Ask HN:  How do you find a tech centric group of people outside of the valley? - <AUTHOR>

<comment><USER2> Here is a list of actions I can think of (in no particular order):

1\. Check with (the IT/Computer departments of) local universities/colleges

2\. Find a few local computer/hardware/software/networking/web design shops (via Yellow pages or online search) and check with them

3\. If all else fails, 'roll your own' :-). Sign up with Meetup.com and form/announce a group meet (a few weeks forward) - the results might surprise you; they sure did me once.

HTH

</comment><comment><USER3> Have you thought about checking out Startup Digest (<http://startupdigest.com>)? They have a bunch of cities listed there.

If your city isn't listed there you could always search the name of your city in CrunchBase (<http://www.crunchbase.com>) and a you should find a bunch people that way.

</comment><comment><USER4> Meetups have been my biggest success here in the rural UK. Find a BarCamp, find a local tech mailing list, things like that. Even find a user group for a technology you don't use and attend - you'll probably find people who attend other local meetings you didn't know about.

Here in the north of the UK, the "Geekup" events and mailing list, Think Visibility conference, iLinkoln and the NWRUG (a Ruby User Group) have been most helpful in getting me "into the network" as it were.

</comment><comment><USER5> If you're in school, join one of the tech-centric clubs. Otherwise, scout around for local or semi-local conferences/events.</comment>


Fonts make me insane - <AUTHOR> http://alecbenzer.com/blog/fonts-make-me-insane/

<comment><USER2> I'm going to blatantly ignore the content of your post and make a suggestion:

Have you tried using font-smoothing?

-webkit-font-smoothing: antialiased; font-smoothing: antialiased;

I find it helps, though you may want to darken the text a bit afterwards (or increase the weight).

</comment><comment><USER3> I add this to my hosts file to speed up browsing and avoid these issues: 127.0.0.1 fonts.googleapis.com</comment>


An app for practicing language listening skills - <AUTHOR> http://lisn2.me <comment><AUTHOR> Hi all,

This site is born out of my frustration when trying to learn a new language. It is a "language learning application", but you won't learn a language by using it. I made it to practice one specific (and I think important) thing - the skill of listening a new language.

The idea is simple, the site contains short user-uploaded voice recordings with transcription and translation.

Here's an example in Spanish: [http://lisn2.me/exercise/1455534102678176880](http://lisn2.me/exercise/1455534102678176880) . Users who learn Spanish can then listen to it (with/without transcription and translation).

After that you can exercise listening to chunks of the recording and then guess the text and translation: [http://lisn2.me/exercise/1455534102678176880/quizes/guesschu...](http://lisn2.me/exercise/1455534102678176880/quizes/guesschunk)

The second exercise is to listen and type (in the original language): [http://lisn2.me/exercise/1455534102678176880/quizes/dictate](http://lisn2.me/exercise/1455534102678176880/quizes/dictate) The app will show (in green or red) when you got the transcription right.

This is still a proof-of-concept, the site html is very simple (but to be sincere, I like simple html websites:) and there are some bugs.

Now, I'm looking for feedback/suggestions/questions before deciding how (if) to proceed with this project.

</comment><comment><USER2> This might make a good "Show HN".

Guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)</comment>


Godot 3's renderer design - <AUTHOR> https://godotengine.org/article/godot-3-renderer-design-explained <comment><USER2> While scrolling fast through the long document, my eyes immediately focused on "Wait, why not Vulkan or DirectX12?" :-D

tl;dr "At the end of the day, the use case where Vulkan and DirectX12 make the most sense is when you have hundreds of thousands of objects, which are all different (different geometry, textures, etc.), and which move. This is a difficult use case to achieve, even willingly."

<comment><USER3> The paragraph above that is relevant as well. Vulkan is only on Linux and Windows, DX12 is on Windows, Metal is on Mac and iOS. They'd have to have multiple renderers written for different APIs to cover all the platforms that they support.

<comment><USER4> > Vulkan is only on Linux and Windows

And android. I.e. everything but Mac OS, iOS.

<comment><USER5> Plus you can get Vulkan on macOS with MoltenVK.

<comment><USER3> I've seen that before, and while it's technically true it's also 100% useless for an open source engine.

<comment><USER6> It may be open sourced in the future, there are stakeholders who might be willing to pay for this to happen (Google, for example, might want it for their iOS and Apple deployments).

<comment><USER7> Eh, google doesn't really need it. They don't make anything that requires high performance and cross-platform, they don't make games, and chrome is only for android so they don't need to be able to run it on ios.

<comment><USER6> Chrome runs on OS X, where GL is deteriorating; they also have Maps and Earth on iOS.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Researching Godot's multiplayer support it looks like there is not anything very comprehensive?

In a separate discussion, will we ever see any sort of UDP support in the browser for client/server games?

[https://gafferongames.com/post/why_cant_i_send_udp_packets_f...](https://gafferongames.com/post/why_cant_i_send_udp_packets_from_a_browser/)

<comment><USER9> I have UDP semantics for my game, which has a Javascript front end and Golang servers: (Though I use node-electron processes as a WebRTC proxy.)

[https://news.ycombinator.com/item?id=15334726](https://news.ycombinator.com/item?id=15334726)

[https://news.ycombinator.com/item?id=15332187](https://news.ycombinator.com/item?id=15332187)

<comment><USER8> Reading the article I linked in my first post, my understanding is that it is possible to use WebRTC for UDP _today_ but its just very difficult?

"while WebRTC makes it easy to send unreliable-unordered data from one browser to another, it falls down when data needs to be sent between a browser and a dedicated server...It falls down because WebRTC is extremely complex. This complexity is understandable, being designed primarily to support peer-to-peer communication between browsers, WebRTC needs STUN, ICE and TURN support for NAT traversal and packet forwarding in the worst case."

Given your experience with WebRTC stcredzero, do you think it is possible to wrap WebRTC in a class to emulate UDP? What is the hold up?

<comment><USER9> _it falls down when data needs to be sent between a browser and a dedicated server...It falls down because WebRTC is extremely complex._

The SimplePeer library works very well to hide the complexity of WebRTC. It works just fine for me. The big sticking point is the complexity/overhead of the setup. This might be mitigated by using the true headless modes in Chromium and Firefox. Given what I remember from installing dependencies, it should be possible to create a fairly lightweight headless fork that only has just enough to run WebRTC datachannels.

So, if you don't need lots of scaling and can deal with the overhead, there is no hold-up right this moment. It's just a matter of motivation.

</comment></comment></comment></comment><comment><USER10> I'm really looking forward to the proper release of Godot 3! Want to use it to get my kids into game writing, but have been holding off because Godot 2 has a custom scripting language which will be going away and I don't want to invest in that. Any idea when 3.0 ships?

<comment><USER11> You might really like UE4's blueprint system, it's the only time I've seen "visual programming" work really well.

<comment><USER12> It's really impressive. I thought I'd be using C++ a lot more when I started seriously digging into UE4, but more and more it's just to make helper functions so the primary logic and asset management can be done in blueprints.

</comment></comment></comment><comment><USER13> Someone who wish to learn about developing game and its theory can get started here. [http://gameprogrammingpatterns.com/contents.html](http://gameprogrammingpatterns.com/contents.html)

<comment><USER14> While I agree this is a wonderful resources, it is much less about game development than it is about design patterns. Basically, it's a gamedev flavored book about design patterns. A much better books about game development would be Game Coding Complete [0].

[0] [https://www.amazon.com/Game-Coding-Complete-Fourth- McShaffry...](https://www.amazon.com/Game-Coding-Complete-Fourth- McShaffry/dp/1133776574)

</comment></comment><comment><USER15> Very interesting reading.

I like specially the architecture decision of a separate render process.

</comment><comment><USER6> Here's an archive link since you probably won't be able to see the article from the original location.

[http://archive.is/lvKV9](http://archive.is/lvKV9)</comment>


Managing a TODO list - <AUTHOR> http://kylecordes.com/2017/managing-a-to-do-list <comment><USER2> After years of experimenting with every todo app under the sun, I've gone back to the trusty notebook and pen. I spend far less time faffing and more time doing what I'm supposed to be doing.

The only computerised task management I use now is the occasional checklist for more complex projects and I use taskpaper for that.

</comment><comment><USER3> When I started reading this post it would make sense to use a local spreadsheet and avoid all the surfing, logging in and searching for the right tab. But when you use a cloud based solution, you still face the same problem as when using yet another (online) app.

For me personally a digital todo list must be as easily accessible as a notebook next to me. If you have your browser open, like me, with 10+ tabs, this is gonna be a problem.

</comment><comment><USER4> This is a reasonable solution for many people.

I don't think I could stand keeping track of it in a spreadsheet: \- You can only access the data from the computer the spreadsheet is on \- Can't share with other people Lastly, and most important to me: \- I find it ugly to look at spreadsheets or enter data into spreadsheets

The post is a useful list for people who want to create a todo list app about some potential features. I think that even if there was an app that addressed all this (and I think there are apps that do address most of these points), the OP wouldn't be convinced to use it because a spreadsheet is just much more familiar to the him and he doesn't find them ugly.

I personally have my own todo list app that I created and always use (along with paper for more free form notes). In fact, there are 4 different versions of a todo list for different purposes. I like it because it works exactly how I want it to work and I can change it as I desire. I suppose there's also a degree of pride in using my own app.

<comment><USER5> The author uses a cloud-based spreadsheet to access it anywhere on any internet-connected device. These can also be shared with others.

Some software, like Google Forms, for example, allow users to provide a simple form to enter data into a sheet.

[https://support.google.com/docs/answer/2917686?hl=en](https://support.google.com/docs/answer/2917686?hl=en)

</comment></comment><comment><USER6> At this point, why not use a plain text editor for everything? I expect some minimal features from a todo app (time and/or location based reminders/notifications, ability to quickly add new items and check existing items, items classification, etc.), some of which cannot be achieved by using spreadsheets. Using a spreadsheet for this purpose sounds more like "everything is a nail" syndrome.

</comment><comment><USER7> Zim wiki</comment>


Bored of the Rings - <AUTHOR> https://en.wikipedia.org/wiki/Bored_of_the_Rings <comment><USER2> > the paperback cover art for Lord of the Rings prevalent in the 60s, then > famous, is now obscure.

[http://lotrscrapbook.bookloaf.net/gallery/bookcovers/pages/0...](http://lotrscrapbook.bookloaf.net/gallery/bookcovers/pages/04.htm)

It is far and away my favorite artwork for the books, and I had to do some searching to get those particular editions.

</comment><comment><USER3> While we're on the topic of reinterpreting The Lord of the Rings, someone speculated (based only on the texts of Tolkien, themselves) that Tom Bombadil was a sinister character.

The Terrible Secret of Tom Bombadil

Original Post: [http://km-515.livejournal.com/1042.html](http://km-515.livejournal.com/1042.html)

Hacker News discussion: [https://news.ycombinator.com/item?id=9982237](https://news.ycombinator.com/item?id=9982237)

<comment><USER4> Here's an alternate theory by Corey Olsen (The Tolkien Professor) where Tom Bombadil is a Maia.

[http://podbay.fm/show/320513707/e/1247080860](http://podbay.fm/show/320513707/e/1247080860)

(Tom Bombadil part starts at 10:58, but the Balrog segment is interesting too)

</comment></comment><comment><USER5> There's also _The Last Ringbearer_ , a Russian novel which attempts to fill in most of the gaps in Tolkien's worldbuilding.

[http://ymarkov.livejournal.com/280578.html](http://ymarkov.livejournal.com/280578.html)

<comment><USER6> Read the Wikipedia page and I like the concepts at least.

</comment></comment><comment><AUTHOR> "He would have finished Goddam off then and there, but pity stayed his hand. 'It's a pity I've run out of bullets, he thought.'"

</comment><comment><USER7> There are also text computer games, "Bored of the Rings"[0], and "The Boggit"[1] which were quite funny (and better than e.g. "The Hobbit" adventure game). Surprisingly, Google cannot find any of the game quotes I remember...

[0] [https://en.wikipedia.org/wiki/Bored_of_the_Rings_%28video_ga...](https://en.wikipedia.org/wiki/Bored_of_the_Rings_%28video_game%29)

[1] [https://en.wikipedia.org/wiki/The_Boggit](https://en.wikipedia.org/wiki/The_Boggit)

</comment><comment><USER8> _The first text a browsing reader is liable to see purports to be a salacious sample from the book, but the episode never happens in the main text, nor does anything else of that tone: the book has no explicit sexual content._

To quote Otto from _A Fish Called Wanda_ , "Disappointed!"

</comment><comment><USER9> Every few years I have to take this out and reread it (it doesn't take long). I'd say, does wikipedia really need to explain all the puns? But then, I suppose the kids today don't get jokes about the inauguration of Harold Stassen.

<comment><USER10> Detailed explication, for any work, is also valuable to people who speak English as a second language.

</comment></comment><comment><USER11> One of my favorites. The first few opening chapters are comedy gold.

<comment><USER12> Also, the next chapters. And the ones after that. Until the end, pretty much.

        Two, four, six, eight
           Tiptoe, sneak and infiltrate
        Cha cha cha!

<comment><USER11> "And what is this ring?" said Frito, eyeing the possible exits from the hole."

</comment></comment></comment><comment><USER13> Bizarrely, I read this before reading Lord of the Rings, in something approaching fourth grade.

It was still quite funny, even though I didn't understand what the heck it was parodying.

<comment><USER14> Maybe bizarre, maybe not. I did the exact same thing at the same age.

</comment></comment><comment><USER15> _The First Law_ trilogy by Joe Abercrombie is a grim satire. Villains who think of themselves as heroes, and _vice versa_.

</comment><comment><USER16> I've found BotR an invaluable inspiration for RPG characters of the less- serious sort. I wish all my wizards could have that ancient weapon known to the Elves as a Browning semi-automatic.

</comment><comment><USER17> Doug Kenney was the best.</comment>