What web developers should know about SSL - <AUTHOR> https://certsimple.com/blog/obsolete-cipher-suite-and-things-web-developers-should-know-about-ssl <comment><AUTHOR> A less common question we get, that a lot of web devs are interested in is 'How do I mitigate against MITM attacks'.

\- As a browser, by using a default OS and watching the root CA store. You can control the key stores on most devices except iOS pretty easily: [https://certsimple.com/blog/control-the-ssl-cas-your- browser...](https://certsimple.com/blog/control-the-ssl-cas-your-browser- trusts)

\- As a server, setting up key pinning ([https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning)) which throws up a browser warning if someone accesses your site with a new key.

</comment><comment><USER2> Right from the beginning "EV cert". What is EV? When you write article and it's the first time you use acronym, please define it.

<comment><USER3> DV = Domain Validation - all that's validated by the certificate authority (CA) is that the person getting the certificate controls the domain

OV = Organisation Validation - the CA also checks that the person getting the certificate is the organisation they claim to be (the cert will contain, for example, a company name or number)

EV = Extended Validation - the CA does additional checks for authenticity and trustworthiness

Typically, sites with EV certificates have the address bar show up green, and the organisation name is visible in it. EV is mostly only used for stuff like online banking. Less important things like Facebook, YouTube and your blog will use cheaper and easier to get DV or OV certificates. Let's Encrypt! gives you a DV certificate since domain ownership is the sole thing it can and does validate.

<comment><USER4> Somewhere I read that EV certs (green bar) are slower because of an additional round trip or so. If it is the case, can someone point me to an article that explains this?

<comment><USER5> Browsers actually validate the certificate through CRL / OCSP for EV sites, if I recall correctly.

That takes time and adds latency and there are differences between CA's in OCSP server performance. Your location can obviously impact performance too. If you're performance conscious you might want to take this into account.

This is actually something people don't consider when they say certificates should be free - running these CRL / OCSP servers costs money.

[https://www.imperialviolet.org/2012/02/05/crlsets.html](https://www.imperialviolet.org/2012/02/05/crlsets.html)

Netcraft does OCSP responder performance analytics: [http://uptime.netcraft.com/perf/reports/performance/OCSP](http://uptime.netcraft.com/perf/reports/performance/OCSP)

<comment><USER6> Would I be right in thinking OCSP stapling would avoid the extra trip in this instance?

<comment><USER5> Yes. It's meant to lessen the load on the OCSP responders and improve performance. The server will periodically fetch the OCSP response and serve it to clients so not every client needs to do it themselves.

</comment></comment></comment></comment></comment></comment><comment><USER7> A slightly stronger argument not to use 4096-bit certs is that just about every (intermediate) CA certificate out there is 2048-bit, and there's no security advantage to your cert being 4096-bit if it only has a 2048-bit signature. An attacker can just factor your CA's public key and not care how strong your own public key is.

So it's not just that it slows down your site, it slows down your site without any additional security or other benefit.

<comment><AUTHOR> That's an excellent point - I've added it to the article and credited you.

</comment></comment><comment><USER8> Item number 1: SSL is obsolete, use TLS.

Can we please, as a society, try to move forward with the correct acronym? Everyone who isn't wide-open-vulnerable is using TLS 1.0 or newer. (Personally, I like to run TLS 1.2 only, but my CloudFlare domains still speak 1.0 and I can't turn it off without paying money.)

<comment><USER9> It's difficult to understand the difference, especially when people use the terms interchangeably.

<comment><USER8> Easy mode:

        - SSL is outdated
        - TLS is newer

Yes, there are a lot more differences, but if we start today we might be able to retire the use of SSLang in the future.

<comment><USER9> Fantastic.

</comment></comment></comment></comment><comment><USER10> The general public couldn't care less about EV certs.

Important reading: [http://webmasters.stackexchange.com/a/9095](http://webmasters.stackexchange.com/a/9095)

</comment><comment><USER3> Another thing: You should probably go TLS-only. Set up a 301 redirect from HTTP to HTTPS, and set the Strict-Transport-Security header on all HTTPS responses.

It's very easy to do, and ensures all your users get maximal security. The future is encrypted.

Today I did this for my blog: [https://github.com/TazeTSchnitzel/blog/commit/792986d18d8583...](https://github.com/TazeTSchnitzel/blog/commit/792986d18d8583712fa3fe59d0ec047b21701d46)

<comment><USER7> This is pretty reasonable provided that you're not in danger of having to stop using HTTPS. For our personal blogs, that's probably fine (and hey, I should kick up the timeout on my HSTS header, thanks for the reminder). For a site that you're making for an employer or a customer, you should be certain that they're not going to want to move it over to a non-HTTPS-compatible web host for whatever reason. Most of the time you can be confident about this; sometimes you can't. Strict-Transport-Security is a promise to your viewers that for the next whatever time period you say, you're not going to change your mind about HTTPS.

</comment></comment><comment><USER11> Re: Point 1

You really only need two ciphers to get to most browsers/clients and good security and speed (replace RSA with ECDSA if needed):

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Example: [https://www.ssllabs.com/ssltest/analyze.html?d=theandrewbail...](https://www.ssllabs.com/ssltest/analyze.html?d=theandrewbailey.com)

It baffles me that Mozilla recommends 20 ciphers for their highest security level. I think high security should be more exclusive than that, and with forward secrecy only.

Point 5:

How I imported Let's Encrypt's certificates into a Java keystore:

        openssl pkcs12 -export -name yourdomain -in fullchain.pem -inkey privkey.pem -out pubchainpriv.p12
        keytool -importkeystore -srcstoretype pkcs12 -srckeystore pubchainpriv.p12 -alias yourdomain -destkeystore /path/to/keystore.jks

</comment><comment><USER12> I've compiled lots of resources for moving to HTTPS: [https://docs.google.com/document/d/1EJKAoa4Hxc4AyH0znuA_AApl...](https://docs.google.com/document/d/1EJKAoa4Hxc4AyH0znuA_AAplcNeNejEhATFptFX- OME/edit)

</comment><comment><USER13> A good start. If you want to improve it, please add information about how to consume HTTPS services in a secure way.

Also potentially add an aside for self-signed/enterprise CA, as most web developers will encounter internal systems sooner or later. This makes the above (consuming services) more challenging :-)

</comment><comment> angry-hacker My addition: if you use SNI cert, expect loads of problems. And I don't mean browser support.

Bing wont crawl you, you have to email the support and maybe they manually whitelist you.

A lot of RSS readers wont work, services like pocket, reddit submissions, mailchimp rss to email etc etc.

It's crazy considering we want to move everything to https only.

<comment><USER14> Add the Hg client to that list.

The amount of software that fails because of SNI is insane. For something that should be done systemwide by a single library, it's also too weird.

<comment> angry-hacker Yeah, I suspect it's because of Python 2.7.9

So many things are broken because of it. It doesn't have native SNI capability.

</comment></comment></comment><comment> james-skemp You might be slow from traffic, but just in case that's not the case, the linked article loads fine but the home page does not on a 2nd gen Nexus 7.

I see the top navigation followed by a white page, no scrollbar.

<comment><USER15> What browser are you using on the Nexus 7? We test on current Chrome (which I imagine most Nexus 7 users are using).

</comment></comment><comment><USER16> beware of item 4. Android 2.3 is still prevalent in some markets

<comment> fredrik-j It is of course good to be aware, but legacy Android versions shouldn't be a show stopper for modern TLS.

For general web browsing, I'd expect that both Chrome and Firefox are installable on Android 2.3 and bundle their own TLS libraries.

Other app developers can also vendor TLS libraries, like Bouncy Castle, to support modern encryption on legacy devices.

<comment><USER17> Chrome for Android 42 and older requires Android 4.0 or newer. Current versions require 4.1 or newer. What you say about Firefox is accurate, though.

</comment></comment></comment><comment><USER18> What should I know about cert revocation and client support for it?</comment>


Terence Mckenna: Know Your History [video] - <AUTHOR> https://www.youtube.com/watch?v=WvYw8RoSOGM

<comment><USER2> I love his remarks on the New Age movement. Spirituality without some form of sacrifice has always struck me as unauthentic.</comment>


A list of places to post about your startup/launch - <AUTHOR> https://sizle.io/how-to-maximise-traffic-to-a-bootstrapped-product-hunt-launch/ <comment><USER2> No, no no.

Post to people who will value your idea and give you valuable feedback.

Just trying to get "traffic" is a wasteful and distracting vanity metric. The feedback you get from such traffic will take you further away from building something that really connects with the right audience.

(In the case of the list itself, it _is_ worth posting it to those sites, as the audience at those sites _is_ the target audience for the list itself. Which makes it hard to point out why the list is misguided.)

<comment><USER3> This is 100% false information.

If you are building a consumer app your base unit is attention. You need to post to these sites in order to even find that "right audience" - so long as you're not just trying to get people to sign-up for a non-existing product, this is the way.

Yes it's fun to give people the "just give it to 5 people who really like it, and make sure you keep in touch" advice - but the truth is that for most good devs, their product dies because of exactly this mentality.

You need to learn to push your product as a creator, otherwise you will just straight fail, even if it's a good product.

This is simply the easiest path to getting initial users to seed the feedback mechanisms that drive feature development.

Do not take the above advice - post your product to every high traffic place you can get your hands on. The users you don't care about won't stay, the ones that you do care about will give you information through the channels you hopefully have set up beforehand (i.e. Intercom, Segment, email, phone, Logrocket, Sentry, Datadog).

It's up to you to then parse out which users are responsive, and if they come from some specific subreddit, you target that. If they come from a specific city, target that. You won't ever get the data to make the decision of what niche group to target unless you post it to some high traffic source, or you are somehow extremely intimate with one of those groups already, which is often not the case.

</comment></comment><comment><AUTHOR> Here is a list that I made for my own Product Hunt launch in December for www.sizle.io after going through a lot of the old lists that exist online and finding the most up to date ones. There is probably a much better way to format this but hopefully it helps! If anyone has any suggestions to improve the list that would be great :)

<comment><USER4> Cool thanks, I've just updated my own list. If someone wants to save some time, we offer the posting as a service here:

[https://launchpropeller.com/](https://launchpropeller.com/)

</comment></comment><comment><USER5> I made a similar list at [https://submit.co](https://submit.co) a while ago.

The idea was to provide a definitive resource which was more user friendly than just a bullet list of links.

If you did come across it, I'm curious to hear if you have any suggestions on how to improve it.

<comment><USER6> Whilst I'm not the OP, I am in the market for something like this, hence being in this thread.

# It's slow, each page load and column sort is 1.7+ seconds.

# It only sorts in increasing order, not decreasing, and if you'd want only one direction you'd likely want decreasing for followers and Alexa rank.

# Categories (Regions, and Platforms) should be faceted, to keep the UI tight consider the pattern employed by Excel for picking column filters.

# URL and Twitter should be sortable.

# Whole and filtered lists should be exportable to CSV.

Whilst these are all UX related, the last one for content.

# Add a "Type" column, this could differentiate between the type of site: "News", "Directory", etc.

This is all possible with a sprinkling of JS, no need for heavy server-side stuff :-)

I hope my partially unsolicited feedback is useful, have a great day.

</comment></comment><comment><USER7> A few months ago i painstakingly submitted a product of mine to many places listed here. It was 100% ignored while many sites asked me to pay a price so they can post about my site. The general modus operandi is to claim "we get lots of submissions. We can move you up the queue list if you pay $$$."

I agree these sites need the revenue. Just don't claim to be torch bearers for the startup community. Be upfront like ProductHunt which says pay us to get promoted. No harm in that.

</comment><comment><USER8> Generally speaking, if you're launching a new project what are the downsides of posting to lots of these?

Thinking about seo, wouldn't Google downrank duplicate submissions across multiple disparate sites as spam?

Would it be better to try and shoot for the top 5% of these sites with unique submissions (different text descriptions)?

<comment><USER9> Yes, to both statements.

However, duplicate submissions are starting to become shadowbanned (if the intent is to manipulate SERP), while having your site link on spammy sites is simply a downrank in relevant metrics.

The other corollary is that these sites will likely not have substantial enough metrics -- owing to the amount of outlinks they have to all sorts of low-ranked content -- and so posting your site on them for purely SEO purposes is misguided.

They're better used for organic traffic.

<comment><AUTHOR> ^ This. These links/directories are best used as a 'set and forget for a while' tool so help drive organic traffic over time, definitely not a silver bullet.

</comment></comment></comment><comment><USER10> There's also this[1], although some of the links now 404.

[1]: [https://github.com/mmccaff/PlacesToPostYourStartup/blob/mast...](https://github.com/mmccaff/PlacesToPostYourStartup/blob/master/README.md)

</comment><comment> alex-wallish Somebody should make a script that takes some info about your product and auto submits them to each one of these.

<comment><USER11> Please don't. That's spamming.

<comment> alex-wallish Isn't the goal of lists like these to make it so you can easily submit to all or a subset of them when you launch a product? Automating that process to save time does not make it spamming.

<comment><USER12> Automating it basically ensures that you don't adjust your submission for tha audience or consider if it is appropriate for the site. That makes it spamming. You can be working manually and spamming too, but automation "helps".

<comment> alex-wallish That's not true. You could require a list of say 50 parameters, and then it determines what needs to be sent to each site and in which format, adjusting for each site.

<comment><USER12> Technically true, but that's not what "take some info about your product and auto submits them to each one" tends to mean.</comment></comment></comment></comment></comment></comment>


Ask HN: Was integrating with Zapier worth the time/effort? - <AUTHOR> We're having an internal discussion about whether integrating Zapier is worth the effort.  We're specifically talking about it as a marketing tool to draw in customers (or at least help convince) so I was hoping to poll the larger community and hear about how integrating Zapier into your company affected sales.  I realize this would mostly be anecdata but am interested in hearing anyway.  Part of what brought up the discussion is not being able to find a killer use case for our own Zapier account so it makes us wonder if there is a bump in sales after integrating Zapier if it's just customers aspirationally thinking they'll use it or possibly if two companies otherwise are relatively equal that the one having Zapier is "better".  Also any thoughts on the integration experience would be helpful as well.  TIA <comment><USER2> If your question is whether being part of the Zapier integration catalog will drive new customers / business, then I wouldn't count on it being a major growth channel. Though, being listed will serve as additional credibility and will likely have branding and SEO benefits for you.

On the other hand, we found that building a Zapier integration made customer on-boarding faster and smoother, which helped to speed up our overall sales processes. While slightly different from your use-case, our product requires an API integration, so allowing customers to integrate via Zapier instead of requiring development effort to support our APIs has reduced the cost, time/conversations, and resources necessary for our customers to work with us. It also reduces technical support requests.

Finally, seconding what lpellegr said, Zapier has now introduced Partner Tiers, meaning that you need to get your own users before you can graduate to a listing level of beta and then even more users before you get other benefits like a blog post and potentially featured status.

Overall, I'd look at whether these benefits are worth the engineering effort. If your main goal/priority is marketing then there may be other exciting growth/marketing opportunities that would be a better use of time with better ROI. Hope this is helpful.

<comment><USER3> Can you list the other growth/marketing opportunities for your product that you found were exciting?

</comment></comment><comment><USER4> In general and from my experience, I'd say integrations are more effective at increasing retention than they are at increasing sales.

It's not that integrations aren't valuable to new users, it's just that users will be initially be buying for your core value, as oppose to an integration that is by definition not core.

Yeah, if 2 companies are equal then I suppose the one having Zapier will be better, but that doesn't seem sustainable :)

Once users have spent time in your app, they will start adding integrations that will make your app "stickier" and hopefully increase retention.

<comment><AUTHOR> Thanks for the feedback. It seems as though Zapier has taken over the startup scene which just makes me wonder its value to us.

</comment></comment><comment><USER5> I would say this depends on what your purpose is. If your service has a real value to integrate with multiple other services, or your customers ask for, then it's a time saver and thus you may save money by integrating with Zapier.

However, by experience, do not expect to get customers only because you are part of their catalog. Especially, since they have introduced partner tiers to get promoted (i.e. to appear in their newsletter, use cases, etc.). Previously, all integrations had this benefit, now you need to satisfy some criteria.

Regarding the integration, we made one for Noticeable.io last year, it took us some weeks. The documentation is not that bad but there was several steps that were involving human interactions with Zapier.

<comment><AUTHOR> I personally struggle with how I'd use the Zapier integration (thinking as a customer/client) but I think that about other services. We tried to do a RingCentral / Pipedrive mashup and couldn't make it work the way we wanted (got 75%+ there).

If you don't mind what is the usage like? Did use-cases emerge you hadn't considered. Has it been a headache from a support standpoint? Lastly, are customers confused when you say yes we integrate with X but in order to use it you have to use/purchase Zapier? Again thank you!</comment></comment>


The Adafruit Guide to Excellent Soldering - <AUTHOR> https://learn.adafruit.com/adafruit-guide-excellent-soldering/tools <comment><AUTHOR> Really nice all in one guide (of course they are trying to sell you stuff but it is still a really good guide).

There are five parts which you might not notice on the left.

</comment><comment><USER2> A well written guide with good pix. In the 80s (and before) each heathkit shipped contained a "how to solder guide" that was also pretty good.

Some additional commentary although nothing in the linked article is wrong:

Nail clippers snip component leads easier than diag cutters AND diags, depending on component lead construction, can fling the lead ends off with considerable force inevitably into someones eye (so goggles, or nail clippers, or lots of experience is advised). Old timers (working alone) set up the clip and don't compress until eyes blink closed or develop weird finger dexterity to put finger on end of wire being clipped off so it physically can't fling off into space or into eye.

Some RoHS leadfree always look "naturally" like cold solder joints, kind of matte finish. Foolin around to gain experience before doing something for real is advised. Just twist two snipped off leads together and see how it looks when its been heated up so much when soldering that it can't possibly be a cold joint.

(edited to add, the first time someone solders with lead-free they have a mandatory weird look in their face when they inspect the joint)

A piece of wood helps when soldering in 50 IC sockets and flipping the board over to solder them. Work bottom up when you can (sockets first, THEN caps THEN connectors or whatever). It beats flipping a board 50 times by hand and only takes a piece of wood (or maybe a hardcover book?)

Watch some videos of a pro plumber doing copper plumbing to get a vague idea of what you're trying to do WRT filling but not overfilling the joint etc. Its easy to see on big stuff not so much with macro lens time.

Stray spatters can be cleaned up with ethanol and a dedicated toothbrush, they don't stick very well to solder resist. Which also cleans off the flux. Which is impossible to accomplish without inspecting each soldered joint.

Some people are allergic to rosin solder smoke. I kind of like it. Its not like theres giant clouds, but then again some people sniff a peanut and die (seriously) so if you're allergic I'm sure it really does suck. Some ventilation might not be the worst idea. If you can tolerate a wood campfire you'll almost certainly be OK.

(forgot to add, no matter your natural inclination, never reach for something thats falling (like an iron) and never solder in shorts or sandals or bare feet or otherwise over anything super delicate, and never mix business with pleasure aka food drink booze never improved by added lead or plain old dirt)

(And speaking of falling irons and iron issues in general until you own a "real" soldering station always route cable around back of desk not front, and develop a ritual where you never step away from a desk or shut off the lights or leave the room without putting a cold iron in its storage area, irons are hot enough to start a fire if left on)

<comment><AUTHOR> Gosh I miss heathkit. I could never afford anything there but it was a fun store to browse and the catalog was amazing.

Learned to solder on their AM radio kit (cheapest kit they had).

Soon we'll miss Radio Shack and there will be nothing left but internet orders.</comment></comment>


Farewell, 12309 - <AUTHOR> https://bugzilla.kernel.org/show_bug.cgi?id=12309#c576

<comment><USER2> It doesn't look like they really fixed it. Care to point out what they did? The bug history is humongous, I don't think I can go through all of that.</comment>


HiFive Unleashed Expansion Board Makes It Easy to Build a RISC-V PC - <AUTHOR> https://blog.hackster.io/hifive-unleashed-expansion-board-makes-it-easy-to-build-a-risc-v-pc-c060786bce9d <comment><USER2> "Microsemi is currently crowdfunding the HiFive Unleashed Expansion Board on Crowd Supply for $1,999 for just the board and $2,998 for a bundle package that features both the Unleashed and Expansion together with delivery (free for the US, $40 and up worldwide) beginning on May 30th."

For $895 you can get a Xilinx Zynq UltraScale+ MPSoC ZCU104 Evaluation Kit, which will stomp all over this board's face.

The kit comes with the Microsemi GOLD software...for a year. The Xilinx kit comes with a license that is simply locked to the device (iirc).

What a terrible joke; it would be much more reasonable to buy a more capable FPGA development system and throw a RISC-V into that (a KCU116 is ~3K and is light years ahead of anything from Microsemi).</comment>


RISC-V Executive Director, Rick O'Connor, Interview and Booth Tour - <AUTHOR> http://armdevices.net/2018/08/09/risc-v-executive-director-rick-oconnor-interview-and-booth-tour/ <comment><USER2> This is absolutely brilliant. Kudos to the team that created and produced this video.</comment>


Ask HN: If Politicians were selected by Random Lotto? - <AUTHOR>

Instead of the current "I volunteer as tribute method, what if our elected officials were drawn from completely random lottery..." --
The approval rating of congress is abysmal, and idiot-rating through the roof, sure average americans may not know everything about running a country, neither did the author's of the constitution, they just knew they wanted something better.
I submit that if we picked all senators and congressmen via random lottery, w/ 1 term only. We would have a MUCH healthier political system than we have now.
Just as people say Guaranteed Basic Income will fail-- Let me ask 2 questions: 1: Is what we have now working, e.g. is there still homelessness, and poverty in America? 2: If our system is already failed, how does trying something new that may fail, hurt anything?
Same goes for anything. Why can't we change things, shake things up a bit, push the envelope? Wasn't America's founding principles on shaking things up? <comment><USER3> While there is no system of government that is good, a random lottery would probably be better than what we have today. In a democracy, the best liars and thieves rise to the top of the totem pole. I think that a random sample of the population is more likely to include a few more good and decent people than today's system where outright criminals continuously gain power. EDIT - <USER2> idea of the incentives in democracy for bad people to rise to the top is discussed in very interesting ways in Hoppe's Democracy: The God that Failed which I would highly recommend.

One reason why I believe that a voluntary society is the ultimate future of the world is that there would be more opportunity for like minded folks to get together and institute any social order they wish to. If there's lots of folks that believe in a guaranteed basic income, there wouldn't be any regional monopoly of ideas so they'll have an opportunity to try their ideas and convince others that their system is the right one.

</comment><comment><USER4> > "... w/ 1 term only."

Nevada introduced term limits a few years ago and the result has been, at best, zero meaningful change and, at worst, actively making an already crappy state government even worse. And they're still given at least a few terms, rather than just one (which would make it even worse).

What ends up happening when you term limit politicians is other actors in the political system gain more power. And in Nevada's case, that means lobbyists and special interests.

They're the ones who can accumulate 20 years of experience while politicians come and go. They're the ones freshman lawmakers are forced to turn to because all other sources of institutional knowledge are no longer around.

In the abstract, I get the appeal of term limits. Fresh blood, new ideas, change for the better. In the real world, though, it just doesn't work.

<comment><USER5> Term limits are a (generally, ineffective) attempt to hack around a bad electoral system that doesn't provide meaningful choices (majority or plurality/runoff).

Preference voting systems (either single member systems, like IRV, or multimember systems like STV) address the problem term limits try to address more directly.

<comment><USER4> Absolutely. Well said.

To your point that the electoral system doesn't provide "meaningful choices," one suggestion I've always thought was interesting is Jonathan Bernstein's "floors, not ceilings" idea:

> No, the trouble in campaign finance that bothers me the most isn't > corruption, or the massive sums spent on presidential campaigns; it's the > fact that many Senate challengers and most House challengers can't raise > enough to run minimally viable campaigns. The solution to that, in my view > is to put a layer of public financing as a floor for all major party > congressional nominees, while loosening the rules to make it easier for them > to raise larger amounts of money. Floors, not ceilings (plus meaningful > disclosure).

[http://www.washingtonpost.com/blogs/post- partisan/post/for-f...](http://www.washingtonpost.com/blogs/post- partisan/post/for-floors-not-ceilings-in-campaign- finance/2012/04/13/gIQAU31UFT_blog.html)

</comment></comment></comment><comment><USER5> > Let me ask 2 questions: 1: Is what we have now working, e.g. is there still > homelessness, and poverty in America? 2: If our system is already failed, > how does trying something new that may fail, hurt anything?

There's a pretty big gap between a government "working" to the extent of eliminating all major social ills like homelessness and poverty, and "failing" so completely as to not require any more argument than "our current system is failing, so trying something new, no matter what its obvious weakness, can't hurt anything".

<comment><USER6> Exactly. The current system is bad. But things can still get _much_ worse. So "let's try some random thing, because it might help" is a bad idea. On average, it's probably more likely to make things worse rather than better.

</comment></comment><comment><USER7> Ever read Solar Lottery? It's not really the same, but I do wonder if over time randomly selected representatives wouldn't just milk their power for what it's worth since it seems like there'd be little to no accountability of any kind.

Not that there's any real accountability provided through elections as it is anyway.

</comment><comment><USER8> _" 1: Is what we have now working, e.g. is there still homelessness, and poverty in America?"_

You presume that there could not be homelessness and poverty in the optimal system. I'm not sure that's guaranteed.

 _" 2: If our system is already failed, how does trying something new that may fail, hurt anything?"_

You can _always_ fail harder.

Mind you, I'm in favor of a basic income and there are some interesting things about this idea (though I don't _think_ I favor it); I'm just skeptical of your rhetoric.

</comment><comment><USER9> >Just as people say Guaranteed Basic Income will fail-- Let me ask 2 questions: 1: Is what we have now working, e.g. is there still homelessness, and poverty in America? 2: If our system is already failed, how does trying something new that may fail, hurt anything?

I question your assumptions. Should homelessness and poverty be the main concerns for politicians? Why do you believe our system has failed to the point of "elect random people from the public."

>Why can't we change things, shake things up a bit, push the envelope?

"Push the envelope" is a meaningless expression. What exactly do you mean?

>Wasn't America's founding principles on shaking things up?

No, it wasn't.

<comment><USER5> > >Wasn't America's founding principles on shaking things up?

> No, it wasn't.

Yeah, this is part of the myth that comes from the misnamed American "Revolution". The revolt of the American colonies against Britain was largely the _opposite_ of being about shaking these up -- the anger was largely over the arbitrary deprivation of rights the upper classes expected to have respected as British subjects. The founding principle was more about _securing_ what were already viewed as traditional protections than about shaking anything up.

</comment></comment><comment><USER10> I've advocated this for a long time.

The big advantage is that it would put an end to corruption. If you tried to corrupt a member of the political class you might get a polite "no thank you" at best. If you tried to corrupt average Americans you might have some who would say yes, but you'd have 1/3 who would call the cops, punch you in the face, pull a gun, or otherwise do something that would make it way too risky.

<comment><USER11> What makes you think people are less likely to be corrupted by power and large financial incentives if they _don 't_ have to convince the electorate they have principles?

<comment><USER10> It works the opposite of how you say.

The first rule of being a "respectable" person is that you have to respect other "respectable" people.

For instance, you have to respect Bernard Madoff because Bernard Madoff is respectable.

What this means is you can safely feel out a respectable person to see if he is corruptable or not. If you picked average people, very dangerous things might happen at a 30% or so probability.

</comment></comment></comment><comment><USER12> I just read this a few days ago and it's pretty interesting: [http://en.wikipedia.org/wiki/Franchise_(short_story)](http://en.wikipedia.org/wiki/Franchise_\(short_story\))

If this kind of thing is interesting to you I'd get ahold of the short story and read it through.

</comment><comment><USER13> Similar method worked fine for 300 years in ancient Greece in Athenes....

</comment><comment><USER14> What you describe is called Demarchy: [https://en.wikipedia.org/wiki/Demarchy](https://en.wikipedia.org/wiki/Demarchy)

</comment><comment><USER15> maybe we should have more congress people since population has skyrocketed since 1912 when it was last adjusted.

</comment><comment><USER16> I love this idea. And for anyone who doesn't like it, ask yourself why we are using it for juries...

<comment><USER5> We use it because juries can't write laws, enter judgements, or execute laws/judgements, or, really, do anything on their own. They serve -- particularly in the criminal sphere -- as a _brake_ on government.

<comment><USER8> Which might be an interesting role in this case. Any time congress tries to pass a bill, it not only needs the President's signature, but it also has to pass a randomly selected panel of ordinary people?

<comment><AUTHOR> Why not move to popular vote for laws? Some people think it can be hacked/gamed, but --if that's the case so can any normal election - and a lot of times republicans will do anything they can to get people not to vote because the more voters that show up, the more likely they are to fail.

I really like the idea of Liquid democracy -- what if a new political party popped up, and the runners agreed to take a public poll before every vote and the party can choose to keep or throwout the candidate at the next election based on how often they side w/ the people.

Throw in location/regionalized grouping, and you can easily have all sw ohio voters contribute to reps vote tally from that area...etc..

Also what if we raised the bar on representation - We currently have 1 congressmen per million... that's highly not representative.. -- true representation needs to also find a way to not only represent locations...but also demographics better..

What if we just tripled the reps, but required 1/3rd come from middle class, 1/3rd from lower-class, 1/3rd from upper class.

It would provide a better idea of what the people really want from all levels.

<comment><USER8> An ordinary popular vote for laws I don't like because I don't have time to research everything to the depth I would need to. Something like liquid democracy suffers much less from that, of course. I've recently been taken with the idea (though I am not at all convinced it would actually be a good idea) of drawing panels at random - like jury selection - to decide individual issues, but giving them time and pay to inform themselves and deliberate. Just expecting people to come to well informed decisions on their own time doesn't turn out great.

</comment></comment></comment></comment></comment><comment><USER17> The Napoleon of Notting Hill is a story about this.

</comment><comment><USER18> What would happen? Most likely, chaos would ensue.</comment>


Ask HN: iPhone 6 (plus) compatible app for reading HN? - <AUTHOR>

As riposte and any other app.net client most likely won't see any updates any more, I was looking for a dedicated iOS app to get my daily dose of HN. While the AppStore is limited in searching and filtering, I didn't find any app, free or payed, that is "already" working with the new iPhones' bigger screens. Did I just miss one? Is there "THE" HN iOS app? <comment><USER2> I just use Hacker News mobile, seems to work really well. [http://hn.premii.com/about/](http://hn.premii.com/about/)

<comment><USER3> This is what I use as well. You can also just use their web app if you don't feel like downloading it.

</comment></comment><comment><USER4> HN just released an API but v0 was read-only, I'd look into this again next month.

[https://news.ycombinator.com/item?id=8422599](https://news.ycombinator.com/item?id=8422599)

</comment><comment><USER5> I just started using MiniHack ([https://appsto.re/gb/UtFNL.i](https://appsto.re/gb/UtFNL.i)) today, and it seems great.

</comment><comment><USER6> Tried all sorts of apps. Minihack is the most convenient for me. Besides reading I value the integration with other apps and services.

</comment><comment><AUTHOR> Great suggestions, thanks! I'll try both and see which I like better.

</comment><comment><USER7> I use chrome :)</comment>


Ask HN: I Think This is the Best Task App - <AUTHOR>

I'm biased, as I made it. But I use it everyday.
http://taskthing.appspot.com/ or blogpost: http://blog.staydecent.ca/entry/task-thing
I obviously like the UI, but I've always had a feeling that others wouldn't as it relies heavily on mouseover. I added a KISSInsights question, but no one uses Task Thing, so haven't had much feedback. What do you think?
It's free but requires a google account.
Why I'm posting here: I see other people still making new Task apps, and charging money. I still like mine better but that's not really a fair judgement. <comment><USER2> It didn't work for me at all. I created a new task, and would edit the title, and description. As soon as I would click off of the task all my changes were lost.

<comment><AUTHOR> That's no good. What browser/OS? I'm developing with Chrome/Windows7 and have tested in Firefox.

`elm.children("form").bind('submit focusout', function() {`

is the event. Thanks for trying it out!</comment></comment>


Show HN: My Android app that creates customized QR codes - <AUTHOR> https://market.android.com/details?id=com.rabidgremlin.android.mecodelite

<comment><AUTHOR> I'm particularly interested in feedback on the app's description and icon... the UI....the concept...heck I'm actually interested in any feedback you guy's have :)

</comment><comment><USER2> Nice way of abusing QR code's error correction system. I like it!

<comment><AUTHOR> Indeed that 30% error correction rate was very helpful :)</comment></comment>


Why Do People Stay When a Hurricane Comes? - <AUTHOR> https://www.nytimes.com/2018/09/14/opinion/hurricane-maria-staying-home.html <comment><USER2> Probably because the estimated danger zone is too big and 95% is safe. Add the risk of looting if you leave. Bam. Saved you 10 minutes of your life. You are welcome.

</comment><comment><USER3> Without even looking at the article I'm going to say "because they can't afford to leave".

</comment><comment><USER4> Because they are poor/lack resources.

Why is this even a shock to people?</comment>


Tech luminaries call net neutrality vote an 'imminent threat' - <AUTHOR> https://www.theverge.com/2017/12/11/16754040/steve-wozniak-vint-cerf-internet-pioneer-net-neutrality-letter-senate <comment><USER2> Not that this will make a difference in the outcome of Thursday's vote. I urge everyone to look at the actual proposed rules, and in particular the technical background and explanations. Basically, if ISPs claimed something in their comments, the FCC assumes it is true and dismisses any contradictory claims submitted by others.

The entire comment period was for show. Pai and his republican co- commissioners are going to jam this through regardless of what anyone says or does. He was brazen enough to admit, early on, that he does not care whether or not his plan is unpopular and that what the public thinks makes no difference whatsoever.

The only way to change this is to convince Congress that this is an election issue. Unfortunately there are too many other things happening right now, so net neutrality is being drowned in the noise and will likely continue to be drowned in the noise.

<comment><USER3> I'm actually somewhat satisfied with how they're ramming this vote through right now. Not because I want to lose Net Neutrality, but because if it is going to happen, it's best that it happens now, early in Trump's term, and that the process of forcing the vote is messy.

Two possible silver linings if it does get removed on the 14th:

1\. We were wrong the whole time and reversing net neutrality launches us into a golden age of fast and cheap internet for all. (Very unlikely)

2\. We were right, and reversing net neutrality is as bad as we feared. While it will be painful in the short term, hopefully it's bad enough to The Internet/Net Neutrality a relevant election issue for more people.

Either way, the sure silver lining is that by hashing this out now the consequences will be fully felt by the time the next presidential election rolls around.

Can you imagine if they were trying to shove this through in the lead up to the 2020 election when everyone is distracted by all the other issues at stake in the election?

<comment><USER4> Most people are not going to realise the pain. It's one of those issues that affect people but they would never understand why. In spite of scientists saying climate change is real and it's affecting us directly (floods, heat waves,...etc) people still can't put 2 and 2 together to ask for change. I don't think ISPs would be dumb enough to drastically become cable-operatorish and charge customers for every website. The pain will be felt by small companies and competition (albeit indirectly).

<comment><USER5> I'm fairly sure they early stages will even look like it was a good change, making some people wonder why were they even fighting it.

For example excluding affiliated sites from any caps (let's stream 4k movies from Hulu, RedBox etc even if you have lower bandwidth than necessary, you would be excluded for these services) or have data caps not apply for affiliated sites.

For an extra fee you could also get similar treatment for non-affiliated sites (Netflix, YouTube, Amazon Video etc).

In the mean time everything else will gradually is getting slower and slower. Tough luck for any new startup trying to enter the market. As it already is difficult right now, it will be nearly impossible after that.

The absolutely bad things (throttling/blocking/modifying content of sites the companies don't agree with) will happen much much later.

<comment><USER6> More like they use the fees from content providers to make service nearly free, then they'll be able to plausibly say that bringing back net neutrality will make internet service more expensive. Then, no one will want to bring net neutrality back.

Like how cell phones are "free" so it's impossible to buy one without a contract.

<comment><USER7> None of the major US carriers have contracts anymore, since the start of this year.

[https://www.fiercewireless.com/wireless/verizon-kills-two- ye...](https://www.fiercewireless.com/wireless/verizon-kills-two-year- contracts-and-smartphone-subsidies-raises-activation-fees-by-10-0)

</comment></comment></comment></comment></comment></comment><comment><USER8> For all the zero-rated services that Google and Facebook subsidize globally, they've actually become part of the problem.

It seems hypocritical for them to take a pro-net neutrality stance when they're funding the capture of entry-level mobile data plans.

<comment><USER9> I might be wrong, but didn't the net neutrality regulations that were put into place before the current rule change allow zero-rating? A large part of the opposition to the rules change is that it allows paid prioritization, not just zero rating.

<comment><USER8> Zero-rated services were the trojan horse that led to paid-prioritization.

Both producers and consumers have already been conditioned to accept this new model.

</comment></comment></comment><comment><USER10> An interesting counterpoint to the standard arguments equating support for Net Neutrality with support for Title II classification of broadband providers, from Ben Thompson:

[https://stratechery.com/2017/pro-neutrality-anti-title- ii/](https://stratechery.com/2017/pro-neutrality-anti-title-ii/)

> Allow me to state this point plainly: I am absolutely in favor of net > neutrality... The question at hand, though, is what is the best way to > achieve net neutrality?

> Any regulatory decision — indeed, any decision period — is about tradeoffs. > To choose one course of action is to gain certain benefits and incur certain > costs... equally difficult to measure is the inevitable rent-seeking that > accompanies regulation, as incumbents find it easier to lobby regulators to > foreclose competition instead of winning customers in an open market.

> A classic example of this phenomenon is restaurants: who could possibly be > against food safety? Then you read about how San Francisco requires 14 > permits that take 9 months to issue... and you wonder why anyone opens a > restaurant at all.

> This argument certainly applies to net neutrality in a far more profound > way: the Internet has been the single most important driver of not just > economic growth but overall consumer welfare for the last two decades. Given > that all of that dynamism has been achieved with minimal regulatory > oversight, the default position of anyone concerned about future growth > should be maintaining a light touch. After all, regulation always has a cost > far greater than what we can see at the moment it is enacted, and given the > importance of the Internet, those costs are massively more consequential > than restaurants or just about anything else.

<comment><USER11> The argument that network neutrality is a new regulatory burden is wrong. Before the 2000s network neutrality existed because the ISPs did not have the network equipment to do deep packet inspection and filtering at large scale. By 2004 the FCC began looking to enforce network neutrality and began testing various legal authorities starting with the Madison River case, and culminating in the 2014 loss in Verizon vs FCC which forced Tom Wheeler to reclassify ISPs as common carriers in order to enforce net neutrality.

In other words, the whole history of "the single most important driver of not just economic growth but overall consumer welfare" has occurred under defacto network neutrality.

<comment><USER12> Right, I think it's increasingly important to distinguish between (A) the _end-result situation_ of neutral-networks and (B) any specific regulations/laws that are trying to preserve that status-quo.

I fear there are a lot of people out there who don't understand the distinction and are confused when they hear that NN is both the status-quo _and_ that NN is new regulation.

</comment></comment></comment><comment><USER13> Aren't government officials supposed to be working _FOR_ the public, rather than some vested interests by a few?

And shouldn't you be listening when the people who have made internet possible today (Tim Berners-Lee, Steven Bellovin, Steve Wozniak and Brewster Kahle to name a few) is very much against it?

The vote, the process and the resulting decision otherwise should be done in an objective and transparent manner. Just the way that the internet has been envisioned to be.

<comment><USER14> They are supposed to work for the good of the majority while not crushing minorities... and since corporations are considered people and could be considered minorities, I guess it makes sense.

See [https://en.wikipedia.org/wiki/Tyranny_of_the_majority](https://en.wikipedia.org/wiki/Tyranny_of_the_majority) .

/s

<comment><USER6> This will benefit some corporations (Verizon, Comcast) and hurt others (Google, Facebook).

<comment><USER15> I would assume that this would ultimately help google and facebook, they will be able to afford to pay for fast lanes while also making deals where their services are faster than new comers.

<comment><USER6> It doesn't help them at all. Google and Facebook can afford to pay whatever their users are worth to them and the ISPs can demand every last cent of that.

It's exactly analogous to the RIAA squeezing music startups dry: You absolutely have to pay them so why would they demand anything less than everything you make?

So why should ISPs demand anything less than everything the internet companies make?

<comment><USER16> Google and Facebook are large and rich enough to replace the ISPs if they felt they needed to. They've both dabbled in this area and would surely turn it into a serious effort if their core business was threatened. They just haven't done it because it's still cheaper (for them) to let the existing ISPs do it.

Comcast/Verizon/etc don't want to pick a fight with Google or Facebook. They want to pick fights they can easily win and gain extra money from: companies too small to pose a threat.

</comment></comment></comment></comment></comment></comment><comment><USER17> All signs point to net neutrality being killed this week no matter who opposes it, but I applaud all those that stand up for their voices to be heard. Just because those currently in power are choosing to ignore those voices doesn't mean they aren't heard, and even if net neutrality dies this week doesn't mean it can't be resurrected later. The more voices loudly protesting, the more momentum there will be to help correct this travesty in the next election cycle.

<comment><USER11> The next time this political battle comes up the ISPs will have the legal authority to censor any pro neutrality voices.

</comment></comment><comment><USER18> What about the devil's advocate?

As the internet kept growing for the last 20 years, "global bandwidth" have increased by a lot because of services like youtube, netflix. The democratization of smartphones multiplied this effect: people listens to music using streaming, and you could say it doubled the amount of connected devices (not to mention smartphones update apps quite often).

I'm not against net neutrality, but the internet is still a very centralized platform, and it's not surprising that very popular services can become problematic for ISPs.

If you look at bandwidth, the largest actors are using a disproportionately larger share of it compared to smaller actors.

I just want to ask, is there some accounting of how those big actors contribute to the internet infrastructure, or how much they pay for its access considering the bandwidth usage?

I know that monopolies are bad, but I'm really curious about the business of internet infrastructure and how things works.

<comment><USER19> This question touches on something I've wondered about for a while. Why are large actors' usage questioned as if they alone were responsible for their internet traffic? Bits go in and bits come back out somewhere. There are always two endpoints in a connection.

Netflix, for example, pays for Netflix's internet connection according to their usage at their endpoint[1]. The consumers cumulatively pay for the same amount of usage; it's just spread across a large number of endpoints. Netflix's ISP and the consumers' ISPs pay for the infrastucture to connect the two together, and set their end user rates accordingly. Nobody in this chain of connections is getting a free ride.

Is this deliberate misdirection from the ISPs? Do I have some fundamental misunderstanding? Is it more nuanced than this?

[1] ignoring CDNs etc. for the sake of simplyfing the argument

</comment></comment><comment><USER20> I hope these individuals and companies fight for and win the change they want to see in the world because I agree with them. But I hope the vote passes tomorrow and ISPs no longer fall under Title 2 regulations. A 100 year old law cannot possibly fit the world of global, decentralized digital information sharing that the internet has become in the last 20 years. We need a new law for the new time. And it's this passion and energy we need from these luminaries and large companies to get people aware enough of the problem to pressure congress to do something about it. So the fight doesn't end tomorrow, it starts tomorrow.

</comment><comment><USER21> Apple Siri promotes Google over Bing for billions of dollars. Net Neutral.

Mozilla promotes Google over Yahoo and switches user search preferences back to Google. Net Neutral.

Google blocks YouTube access from Amazon's streaming devices. Net Neutral.

Netflix throttles AT&T and Verizon customers. Net Neutral.

You know why I don't care if Pai "repeals" NN?

<comment><USER22> The FCC regulation of ISPs isn't expected to right every wrong in the technology sector; the only US laws those cases might have transgressed are anti-competition/monopoly, regulated by the FTC. You've not provided any support for ending the regulation of ISPs as common carriers.

 _Netflix throttles AT &T and Verizon customers. Net Neutral._

They've limited the bitrate/quality for the benefit of the consumer, since those ISPs have low monthly bandwidth limits. This allows them to watch more video before they hit their bandwidth limits, something most would probably find to be a desirable tradeoff.

<comment><USER21> >the only US laws those cases might have transgressed are anti- competition/monopoly, regulated by the FTC.

That's the point. When you put up a law that says "Cable Co can't do this, but Internet Co can" it offends my sense of fairness.

</comment></comment></comment><comment><USER23> > "The current technically-incorrect order discards decades of careful work by > FCC chairs from both parties, who understood the threats that Internet > access providers could pose to open markets on the Internet."

Paid prioritization is that threat.

Again, streaming video content for all ages is not more important than online courses.

</comment><comment><USER24> I don't understand how the administration can support this change.

Allowing carriers to discriminate against content providers seems like legalizing extortion.

Is there an argument in favor of this change that would convince a reasonable person?

</comment><comment><USER25> > Tech luminaries call net neutrality vote an 'imminent threat'

If tech companies and luminaries genuinely considered the loss of net neutrality as an existential threat, wouldn't they be hiring every lobbyist under the sun to fight for it?

<comment><USER26> They have. The fact that it didn't work should inform you about how politics works today

</comment></comment><comment><USER27> I keep asking: where the HECK is Facebook?

Zuckerberg needs to forget about profits for a moment, and put a 5-minute blackout page instead of people's feed. And phone number Geolocated to their representative.

I guarantee this will change the winds of internet history!

<comment><USER28> Facebook _wants_ NN gone, so that they can sell their curated "Free Basics" plan with ISPs, blocking everything outside of Facebook and maybe Wikipedia.

They want to lock low income people into the Facebook bubble.

<comment><USER27> ? I thought that Zuckerberg was for internet freedom?? Project Free Internet in India and his non-profit??

<comment><USER28> Quite the opposite[0].

"Free Basics" was the name of the program, and it only allowed access to Facebook and whatever sites whichever sites Facebook (in all its infinite wisdom) decided were appropriate for the users to visit. The program was eventually found to be in violation of India's neutrality rules and was shut down.

[0] [https://en.wikipedia.org/wiki/Free_Basics#Net_neutrality_cri...](https://en.wikipedia.org/wiki/Free_Basics#Net_neutrality_criticism_in_India)

</comment></comment></comment></comment><comment><USER29> So why does no one complain when they benefit from non-net neutrality: [https://www.theverge.com/2017/9/6/16262086/t-mobile-free- net...](https://www.theverge.com/2017/9/6/16262086/t-mobile-free-netflix- family-plan-deal)

See the comments and tell me if I missed any.

<comment><USER4> Zero rating is a complex subject. Prior FCC chairman had vowed to look at zero rating on a case by case basis. In the case of T-Mobile, they treated all video services the same and more important did not own a competing video service that they prioritized unfairly over others. Seems sensible to me.

<comment><USER2> I can see objections to T-Mobile's plan:

It is a layering violation, since the network is dictating application requirements (the video streaming technology must be "T-Mobile friendly" to benefit from the zero-rating).

It fails when users use VPNs, because the network cannot inspect packets or determine which service is used. Likewise with proxy servers, Tor, etc.

It is not applied equally to all streaming services; T-Mobile maintains a list of registered services that is not even remotely comprehensive.

So yes, this is a net neutrality violation, even if it is not the sort of behavior prohibited by the 2015 rules.</comment></comment></comment>


Facebook Buys $550 Million in Patents from Microsoft - why-el http://mashable.com/2012/04/23/facebook-buys-microsoft-aol-patents/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Mashable%2FSocialMedia+%28Mashable+%C2%BB+Social+Media+Feed%29&utm_content=FaceBook <comment><AUTHOR> Yahoo has caught a Tartar.

<comment><USER2> [http://www.phrases.org.uk/bulletin_board/13/messages/1380.ht...](http://www.phrases.org.uk/bulletin_board/13/messages/1380.html)</comment></comment>


Wal-mart in talks to buy Jet.com for $3 billion - <AUTHOR> http://www.wsj.com/article_email/wal-mart-in-talks-to-buy-web-retailer-jet-com-1470237311-lMyQjAxMTE2MTAxMzEwODM2Wj <comment><AUTHOR> Is Jet.com really worth $3B? I tried it on multiple occasions because of the hype surrounding it and was underwhelmed. From the WSJ article:

Wal-Mart would gain Jet's sophisticated pricing software, as well as warehouses and valuable customer data. The retailer also would get a brand that can appeal to higher-income shoppers, something Walmart.com has struggled to do. Walmart.com shoppers' mean annual household income was $58,000 in 2015, while Amazon shoppers made $68,000, according to data from Kantar Retail.

<comment><USER2> I tried it a handful of times. Each time, I got frustrated and left. Looked good for 1999.</comment></comment>


Italy Finds Scientists Guilty Of Manslaughter For 2009 Earthquake Forecast - <AUTHOR> http://www.npr.org/blogs/thetwo-way/2012/10/22/163400917/italy-finds-scientists-guilty-of-manslaughter-for-2009-earthquake-forecast

<comment><USER2> Haven't heard something more stupid in a long, long time.

<comment><USER3> You're statement is actually much more stupid than the verdict. I can tell you have not studied law. You should start with Babylonian law...

<https://en.wikipedia.org/wiki/Code_of_Hammurabi>

Fortunately for humanity, such principles have been the foundation of civilisation since the time of Babylon. What you think is stupid is actually a part of the foundation of civil society.

I think the loss of principles such as these are a big part of the rot in our society. Take for instance Wall Street. Once there is a disconnection between the actions and behavior of people in positions of influence and authority and the consequences of that behavior, you get an economic moral hazard and the implicit license to do and say whatever pays your pockets for that day, ignoring all the downside risk.

The correct answer the scientists should have given at the time is "yes, there may be an earthquake. Or there might not be. We can't tell." Not just saying what the politicians wanted to hear. Not just putting out a statement to placate people and make them feel safe. That is certainly negligent. This is not an attack on science. This is holding authority to account for their negligence.

Personally I think the case should extend into the negligence of politicians who forced the scientists to release the statement as well. Also negligent may be the builders or building code authorities who allowed such fragile buildings to be built in a high quake area. There is more than one negligent party here.

Also not covered in the article is the fact they arrested the non-scientist who made the prediction and locked him up, because he was driving around trying to convince people to relocate before the earthquake hit.

<comment><USER2> > The correct answer the scientists should have given at the time is "yes, > there may be an earthquake. Or there might not be. We can't tell." Not just > saying what the politicians wanted to hear. Not just putting out a statement > to placate people and make them feel safe. That is certainly negligent. This > is not an attack on science. This is holding authority to account for their > negligence.

Please post and tell us what the scientists said with authentic appropriate references.

<comment><USER3> Immediately after that meeting, De Bernardinis and Barberi, acting president of the committee, held a press conference in L'Aquila, where De Bernardinis told reporters that

 _"the scientific community tells us there is no danger, because there is an ongoing discharge of energy. The situation looks favorable"._

No other members of the committee were at the press conference.

<http://www.nature.com/news/2010/100622/full/465992a.html>

<comment><USER2> Selective amnesia? Here's another and more important snip from the article.

 _The minutes of the 31 March meeting, though, reveal that at no point did any of the scientists say that there was "no danger" of a big quake. "A major earthquake in the area is unlikely but cannot be ruled out," Boschi said. Selvaggi is quoted as saying that "in recent times some recent earthquakes have been preceded by minor shocks days or weeks beforehand, but on the other hand many seismic swarms did not result in a major event". Eva added that "because L'Aquila is in a high-risk zone it is impossible to say with certainty that there will be no large earthquake". Summing up the meeting, Barberi said, "there is no reason to believe that a swarm of minor events is a sure predictor of a major shock". All the participants agreed that buildings in the area should be monitored urgently, to assess their capacity to sustain a major shock._</comment></comment></comment></comment></comment>


Why Rust and Not Go: A Rebuttal - <AUTHOR> https://blog.juliobiason.net/thoughts/why-rust-and-not-go/ <comment><USER2> Really who cares?

Pick a language. They are both fine. Both will probably solve whatever problem you have without too many issues. Arguing over which one you should use its probably pointless 99% of the time.

I wish I had a link to the twitter exchange between both accounts where the answer they both agreed with was learn both, and lets have this conversation in a week. It feels 100% relevant here.

<comment><USER3> > _learn both_

This is a common advice but it isn't realistic.

It takes a lot of time to learn a language, its tools, its most popular libraries, its best practices, to interact with its community, to see in what problem domains it shines, etc.

I'd say you need to give it more than a year, more than two if you're not doing it on the job. You can churn code much sooner than that obviously, that's not what we are taking about.

Nobody does that to see which language is best. And those that do are doing it superficially, writing a hello world or two and then jumping to conclusions.

This advice basically makes no sense and yet people keep repeating it.

</comment></comment><comment><USER3> Not sure how good the original article is, but this is a poor rant.

And I very much dislike Go as a language.

<comment><USER4> Agreed. The original article made a good point of the language being simple (feature-light) makes it appealing for enterprises, as an alternative to Java, for building enterprise solutions. Go is easy to pick up and the language is opinionated, forcing teams to adhere to a uniform way of doing things.

I was interested in a rebuttal which would address these points. Instead, it comes across as just addressing the points in the article as an attack on Rust.

</comment></comment><comment><USER5> > > The Go compiler is fast.

> Ah crap, not that shit again.

> The whole point is "compiler is fast, tests run faster". Well, what if I > said the compiler would catch bugs before the tests? That would be even > faster, 'cause then you can focus your tests on system behaviour, which is > way more important than function behaviour or class/structure/module > behaviour.

No.

A fast compiler is not only good for unit tests. And even when it comes to unit tests, it is not at all idiomatic Rust to omit them; on the contrary, unit test support is built into the language!

Rust having a slow compiler is a serious downside. The language has many upsides that can hopefully make up for it, depending on your priorities, but that doesn't make compilation speed a non-issue.

That said, the compiler is significantly faster than it used to be and hopefully will continue to improve as time goes on.

</comment><comment><USER6> I don't understand how these 2 languages always get into these comparisons.

They are mostly aimed for different audiences and different purposes.

</comment><comment><USER7> They're just fundamentally for different things. For most classes of problems where the distinct features of one or the other would make any difference, if you're choosing between Rust and Go, then you may consider that you might not entirely understand either your problem and/or why either of these should be considered as part of a solution.

We chose Rust for a bunch of reasons related to enabling high-assurance software development with better ergonomics & efficiency than attempting to do the same with C and bolting a bunch of disjointed augmentations onto either it or its toolchain.

Substructural type system + HM type system + ease of integration into embedded targets is fantastic for the platform we're building and the markets we're addressing. Using Go would make no sense at all for us, but may be perfect for a use case where the same kinds of guarantees & assurances aren't necessary.

</comment><comment><USER8> > > As I already mentioned, Go was created to solve Google problems, and > Google problems are definitely enterprise-scale problems.

> You know who has Google problems? GOOGLE! You know who else has Google > problems? NO ONE!

That's true, but guess what, Google still uses C++ and Java for the vast majority of its critical infrastructure. So even at Google, C++ and Java reign supreme at handling "Google scale". And it's not surprising really, the maturity, performance, tooling, etc. available for Java and C++ are far superior to what golang has to offer. Not to mention both being far better languages than golang (even with how complex C++ is). golang is a weak language not suited for modeling complex domains.

Secondly, golang was developed by some employees at Google, not Google itself. And if it weren't for the brand name behind it, it would have gone nowhere.

</comment><comment><USER9> > Honestly, I haven't seen -- even with Rust -- something as dead simple as > Flask

What about warp? [https://github.com/seanmonstar/warp/blob/master/README.md](https://github.com/seanmonstar/warp/blob/master/README.md)

</comment><comment><USER10> I don't like the aesthetics of rust as a language, and I don't like the behavior of certain members of the rust community who vacillate between overzealous evangelism and dismissive rudeness.

</comment><comment><USER11> As far as my understanding goes, I see this kind of comparisons as a "Please- consider-to" list to the language teams.

I'm a heavy Go user and light Rust user. I enjoy them both, and they gives me different set of advantages in return.

Please, don't use/treat comparisons as an attack, make it "So-this-can-help- me-do-that".

</comment><comment><USER12> I totally see what the author of this post is saying, and I agree with most...But, that original post wasn't half bad. It was entertaining and well written. I frankly don't think anyone took it for anything other than an opinion piece.</comment>


JetBrains the State of Developer Ecosystem 2019 - <AUTHOR> https://www.jetbrains.com/lp/devecosystem-2019/ <comment><USER2> Unrelated, JetBrains have an office in Novosibirsk. I had the privilege of studying at the university there, wonderful place, and as someone who dislikes hot weather, the climate was great :)

</comment><comment><USER3> The results may be slightly skewed towards the languages/market segments their tools target. I have been an embedded developer since the late 90's and have a CLion license, but since they don't fully support Make files out of the box this tool doesn't fit within my development flow. One of the problems with CLion is its steadfast reliance on the output of the build to support CTAGS/Intellisense (sorry, I forget their specific terminology).

</comment><comment><USER4> The response to the last question, "What is your commute to work/university like?" really surprised me. I thought the overwhelming majority would be by car.

<comment><USER5> Seems that the majority of respondents were not from US</comment></comment>


Microsoft Application Inspector - <AUTHOR> https://github.com/Microsoft/ApplicationInspector <comment><USER2> This looks like something that would be nice to have integrated in nuget.org, showing the report output for every package/version (and maybe highlighting deltas across versions).

If you're running this across your own project output, especially for a big code base, it's definitely not going to be as useful as across each dependency. For example your app having "analytics services" and "outbound http connections" might be totally normal, but if a library you're using for encryption adds those, that would be a concern.

<comment><USER3> In regards to the first line of your comment, check out [https://www.fuget.org](https://www.fuget.org). It does exactly that.

<comment><USER4> Sorry, where's the app inspector output in this?

[https://www.fuget.org/packages/System.Net.Http](https://www.fuget.org/packages/System.Net.Http) for example doesn't show me all of that.

</comment></comment></comment><comment><USER5> Just wanted to introduce myself as the lead developer on the tool. Valid comments and questions have been dropped here and I've responded to a couple of them already by posting clarifications below and on the project wiki. Yes we are thinking of using the tool for repos like NuGet and maybe Github as a service that automatically identifies detected features for each component. Stay tuned and keep the ideas coming. Happy to answer any further questions.

<comment><USER6> My team has been desperately searching for something like this. We actually started the effort to build our own, and were well into the prototyping phase. You may see some contributions from us in the future.

<comment><USER5> smile

</comment></comment></comment><comment><USER7> Weird, that first screenshot [0] contains Audible's logo [1] which is an Amazon company (far right icon in the first row of icons).

It looks like they are repurposing Audible's logo to mean "Dynamic Command Execution" [2]

[0] [https://user- images.githubusercontent.com/47648296/72893326-...](https://user- images.githubusercontent.com/47648296/72893326-9c82c700-3ccd-11ea-8944-9831ea17f3e0.png)

[1] [https://m.media- amazon.com/images/G/01/audibleweb/arya/navig...](https://m.media- amazon.com/images/G/01/audibleweb/arya/navigation/audible_logo.2x._V517446980_.png)

[2] [https://user- images.githubusercontent.com/47648296/71859554-...](https://user- images.githubusercontent.com/47648296/71859554-2dd62480-30a4-11ea-8ee5-06b2a0d08d24.png)

<comment><USER8> Heh, the icon is named "audible":

        "displayName": "Dynamic command execution",
        "detectedIcon": "fab fa-audible"

It's probably unintentionally used by an engineer unfamiliar with the product as audible is more common as a descriptive word than as a brand.

[https://github.com/microsoft/ApplicationInspector/blob/08c91...](https://github.com/microsoft/ApplicationInspector/blob/08c91033526e2fae4c925be31598cc8d8f697bd6/AppInspector/preferences/tagreportgroups.json#L39-L40)

<comment><USER9> Yeah this happens pretty often, though I'm surprised it continues with Font Awesome's organizational changes: The "fab" prefix is specifically supposed to communicate that it's an icon from the "Brands" style. (Non-brand icons use "fas".) If you find yourself using a "fab" icon generically, you might want to double-check what it's _supposed_ to represent...

<comment><USER10> Honestly, a lot of times when I'm doing quick designs, I just open the font page with all the images and just visually pick any that looks best. Definitely needed some sort of legal pass before release.

</comment></comment></comment></comment><comment><USER11> I pointed it at my Clojure project [1]. It correctly inferred [2] that the project is doing multithreaded network connections, which is nice, especially given that Clojure's a rather niche language.

It quite confidently pointed out an "App container" category, on grounds of the repo containing a circleci/config.yml, which is... technically correct, I guess, but less than useful.

[1]: [https://github.com/nathell/skyscraper/](https://github.com/nathell/skyscraper/) [2]: [http://pliki.danieljanus.pl/appinspector- skyscraper/](http://pliki.danieljanus.pl/appinspector-skyscraper/)

</comment><comment><USER12> Just in case anyone's curious what these reports look like, I've uploaded the reports for curl, grep, and chromium here: [https://gracious-jang- bc0194.netlify.com/](https://gracious-jang-bc0194.netlify.com/)

</comment><comment><USER13> I think an important warning should be, that it can maybe to some extent tell _" what's [for sure] in it"_, but I suspect it definitely shouldn't be used to verify _" what's NOT in it"_, as in any kind of "security verification". Meaning, if you want to hide some code/malware snippet from it on purpose, I assume you'll definitely find a way to do that. And even if not on purpose, it may still happen accidentally.

</comment><comment><USER14> > The tool supports scanning various programming languages including C, C++, > C#, Java, JavaScript, HTML, Python, Objective-C, Go, Rudy, Powershell and > more and includes html, json and text output formats with the default being > an html report similar to the one shown here.

Is Rudy meant to be Ruby?

<comment><USER15> Yes - its a typo. There is a pull request for it already.

[https://github.com/Microsoft/ApplicationInspector/pulls](https://github.com/Microsoft/ApplicationInspector/pulls)

</comment></comment><comment><USER16> I don't see any mention of the languages that it recognizes, but a perusal of some of the JSON files leads me to believe that this handles many different languages. It seems that it's by way of regular expressions, though, not language-specific parsing.

<comment><USER17> Does it support HTML? Can one parse HTML with regex?

<comment><USER18> You can't parse it _properly_ with a Regular Expression, but you can parse it with regex-like systems. However I doubt it is parsing outright - it only has to look for certain keywords and patterns that indicate certain behaviors.

<comment><USER5> Correct. We don't need to parse it per se just look for use of features that are easy to identify like XmlHttpRequest, Json.Parse use etc.

</comment></comment></comment></comment><comment><USER19> I wonder if they could marry this with ILSpy [1]. Basically point it at a compiled program, de-compile it, then analyze the decompiled code to see what it's doing. Might be useful in malware analysis and other areas.

[1]: [https://github.com/icsharpcode/ILSpy](https://github.com/icsharpcode/ILSpy)

</comment><comment><USER20> I'm simultaneously amused and saddened that even apps released by Microsoft('s github organization) don't support white-space in paths.

<comment><USER21> It's a big company! Even people are not that consistent! For one, I'm seeing that the "mono" culture (not sure if pun intended, or not) is going away from there!

</comment></comment><comment><USER22> I'd love to see the generated output of famous programs like grep, curl or chromium. It would give a better idea about what it does.

<comment><USER12> Here you go! [https://gracious-jang-bc0194.netlify.com/](https://gracious- jang-bc0194.netlify.com/)

<comment><USER22> Excellent! Really nice app. Now I understand it a lot better.

</comment></comment></comment><comment><USER5> See [https://github.com/microsoft/ApplicationInspector/wiki/6.-Un...](https://github.com/microsoft/ApplicationInspector/wiki/6.-Understanding- Results) that answers questions on choice of icons and [https://github.com/microsoft/ApplicationInspector/wiki/2.1-F...](https://github.com/microsoft/ApplicationInspector/wiki/2.1-Field:-applies_to-\(languages- support\)) that talks about language support.

</comment><comment><USER23> I could see this as handy when I'm trying to troubleshoot an opaque/proprietary/legacy application. Things like knowing it's talking to environment variables or the registry would be a lot of help drilling down into what it's touching so I know where to look for what's breaking it.

</comment><comment><USER5> Good point. At a minimum it should clearly state that while the tool didn't "find" such a feature it should not be taken as a security reliable result. See [https://github.com/microsoft/ApplicationInspector/wiki/6.-Un...](https://github.com/microsoft/ApplicationInspector/wiki/6.-Understanding- Results)

</comment><comment><USER17> Sounds like builtwith.com for codebases. I wonder if one can run it against all company repos and generate an accurate stackshare.io alternative.

</comment><comment><USER24> Unusable on osx. It fires off 20+ notarization errors on run.

<comment><USER5> Mac Catalina restrictions appear to be the issue which where app launch checks were relaxed for a bit then made more aggressive very recently. We added an issue on the app project site to look into whether the app or just .net core or both need a macOS notice fix but there's a work around discussed here [https://www.cultofmac.com/672576/cant-launch-your-apps-on- ma...](https://www.cultofmac.com/672576/cant-launch-your-apps-on-macos- catalina-heres-the-fix/)

<comment><USER5> Affects .Net Core 2.1, 3.0, 3.1 -not app specific but workaround exists as mentioned and is tracked here [https://github.com/microsoft/ApplicationInspector/issues/123](https://github.com/microsoft/ApplicationInspector/issues/123)

</comment></comment></comment><comment><USER25> What have Ms application Inspector to tell about Ms application Inspector ?

</comment><comment><USER26> One thing I'm not a fan of C# is how often library usually lack bundled code source, while other similar language(eg. Java), you can use "Go to to Definition" on pretty much any third-party library/anything without hassle.

<comment><USER27> This is changing (slowly) for .NET. Nuget packages support something called Source Link [1] and can embed URLs to Github/Bitbucket/Etc.

IDEs like Visual Studio and Rider can download the code on demand and debug step-through.

Tons of popular .NET libs (including the Microsoft ones) already support this.

[1] [https://docs.microsoft.com/en-us/dotnet/standard/library- gui...](https://docs.microsoft.com/en-us/dotnet/standard/library- guidance/sourcelink)</comment></comment>