Ask HN: Review my startup, FleshEatingZipper - One Year Later - <AUTHOR>

Hello everyone! 365 days ago I asked you to check out my startup, FleshEatingZipper: http://news.ycombinator.org/item?id=2194580 (http://flesheatingzipper.com)
I just wanted to let everyone know what we've been up to, how much traffic we've been getting, etc.
The first few months we were so excited getting a few thousand people reading what we were posting and listening to our podcasts. At the end of May we decide to tackle Phoenix Comicon and at the beginning of June we had an article explode at a news aggregator and had almost 30,000 visitors that month.
The traffic dropped down to about 8,000 for the next two month until we were accepted in Google News in the middle of September. September we had 58,000 visitors, October it was 98,000 and November it was 328,000!
This traffic was just to much for our shared hosting account to handle so we bought a server. I work at a data center full time and one of the perks is free colocation/power/bandwidth. We decided to go with nginx and PHP-FPM because of the max connections limitations we read about with Apache.
We did over 1,000 articles and had over 2,500 comments in 2011.
In terms of revenue for 2011 we got paid from Google AdSense $125. We use other ad networks and have been doing campaigns but those have 60 day terms after the campaigns have completed so we didn't see anything else in 2011.
In January we launched our current design and should have a mobile theme soon. The site is WordPress, designed and built internally.
Currently we are averaging about 250,000 visitors a month and preparing for E3 in June. <comment><USER2> Great going. Congrats and all the best moving forward.

> In terms of revenue for 2011 we got paid from Google AdSense $125.

For the whole year 2011? Do you run Google Ads on all the pages? What were your total traffic numbers? Does that tell you anything?

<comment><AUTHOR> Thanks. For the year we had a total of $2,243 in billable ad revenue but since we didn't collect any of it except for Google AdSense, it's not being counted. Every ad company that we use has 60 day terms.

As far as traffic 2011 total traffic was 670,587 unique and 1,013,611 page views. For the longest time we had only 3 ads per page then upped that to 4.

That total revenue is not for just ad impressions but paid placement. On average our CPM for ads is only $0.50.

We could be making more with pop-ups/unders and full page ads but we don't want to be that type of site.

We know nothing about the online advertising game except it feels like we should be making more. Right now we are working with a pretty large ad network to hopefully bring us more ad revenue for 2012. Our goal is to be able to work for the site full time which means at least $15,000/month in ad revenue is needed.

</comment></comment><comment><USER3> Try reaching out to Giant Media (giantmedia.com). They match up viral videos/targeted media ads with demographic-appropriate websites. They can help provide some additional monetization.</comment>


Huawei isn't trustworthy 5G partner, German spy agency says - <AUTHOR> https://www.bloomberg.com/news/articles/2019-03-13/huawei-isn-t-a-trustworthy-5g-partner-german-intelligence-says <comment><USER2> I think there is one reason why western governments are opposed to Huawei systems in their communications networks. Western governments have historically had more trust in the US being a partner they can rely on, which is not the case (yet) for the Chinese.

All governments spy on each other, and they do whatever is necessary for their spying needs, the US, European nations as well as the Chinese. And I bet this includes exploiting Huawei/Cisco/Nokia/Motorolla hardware. Only difference is in this case for Germany: The US is more trusted than the Chinese. Thus the US/Europe get more leeway in these hardware purchases.

<comment><USER3> Western governments have historically been allied with and have had intelligence sharing and cooperation arrangements with the U.S.

There is a general alignment of Western intelligence agencies as a cooperative group against the antagonism of China (and Russia, NK, etc)

It isn't just "everybody spies" \- it's "we are actively engaged in an adversarial relationship together against this other group"

<comment><USER4> In addition, there is a "special" arrangement between 5 western allies called the "five eyes"[1]. Between the five partners, they cover internet backbone infra for much of the world.

[1] [https://en.wikipedia.org/wiki/Five_Eyes](https://en.wikipedia.org/wiki/Five_Eyes)

<comment><USER5> Germany is not part of the Five Eyes alliance.

<comment><USER6> They never claimed Germany was. The wiki link in GP doesn't list Germany as being a part of the five eyes.

<comment><USER5> > They never claimed Germany was.

The article is about Germany.

<comment><USER4> and much of the EU internet traffic, including to/from germany, goes through the UK. I'm not sure why I'm being downvoted for pointing out a relevant fact on US and western allies who share intel and basically have tapped most all of the fiber in the world via legal or illegal methods (per the snowden docs).

<comment><USER5> > and much of the EU internet traffic, including to/from germany, goes through > the UK.

Indeed - and many German citizens who are interested in such topics find this concerning exactly because of Five Eyes.

My comment that Germany is not part of Five Eyes

> > [https://news.ycombinator.com/item?id=19399560](https://news.ycombinator.com/item?id=19399560)

refers to its grandparent

> > [https://news.ycombinator.com/item?id=19398858](https://news.ycombinator.com/item?id=19398858)

which I requote here:

"Western governments have historically been allied with and have had intelligence sharing and cooperation arrangements with the U.S.

There is a general alignment of Western intelligence agencies as a cooperative group against the antagonism of China (and Russia, NK, etc)

It isn't just "everybody spies" \- it's "we are actively engaged in an adversarial relationship together against this other group"".

<comment><USER4> bingo. The BND and NSA work very closely together even if they aren't in FVEY. This is quite well known, but it makes a lot of sense in the face of Russian/NK/Chinese aggressions. As much as our president wants you to not believe, we are stronger together.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Huawei is an interesting case. It normally isn't a problem to operate out of a country like China, but telecommunications infrastructure is sensitive. We are essentially seeing a rare case of differences in political systems having real-world effects on the export of goods. If China had the same relationship to the West as today, but stronger legal protections, this wouldn't be an issue at all, I suspect.

<comment><USER8> also if in the future we actually make cellular standards where encryption isn't demarcated at the tower and instead setup e2e between consumer devices, some risks are mitigated

it's really a shame that with both 4g and 5g standards bodies did not already work on this.

<comment><USER9> > instead setup e2e between consumer devices, some risks are mitigated

Only some, though. The metadata will still be there to be collected, which I understand is more valuable than you'd assume on first glance.

<comment><USER10> Metadata is more than enough: [https://kieranhealy.org/blog/archives/2013/06/09/using- metad...](https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to- find-paul-revere/)

</comment></comment></comment></comment><comment><USER11> Why they are so obssesed with 5g?! One traveling on the Berlin S-Bahn ring receives EDGE mobile connection. Let me guess - the only trustworthy and reliable partner is T-Mobile?

<comment><USER12> It's a new frequency space that can be auctioned off, so they can try to set new rules requiring expansion of coverage and local roaming. So in theory the exact opposite of "the only trustworthy and reliable partner is T-Mobile." Of course none of the triopoly like that proposal, so it's not clear yet whether those new rules will actually be implemented or not.

If it weren't for these political considerations, expanding 3G coverage instead would be cheaper and likely good enough for most applications. Especially the self driving car stuff where 5G is always touted as necessary: if it can't work without constant network connection, it's not safe enough to be deployed on the streets.

<comment><USER11> > So in theory the exact opposite of "the only trustworthy and reliable > partner is T-Mobile."

My last sentence was was /s, obviously.

> Especially the self driving car stuff where 5G is always touted as > necessary:

Germany must the only country where the development of 5G is not motivated by providing better connectivity to the citizens, but by.... the interests of automotive industry. The oligopoly is strong.

</comment></comment></comment><comment><USER13> It's easy to point at Huawei and say 'they are not trustworthy'. The question is, what alternatives are out there and can they deliver?

<comment><USER14> Nokia and Ericsson are the other big 5G vendors. I don't know of any problems in their ability to deliver.

<comment><USER15> Besides both are old companies with solid reputations in two stable democracies.

</comment></comment></comment><comment><USER16> "it would be hard to work with a company that cooperates with its national secret service. "

Doesn't every telecom company cooperate with its home government? I see a lot of doubt cast towards Huawei's behavior, but how about some evidence?

</comment><comment><USER17> > An outright ban on Huawei is seen as legally impossible, but German > officials are looking at tools that would have the same effect.

How can 'tools' with the effect of a ban be legal, when a ban isn't?

<comment><USER18> The usual approach would be to define requirements in a way that are unsuitable for the specific vendor you want to get rid of.

This is more common the other way around, where a government wants a specific company to do a job, but is required to issue a public call for bids. In that case the requirements are just written exactly for that specific company.

</comment></comment><comment><USER19> What about e2e encryption and then you don't have to care about the infrastructure?

</comment><comment><USER20> This is a witch hunt that will undermine confidence in the global economic system. Everything one can accuse Huawei of can be applied against any tech company - and for some with hard evidence and most here know.

This can easily backfire with tech companies being banned and excluded from markets on frivolous grounds without due process in the same way.

It cannot just be some can undermine competition and limit access to markets with scaremongering and wild allegations. If free markets and competition are mere political constructs to benefit a few then the whole system is effectively over.</comment>


What are Go modules and how do I use them? - <AUTHOR> https://talks.godoc.org/github.com/myitcv/talks/2018-08-15-glug-modules/main.slide#1 <comment><USER2> Super clear and THIS is GREAT!</comment>


Postgres to Oracle: please, security test our code - <AUTHOR> http://www.databasesoup.com/2015/08/please-security-test-our-code.html?m=1 <comment><AUTHOR> Attrition.org has done an interesting biography of Oracle CSO Mary Ann Davidson here: [http://attrition.org/security/rant/oracle01/](http://attrition.org/security/rant/oracle01/)

It only goes to 2008, but it really shows nothing has changed! How did this self-admitted "closet-Luddite" become the most important security person within Oracle?</comment>


Project AT&T - 4chan responds - <AUTHOR> http://s6.invisionfree.com/ProjectATT/index.php

<comment><USER3> Worth reading:

[http://z6.invisionfree.com/ProjectATT/index.php?s=c670226f1b...](http://z6.invisionfree.com/ProjectATT/index.php?s=c670226f1b08026510786d310a63f589&showtopic=106)

Edit:

yeah, broken link and the original appears to be gone. Too bad, it was a fairly level headed "calm down and let's see what's really going on" kind of post. Next best post is this:

[http://z6.invisionfree.com/ProjectATT/index.php?showtopic=10...](http://z6.invisionfree.com/ProjectATT/index.php?showtopic=107)

Seems that access is restored for many people...

Edit 2:

What it used to say:

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=

Okay, let's stop and be rational here. And if your stupid ass is too lazy to read this, fuck off and go back to Habbo.

Here is what we know:

1) AT&T customers around the nation cannot access img.4chan.org;

2) AT&T claims that there is a security issue (no further details available to end-users) regarding img.4chan.org that they have contacted Moot about; and

3) Moot is aware of the problem (I emailed him, and I'm sure others have as well).

Someone correct me if I'm wrong, but that's all we know.

I am significantly older than most of you, and I have a law degree. I have significant public relations and marketing experience, and I have the wisdom to see that we should wait before jumping the gun here. Moot is probably shitting bricks right now with the amount of emails he's receiving.

This is essentially a he-said/she-said issue now, and AT&T may be full of shit about the "security issue." But before the hordes of 14-year old boys and their Skype accounts start sending massive amounts of pizzas to AT&T offices, let's wait and see what happens. I suggest we give AT&T the benefit of the doubt and wait to see if Moot responds (assuming there is a legitimate issue between AT&T and 4chan) and if the matter can be resolved that way.

If, after a few days, it is revealed that AT&T is truly "censoring" parts of its customer's Internet experience, then I suggest we work through the media. There are legitimate news outlets that would be interested in hearing about censorship, because the media has long been at odds with any sort of regulation of information.

However, as a personal favor, please stop with the First Amendment shit. You don't know what you're talking about, you sound like idiots, and anyone that knows a bit about the First Amendment is going to laugh when they read your posts... meaning our "cause" loses credibility. And let's face it, despite that censorship issues have the potential to reach much further than 4chan, when the public finds out what /b/ is all about, we're not going to be the media darlings we need to be.

So for the time being, plan. But plan wisely. Don't threaten. Don't physically damage equipment. DDOSs against a Tier1 ISP are about as useful as screen doors on a submarine. Do these things at your own peril, but realize for each retarded action you take in the name of a resistance, every time it fails or gets negative press, you are fucking things up for the rest of us.

Let cooler heads prevail. Think before you act.

BlackMagister

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>=

<comment><USER4> According to this mailing group message it could very well be a security issue: <http://www.merit.edu/mail.archives/nanog/msg19609.html>

That makes a lot more sense than AT&T going out of its way to censor 4chan anyway.

<comment><USER5> 4chan has always been under a DDoS.

</comment></comment></comment><comment><USER6> Man, it must be fun to have computer skills, a ton of free time, and no interesting ideas. Nice logo.

<comment><USER7> I see they went with ole' "glowing marble set in Copperplate eclipsing some kind of quasar." For the client looking for the random Gimp filter.

</comment></comment><comment><USER8> Ok, so I understand that AT&T blocking 4chan could qualify as an acceptable topic for this site, but how is a forum dedicated to pranks against AT&T even remotely Hacker News?

<comment><USER9> If AT&T censoring the internet is an acceptable topic, surely the first organized counter-attack is also hacker news.

<comment><USER8> Umm, no.

AT&T censoring a website was fundamentally wrong. It violates your (as in Americans) constitutional rights to free speech. That is something that is interesting to read and discuss for the HN community.

Sending pizza's to the operational centres of AT&T (which was one of the few topics currently on the site when I first looked) is not, sorry. It's an immature response to a serious problem.

<comment><USER10> people always bring up the free speech issue, here is a newsflash...all those rights you think you have, only apply to the government. Corporations are more or less free to do whatever.

<comment><USER11> Not that black and white - note that telecommunications is often a government- granted (and mandated) monopoly. Some municipalities sign exclusivity deals with certain telecom providers, and certainly spectrum limitations and whatnot as granted by the government reinforces this.

Private companies engaging in censorship runs afoul of the law if the government has a hand in them being there.

</comment></comment></comment></comment></comment><comment><USER12> <http://twitter.com/automeme/status/2866503271>

</comment><comment><USER13> The servers were taken down in response to several weeks of DDOS attacks - <USER2> <http://www.merit.edu/mail.archives/nanog/msg19609.html>

much ado about nothing

<comment><USER14> If the DDOS attacks have been occurring for several weeks, why didn't they take down the servers earlier?

</comment></comment><comment><USER15> I think this is a bad idea... There has to be a better way to fix the situation.

<comment><USER11> Not to mention the last few "evil corporation" scandals have turned out to be a lot tamer than knee-jerk armchair commentators would have us believe.

<comment><USER16> Agreed. I would be willing to bet that 4chan is unblocked within 24 hours. Someone at AT&T did something stupid.

<comment><USER17> Indeed. San Francisco is reporting they're unblocked already. Also, it appears that it was not someone doing something stupid... the most official-looking explanation I've found is here: <http://www.merit.edu/mail.archives/nanog/msg19609.html>

Nutshell: the affected subdomains were getting DDoS'd, and the colo housing the relevant 4chan servers couldn't take it, so AT&T did the colo a favor and started dropping traffic upstream.

EDIT: Aaaand now everything is down.

</comment></comment></comment></comment><comment><USER18> Digging up and cutting fiber is not going to make this situation any better...</comment>


On average, skipping college and investing tuition costs nets a higher return - <AUTHOR> http://erikrood.com/Posts/college_roi_.html <comment><USER2> This is something I'm torn about. On one hand, I agree with this sentiment and wish I would've just gone to a trade school instead of a traditional college. That would've been much more useful than a non-STEM degree.

On the other hand, going to college and getting the chance to explore electives really helped me grow as an individual. Was philosophy and learning to analyze & interpret works of art practical? Not monetarily, no. As far as software jobs are concerned, at least I have _a_ degree, it's better than nothing.

And yet my father started a business with only a highschool education, that makes way more than I would even as a mid level software engineer.

Thankfully my loans were only $20k and I was able to pay them off through the family business. I would not be able to justify this attitude for $50k/year.</comment>


Send money in Gmail - <AUTHOR> https://www.google.com/wallet/send-money/

<comment><USER2> Old news from 2013. ([http://gmailblog.blogspot.com/2013/05/send-money-to- friends-...](http://gmailblog.blogspot.com/2013/05/send-money-to-friends-with- gmail-and.html))

</comment><comment><USER3> Effective 20 November 2013, Google Checkout is shut down and no longer processing payments.

So how can I receive money now? More then people sending via gmail?</comment>


Google has paid Android developers about half of what Apple has - <AUTHOR> https://www.theverge.com/2020/2/4/21121558/google-80-billion-android-developers-apple-155 <comment><USER2> I'm not surprised. I have a Pixel 3 to test stuff with and the quality of the apps just doesn't compare. It seems that Apple customers are just more willing to pay, so they get much better apps. iOS is also far easier to create great apps for - Android app development is an unmitigated disaster in comparison, particularly when it comes to things that are very important in 2020: video and photo capabilities. So not only is it harder to build apps, you make much less money as well if you do. So it's not surprising there aren't many apps worth paying for on there. And on top of that you're also selling to people who statistically have much less money to begin with.

</comment><comment><USER3> >The vast majority of phones on Earth run Android,

Yes but there are _Google_ Android, and Chinese Android. The latter doesn't really contribute anything to Google's ecosystem.

The estimate currently are roughly 2.1B Google Android Vs 700M iPhone excluding China. With China representing around 30% of App Store Revenue.

So we have 2.1B Android with $80B Revenue, and 700M iPhone with $108B Revenue. On a per user spending basis that is Android @ $38.1 and iPhone @ $154.3.

Which is roughly 4.04x difference.

</comment><comment><USER4> This is unsurprising given their positioning in the market. Apple sells exclusively premium devices (for the most part). A huge portion of Android's install base is comprised of budget devices whose users are less likely to spend money on apps.

</comment><comment><USER5> I'm not a fan of these headlines. Android users have bought about half as much as iOS users have; Google and Apple are just intermediaries.

<comment><USER6> Also, Apple hasn't paid Android developers anything, despite the title.

<comment><USER7> If we're being pedantic ... Apple has a few apps in the Google Play Store. So they must have had Android developers on payroll at some point in time.</comment></comment></comment>


Intelligent Tracking Prevention - <AUTHOR> https://webkit.org/blog/7675/intelligent-tracking-prevention/ <comment><USER2> I am surprised how complicated it is, they even use machine learning. It will look like a bug to developers when the third-party cookies will suddenly stop working without obvious reason.

Why don't just block third party cookies except where it is enable by the user? I think 100% of the sites I visit use third-party cookies only for tracking.

And of course this is not enough. Using a combination of an IP address and browser fingerprint allows tracking a user without any cookies.

And websites can still track users if they use a redirect through an analytics website (when a user visits a site for the first time he is redirected to an analytics domain, that redirects the user back adding an identifier to URL).

<comment><USER3> "Self-Destructing Cookies" is an extension for Firefox that automatically deletes cookies 30 seconds after you close the last tab associated with a site, unless you put it on a whitelist.

It is the most sensible and useful policy I have ever seen. Sadly, it can't be done as an extension in the new Firefox model.

<comment><USER4> [https://addons.mozilla.org/en-US/firefox/addon/cookie- autode...](https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/) is compatible with the new add-on model.

<comment><USER5> That one looks great, it even supports the new container tabs with per container whitelists.

</comment></comment></comment></comment><comment><USER6> Unintended consequences of this will be the complete dominance in affiliate and ad networks of major consumer sites like Google, Facebook and Amazon who already own products visited daily. It also means larger focus of all ad networks to aquire consumer sites or buy redirects or hijack users somehow to get their ads to show/track. Ads and addictive sites are going to feed off of this rule.

<comment><USER7> Although your point is valid, currently, Google uses quite a lot of other domains for analytics and tracking than google.com. For analytics, some (unknown to me) things are served from google-analytics.com, and I'm seeing cookies from googlesyndication.com and doubleclick.net as well.

As with many things in ML and NN, the premise of the tech is that it won't be a 100% perfect solution, but it'll hopefully be good enough or better than what you have.

<comment><USER8> _> Google uses quite a lot of other domains for analytics and tracking than google.com_

... for now. It's just a matter of time before analytics and tracking will move. Just like maps has moved to google.com in order for search to also get access to the current location (which is a permission I'd gladly give to maps, but not to the search engine)

<comment><USER9> They can do that, but it's a delicate choice: if google.com gets flagged as a "tracker domain", the google.com cookies will be deleted after 30 days of no interaction with google.com.

Probably not an issue for most of the users, but for those who don't use it very often, they'd get logged out. Not sure Google wants that.

<comment> fake-name I think the original point here is that almost everyone interacts with google.com daily.

As such, if a company with a non-add business attaches a tracking business to their existing domains, they can circumvent the deletion policies.

</comment></comment></comment></comment></comment><comment><USER10> I get why this needs to exist, but it feels more complicated than it should be and that sort of "magical" decision that's based on ML is going to confuse both web developers and web users. It might be worth it, but I don't think it is just yet.

On a side note though, it seems Apple is doubling down on making decisions for its users. This is one example, another is do not disturb when driving. These sort of features make a lot of assumption and use complex logic to decide for users, even when the users don't need that. I think that's concerning.

<comment><USER11> Both of these things can be turned off in settings and DNDWD will ask you if you'd like to enable it.

<comment><USER12> Yeah, these aren't forced decisions. The driving mode is opt-in the first time.

</comment></comment></comment><comment><USER13> Why is "cookies can't be used in 3rd-party context" not turned on from day 0?

Right now isn't it a cat and mouse game of holding many domains/subdomains, and passing the cookie flag across them. It seems technically possible to cancel out the protections of ITP. However, deciding cookies can never be used outside of 3rd party context may mean I have to make some additional logins to services from time to time, but have much better tracking protection.

Is my assessment faulty?

<comment><USER14> > Why is "cookies can't be used in 3rd-party context" not turned on from day > 0?

It's been the long-standing default of Safari to block 3rd-party cookies. As is described in the excellent post this links to, there is some functionality that 3rd-party cookies enable that can be beneficial. They use single-sign-on as an example.

<comment><USER2> Single-sign on can be implemented without third-party cookies using only redirects. That is how OpenId and OAuth work.

But social network widgets (Like buttons, comment form) would break without third-party cookies.

<comment><USER15> If I understand correctly, "Single sign-on" means that when you sign in at one site, you're _automatically_ signed in at others. Like when you sign in to Gmail, you get logged in on YouTube without any extra clicks.

OAuth is typically a user-initiated action, like "Sign in with GitHub" or "Sign in with your domain" ([https://indieweb.org/IndieAuthProtocol](https://indieweb.org/IndieAuthProtocol)).

Though I think SSO _should_ be possible with OAuth — maybe with a hidden iframe that does the auth process, or something with CORS requests… Or maybe a custom redirect-based protocol would be better.

<comment><USER2> OAuth can be modified so that it would not require any user action. When user visits a site, he gets redirected to the authorisation domain that checks whether the user is logged in and makes a redirect back to the original site, adding authorisation result to URL.

</comment></comment></comment></comment></comment><comment><USER16> The untold story here (that is, however, indirectly acknowledged by Brave) is that user tracking is required by websites to prevent being completely defrauded by ad providers / advertisers being defrauded by click bot farms. Without providing viable alternative incentives, this will just move the ad driven part of the web into closed networks (Twitter/FB) where everything is single domain.

Is this really the intended outcome?

(It's nice to see Brave have an effect, though.)

<comment><USER17> > user tracking is required by websites to prevent being completely defrauded > by ad providers / advertisers being defrauded by click bot farms.

Maybe don't pay for clicks, only pay for sales.

<comment><USER18> How would you keep track of the sales without cookies? Most people don't buy on the first visit.

<comment><USER17> Unless I'm misunderstanding, the technology described in the article is designed to fight against cross-site tracking (i.e. following users all over the internet to different sites)

I suspect few users would object to a single web property remembering them across multiple visits.

<comment><USER18> So you'll have to rely on the webshop to keep track of purchases? I'd rather have a third party involved that has to keep both the publisher and the advertiser happy.

</comment></comment></comment></comment></comment><comment><USER19> I'm running a fairly old browser here, I have the ability to set when to accept cookies/third party cookies and which sites to whitelist and to set the retain policy whatever I wish to. Also, I can add extensions like Self Destructing Cookies on a whim.

To me it looks more like Overengineered Tracking Prevention to be able to shovel in 'Machine Learning Classifier' for buzzword compliance.

<comment><USER20> You can, but are you better than the classifier at actually doing? Have you done it for every web site you visited today?

Besides, there is some value in getting widespread blocking. When you're the only one who blocks, that's a signal. When Apple's new doodah blocks mostly- the-right-thing for 10% of the users, that's quite different. You get to be part of a crowd.

<comment><USER19> I would think so, yes, mainly because I don't have to take advertisers into consideration. And I can do a lot more for my browsing experience blocking wise, much much more.

Invalidation is hard. Once you accept you have to tread down the road of accepting and deleting cookies and local storage I see no reason to wait 30 days. Why not purge them right on (tab)closing?. If you really care about privacy that is. Which could have been set to be default on the next update btw.

<comment><USER21> My browsers are set to purge all cookies upon exit. And I typically exit at least daily.

<comment><USER20> Then you log in to HN again, which enables HN to tie your new cookie to your old cookies and tell all its advertising and tracking partners.

HN has no such partners, of course. But many other sites do, and correlate cookies in order to tie devices together.

</comment></comment></comment></comment></comment><comment><USER18> What prevents a tracking script to set a third party cookie first and then set a first party cookie that references the third party cookie. And when the script notices the third party cookie is gone, it sets it again on the next visit? With enough websites using it, you would only lose a couple of visits.

<comment><USER22> Cookies are called third party based on a context in which they are sent. A cookie itself is not third or first party, it can act as both depending on this context.

<comment><USER18> Yes, but only one of them is removed after a day.

</comment></comment></comment><comment><USER23> I have so many questions that I'm sure will be cleared up over time.

I am very happy to hear this "classification" happens on-device. I am curious how opaque it is. I assume, like the rest of WebKit the classifier is open source? In Safari, both desktop and mobile, is there a way to see which domains/cookies are blocked/purged or what the time remaining on them is (assuming I don't revisit the page)?

Also, I assume this can easily be beaten be smart ad networks. "Hey, publisher, just use our JS snippet which loads your first-party cookie we may have set previously and then loads a JS URL with that identifier as a query param in the URL along with other fingerprinting info, and we may set that first-party cookie after load too."

I would personally love the option to not send any third party cookies not on the same domain as the frame (or maybe an opt-in) on a per-site basis as I can only see it breaking social logins and other lazily-dev'd items like comment board integration (most SSO uses redirects anyways). Surely if a website wanted to offer its own domain's cookie store, it could (just like you can with local storage).

</comment><comment><USER24> You know, we put a "padlock" on the address-line for a reason. Why can't we just make it easy for anyone to inspect the persistent state associated with a website. Websites already make site-maps to tell search engines how they work, why can't websites tell end-users what data they create and use with your browser? Treat them like capabilities and let the user decide if your website gets to treat your localStorage as a stalking ground of your behavior or if they'll have to work even harder.

This kind of contract can do in both ways. The user can set up a permission set to give to the website. If the website balks then the user can go somewhere else or negotiate with their own principles how much they want to be "the product."

<comment><USER25> Always wanted something like what you suggested. It would be fair to the users, hence why it's not implemented (lol).

</comment></comment><comment><USER26> I theory cookies are great. They put the choice on the user to be remembered as the same person by either sending the cookie or not. The problem is that cookies were designed intransparently leading to them being percieved as non- consensual tracking rather than as the consensual mechanism that puts the user in control they could have been. These solution feel like a makeshift stopgap workaround when I think the actual solution involves creating a way to put the user back in active control if and how a site remembers you.

</comment><comment><USER27> _A machine learning model is used to classify which top privately-controlled domains have the ability to track the user cross-site, based on the collected statistics. Out of the various statistics collected, three vectors turned out to have strong signal for classification based on current tracking practices: subresource under number of unique domains, sub frame under number of unique domains, and number of unique domains redirected to._

What's preventing ad networks (or whoever this is meant to protect against) from gaming this system?

<comment><USER17> Presumably the model will be updated to adapt to a changing threat environment from ad networks.

</comment></comment><comment><USER28> What's the difference between this and the EFF's Privacy Badger? It's not a complaint, as I realise the EFF wants browsers to adopt such technology natively.

<comment><USER26> I haven't been able to find such an explicit explanation of he policies Privacy Badger uses. It is all very vague machine lerning talk.

I would like to see a clearer comparison as well.

<comment><USER15> Privacy Badger uses simple heuristics like cookie entropy estimation, domain prevalence (how many other domains embed that domain's stuff): [https://github.com/EFForg/privacybadger/blob/master/src/js/h...](https://github.com/EFForg/privacybadger/blob/master/src/js/heuristicblocking.js)

and static block lists [https://www.eff.org/files/cookieblocklist_new.txt](https://www.eff.org/files/cookieblocklist_new.txt)

<comment><USER28> So this new WebKit one is more complex?

<comment><USER15> Of course. They shoved goddamn _machine learning_ into the WebKit one.

</comment></comment></comment></comment></comment><comment><USER29> Does this affect Google analytics?

<comment><USER30> This is my main problem. GA loads a script that sets first party cookies.

I really want Safari to have easy integration points to make a good cookie whitelist interaction using plugins.

Sure it's painful the first few days having to gradually build up that list, but like little snitch, once you're passed that stage, you just set it to say no to any new domains setting cookies.

Then users could cooperate to build cookie whitelists...

<comment><USER31> > This is my main problem. GA loads a script that sets first party cookies.

Only when scripting is enabled.

</comment></comment></comment><comment><USER32> Does anyone know if this break/affect affiliate networks? They use third-party cookies, I think. Any purchases after more than 24h since the click cannot be attributed to it.

</comment><comment><USER33> I've had third party cookies disabled since > 5 years and never had a real problem. I'm not convinced that such a complicated solution is necessary.

</comment><comment><USER34> I already disable 3rd party cookies, its always a good idea, believe me.

Why I say that? 1\. No retargeting adv. 2\. No site-to-site tracking 3\. Less chances of identifying you uniquely.

</comment><comment><USER35> So is this a personal suggestionby a developer in the webkit community? I see nothing that says this has landed anywhere?</comment>


Hub for city/state data portals - <AUTHOR> https://www.data.gov/open-gov/

<comment><AUTHOR> There's no need to go posting every city portal to HN individually folks, they're already organized into maps and lists.</comment>


Secrets of the Glasgow Haskell Compiler Inliner (1999) [pdf] - <AUTHOR> https://www.microsoft.com/en-us/research/wp-content/uploads/2002/07/inline.pdf <comment><USER2> Also worth checking out is this [https://www.youtube.com/watch?v=uR_VzYxvbxg](https://www.youtube.com/watch?v=uR_VzYxvbxg) conference talk by Simon Peyton Jones discussing the basic constructs of GHC core and how they affect inlining and optimisation

<comment><USER3> SPJ must be the bounciest computing-guy-over-30 I've ever encountered. Always a refreshing pleasure to watch any of his performances =)

<comment><USER4> His enthusiasm is truly contagious, somewhat reminiscent of how excited Feynman could make you feel about science.

<comment><USER5> Yes, i was lucky enough to be in the audience at St Andrews in about 1986 when he came to talk to us about parallel combinator reduction, G-machines and Alice.

Amazing enthusiasm and application. Amazing guy.

</comment></comment></comment></comment><comment><USER6> I still think it is a pity that GHC isn't much better documented. It could be a _huge_ education and research platform, with a much wider reach than the small group currently versed in GHC internals.

<comment><USER7> It is a huge education and research platform. There are many many papers every year developing new ideas in GHC. Look at the massive cottage industry in Haskell language extensions implemented in GHC.

</comment></comment><comment><USER8> > _A major issue for any compiler, especially for one that inlines heavily, is > name capture_

What? If you inline just one block of code in a million lines of code (i.e. you "inline with the dainty lightness of a frolicking fairy"), and that situation is wrong due to a name capture, you have a bug, which could stop the show.

<comment><USER9> In section 3.1 they say it is a performance issue.</comment></comment>


What Happens at a Firearms Training for Teachers - <AUTHOR> http://bostonreview.net/politics-education-opportunity/thomas-baxter-teachers-guns <comment><USER2> "hollow points, rounds designed to swell upon impact to ensure maximum harm."

My understanding is that hollow points were designed to prevent over- penetration rather than to harm more. How does the author know it was designed to "ensure maximum harm"? I can't help but think it was intentional.

Edit: Of course now that I read the rest of the article after initially writing this comment, I see that quote is also highlighted in a text box (side note, what is that called when they do that?).

<comment><USER3> They're designed to prevent going straight through by expanding inside of soft tissues. One of the effects of that is increased tissue damage. So they maybe they weren't "designed to cause maximum harm" but that's certainly one of the effects over a full metal jacket round.

<comment><USER4> Yes but ammunition manufacturers often advertise the enhanced lethality of their hollowpoints. It's pretty clear that it's seen as a benefit.

<comment><USER3> I should have been more clear. That was the point I was trying to make. Anyone I've talked to about using firearms for home defense likes hollow points because of the damage they do to a home invader, not how much safer the rounds are because they stop.

<comment><USER4> Well, over-penetration is definitely an important concern in a home defense situation. I remember reading a case about a man that shot an intruder with a .44 Mag, the round went through the robber, through his house, across the street to another house where it hit his neighbor.

</comment></comment></comment></comment></comment><comment><USER5> The hand-wringing by the author in this piece is off the charts. If they're this conflicted about carrying, they shouldn't do it. Carrying is a strictly voluntary practice, and I'm glad to see Ohio is enacting (IMHO sensible) legislation allowing it for teachers _who want to participate_.

<comment><USER6> Based on my experience, this sounds like someone who takes it seriously, but isn't happy about feeling the need to carry. That doesn't make them less effective or safe, it's an internal struggle.

I carry every day, and have for over a decade now. It changes your mindset (for the better), and makes you confront your own feelings ahead of time.

</comment></comment><comment><USER7> Unless they train frequently I can't imagine this working well. When I was at military we did shooting exercises at targets. This was easy but as soon as there was an exercise where the situation is messy or you are under pressure things fall apart quickly. There were situations where our group would have killed each other instead of the attackers. You need a lot of training to do that right.

I don't know how things develop at a school shooting but I wouldn't be too surprised if people ended up shooting each other or the wrong people. I hope the organizers have thought this really through.

<comment><USER8> Great feedback, except for the part about the organizers, who obviously have not.

More guns is not the solution to problems with guns.

Improving access to medicine, economic stability and programs that help empower educators and students to build safer spaces may be though.

In my school all the kids knew who was having a hard time and who was isolated, it would be better to reach out to these students rather than shoot at them. Students are going to school to learn and we're teaching and modeling militarism and violence.

The reason, my guess - doesn't make headlines, isn't good for bottom line.

</comment></comment><comment><USER9> "In late fall, an anonymous threat of school violence is shared on social media. It is improbable, but all threats must be handled as emergencies. The staff reacts with practiced precision, preparing students to evacuate. I begin alerting parents and working with the police."

...

"Jason lays out the story, how he learned belatedly that some students in his class had planned to leave early that day for a party in the woods. Jason, who had thought they were his friends, had not been told. When Jason realized he had been left out, he gave in to anger and posted a threat, hoping to ruin the other students' fun. It was irrational, as most teenage decisions are.

In minutes, our conversation is over, and I watch as he is handcuffed and stuffed into the back of a cruiser. The deputies try to hold back community members on the opposite sidewalk. Other policemen are already at the courthouse to obtain a warrant to search his family's property. The married campers, I think as the cars pull away."

</comment><comment><USER10> "But now it was no longer a theoretical question of protecting kids at any cost. The faceless target at the shooting range, so absurd in its proportions, had a face: Jason, whom I wanted so badly to help."

Yeah, I don't know. I feel that we shouldn't be training civilians in the psychological dehumanization necessary to kill someone. Especially students they know. We know this kind of mindset is damaging to the psyche. Also, has there ever been a case where a teacher successfully shot a school shooter before any innocents could be harmed? America has so many school shootings, we'd have data... such unfortunate data.

<comment><USER2> > has there ever been a case where a teacher successfully shot a school > shooter before any innocents could be harmed?

I don't think there ever will be. I would probably not shoot a kid that I only _suspect_ would shoot someone. I doubt a teacher would either.

(Also, is the kid a "school shooter" if he/she did not harm anyone?)

There has been a case where a principal got a gun from his car and stopped a school shooter though.

<comment><USER10> Could you link me the case? I'm pretty curious about it. The cases I've seen have been when the school shooter was already largely finished killing people.

<comment><USER2> I had to do an internet search. It was Pearl High School, and it looks like the principal only stopped the subject from leaving the school grounds. Who knows if the subject would have killed more elsewhere, the subject had already killed that day even before going to the school.

That's the thing, we'll never know how many shooting deaths were prevented by "a good guy with a gun", because we don't know if more people would have been shot and died if the shooter wasn't stopped.

</comment></comment></comment></comment><comment><USER11> The USA is the only country where mass shootings happen regularly, I wonder what every other country in the world does differently?

[https://www.washingtonpost.com/graphics/2017/world/mass- shoo...](https://www.washingtonpost.com/graphics/2017/world/mass-shootings)

<comment><USER12> Uh, no it's not. You think they happen less often in Russia? Syria? Venezuela?

<comment><USER13> > You think they happen less often in Russia? Syria? Venezuela?

"Mass Shootings", yes. "Shoot outs", no.

Venezuela, most shooting homicides are to cover up a crime, such as petty theft. These are inherently not "mass".

Syria is in active civil war, these are not "mass shootings" as much as battles. They're also more shootings to achieve a political end (not to create terror towards a political end) or for the personal vendettas of the shooter.

<comment><USER14> Mass is simply defined as three or more people getting shot.

<comment><USER15> I mean we can play semantics but the lone wolf shooter who shoots (many, many) people for no other reason than to shoot them is a problem almost entirely uniquely American.

<comment><USER16> But the lone wolf killer who kills many people for no other reason than to kill them is not.

</comment></comment></comment></comment></comment></comment><comment><USER17> While there is valid critisism to be leveled here, the elitist, yet doom- filled language of the author does more to inflame than to inform, dispite the detail. I dislike the militarization of police. I think modern traning instills cowardace and shooting first and thinking later, and it condones murder in the line of duty. But to paint a voluntary action, that the author mentions nothing of fighting against as evil, is disingenous at best, and manipulative as I read it.</comment>


Who should play Steve Jobs in a biopic?  - <AUTHOR> http://www.itworld.com/mobile-wireless/227357/who-should-play-steve-jobs-biopic

<comment><USER2> What about somebody who already played the role? <http://www.youtube.com/watch?v=TIClAanU7Os>

</comment><comment><USER3> Noah Wyle hands down!</comment>


Apex Electronics – Los Angeles, California – Atlas Obscura - <AUTHOR> https://www.atlasobscura.com/places/apex-electronics <comment><USER2> Thanks. Now I'm checking for weekend deals on airfare to LAX.</comment>


Google Patenting Electronic Tattoo - <AUTHOR> http://news.kron4.com/news/google-patenting-electronic-tatoo/

<comment><USER2> I don't know what's worse - the patent application or the patent illustration.

<comment><AUTHOR> I'm I the only one that is a little weirded out by this?</comment></comment>


Air India's Delhi-SF flight now the world's longest nonstop flight - <AUTHOR> http://toi.in/Pqi9ea/a18ag <comment><AUTHOR> Despite the route being longer, the flight took almost two hours less thanks to tailwinds — winds that blow in the same direction as an aircraft and thus make it go faster.

Flights across the world are doing this but what is fascinating is that how much important is the collaboration of science and engineering.</comment>


Mac vs PC: Does it matter anymore? - <AUTHOR> http://broadcast.oreilly.com/2008/08/mac-vs-pc-does-it-matter-anymo.html

<comment><USER2> I think it still does. I use both a mac and a pc. I tend to spend a chunk of time inside a browser. Desktop work on the PC is Outlook and Excel. Desktop work on a mac is mostly spent inside Textmate and a shell. All computing/web hosting is done virtually. I can't wait to get a mac from work so that I don't have to use the PC. Now that is personal preference, but IMO the experience on your host machine does make a difference, regardless of your preference.

</comment><comment><USER3> _Is Mac vs. PC becoming irrelevant because of the maturing of the internet as a platform and cloud computing?_

What I find very interesting about this is the possibility that it cuts both ways for Apple. If the two are interchangeable, you can buy based on price and features, which can be an advantage for Windows, since there are many manufacturers who can offer a larger variety of form factors and feature combinations.

But the flip side of that proposition is that if there is no Windows lock-in forcing consumers to buy Windows, so they can also choose Apple based on good design, Apple branding, the iPod halo effect, and perceived security.

Personally, I think that there is a big difference between saying that there are no factors forcing consumers to purchase one or the others and saying that the differences between them don't matter any more.

<comment><USER4> _Perceived_ security? How many hundred thousand new pieces of malware for the mac this year again?

<comment><USER3> An astronomer, a physicist and a mathematician are on a train in Scotland. The astronomer looks out of the window, sees a black sheep standing in a field, and remarks, "How odd. Scottish sheep are black." "No, no, no!" says the physicist. "Only some Scottish sheep are black." The mathematician rolls his eyes at his companions' muddled thinking and says, "In Scotland, there is at least one field, containing at least one sheep, at least one side of which appears black from here."

<http://en.wikipedia.org/wiki/Mathematical_joke>

<comment><USER4> I was referencing effective security (what your chances are of contracting something _bad_ ), not theoretical security (how inherently secure the system is or isn't). You're effectively safer on a mac than Windows regardless of the design and architecture. It's just a fact that you have orders of magnitude less malware on the mac.

So saying macs have "perceivably" better (effective) security than Windows is a bit like saying white is perceivably brighter than black. Technically true, but it sounds a tad dishonest to me (or maybe he was just talking about theoretical security).

<comment><USER5> Yes, but you should still take the SAME basic security precautions on both platforms. And if you do so, you are probably just as safe on Vista, and maybe safer. The biggest security risk on the MAC is a false sense of security. I don't know how many people have told me, "I have a Mac, I can't possibly get anything bad!"

</comment></comment></comment></comment></comment><comment><USER6> It totally matters. Just ask any Mac or Linux diehard. Personally, I use _all three_ of the primary operating systems: Windows XP, Mac OSX and Linux (Ubuntu in this case). I have separate uses for each and can't imagine getting rid of any of them.

<comment><USER7> I'm curious what you use Windows for. The only things I can imagine myself using Windows for are gaming or testing in IE.

<comment><USER8> Windows seems to work better as a media center PC. Streaming video to an 360 or a PS3 is really easy to setup with Windows and getting the hardware / codec's to work is simple.

Note: I have heard that Linux is getting better for this stuff but windows is cheep enough that I don't really care.

<comment><USER9> I use Connect360 (<http://www.nullriver.com/products/connect360>) for OSX->360 and I couldn't be happier. The only annoyance is that it won't stream drm'd content from the itunes store. I think that SUCKS. Otherwise, it couldn't be easier to use and it's quick and clean.

No connection to them other than I'm a happy customer ;)

<comment><USER8> Yep, it almost works but that just means it's only slightly broken.

<comment><USER9> My response has simply been: don't buy DRM'd content. Works 100% of the time ;)

<comment><USER8> Are there any legal options to buy non DRM'd Blu-ray content? I mean new 1080p movies?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Even if the Internet is the "killer app", it still matters how you get there. Is your preferred client available on the platform? Does it work well on that platform?

My web browser, E-mail client and terminal of choice, for instance, are not available on Windows; and no, I'm not using Apple's Safari or Terminal. So when I pull up these applications, I'm seeing what is (to me) a superior Internet experience. Even Firefox on Windows, or PuTTY, just don't quite deliver what I like most.

And cross-platform applications are still platform-dependent. For instance, I love Thunderbird on Linux...it works well. On the Mac, however, despite using Thunderbird for months, it always felt a little clunky (e.g. emulated UI appearance, doing everything itself instead of integrating with OS services such as Keychain). In the end, the combination of platform and application made Apple's Mail more useful to me.

<comment><USER11> That is by definition a very niche problem.

Apart from running each other's proprietary browsers, there is no reason not to make any browser with enough of a following to determine machine choice, available on any platform.

Normally, the reason an 'app of choice' wouldn't be available is obscurity. The point here is that the only app that matters now is the browser & maybe another handful.

Fewer chances for an obscure killer app to kill the sale because all your obscure apps are online. If all you need to do is make sure that all important browsers are available on your platform, it's doable even if it's chasing down browsers with less then .01% of users.

</comment></comment><comment><USER12> Mac vs PC, not really. OS X vs Windows, totally.

</comment><comment><USER13> Only in so much as Macs are popular enough now that I'm almost never forced to use a PC. On the (thankfully) rare occasions when I am, then yes. It matters a great deal.

</comment><comment><USER5> I cant help but to wonder if this author knows what he is talking about. "Mac Vs. PC??? Does he not realize that Mac (Apple Macintosh) is a brand of PC (Personal Computer)?

</comment><comment><USER14> rather than get my pc with xp out of my briefcase, i picked up my wifes mac air and with outlook web access i can grab email and with mionews.com i can read friendfeed and news. biggest difference left is instant on...and of course IM which requires a thick client to be good.

</comment><comment><USER15> Sure it does. I prefer the Mac over a PC. Windows generally treat the user like an idiot (you have unused icons on your desktop!!) while the Mac tends to be a little more user friendly. Sure I have a PC as well, I don't know of a good alternative to EAC for ripping a perfect copy of a CD. And playing games on the PC is great too, not to mention the hardware is more often than not a lot cheaper. But I've been a Mac User since 1984 and haven't felt any need to stop using one. I like the Mac philosophy, and Windows generally erks me to no end. My newest Mac (a MacBook) runs Windows XP on a partition, which is pretty nice, so I get both OS's on one machine. No more Dells from Hell for me. Knowing the average reader on this site, this comment will probably get voted down to about a -15, because I don't trumpet the superiority of Linux.

<comment><USER16> There are easily as many Mac users on HN as there are Linux users. If you're getting voted down it's because you say things like this: _Windows generally treat the user like an idiot (you have unused icons on your desktop!!)_ Never mind the poor grammar and complete non-sequitur, it takes all of two seconds to remove those icons. Just delete them and find something more substantial to complain about.</comment></comment>


Fedora 26 released - <AUTHOR> https://fedoramagazine.org/fedora-26-is-here/ <comment><USER2> I am mainly a macOS user, but I keep around a Dell workstation for work that needs a lot of memory or cores. After years of primarily running Debian and Ubuntu, I switched the machine to Fedora 25 and upgraded to Fedora 26 during the beta cycle.

I was surprised how good Fedora is these days. The GNOME desktop is buttery smooth with Wayland and the Nouveau drivers on the relatively old Quadro that the machine has. Audio and suspend/resume worked out-of-the-box without any problems. Upgrades are very fast thanks to DNF and delta RPMs. Software also seems to get minor release updates within a release (e.g., I had some vim updates).

The Fedora installer also put / on a separate btrfs subvolume as it should (Ubuntu didn't do that in 16.04, not sure if they fixed that).

Great work Fedora folks!

<comment><USER3> Did they fix the copy-paste issues between application with wayland in Fedora 26 (particular between terminal and the rest of the world)? But maybe that is a more of request for the GNOME guys...

<comment><USER4> Just tested copy and pasting on a fresh Fedora 26 install between gnome- terminal, gedit and Firefox: All directions worked fine :)

<comment><USER3> Nice. I had to move back to Xorg just because of that in 25. Time for an upgrade I guess :)

</comment></comment></comment></comment><comment><USER5> I've been a Ubuntu user for years, but I've just read the Fedora 26 announcement and followed the link through to Gnome 3.24 release notes ([https://help.gnome.org/misc/release- notes/3.24/](https://help.gnome.org/misc/release-notes/3.24/)). The 3rd headlighting major feature of this is "New Recipes Application". One word: Sold! I've been dreaming of the day Linux DE/WM got this core feature!

I think we can safely say 2017 will indeed be the year of Linux desktop, we got there, we've made it! (there is also minor footnotes for niche things like file managers, calendar and gfx config, if that's your thing)

<comment><USER6> There was me thinking it was some app configuration installation tool

</comment></comment><comment><USER7> Fedora has been great lately. QA is so much better than other distros. Things "just work".

<comment><USER8> Agreed. I readopted Fedora as my distro of choice around 19 and haven't looked back.

<comment><USER9> I've been using Fedora since they forked from RedHat for the simple reason that clicking "Next" through the installer or mashing F12 always did the right thing by default.

Ubuntu and Debian, by comparison, would always ask stupid questions that had even dumber defaults. Nothing would ever work unless you went out of your way to look things up.

The Fedora team has done a really great job of keeping the distribution coherent and functional even though they've fully embraced the "move fast and break things" mentality.

The only down-side to Fedora is they iterate really quickly and there's no LTS option, as that's what RedHat is for, but if you can turn over your installations on a regular basis (e.g. cloud servers) it's not really a big deal.

<comment><USER10> They didn't fork, RH just rebranded it.

<comment><USER9> Fedora is not identical to RedHat. It's more of a proving ground for new things that may or may not make their way back into RedHat Enterprise Linux.

It's not a simple rebrand. Fedora Core 1 took what was staged for RedHat 10 and packaged it with a different license and sent it off in a different direction.

</comment></comment></comment></comment></comment><comment><USER11> I was a bit cynical when GNOME started writing new 'modern' desktop apps. It seemed like a lot of wasted effort chasing Windows/Mac. Who really needs a native desktop maps app?

But I actually really like the new apps they've put together. They're simple, clean, and lightweight. I'm a bit surprised that they're made with GTK.

Still hate "hot corners," though.

<comment><USER12> I do agree about hot corners m.

Have used it for long time? It is really buggy. After awhile it literally slows down. I keep my workstation open for at 2 days and after 7,8 hours it gets slower and slower m.

And sometimes it crashes badly. That should not happen with desktop environment.

<comment><USER13> Do you use extensions? I've experienced this (in Fedora 21 to 23) but since I stopped using extensions, I haven't had a single crash. I usually run one session on the laptop for 5 days straight.

<comment><USER12> I am not going to use gnome with out extensions . Never ever ;)

</comment></comment></comment></comment><comment> mickael-kerjean I saw some articles saying fedora 26 might land with fractional scaling for Hdpi screen. Any news regarding this? if it lands somewhere is there any way to know about it? I'll be very keen to switch back to Linux when my main laptop will have good support for this

<comment><USER14> Gnome 3 has been dpi independent from day 0, so what are you talking about?

<comment><USER15> DPI independent, but requires whole number scaling (1x, 2x, not 1.5x)

<comment><USER16> And WINE still won't scale.

I'll buy a Chuwi HiDPI laptop for any developer who can make HiDPI on Linux suck less.

</comment></comment></comment></comment><comment><USER17> Everyone is praising GNOME here. Am I the only one who thinks that it's not polished enough? I'm using it on my laptop and it kind of works most of the time. But there are occasional bugs arising here and there. I even sometimes think that I'm the first user otherwise how come nobody noticed those (sometimes very obvious) bugs. If 26 isn't fixing them, apparently I'll have to move back to the Cinnamon spin.

<comment><USER18> I think GNOME 3 has come a long way but years later I'm _still_ bothered by their killing type-ahead navigation in the file dialog and replacing it with search -- however useful searching may be (and despite recent improvements), it slows me down greatly, and often leads to mistakes, when I know where something is and simply want to _navigate_ to it.

Plenty of discussion about this [0] [1] but the GNOME devs don't want it back, for various reasions.

Ubuntu has always patched it back in, but it looks like they will drop it in 17.10 if nobody steps up to maintain the patch [2].

[0] [https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/1164...](https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/1164016)

[1] [https://bugzilla.gnome.org/show_bug.cgi?id=721968](https://bugzilla.gnome.org/show_bug.cgi?id=721968)

[2] [https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/1666...](https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/1666681)

</comment></comment><comment><USER19> I switched away from Ubuntu and to Fedora quite a few cycles ago because at the time they supported systemd by default and I wanted specifically to use systemd-nspawn. I found that it was a very solid and stable GNOME 3 distribution and that it had the best implementation of GNOME 3 between it and Ubuntu GNOME.

Now that Ubuntu is going to switch to GNOME I might eventually switch back but idk yet.

The one gripe I have with fedora is that dnf is much slower than apt.

<comment><USER20> There's (supposedly) a C version being created, but it's a pain to keep up to date with its progress.

[http://dnf.baseurl.org/2016/02/24/dnf-into-c-initiative- star...](http://dnf.baseurl.org/2016/02/24/dnf-into-c-initiative-started/)

</comment></comment><comment><USER21> The best part of fedora 26 is built in f.lux /redshift. No need to install or setup third party apps. Just that feature makes it worth it

<comment><USER22> Man its annoying that this kind of stuff is specific to the DE not OS.

I find XFCE to be perfect for my workflow but would love this utility.

<comment><USER23> Doesn't Redshift work for you? It's not GNOME specific.

[https://fedoramagazine.org/safe-eyes- redshift/](https://fedoramagazine.org/safe-eyes-redshift/)

</comment></comment></comment><comment><USER24> So what's the Linux remote desktop story these days? It seems like modern versions of GNOME running on Wayland don't support VNC?

<comment><USER25> There is an RDP backend for Wayland: [https://241931348f64b1d1.wordpress.com/2016/02/12/waylands-r...](https://241931348f64b1d1.wordpress.com/2016/02/12/waylands- rdp-backend/)

There is a SPICE backend: [https://github.com/ein-shved/compositor- spice](https://github.com/ein-shved/compositor-spice)

There is the Samsung effort Wayland Over Wire (WOW): [https://blogs.s-osg.org/wow-wayland-over-wire/](https://blogs.s-osg.org/wow- wayland-over-wire/)

Apparantly, the Pipewire effort to make a high performance, low latency audio/video server will address remote display somehow too: [https://blogs.gnome.org/uraeus/2017/06/20/fedora- workstation...](https://blogs.gnome.org/uraeus/2017/06/20/fedora- workstation-26-and-beyond/#comment-6906)

</comment></comment><comment><USER26> Congratulations Fedora!

Everyone is praising the GNOME (default) edition. Does anyone use the KDE spin? Also, how are Fedora version upgrades nowadays? I'm trying to decide between KDE neon and Fedora.

<comment><USER27> I've used the KDE spin since GNOME 3 came out, and I love it. I wouldn't dream of going back.

<comment><USER28> I guess this means it now gets enough attention? Last I tried (n years ago) it felt like a second class citizen.

</comment></comment></comment><comment><USER29> I love Fedora 25, but according to this thread[1], Firefox doesn't work out of the box in Fedora 26? Seems like a big oversight...

[https://www.reddit.com/r/linux/comments/6mjb7j/fedora_26_tor...](https://www.reddit.com/r/linux/comments/6mjb7j/fedora_26_torrents_released/dk284lr/)

<comment><USER30> I haven't had a single issue with Firefox (54) out of the box. I know that some add-ons can break the multi-process windows feature, but out of the box has been fine, both with clean VirtualBox installs and bare-metal desktop installs.

</comment></comment><comment><USER31> Still no Wayland with Nvidia drivers. Yes, I have read perhaps too much about GBM/EGLStream debate, but right now I am out of luck with my GTX1080 :(

(And, frankly, Wayland guys are wrong and Nvidia is right.)

<comment><USER32> To the parenthetical part of your post: I thought Wayland and NVidia sorted out their differences several months ago and agreed to write a new protocol that addressed the valid concerns of both parties.

</comment></comment><comment><USER33> Been hearing a lot of positive feedback from Fedora lately. Wondering how good the KDE integration is before trying it out though ( no machine to spare). Anybody have some experience with KDE and Fedora, in particular!at Wayland and multi monitor support?

</comment><comment><USER34> Ever since Ubuntu went all NIH with Mir and Unity, I looked for other desktops to recommend to people who want something that "just works". The wishlist includes non-breaking upgrades and not changing interface unnecessarily.

There are a few modern distributions like Mint and Elementary, but none pay much attention to upgrades. Fedora Workstation it is. The tools have matured a bit since esr's wife famously wanted to use her printer with it.

The past four or five years with it have been pretty uneventful, just as was hoped.

<comment><USER35> Solus is very, very good. The default version uses their own desktop, but they also offer a solid GNOME edition and are preparing a KDE edition as well.

I am a long-time Fedora user, and very fussy about Linux desktops, but would now recommend Solus over Fedora for most people: it is almost as polished, more simple to manage, faster on modern hardware, and has newer software packages whilst staying away from the bleeding edge technologies that Fedora promotes. For example, the move to Wayland is great, but if you just want a system that works, you don't want a distribution that enables it by default just yet.

</comment></comment><comment><USER36> I've been running Fedora 24/25 on my Macbook Air for the better part of the past year. It has been fantastic, and I don't see myself going back to OSX anytime soon. I intend to upgrade to F26.

</comment><comment><USER30> I've been using Debian Stretch (which was previously Debian Testing) for the last 2 years. I didn't ever have a single problem. But as the months passed I kept getting miffed about old packages. Yes, there are backports etc, but it just didn't feel current enough. I loved the stability though.

When the difference in Firefox versions got to 50 vs 54, and I had written myself a custom bash script to keep Firefox updated, I went looking...

I've been running F26 since the early alpha days, and I have to say that I haven't had a single problem in that whole time. I've been running it on my brand new i7 desktop machine as well as a 7 year old HP laptop. Both have been superb. Performance of Gnome 3.24 is great. Stability of the platform as a whole is rock solid.

In fact, the only issue I have come across is with MakeMKV (which I have written about elsewhere). Other than that, all of my use cases have been rock solid. For reference, they include:

* Firefox (with Lastpass, uBlock origin, HTTPS everywhere, privacy badger add-ons)

* Evolution (for email, contacts, and calendar)

* taskwarrior

* ledger (with some hledger experimentation)

* Gnucash

* MakeMKV (for creating MKV files for my LibreElec HTPC)

* Shotwell (for my 15,000 file photo library)

* Quodlibet (for my 140GB music library - including a growing FLAC library)

* vim (for all my writing)

* git (for my writing and my code)

* Krita (with a Wacom tablet for illustrations for some book ideas I have)

* gimp (for image editing. e.g. I mocked up a photo of my house with how it might look with a grape vine covered pergola)

* Libreoffice (including my wife using it for her study, opening and editing MS Word, Excel, and Powerpoint files from the Uni)

* Ardour & Calf Plugins for music recording. I also experimented with BitWig, which was fantastic, but I prefer to support OSS.

* Golang (1.8, for my own personal development projects)

* Postgres (for same)

* qemu and virt-manager (for virtual machines)

I was a Microsoft .NET developer for almost 20 years. I've been a Linux user in my own time for a bit over 5 years. I'm now happy to say that I use Linux 100% for every single computer related task I have, and I couldn't be happier.

So far, the move to F26 has been fantastic, and it gets my highest recommendation to anyone else that might be considering it.

P.S. I also happily use F26 for the occasional 0AD game :)

</comment><comment><USER37> Does Wayland work with proprietary nVidia drivers yet?

<comment><USER25> See [https://blogs.gnome.org/uraeus/2017/06/20/fedora- workstation...](https://blogs.gnome.org/uraeus/2017/06/20/fedora- workstation-26-and-beyond/)

</comment></comment><comment><USER38> Fedora is a fine Linux distro (as are many others).

I was hoping to see an update on the RISC-V port. Fabrice has made it easy to try to the early F25 in the browser (see, [https://vfsync.org/vm_list.html](https://vfsync.org/vm_list.html)) and I'd really love to see RISC-V becoming an officially supported architecture now that the privileged spec is frozen (that is, will evolve in a backwards compatible way).</comment>


Webcast: Windows 8 Launch (Live) - <AUTHOR> http://www.microsoft.com/en-us/news/presskits/windows/liveevent.aspx

<comment><AUTHOR> He's absolutely nailing this Surface presentation right now. I think he's doing a great job selling it and I think the audience is finally warming up.

<comment><USER2> Yes, Surface presentor was really good. That's what the presentation should look like.

</comment></comment><comment><USER3> My big question watching this webcast (and reading reviews of windows 8 online is), how does it all work when you step outside the ecosystem? I want to keep using chrome, not IE; dropbox not skydrive, gtalk not skype. VLC and a third- party media player, not the baked in tools.

Will these applications integrate well and can i switch off the defaults? For example, bookmarks on the homescreen, easily accessible play/pause controls etc. Or will i feel like i'm wrestling with the OS because i'm not using the Microsoft tools?

<comment><USER4> Just like Windows always has, and then some. Chrome's already got a Metro- friendly build (though the UI is still identical to the desktop); and Dropbox et. al. can hook in via "Contracts" (similar to Android Intents) to other apps and Windows itself.

<comment><USER5> Its not quite identical, if you launch it via the desktop its the same but if you launch it via the "metro" launcher its more like a Chromebook.

<comment><USER4> Different styling, but same overall UI. No modifications I'm aware of for touch use or "Metro" restyling has been done so far (and I doubt they're concerned until x86 tablets ship in significant number or if/when Microsoft gives way on alt browsers for WinRT)

</comment></comment></comment></comment><comment><USER6> I'd like to pick up a Windows 8 (Pro, not RT) tablet right now. I wish Microsoft had more control over hardware. This webcast isn't going to end with "and you can buy it right now" since stores won't start selling stuff 'til tomorrow... and I'm not confident stores near me will have any tablets for sale tomorrow either. The nearest Microsoft Store is 4+ hours away.

<comment><USER7> x86 Windows 8 tablets from several manufacturers have been available for pre- order (e.g. on Amazon) for a couple of weeks now, for shipment tomorrow. (Of course, that doesn't help if you want to go into a store to play with different devices before buying one.)

</comment></comment><comment><USER8> Where's Billy Mays?

Seriously though.. this only highlights how much better Apple's presentations are. At least they focus on keeping people on stage who know the ins and outs of the tech they are showing. This lady struggled with the term 1080p..

I'm beginning to warm up to Windows 8, though I still think usability is kind of a mess, and once you scale up to a 20"+ screen the launch pad looks 'confusing'.

That said, I'm very impressed with all the different devices they have ready at launch, but something tells me this is the part where they are missing the secret sauce that Apple posses. As a general consumer I'm simply befuddled at all the options - the paradox of choice - and I'm more likely to just go simplify things and go buy that Apple one instead.

<comment><USER9> I don't know if we can still use the Apple keynotes as references as Tuesday one was really painful. It was slow, packed with marketing keywords, and Tim Cook was unable to ramp up the suspense through his speech...

PS: I am not watching the Microsoft one right now, so I have no idea if it can compare.

<comment><USER8> I agree.. Tim Cook's presentation was borderline painful to listen to, but Phil Schiller was as toptastc as ever.

</comment></comment></comment><comment><USER10> I gotta say they really have a coherent message now.

<comment> simba-hiiipower absolutely; and i feel it's because they've really pulled everything together nicely and built a very compelling ecosystem. people tend to define the merits of an ecosystem based largely on app counts, the real value (in my opinion) is in the range of services you get on a platform, and how much you can accomplish utilizing them..

connecting to my microsoft account today, i pretty much have access to services that cover nearly everything i need out of a computing device:

\- email (outlook.com)

\- messaging (skype)

\- cloud storage (skydrive)

\- productivity (office)

\- collaboration (onenote)

\- entertainment (xbox music / xbox video)

\- gaming (xbox live)

\- social media integration (facebook, twitter, linkedin, ... info pulled-in)

\- roaming settings (windows, windows phone)

\- roaming favourites (internet explorer)

that makes for a pretty compelling offering to me, and i honestly don't see any of the others in the market coming close to this.

on the development side, while they're not quite there yet, they also seem to be the closest in offering an ecosystem where a single application can be accessible on the widest variety of devices and form-factors; i'd say that's pretty damn cool, and as a consumer i'm looking forward to the experiences that will bring..

<comment><USER11> ..until you have to move internationally.

[http://owened.co.nz/how-microsoft-might-sink-its-own- ecosyst...](http://owened.co.nz/how-microsoft-might-sink-its-own-ecosystem)

<comment><USER12> Name one provider who offers similar content that doesn't have this issue. With all the legal and localization issues this is a difficult problem to solve.

<comment><USER11> The solution is to do it manually.

A dedicated team to manually transfer your account across locales could do the job right the first time.. and it retains a happy customer within your ecosystem.. which is the whole point.

</comment></comment></comment></comment></comment><comment><USER13> Why isn't Techcrunch or Gizmodo streaming this on their websites like they did for Apple's event?

<comment><USER14> That is a good question. The Surface presentation was solid. Except for their pull quotes at the end..."The best screen ever..." ha

<comment><USER15> It's not all about pixel count.

</comment></comment></comment><comment><USER16> I'm really happy with what Microsoft has been doing lately, but this presentation is kind of failing. It's not really getting the audience that excited. This doesn't affect my opinion of the new products, but it's not helping Microsoft's competitive mission, and that makes me cringe a bit.

</comment><comment><USER14> Watching Ballmer speak at the end was hard. I wish they simplified their keynotes a little bit.

Off-Topic Question...

I need to purchase my girlfriend a birthday gift. She "really" wants a tablet. I think a laptop would suit her needs the best. However, "must make g/f happy", is what my brain says. Do you guys think the Surface RT is a solid choice? I asked HN here <http://news.ycombinator.com/item?id=4697945>

I ask, because I cant seem to pull the trigger on any tablet.

<comment><USER17> Depends on whether they worked with Instagram, Twitter, Pinterest, Instagram, Amazon (Kindle) to make some apps available on day one. If not, then probably not.

I don't like the idea of buying the first iteration of any hardware either, regardless of whether the manufacturer is Apple or Microsoft.

<comment><USER18> amazon just launched kindle for windows 8, so one of them is in, I am confident apps for the others should be out soon. Netflix , hulu apps look gorgeous on windows 8 pro desktop

</comment></comment></comment><comment><USER19> Ballmer recites hundreds of features, how long did he take to remember everything, how should a viewer?

Some stuff next year, some now... How should i know what are the important ones, he sounds kinda bored. The crazy Ballmer is 10 times better.

<comment><USER20> I'm not so sure he was recalling all those details from memory. You could see him looking at a prompt of some sort quite often (looking down/up, etc).

Of course, that might reinforce your position.</comment></comment>


GE Powered the American Century – Then It Burned Out - <AUTHOR> http://wsj.com/articles/ge-powered-the-american-centurythen-it-burned-out-11544796010 <comment><AUTHOR> For those who get a paywall, here's[0] an Outline link.

[0] [https://outline.com/M22bbL](https://outline.com/M22bbL)</comment>


Show HN: Hacker News Launcher for Android - <AUTHOR> https://play.google.com/store/apps/details?id=com.fxpi.hnlauncher&ref=producthunt <comment><AUTHOR> Hacker News Launcher is an android launcher with one primary goal to help people know what's trending in Hacker News in the easiest and fastest way possible without compromising their productivity without distractions of push notifications and allow them to share to twitter or any other social media and save stories for future reference in Pocket with just one click.</comment>


Pwning the Dlink 850L routers and abusing the MyDlink Cloud protocol - <AUTHOR> https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html <comment><USER2> _The latest firmware for Dlink 850L revA (DIR850L_REVA_FW114WWb07_h2ab_beta1.bin) is not protected and a new firmware image can be trivially forged by an attacker._

That's a feature, not a bug. ( [https://openwrt.org/](https://openwrt.org/) )

At least it makes it possible to patch the other (real) bugs yourself.

<comment><USER3> No, it's a bug. A home/consumer router isn't targeted at power users, and should not require the average user to understand what they're doing.

I also think it's unreasonable to expect people to patch bugs in consumer gear they've purchased.

<comment><USER4> I don't think those goals are actually contradictory. Cryptographically verified auto updates, manually acknowledged non signed file upload updates can coexist peacefully.

</comment></comment></comment><comment><USER5> Maybe some of this is legitimate, but the user being able to install their own firmware is not a security vulnerability. Yesterday I had to download a large ISO for a friend instead of using the Linux.efi file I use on my laptop because their's was made "secure" by Microsoft.

<comment><USER6> > the user being able to install their own firmware is not a security > vulnerability.

That's actually a feature. I consider this a fundamental _right_ I demand on most equipment I buy.

I have no issues with UEFI secureboot as long as it can be disabled and/or put under the users control.

If not, that's strictly a vendor issue and best solved by not buying stuff from that vendor.

</comment></comment><comment><USER7> And this is why we finally need fines in the magnitude of a few million to make corporations even think about having a secure-by-default mentality, not patch-when-sh*t-hits-the-fan (and even then only barely).

<comment><USER5> I really wonder if that will result in a bunch of companies that own parts of your house the way they do your iPhone.

Otherwise I would totally agree with that.

</comment></comment><comment><USER8> Impressive. (Not you, D-Link) But seriously, why? Just why? I haven't even gotten a degree in security or anything, but I know better than to store a password in plaintext, at least!

<comment><USER9> The sad thing is that it's not really impressive work. And I don't say that to discredit the author, but to discredit dlink, because the bugs found are really security 101 kinda stuff we really should not be seeing anymore.

<comment><USER10> Most home networking gear I've come across are basically MVP (minimum viable product) only. I've managed to trivially bypass quite a few via using common techniques in whitepapers/research docs (hardcoded admin passwords stored in plaintext, looking for open ports, etc etc)

Sadly, none of this is going to change in the foreseeable future.

<comment><USER11> Ah, cheap shit, programmed terribly. There should be legislation saying anything you plug permanently to your internet connection should be secure, and anyone caught being part of a botnet because they're using a known "bad" hardware will be fined. And just add to this blacklist "anything made by DLink". That will get them to fix their shit.

<comment><USER12> Are you sure you want more laws? I don't.

We already have laws on the books for vandalization and sabotage. We also have that horrific law that criminalizes EULAs and "Authorized Access". Why aren't they being used against these companies that make easy to remote-pwn gear? Its readily evident that it's not the end-user's actions that cause these forms of vandalization and digital assault.

Id much prefer enforcing laws, rather than make new ones we hardware creators have to parse and understand.

(Like, how does this affect open source hardware? Some of my side projects are put online. I know a few implementations in the wild already.)

</comment></comment></comment></comment></comment><comment><USER13> >are password-protected with a hardcoded password.

This is pretty scary stuff. I suspect dlink just resells generic firmwares and add branding while the real OEM is so no-name Chinese shop that provides everything but the industrial design of the plastic case. With generic OEMs like these you can't burn your key into the hardware, so you more or less have to do non-key passwords, which as the article shows, are trivially cracked on modern equipment.

I think its safe to say budget brands are usually a security risk. They just don't have the funding to actually take security seriously, even if the engineers have the political will to do so.

This is also the same D-link that was sued by the FTC for its poorly secured cameras, which I believe were also a rebranding of a no-name OEM product.

[https://www.ftc.gov/news-events/press- releases/2017/01/ftc-c...](https://www.ftc.gov/news-events/press- releases/2017/01/ftc-charges-d-link-put-consumers-privacy-risk-due-inadequate)

I find that Netgear, Cisco small business, and Linksys aren't perfect, they are miles ahead of d-link, belkin, and other budget brands for home use and really don't cost all that much more. I'm pleasantly surprised to see how often my Netgear gets security updates and Linksys/Cisco small business line is wonderful for the price.

That said, most consumers will be on the receiving end of a ISP provided router. I suspect a good chunk of these things aren't actually internet facing, they're behind the ISP router and working as a access point, but typically consumers won't or can't put them in access point mode. I think there's a lot of dumb luck in home networking that ironically keeps people secure because if they knew how to put the ISP router/modem into gateway mode they'd be in a lot more trouble once their dlinks and belkins are internet facing.

</comment><comment><USER14> Also, the PHP tags (<?echo...) in the examples suggest that they are using an (very) old PHP version which might contains unpatched security holes.

<comment><USER15> Short open tags are still in the current builds according to the docs.

The only thing that's changed is that while in older versions the <?= shorthand was also controlled by the short_open_tags ini option, it's now permanently enabled.

<comment><USER14> >Short open tags are still in the current builds according to the docs.

No.

<comment><USER15> [http://php.net/manual/en/language.basic- syntax.phptags.php](http://php.net/manual/en/language.basic- syntax.phptags.php)

[http://php.net/manual/en/ini.core.php#ini.short-open- tag](http://php.net/manual/en/ini.core.php#ini.short-open-tag)

        $ cat test.php
        <? var_dump(PHP_VERSION); ?>
        $ php test.php
        string(5) "7.0.9"
        $

Yes?

<comment><USER14> Yes. I was thinking about other removed old features from PHP and answered in a lame and arrogant way. Bad day, bad mood...

Please, accept my apologies. :)

</comment></comment></comment></comment></comment><comment><USER16> A quote from D-Link's site, linked from one of the author's posts: "Security is of the utmost importance to D-Link across all product lines."

These sorts of organisations certainly have chutzpah.

<comment><USER17> Reminds me of:"We take security seriously", otherwise known as "We didn't take it seriously enough": [https://www.troyhunt.com/we-take-security-seriously- otherwis...](https://www.troyhunt.com/we-take-security-seriously-otherwise/)</comment></comment>


A Dusting of Gamification - <AUTHOR> https://www.joelonsoftware.com/2018/04/13/gamification/ <comment><USER2> To call the /. system more primitive seems weird.

After all, you don't simply up or down vote, you are given a small number of votes, and you can pick between various terms (with attached values) to use on each vote.

But the big deal is that:

A) the most used term is attached to the comment.

B) it caps out at a +5 upvote.

The caps in particular makes vote brigading (/r/shitredditsays anyone?) harder, though not impossible.</comment>