The Pull Request Hack - <AUTHOR> http://felixge.de/2013/03/11/the-pull-request-hack.html <comment><USER2> I do this on all my personal projects now. It's pretty amazing. I've actually gained several long-term contributors by doing this.

I've gotten emails from people that said, in effect, "Thanks! I feel like part of the team, that you trust me with the code. Before, I was just going to fix that one bug, now, I'm excited to poke around the codebase and see how I can help."

Really, this is a variant of a theme that we see around here all the time: autonomy, mastery, and purpose. The upside is that you empower people to take mastery over the code they use, you provide them with the autonomy a commit bit has to offer, and you give them a sense of purpose: you're now helping everyone else out, too.

<comment><USER3> You can't make a rocket scientist just by giving them carte blanche to play with rockets. I definitely appreciate the empowering aspects of open commit policies, but I'm less concerned with getting contributions than I am with getting _good_ contributions. We've even added some committers prematurely over the years...and those came after months of patches and PRs.

The primary bottom line for a larger or more established project is maintaining code quality, stability, predictability of behavior...all while still moving forward with new features. When you endeavor to achieve those goals in every commit, giving any PR-sender the keys to the castle doesn't seem like such a great idea.

As I mentioned elsewhere (and to you in discussions about open commit policies), I also don't feel like there's a good reason when Github makes it so easy to fork projects. We've worked with some folks for years off forks. I'm also not thrilled with the idea that you're going to get good developers if your developers only "really" started contributing once they got a commit bit. Just because someone's excited to drive a race car doesn't mean they're qualified.

<comment><USER2> I think we just have different tolerance levels for this kind of thing, but we've talked about it in person, so you know this. :)

</comment></comment></comment><comment><USER4> This is a clever bit of social engineering which really taps into the mentality, not to mention the rhetoric, of open source hackers. I like it!

</comment><comment><USER5> I'd be wary of this policy becoming the norm. It would be pretty easy for malware authors to hijack useful-but-neglected projects by submitting moderately helpful pull requests.

<comment><USER6> I think the bigger problem here is that Github is rather useless at gracefully abandoning a project. The usual solution is for an interested maintainer to fork the project and continue, but with any sufficiently popular project it's impossible to tell which forks, if any, have momentum.

I feel like there's got to be a middle ground between the current "fork in obscurity" model and the OP's "commit bits for everyone" model. But I'm not smart enough to think of what that might entail.

<comment><USER7> I like the idea Github providing an easier way to gauge momentum on a repository and then maybe do some sorting based on that. I can't tell you how many times i've been looking for a repository and a large number of them come up with no indication, other than number of starts and forks, about whether that is the main repository that is still maintained or not.

<comment><USER8> That could still be gamed by committing a lot if you are a malicious user. I'm sure they could figure out a way that would work but it seems the naive way is Not ideal.

<comment><USER9> Also remember that you can trivially fake author name, email and date in git and thus github. Only the github-side push log will tell which user pushed what, the commit log can lie all it wants.

Most notably, you can backdate a commit and github won't even show it in the commit log (because it uses strict commit date order).

<comment><USER10> Yes, but also remember that you'll get loud warnings about non-fast-forwards thanks to the cryptographically secure SHA1 hashes. This means that the repo admins and downstream clones can trivially detect history rewrites for branches they have fetched. Unfortunately, there isn't a good way for code- consumers to tell if and when a non-rewrite commit or branch has been "blessed" by an admin rather than some random committer. I guess this means that the README should make some mention of the collaboration policy and the admins should preserve release power to whatever the relevant package manager is.

<comment><USER9> You don't need to rewrite history. You just add new commits with fake author & date.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> This is similar to how the Rubinius project has been managed for a long time: After your first pull request gets merged, you'll be added to the repository as a committer.

<comment><USER12> > This is similar to how the Rubinius project has been managed for a long time

... which in turn was "taken from Audrey Tang's commit policy on Pugs". [1]

[1] <http://jacobian.org/writing/commit-bits/#c2548>

</comment></comment><comment><USER13> Wikipedia works even though everyone can commit by default, anonymously. Obviously there is some difference when people are downloading code and running it, and Wikipedia has its own kinds of problems with edit wars. Collaborative software development should look at the social and software structures that let Wikipedia stay useful. (not that this hasn't already gone both ways)

</comment><comment><USER14> It makes complete sense: people submit patches as "proof of concept", to show that a fix is possible, and how to go about it. It's not laziness or lack of ability, it's just that there's no need to handle exceptional cases in a proof of concept. Needless to say, when you're actually patching the code, then you start worrying about the details, so it makes complete sense.

</comment><comment><USER15> This is pointless. If your fork is no longer maintained you should say so and _not_ accept pull requests. Let the other person maintain their own fork and accept pull requests to their fork.

<comment><USER16> I wish Github made it easier to capture the fact that forks often diverge and become their own distinct (but related) projects. Right now you have to email support and ask them to detach the fork, which detaches everything from the previous graph of forks & commits.

(The graph is important -- Often when I find a useful but less-than-maintained project, I search the graph to find a fork that is better maintained.)

<comment><USER17> In a first step you can have a descriptive branch name for your default branch and if you feel you need to go further you can rename your repository.

Isn't this enough?

For really popular forks you can often see that in the members tab many sub forks have forked off them. This is a good hint for a project that has left the original repository behind.

</comment></comment></comment><comment><USER18> Does Github support branch-level access control? If so, a maintainer could keep control over the master branch to control what gets merged into a stable release but allow developers to run with a development branch and feature branches.

<comment><USER19> I suspect this hack isn't about access control, since that effect is already achieved with pull requests on forked repo branches, but rather with the social hack of giving a person responsibility over mainline code, and having her maintain the project much better herself.

</comment></comment><comment><USER20> Wouldn't it be better to set up an org, transfer the project to the org and add someone else? That way you can even transfer administrative jobs like commit access to others.

</comment><comment><USER3> This policy works for young or small projects. It does _not_ work for larger, more complicated projects.

On the JRuby project, we carefully examine all incoming pull requests. At least half of them would break something unintended, and half of the remaining non-breaking PRs aren't done properly, don't match our style, would perform badly...and so on. Giving out commit access to people based on one PR and a bit of background information is not sufficient.

The problem here is one of expertise. Very few people in the world have what we need on the JRuby project. You need to be fairly meticulous about what you commit, running tests, understanding the codebase. Ideally you need to understand what's involved in building a language runtime. Just because you're a good contributor to other projects doesn't mean you're going to be a good contributor to JRuby, and we won't give out commit access to unproven devs.

Ultimately, the reasons people give for handing out commit access are almost completely trumped by Github's ability to fork repositories. You can basically fork, do multiple PRs and changes over time, and never really require commit access to be a good contributor. And we will potentially add you as a contributor if your results are solid over time (or steadily improve to where we're comfortable adding you).

My last statement on this is that I don't think I want people on the project that aren't willing to put together a good PR or patch until they're given commit access. The kinds of folks I want contributing are the ones willing to submit multiple fixes over time, willing to learn our codebase and standards before joining the team, and who have a vested interest in seeing JRuby remain solid and improve steadily.

</comment><comment><USER21> Cool. I believe this works on the same principle that employee stock options does. Empowerment.

In another situation, it is also generally good practice to let employees know you think highly of their work. Most people will try to live up to this expectation even though it might not necessary be true.

</comment><comment><USER22> It's how Tom Sawyer paints a fence.

</comment><comment><USER23> I've been a user of projects where the maintainer basically merged everything. A lot of stuff was broken. The only good thing was that it was easy to get my fixed merged. :)

</comment><comment><USER24> Old HN link but libreoffice is trying a similar thing.

The video doesn't go into enough detail IMHO but the TL;DW is they are making it easier to commit and putting automated processes into place to mange it(Like extensive and easy testing). Rather than a commit is hard philosophy.

I think the first 5-10 mins of the video is the important bits.

[https://fosdem.org/2013/schedule/event/challenges_libreoffic...](https://fosdem.org/2013/schedule/event/challenges_libreoffice/)

</comment><comment><USER25> I've done it before, it's a great way to kill a project.

<comment><USER24> Sounds like a interesting story, why not value add and say more about the issues?</comment></comment>


Network card rootkit offers extra stealth (2010) - <AUTHOR> http://www.theregister.co.uk/2010/11/23/network_card_rootkit/

<comment><AUTHOR> This is what back in 2010... I wonder if this is the kind of things are out there today and we just do not see them.</comment>


Teeny Tiny Microcopter Deploys to Afghanistan With British Troops - <AUTHOR> http://spectrum.ieee.org/automaton/robotics/military-robots/microcopter-deploys-with-british-troops#.UREwFcXynLk.hackernews <comment><USER2> These are neat, but the last paragraph of that article sums it up.</comment>


Pilot: We need to find out much more about why two Boeing planes crashed - <AUTHOR> https://edition.cnn.com/2019/03/11/opinions/ethiopian-airlines-crash-737-max-abend/index.html <comment><USER2> The article says "Both airplanes are Boeing's latest offering, the 737-800 MAX".

That is incorrect. Both planes were "Boeing 737 MAX 8".

There is no "737-800 MAX".

There is a plane named "Boeing 737-800" and that was the older version of "Boeing 737 MAX 8".

<comment><AUTHOR> Yes, indeed. The author is a decades-long 777 captain, and I doubt the mistake is his. Probably some unfortunate edit by CNN.

<comment><USER3> Well frankly many pilots struggle to distinguish an A320 from a 737-anything so I wouldn't expect variant-level accuracy from a Captain.

But your comment raises the question of why the Max could be grandfathered in on the same 50-year-old certificate as the 737 NG, Classic and 'cigar-tube' variants when there are such major differences between all of them. For example the NG was rewinged and could fly at 41,000ft which was far above the ceiling of earlier variants, but with a cockpit options pack could be flown by pilots with the old rating.

The root reason is to make certification cheaper and quicker and to sell more aeroplanes. I think that is a major error by the regulators who should be concentrating on safety and technical excellence, not facilitating commercial sales. Perhaps certification should be moved to the ICAO level instead of national regulators who have national interests?

<comment><AUTHOR> > _Well frankly many pilots struggle to distinguish an A320 from a 737-800 so > I wouldn 't expect variant-level accuracy from a Captain._

Really ? I would for sure. I am no aviation expert by any means, but something as basic as telling Boeing or Airbus apart and many if not all variants ( certainly within your usual involvement with the industry ) I would think is common knowledge for anyone actually involved in flying, particularly pilots.

> _But your comment raises the question of why the Max could be grandfathered > in on the same 50-year-old certificate as the 737 NG..._

I assume you've seen the comments regarding this on the main thread about this whole thing... [1] I do agree with your point of view on this, absolutely.

[1] [https://news.ycombinator.com/item?id=19356138](https://news.ycombinator.com/item?id=19356138)</comment></comment></comment></comment>


Online Subscription Billing Is A Pain. Recurly Wants To Alleviate It.  - <AUTHOR> http://www.techcrunch.com/2009/11/17/online-subscription-billing-is-a-pain-recurly-wants-to-alleviate-it/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=Google+Reader <comment><USER2> I encourage anyone who needs something like this to check out Spreedly (www.spreedly.com). We use them for the Ars Premier subscriptions and they're fantastic, don't kill us with fees, and have a really nice API.

3% of transactions on top of the credit card fees is pretty nuts.

<comment><USER3> Chargify changres nothing for the first 50 clients and then I think it is a flat fee if I am not mistaken. That can be cheaper than Spreedly. Recurly seems to be doing something similar.

What does make a difference is that Spreedly is not PCI compliant. Both Chargify and Recurly are PCI compliant.

<comment><USER4> Chargify only supports Authorize.net, whereas Spreedly and Recurly support a few more options.

I think Spreedly has by-far the most reasonable and economical pricing structure for lean startups.

<comment><USER5> I've been evaluating all of these companies and I agree, Spreedly is the most startup-friendly. Not only in pricing, but they also have the broadest gateway support.

Unfortunately their admission that they may not be PCI compliant is a legal issue... if you read that, and pass cardholder information to them, you could be in breach of your merchant agreement and have no way to really know.

Spreedly also seems to be a side project that isn't getting the developer time it needs considering the sensitivity of what the product is. They have threads in their support area where they promised features a year ago and still haven't delivered.

</comment></comment></comment></comment><comment><USER6> It sounds like they're targeting startups, but if you're a startup you're adding quite a bit of risk by depending on another startup (in beta) for something so critical as your cashflow. It's easy to imagine scenarios where they go bust at a critical time and take you out too.

<comment><USER2> We are part of a pretty risk averse large corporation, and this really isn't all that much of a consideration for us (for reference, we use another small recurring billing startup). We generally think the startup can do a better job of handling these things than we can. We also get ridiculously good service that we wouldn't be getting from a large, established company trying to shunt us through a useless enterprise sales process.

So in summary, you're kinda right, but I think it's worth the relatively minimal risk.

<comment><USER6> Yes, but as a large corp, you have the momentum to survive if you can't bill for a month, but it might be fatal for a startup.

</comment></comment></comment><comment><USER7> Fair warning: get your own merchant account, never ever use a service that does not use segregated merchant accounts.

All you are doing is to allow other people to reduce their chargeback rates by diluting their volume with your charges and sooner or later they'll go down and leave you swimming.

It will take you a bit longer to get approval and you will have to pay a fee but at least you will be building a business that will last.

All you need to do recurring is an IPSP.

<comment><USER8> What is an IPSP?

<comment><USER7> Internet Payment Service Provider

A company that registers your merchant account with a company such as paysquare, they will take care of scrubbing and fraud control (for a nominal fee per charge) and will deposit your money in your bank account, usually on a weekly basis.

I should probably do a post on how all the items in an e-commerce transaction go together.

<comment><USER9> I've got a contract for a web project right now where, if possible, I'd really like to integrate some fairly sophisticated e-commerce. The two big challenges:

1) The project deals with separate businesses that all have their own bank accounts. The money from transactions processed by the app has to be deposited into the bank accounts that belong to individual businesses. I believe this means that PCI requirements are substantially more onerous for an app like this because my client is classed as a payment service provider, rather than just a user.

2) The app must also be able to process card-present transactions, both credit- and debit-card based. Customers of the businesses (who are the customers of my client) that use the app will often be present to swipe their cards for their payments to be processed.

Are you aware of any services or technologies that would make this easier? So far I think my preference may be for partnership with a vendor who is already PCI-certified and has the pin pads for card-present transactions, whose software has a good API that I can interact with via this web application.

I'll be building this in Rails. I've got lots of experience with traditional e-commerce models, and I'm comfortable with the technical aspects of dealing with multiple bank accounts, but the certification requirements appear to be the major obstacle so far (costing approx $100k, according to my research, for hiring an independent security assessor and working with them to achieve compliance).

</comment></comment></comment></comment><comment><USER10> The API (<http://support.recurly.com/faqs/api/accounts>) looks very similar to the Authorize.net API, so I'm not sure that this service simplifies the integration all that much. Also, it isn't clear to me whether the accounts are stored in Recurly, or whether they are stored within the payment gateway.

Overall, I can't say that I agree with the premise -- I haven't found online subscription billing to be very painful. However, if I can be convinced that this service adds value without creating third-party risk, I'd be interested.

<comment><USER5> Recurly stores the payment information themselves, not through the gateway. I e-mailed them previously to ask about this. Theoretically this would mean that you can switch payment gateways and your subscriptions will continue to rebill automatically on the new gateway. It also means that if the company were to go out of business or you were to leave, they could potentially give you your customers' billing information to take elsewhere.

</comment></comment><comment><USER11> Unless I am mistaken, this is also what Chargify is trying to solve. When I built my first app, I thought about spinning off the billing layer into a separate service, but then realized that established companies like Auth.net have all of the real leverage. We'll see how this plays out in the long run, but I have a feeling that these types of services are in for a bumpy ride as their customer base is probably the least stable of them all (start ups).

<comment><USER12> Chargify, CheddarGetter, Spreedly, Zuora, Aria Systems and now Recurly. Seems the space will get crowded quickly.

</comment></comment><comment><USER13> For a very young startup, the pricing structure is much better than competitors. If my revenue is really small, 3% of total rev is better than $39 plus a smaller percentage of sales.

<comment><USER10> The pricing is in addition to what you pay for your merchant account and gateway.

</comment></comment><comment><USER14> I have seen several of these recurring billing services posted lately, but no one has mentioned BillingCircle. <http://www.billingcircle.com/> I use it for my startup and love it to death. Great API, ok-ish pricing, and the reporting dashboard is insane (in a good way).

<comment><USER5> Expensive, though.</comment></comment>


Pokemon Go API - <AUTHOR> https://github.com/Grover-c13/PokeGOAPI-Java/ <comment><USER2> Haven't delved deeply into this, but does it let you do everything programatically, including track/catch pokeymon?

I'm blind and would be interested in there being an accessible version, but it's just not ever going to get made. Seems like pokestops or whatever they're called could be represented as a plain native list, with Maps integration for voice guidance to the point if you don't already know where to go.

And it looks like the in-game action is fairly simple. Could probably render it with positional audio, which has been done in accessible games for at least a decade [1]. I wear a bone conduction headset, so I could listen to the audio cues overlaying my actual environment. It may be hard to model the catch mechanics, but I assume they aren't too much more complex than "center one thing on another and throw," which again audio games have pretty much figured out.

Seems like a fun project. Might give it a shot if I can stomach the risk of getting randomly shut down one day.

Edit: Speeling

1\. [http://audiogames.net](http://audiogames.net) Kind of an annoyingly bad site in some respects, but useful info all the same.

<comment><USER3> I believe you can do pretty much everything, but sadly people are already using it for buildings bots, so there is a chance that Niantic might change it.

On the other hand, this does sound like a fun project.

<comment><USER4> Doesn't matter how they change it. As long as the app works, there's absolutely nothing they can do to stop someone from using the "API".

</comment></comment></comment><comment><USER5> So let me get this straight -- for these "unnofficial" APIs, someone just scraped a bunch of packets from their phone while letting Pokemon Go run on it? Then investigated to see what the communication from client to server looks like, then implemented an API that mimicks that communication?

If that's all so, could the PoGo devs simply enforce some type of device authentication to 'shut down' these APIs, or otherwise take different steps to make unofficial APIs less compatible/more difficult/effectively impossible?

<comment><USER6> > If that's all so, could the PoGo devs simply enforce some type of device > authentication to 'shut down' these APIs, or otherwise take different steps > to make unofficial APIs less compatible/more difficult/effectively > impossible?

That's impossible. If you try this you'll either have a bunch of false positives or even more likely a patched api around 12 hours later. Never underestimate the dedication of botters. There are multiple headless WoW Apis around for 10 years now and Blizzard isn't able to close them out.

<comment><USER7> The best way to handle this is with account-specific API keys. Even that would just mean creating an account, and the only real benefit to that is that you could track the API key, and if it did "bot-like" things, ban it. That's not really a fix, just a barrier for entry, preventing poorly thought out bots from working.

<comment><USER8> I'm pretty sure this already exists. These APIs have been in development for a couple of weeks now and as far as I can tell (from watching the /r/pokemongodev subreddit) there haven't been any bans. Niantic, at present, don't appear to have any automated system attempting to catch bot-like behavior.

<comment><USER9> Botters aren't as big a threat to Niantic's business as the shortcomings of their own technical infrastructure.

When that changes, watch out.

</comment></comment></comment></comment></comment><comment><USER10> [https://github.com/tejado/pgoapi](https://github.com/tejado/pgoapi) \- Python version

</comment><comment><USER11> There are quite a few Pokemon Go APIs in different languages. This is the Java Pokemon Go api. There is a C# api, and a python api.

If you want to learn more this subreddit is great for news.

[https://www.reddit.com/r/pokemongodev/](https://www.reddit.com/r/pokemongodev/)

</comment><comment><USER12> Instead of implementing bots and trackers, someone could implement:

      *  Just a working 3 step tracker
      *  Gym high scores
      *  Display nicknames of gym pokemon

<comment><USER13> > Display nicknames of gym pokemon

That's rife for abuse. It would require a "reporting" function; a moderation team; resolution practices; human intervention; a "scoring" system to judge repeat offenders... on and on and on.

Please don't ask for that. I don't need to see that the gym located at a church being championed by the Pokeman nicknamed "Gaylord."

<comment><USER14> You can already do it via player name.

The notorious Westboro Baptist Church was being held by an apparently LGBT friendly account called LOVEISLOVE recently, which I thought was quite sweet tbh.

</comment></comment></comment><comment><USER15> Probably good to regard these first few weeks (months?) of Pokémadness as an "open beta" period, before the security measures get turned on. We can look at Niantic's previous project, Ingress, for a roadmap.

The two major categories of cheatifying in Ingress are falsifying one's location and multi-accounting. There's precious little that can be done about the latter, so Niantic focus on banning players that appear to be "spoofing" their location.

Given the wealth of different devices and playing scenarios, immediate detection of GPS spoofing is infeasible. Things like WiFi router locationing idiocy (or even just dodgy GPS antennae) play havoc with the utopian dream of perfect positioning every time. If a player performs actions seconds apart that are separated by thousands of miles then the game temporarily ignores them, but after some time in the naughty corner they can resume play.

Hardy spoofing detection instead depends on longer-term profiling. Ingress has a similar API to Pokémon Go – JSON chunks (rather than protobuf) over HTTPS, most fields out in the open – but each request from the app includes a monolithic "clientBlob" containing device characterisation. The format of this has been (presumably) reverse-engineered by a few hardy souls but it is certainly closely-protected Niantic knowledge. We could safely assume that it's a proprietary blend of signal strengths, gyroscope readings, touch events and timings, secret herbs and spices etc.

The clientBlobs lend themselves to offline processing. There are conceivably servers continuously trawling through a backlog looking for tell-tale patterns of bad behaviour, but it also provides an audit trail if a particular player is suspected of spoofing. Occasionally Niantic indulges in mass purges, which presumably follow from a new cheat detection heuristic being run on all the collected data for some period. These "ban waves" have a reputation for penalising unusual device configurations (the most recent major wave appeared to target, amongst other things, players with modified Android variants that might mask GPS falsifying code, including cheaper Chinese knock-offs, and Jolla phones running Sailboat).

Occasionally during major Ingress gaming events – so called "XM anomalies" – there is some level of human supervision to quickly identify and remedy clearly-fraudulent player behaviour, but for day-to-day operations it seems that account termination, so-called "hard bans" and shorter-lived "soft bans" are entirely automated, and based on offline player data analysis.

Getting back to the New Cruelty: the clientBlob was not part of Ingress's initial implementation; for a while after it was introduced was ignored, and then it became mandatory. A similar opaque chunk of data is included in the Pokémon Go requests, so we should look forward to its imminent deployment when Niantic scrape together enough Pokécoins to buy a few new servers for batch processing. At that time these convenient APIs won't have long to live.

<comment><USER16> >If a player performs actions seconds apart that are separated by thousands of miles then the game temporarily ignores them, but after some time in the naughty corner they can resume play. //

I'm curious how the financial side works with the gameplay side - the people doing spoofing might also be those that are motivated enough to spend money on the game; you don't want to ban your whales [best spenders] just because they tried to cheat. Would be really interested to see how much of that weighs in to business decisions on crack-downs on unauthorised "play".

<comment><USER15> I'd certainly agree that someone who went to the effort of setting up a system for spoofing (even if it was just downloading an extra app) is, in some sense, more motivated than a very casual player.

I don't think though that Niantic have much of a moral hazard to consider here. Looking at what's purchasable in the Pokémon store, there's nothing that would be attractive to anyone who was able to virtually wander the world at all hours from the comfort of their couch, especially since anything that can be bought with cash money could be obtained using coins earned in-game. If a player's motivation in spoofing was to "catch 'em all" by whatever means necessary, it seems unlikely that they'd draw the line at restocking from Pokéstops along the way.

Comparing with the dark side of Ingress, there is a ludicrously well-organised black market economy offering purchases for every in-game commodity – all, of course, completely against the T&Cs, all completely abhorred by legitimate players, but all offered with consummate professionalism (think of the slick ransomware scammers offering a support number). Niantic don't see any of that cash. It is likely to have had a major impact on their design decisions for the PoGo store, and the game in general. If, for instance, there is no way to trade items between players, then it severely limits the options for a parallel economy.

</comment></comment></comment><comment><USER17> Pokemon Go _Java_ API.

The Python version has been out for weeks now and I thought this was the Golang version.

</comment><comment><USER18> I am just happy to see that the API has "trading" as a concept, looking forward to that feature.

Overall it's sad that most game mechanics of the original games didn't make it into Pokemon Go. Does anyone know how much time they had to implement it?

<comment><USER19> My understanding is that the beta for the game got out to a larger audience than they intended and they pushed up the release date, though I can't immediately find anything on Google to corroborate.

</comment></comment><comment><USER20> All these services contribute to the unstable server situation

<comment><USER21> Primarily a bad architecture does, but you are right - the moral case for this being exposed is incredibly iffy.

</comment></comment><comment><USER22> I saw in the examples you can catch Pokemon with this API, does that method give you an automatic excellent throw every time then?

Also, does this API depend on running on Android?

<comment><USER5> Interesting point.

Most of the important stuff is certainly done server-side, like determining whether a Pokemon appears at coordinates x,y or not (though my guess is the client is tasked with this, and then says "Hey server, I'm showing there should be a Pidgey at x,y, I'm gonna try to catch it." The server confirms by running the exact same deterministic check on x,y, then says "Yep, I see it too," or "No, you're a filthy liar, Joey.")

But for the actual "I caught it" or "I missed it," unless the exact user input is sent to the server, and then the server simulates the projected path of the throw, the client seems like it gets to say that. So perhaps the client could actually say "I hit it perfectly," and the server just says "Well if you say so."

<comment><USER23> I've seen the app load something (and hang up while doing that) between pokeball throws. That seems like evidence that it's asking the server about something after each throw / once every n throws.

Checking if a throw resulted in a capture server-side would be weird, I don't see why it couldn't be done on the client. It could be querying for the players inventory, to see if they have enough pokeballs? It'd still be better to just sync that once before the fight...

My best guess is, the conditions for a Pokemon running away involve something only the server knows. A weak example: maybe it considers other players in the area - pokemon might be more likely to run away if the area is too crowded? So every once in a while the client asks the server how many players are there nearby, or something.

<comment><USER19> I've noticed higher CP pokemon tend to run away more quickly. You also have to remember that there's now great balls and razz berries to influence throw chances, so the client probably publishes the events it's doing (gave a razz berry, threw a pokeball, threw a greatball) and the server creates some randomness that says yes/no.

<comment><USER23> That "randomness generating" still seems like it would be easily done locally, and it'd reduce server load. But maybe there's some more advanced mechanisms we don't know of.

<comment><USER24> if it's done locally then people will bodge the client so the random is no longer random. The server's always going to have to do the math, even if to just ensure the client's not lying.

</comment></comment></comment></comment></comment></comment><comment><USER25> You should checkout [https://github.com/disdain13/PokeRoadie/](https://github.com/disdain13/PokeRoadie/)

The best PokemonGo bot by far!

</comment><comment><USER22> Does anyone know about the legality of projects like this in the US?

I vaguely remember stories about game companies legally going after companies making bots.

Would uploading an API like this open someone up to a lawsuit? What about someone uploading a bot or a botting framework?

<comment><USER26> Usually they will just get a cease and desist.

If they are profiting off their work to the extent that it actually makes business sense for the game company to sue them for damages, then that is the action they can expect to get.

</comment></comment><comment><USER27> This just goes to show that Niantic has no idea what they're doing and completely lucked into the popularity their app has had.

It's terribly buggy and clearly totally insecure. They can't keep up with the server load and nobody had a conversation before the game shipped about protecting against abuse from people reverse engineering their APIs. This is a joke.

<comment><USER28> Alternatively: the game's success (and profits) show that none of that matters so they were wise not to waste time on it. There's no way to perfectly harden an app like this, anyway.

<comment><USER27> I think the game's success speaks to the popularity of the franchise and the desire for fans to have this sort of game. I agree, they must have known it was so buggy before launching and went ahead anyway... because profits.

There should be some minimum level of quality regardless of the fact that if you shove crap through the door people will buy it.

</comment></comment></comment><comment><USER29> Could someone please start something called 'Pokemon news'?

<comment><USER30> And React news? Python news? Maybe we can just have HN tags :)

I could be reading too much in your comment but I get the feeling you're upset at the overwhelming amount of pokemon-related threads. Don't be.

Reverse engineering is a very interesting field of programming. Video game reverse engineering is one of the most amazing things, actually. It's where many teenagers discover how the games they play work. Where they first start understanding technology, write their first scripts, start being in control of their computer.

I haven't touched Pokemon Go yet, and am not overly interested (mostly because it's not available where I live). But the reverse engineering effort behind it is spectacular and passionating. Why dismiss it like this?

<comment><USER29> Because it's just a hype. The new page is literally flooded with pokemon links by parties trying to lift along on the hype.

It's utterly boring.

<comment><USER30> So just because the subject at hand "is just hype", you're dismissing the excellent work that goes behind it?

For someone who clearly wants to "keep HN pure", you're very quick to judge a hack by its cover. Guess you didn't read my comment at all.

<comment><USER29> > Guess you didn't read my comment at all.

That's really getting old, right along with 'did you read the article'.

<comment><USER30> Is it? I've seldom seen it pointed out. Do people keep telling you that?

I respect your comments a lot usually, but you're being incredibly arrogant here. You are taking one subject which people quite clearly enjoy, and dismissing reverse engineering work that goes into it just because you don't like it.

If this is you standing up for what you wrote, I really do hope you didn't read my comment.

<comment><USER29> > I've seldom seen it pointed out.

[https://www.google.nl/search?q=site%3Anews.ycombinator.com+d...](https://www.google.nl/search?q=site%3Anews.ycombinator.com+did+you+read+the+article)

> I respect your comments a lot usually, but you're being incredibly arrogant > here.

That's another one of those oft repeated patterns. Usually it means "I like you when we agree, but now that we disagree I don't like you any more".

> You are taking one subject which people quite clearly enjoy, and dismissing > reverse engineering work that goes into it just because you don't like it.

No, I simply don't like dumb games that cause adults to run around like headless chickens whilst ignoring the world around them and then to see my favorite tech news site flooded with one link after another. And yes, it upsets me because it crowds out other submissions not tied into the hype. Then people start making HN specials in order to ride along on the hype.

> If this is you standing up for what you wrote, I really do hope you didn't > read my comment.

You be the judge on that one.

Best of luck with HN.

<comment><USER30> I'm not asking if you read the article, I'm asking if you read my comment. But I guess I have my answer now.

> Usually it means ...

Ok, now you're just doing it on purpose. What it _means_ is I respect you, and I'm surprised you're behaving like a run of the mill HN troll.

> I simply don't like dumb games

You're _still_ conflating the game and the work that goes behind the game. I don't like Facebook, but I don't shit on articles about React. I think Twitter is one of the dumbest thing on the web right now, but I _still read articles about Twitter 's engineering_, because it's interesting as fuck.

You're going on your 10th year on HN. How have you not caught on to this pattern?

<comment><USER29> Note how each of your last three comments contains some kind of personal insult. Is it really that hard to disagree without resorting to personal attacks?</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Smalltalk Making It to the Big Leagues (Slashdot) - <AUTHOR> https://developers.slashdot.org/story/16/12/31/0413250/can-learning-smalltalk-make-you-a-better-programmer <comment><USER2> Here's a link to the actual article: "How learning Smalltalk can make you a better developer"

[https://techbeacon.com/how-learning-smalltalk-can-make- you-b...](https://techbeacon.com/how-learning-smalltalk-can-make-you-better- developer)

Previously discussed on HN 5 months ago: [https://news.ycombinator.com/item?id=12154484](https://news.ycombinator.com/item?id=12154484)</comment>


A Forgotten Adventure with a Telepathic Tribe - <AUTHOR> http://news.nationalgeographic.com/2016/11/amazon-encounter-explorer-photographer/ <comment><USER2> A lot of information can be conveyed with body language, context and emotion, to the point where it's difficult to distinguish from telepathy. Most especially with folks who've spent a great deal of time together.

I'm maybe not the only one who's experienced bits of 'beaming' with a long time friend or partner?

Perhaps "I have a pretty good idea of what X is thinking" is softer language than "I'm reading X's mind", but I can see how the experience of telepathy is not greatly distant from something that's normal for many people.

<comment><USER3> When I was in high school, my AP Chem class only had a handful of people in it. The chemistry teacher was a pretty awesome laid-back guy, and so in the month of school left after the AP test but before the end of the school year, we pretty much used all our class time to play pinochle.

After a few weeks of playing with the same partner, you can pretty much know what they have in their hand just by the way they play.

</comment></comment><comment><USER4> Let's not forget that speaking/talking is telepathy, right people? Speech crosses all the boxes:

      -- It's invisible, travels via 'waves'
      -- The 'waves' I use to speak can cause your brain to show you images
      -- It can convey emotions, thoughts, images.
      -- It can be used to persuade others, change the way they think about a   subject.
      -- **tree**. Did it work? Did you see a tree?

     Of course recognising that speech really does check all the boxes is kind of a let down when you're expecting sci fi voices-in-your-head (wait, that sounds familiar...) telepathy

<comment><USER5> Yes, but the "real" telepathy is when you can picture, in your head, the exact tree I'm picturing in my head, without me doing anything to help you.

Sounds pretty sci-fi, until you read about recent brain to brain communication experiments.

<comment><USER6> I don't think that's possible because the first person never really has a complete tree picture to begin with. Instead you have a while bunch of sub- impressions which your brain dynamically invents from old experiences as your attention wanders.

Even if you transfer all the input-requirements, the other person's procedural generator will give a different set of outputs to satisfy them.

<comment><USER5> You're right, but those experiments are still pretty impressive.

</comment></comment></comment></comment><comment><USER7> As a note, I've seen the encounter twice now here in Manhattan - it's absolutely fantastic and I can't rave about it enough. They used a lot of cool sound trickery, mostly with a Sennheiser Neumann KU 100 and some well placed parabolics. Unfortunately it's no longer on broadway. [http://theencounterbroadway.com/index.php#home- content](http://theencounterbroadway.com/index.php#home-content)

</comment><comment><USER8> I can't believe the claim, since telepathy has never been demonstrated- however! I think I have to admit that there isn't any law of physics that says telepathy is impossible, theoretically. It would certainly be possible over short distances if humans had specialized organs for transmitting and receiving electrical signals, like an electric eel does. Since we don't have that organ, the signals a human brain can produce are very weak, which is why they put electrodes right on your scalp and not a few inches away. If telepathy could occur, it would have to be in a very electrically quiet place like the Amazon. It could be that telepathy is real but just never tested in an electrically quiet enough environment. The modern world is shockingly noisy- cell phones, radio towers, the power grid, and wifi hubs all produce constant electrical noise. Even in the Amazon I'd say the probability that this is real is very very low, but hey, who knows.

<comment><USER9> If that was true there would be some record from the thousands and thousands of years of written history from before humans harnessed the electron.

<comment><USER8> That's a good point!

</comment></comment></comment><comment><USER10> I would love for the species to develop Telepathy. Since I was a child I've dreamed of the day (sci-fi drove me there), and I feel that we inch closer and closer as the Internet grows by day ..

<comment><USER11> careful what you wish for, everyone has their dark side

<comment><USER12> And an exceptional front light side. I'm always amazed how most people give the best of themselves during casual social encounters. The big effort we do in social interactions is kind of an art, we're not so good in daily life with our close ones, simply because we can't maintain that effort for so long. Telepathy would ruin this, I guess.

<comment><USER10> It depends if there were some sort of control mechanism for just how much telepathy was 'allowed' \- like, its not - imho - full mind-reading, but rather "selective understanding" from the target sides' point of view .. I wouldn't want to know everything, just a few things during actual real incidents. Therefore, there still has to be a line between individual choice and social sharing.

</comment></comment></comment></comment><comment><USER13> Our thoughts, as we experience them, are usually in a form of an inner monologue, and very much like talking it's always in some particular language. Based on that I'd suspect, if telepathy was possible, that it would still be very closely bound to the language that you use to verbalize your thoughts.

<comment><USER14> Not for everyone.

People who "think in language" tend to be more common, but there are "people who think in language" and people who just _don 't_. And people in either camp tend to assume that that's just how _everyone_ is, until they are shown different. But since the "think in language" camp is larger, it is a lot easier to go through life not ever realizing that there are people who are different, to the point that many people even refuse to belief that non- linguistic thinkers exist even when presented with examples, which leads to a great deal of misinformation being spread in discussions of psycholinguistics.

</comment></comment><comment><USER15> Saw/heard this in London - very well told story.</comment>


Remembering old games on Mac is like visiting a lost world - <AUTHOR> https://www.rockpapershotgun.com/2019/03/08/remembering-old-games-on-mac-is-like-visiting-a-lost-world/ <comment><USER2> For anyone else who was thinking of a dinosaur-related game, opened the article to see the screenshot at the top, got excited, but then realized that the graphics and the name "Nanosaur" just weren't clicking, perhaps you were also thinking of... "Turok: Dinosaur Hunter". While it appears to have not been a Macintosh exclusive, that's the system I encountered it on. Finding some gameplay video just brought back some memories!

</comment><comment> james-skemp I was hoping for older games, like Bolo, and Shufflepuck Cafe.

There was also a Sokoban game that isn't showing up in the top of a search, that I can remember fondly.

</comment><comment><USER3> Crystal Quest came into existence not long after the Mac, and is still one of the all time greats.</comment>


House passes surveillance bill after rare bipartisan deal - <AUTHOR> https://www.cnn.com/2020/03/11/politics/fisa-deal-house-vote/index.html <comment><USER2> >The reauthorization includes a ban on the collection of GPS and cell phone site location data under Section 215, as well as a five-year limitation for the government to retain most of the materials it collects under the authorities. And the bill requires the government to notify individuals if it plans to use information collected under Section 215 against them.

>The measure also formally ends the National Security Agency's bulk phone collection data program that was stopped last year.

Without clear "if X then Y" clauses for the case where the government does not follow its own laws then these causeless are meaningless. Without consequences the TLAs will keep violating the law.

</comment><comment><USER3> Good to know that the only thing that can get the two parties to work together is invasive, constitution violating, spying legislation.

Hooray for bipartisanship.</comment>


End of "social VR"? Sansar shifting emphasis away from VR - <AUTHOR> http://nwn.blogs.com/nwn/2018/05/sansar-social-vr-linden-lab-pc.html <comment><USER2> Linden labs. A dying company. Not sure what this is relevant for.</comment>


Show HN: Easily create a personal playlist page to display your favorite songs. - <AUTHOR>

http://grapev.in
This was a little app that I built over the course of a few weeks to learn Rails. Or maybe I learnt Rails to build the app. Not really sure.
Anyway, Grapevin is a way to share a personal playlist. Sign in via Facebook/Twitter. Choose up to nine of your favorite songs. Get your own grapev.in/you page to share with your friends. They can click on your songs to play them and check out your taste in music.
It's somewhat rough around the edges, but check it out! If you like it, please share with friends (both the site and your playlist!). Anything is appreciated. It's my first solo app of this scale, so I don't have much experience in actually getting it known to people. :)
And if you see bugs (of which I already know some) or just have general feedback, let me know here or tweet @grapevinapp. <comment><AUTHOR> Clickable: <http://grapev.in></comment>


Cufón, the Javascript font rendering engine - <AUTHOR> http://www.linux-mag.com/id/7334

<comment><USER2> For those who are curious, this is just an article about Cufón, the javascript font rendering engine.

<comment><USER3> Thanks. Too long and very misleading.

</comment></comment><comment><USER4> Is it ironic that the authors goes on and on about the limits of HTML, presents a solution but doesn't actually show it in use. You're only given links to download Cufón and an HTML sample to cut and paste.

... anyway I'll just stick to the good ol' fashion img for a title with an alt tag if I need to have "fancy fonts" for something. It's not slick, but it is simple and reliable.

</comment><comment><USER5> Do publishers have to pay special licensing fees to print a magazine or newspaper with text in a certain font?

I don't understand how font licensing works. Is it because the web browser has to download the font spec to someone's computer who hasn't paid for the font?

<comment><USER6> Actually, for many commercially licensed fonts, every _viewer_ must buy and install the fonts, if they are cheap for $30 for each of regular, italic and bold (and each other variant, if so desired) for every computer he wants to view the document on. Mark Pilgrim had a point with his "fuck the foundries" rant a few weeks ago, even if the tone was controversial.

<comment><USER7> And how much dough do the font-designers see? Virtually nothing. Designing typefaces is one of the lesser paid design professions, albeit being one of the hardest if you want to do a good job. Foundries are just another one of those music-newspapers- obsolete by digital age industries.

</comment></comment></comment><comment><USER8> very very misleading title</comment>


How do I use Ajax with Framework X? - <AUTHOR> http://codebyjeff.com/blog/2013/04/how-do-i-use-ajax-with-framework-x

<comment><AUTHOR> Still creating ajax forms by: 1) Find working code, 2) Copy/paste, 3) Pray it works?

This tut hopes to move you from Cargo Programming your ajax forms to understanding how to debug them, so you can cut out the frustration of this often asked for bit of code</comment>


Ask HN:What's the best product you discovered this year that improved your life? - <AUTHOR> Inspired by Shane Parrish's tweet - https://twitter.com/ShaneAParrish/status/1207271914227609601 <comment><USER2> Robot Vacuum Cleaner - we have a dog and 2 cats and it's amazing how much hair it picks up. It's the Xiaomi brand, it was cheap at $300NZD but China does now have a map of my house and where everything in it is :)

<comment><USER3> Speaking of vacuums, while doing some home remodeling I needed a replacement Shop-Vac type wet / dry cleaner. The replacement I got for $99 at Home Depot was made with a metal drum instead of plastic. And the seal is so much more effective! I now use it everywhere, inside and out ;)

I can't say the same for the $69 power washer I bought from Amazon...

<comment><USER4> Which model shop-vac did you buy?

I have been warned against the metal drum units b/c they may rust easily unless dried after every wet use. Did not realize that they also had an advantage (better seal).

</comment></comment></comment><comment><USER5> Not a product but Intermittent Fasting (IF)

Some products/services

\- Daywise app ([https://getdaywise.com/](https://getdaywise.com/)), to get phone notifications at set times \- Brave browser (on all devices) + Pi-Hole in router. Adguard (all devices) \- Bouncer app (Android) to control permissions requested by various apps. \- Wireguard VPN self-hosted.

<comment><USER6> ADF - alternate day fasting is another variant. Besides getting the supposed benefits of a 24 h fast, you also get to save 15 d worth of money spent for groceries within 1 m. 1 m of ADF yields 15 d of fasting and 15 d of feasting.

Example: 0 kcal on fasting days and for feasting days: your BMR + 500 kcal.

if(male == True): bmr = 24 * your_weight_in_kg

Tip for fasting days: consider supplementing with minerals such as calcium citrate, potassium citrate and magnesium citrate. Also DHA/EPA for your brain either algae based (vegan) or fish-based. Also consider taking a multivitamin as well.

edit: For me: ADF + OMAD (one meal a day) - saves you time!

</comment></comment><comment><USER7> A remote start for my car. I live in a chilly part of the country and unfortunately have a long commute. Being able to get into a warm car is really comforting!

</comment><comment><USER8> So many ...

Love these pants: [https://huckberry.com/store/proof/category/p/54482-rover- pan...](https://huckberry.com/store/proof/category/p/54482-rover-pant)

Loose-leaf tea from Upton Tea Imports and these steeping baskets: [https://www.amazon.com/Infuser-Cooking-Threaded- Connection-S...](https://www.amazon.com/Infuser-Cooking-Threaded-Connection- Single/dp/B075K57B73/ref=sr_1_5?keywords=tea+steeping+basket&qid=1576776833&sr=8-5)

Web Dev Tools: Reincarnated VirtualHostX Pro and hosting at opalstack.com

If you mix protein or nutritional/exercise drinks of any kind and you are not using a blender bottle, then you are doing it wrong.

Daily Metamucil and probiotic.

Set up an aquarium. It's a fun process that requires some patience and adds an interesting element to the house.

</comment><comment><USER9> Libby ([https://www.overdrive.com/apps/libby/](https://www.overdrive.com/apps/libby/))

I have a long commute and I've gone through many audio books without paying a dime!

<comment><USER8> Yep. Our whole family uses it. We have to limit the amount of time our kids walk around the house with headphones on!

</comment></comment><comment><USER10> [https://www.headspace.com](https://www.headspace.com) \- started half a year ago and meditated everyday since then.

</comment><comment><USER11> I got an Ender 3 3D printer for last Christmas and while making gadgets and toys and gifts has been fun, it's fundamentally reawakened my interests in being creative again. I've learned new skills with silicone and resin, gotten back into 3D modeling (and finally learned Blender), discovered a bunch of new visual artists, and found new online communities to inspire me after a long day looking at code.

</comment><comment><USER12> Hmmm... I had to think long and hard about this, as the pickings are pretty lean.

The two standouts for me, though, are Stitchfix (don't laugh! I'm aesthetically impaired, and they have seriously taught me how to dress better. I'd never been complimented on my clothes until I started using them.), and for this winter, a pair of electrically heated gloves.

<comment><USER13> What brand are the gloves?

<comment><USER12> Paxcess, although I've seen the same glove sold under other brands as well. They cost me about $70. They're fully waterproof, and are in the style of motorcycles gloves. They're as warm as heavy gloves should be without the heater being on at all, and when I need the heat, I usually use the low or medium settings.

The heating elements cover the back side of your hand and fingers. They're powered by four 18650 lithium ion batteries (two in each glove). At full heat (which is very, very warm), the batteries last about 2 hours, on medium, about 4 hours, and on low about 6.

The only actual complaint that I have is that it's very easy to accidentally hit the button that controls the heat settings (it's on the back of the wrist).

Also, if you buy these, be aware that the sizing is smaller than American sizing. I have large hands and bought the largest size (XXL). I usually wear Large gloves. The gloves fit well enough to work, but I would really prefer a size larger.

I wasn't sure about them at first, but they're one of my favorite things this year.

</comment></comment></comment><comment><USER14> Zwift - Makes getting and staying fit enjoyable

</comment><comment><USER15> [https://tryspider.com/](https://tryspider.com/) => Amazing for ad hoc scraping projects

[https://www.fullhelp.com/en](https://www.fullhelp.com/en) => great issue tracker, which doubles for internal documentation

</comment><comment><USER16> Scroll Anywhere firefox browser add-on - it's way more ergonomic to hold right mouse to scroll a webpage

MING SHI 2000S ADJUSTABLE SAFETY RAZOR - the Merkur Futur patent lapsed and now one of the best shavers on the market can bought legally for less than $10 posted.

</comment><comment><USER17> Podcasts. Turns my commute from something I hate that stresses me out, into something I look forward to that puts me in the right mood.

</comment><comment><USER18> Razor Pit keeps the Gillette blade sharpened enough for about 2 weeks of shaving. This has been a descent money saver.

<comment><USER19> I recommend looking into Safety Razors. You'll save money, help the environment, and (subjectively) look cooler while shaving.

</comment></comment><comment><USER20> Bitwarden

</comment><comment><USER21> Sam Harris's Awaken App. I've used Headspace and other apps; they've all helped with stress. Sam's approach seems to be more procedural, more of a step by step (if such a thing as true mindfulness can have a step by step).

I've meditated for the better part of a decade but after doing his 50 day course (on the app) I experienced that awakening that they talk about. While it's helped with staying focused and getting work done, I've connected more with my children and wife I have in years.

I highly recommend it to anyone whose tried or thought about meditation but just can't seem to "get it."

[https://wakingup.com/](https://wakingup.com/)

</comment><comment><USER22> My HMA VPN is the best proeduct which I discovered in this year. I like that which I download from [https://freeppsspp.info/ppsspp-games- download/](https://freeppsspp.info/ppsspp-games-download/)</comment>


Windows Terminal 1.0 - <AUTHOR> https://devblogs.microsoft.com/commandline/windows-terminal-1-0/ <comment><USER2> Am I the only one thinking that MS is making those moves several years too late? I jumped out the MS ship 3 years ago and since I'm seeing a solid trend of dev and big companies doing the same.

<comment><USER3> I jumped back around 10 years ago disappointed that graphics programming wouldn't never be a thing on GNU/Linux, and I am still doing pretty alright there are lots of Windows only shops, or those that do Java on a mix of Windows/macOS (as per IT offerings) and deploy on whatever server runs an JVM.

</comment></comment><comment><USER4> Been using the preview with WSL for a few weeks now, really like it. Feels more like a stronger *nix terminal than the Ubuntu app did.

</comment><comment><USER5> Still wishing there was some equivalent to "sudo". The UX of running a priviledged window isn't quite there for me yet.

<comment><USER6> What's wrong with

        Start-Process -FilePath "powershell" -Verb RunAs

<comment><USER7> everything about that is wrong.

<comment> pickle-wizard If it is too verbose for you just alias it.</comment></comment></comment></comment>


F1, like soccer and the metric system, is OK for everyone except Americans - <AUTHOR> http://qz.com/31446/formula-one-like-soccer-and-the-metric-system-is-ok-for-everyone-except-americans/ <comment><USER3> This isn't just a lack of interest in F1, it's an almost complete lack of modern motorsports in general.

Oddly enough, for a country where cars are sacred, the US has barely any capability to develop racing cars of any kind (NASCAR is low tech, Indycar, like most other US racing series, buys its cars from Europe), and there is little to no serious competition.

There are no modern racetracks (besides Austin), the facilities at ovals, even Indy, are cheap, low budget and utterly outdated compared to modern racetracks around the world.

There is very little competition outside the major series compared to the many dozens of competitive racing series around the world, and no way for talent to develop.

NASCAR's commercial success aside, the US is a third world country when it comes to racing.

<comment><USER4> >NASCAR is low tech

Isn't that a common myth?

<comment><USER5> Nascar is low-tech in many ways. The car bodies must fit production sedan templates, so the the chassis is welded tubular steel instead of carbon monocoque like on F1 or Indycar. The engines are carbureted instead of fuel injected. There's no turbochargers (although Indy just got those back this year as well). There are strict rules about spoiler size and type.

They do make extensive use of sensors and telemetry, but the cars themselves are pretty retro.

<comment><USER6> NASCAR moved to fuel injection this past season.

</comment></comment></comment></comment><comment><USER7> As someone who's been an F1 fan for a while (although less so at the moment, but I digress), I've always found it curious that it's never really taken off in America like it could have. Americans love cars, and love racing, it's easy to mock the love of the oval and NASCAR but American teams show up in Le Mans quite a lot, and have a long history of racing on the long, winding and, well, non-American tracks.

Maybe it's just a quirk of culture, something that slipped under the radar and never made it back into vogue. No American drivers, previously no American tracks, no American teams, there's little to get a fan hooked in. F1 suddenly got a lot more coverage in the UK when we had a couple of drivers, and oddly more coverage still when we had drivers doing well, maybe having one _really_ good American driver would change it.

<comment><USER8> > No American drivers, no American tracks, no American teams[...]

F1 was run at the Circuit of the Americas two weeks ago, in Austin. I think F1 is to the USA as NFL is to the UK: there's a dedicated, small audience in both (judging from my Twitter feed), and they're both trying to extend their reach - F1 with more races in the US, and NFL with more games in Wembley. I think F1 is planning a New Jersey street race in 2014 as well.

<comment><USER7> Sorry I should have said 'previously no American tracks', was typing a bit too fast and I'll fix it.

<comment><USER9> There was also an F1 GP held at Indianapolis between 2000 and 2007.

<comment><USER10> I've been an F1 fan since I watched Ayrton Senna get killed 10 minutes after I turned on my first race in '94. Weird, but I was hooked. The last time F1 was run at Indy in 2005 was a disaster. Michelin brought the wrong tires and 14 cars did one lap and pulled into the pits quitting the race.

<comment><USER11> Senna was before my time, and I'm not even a F1 fan, but watching him in action is a mind-blowing display of skill.

Here's an on-board view of an on-board lap in Australia:

<http://www.youtube.com/watch?v=sOkvo5v5-VU>

1400hp engine (in a car body weighing half-nothing), manual transmission (Senna would drive with 1 hand on the wheel a good chunk of the time), no electronic driving aids...pure driving. I've watched documentaries where he would make the car 'dance' in the rain and destroy everyone on the track.

One commentator described his cornering technique - Senna would flick the wheel in the direction of the corner before turning into the bend - <USER2> him to get the tightest possible racing line, so he would brake less than other drivers.

His famous heel-and-toe technique:

<http://www.youtube.com/watch?v=8By2AEsGAhU>

<comment><USER12> That latter video is one of my favorites on YouTube: Senna on Suzuka in an NSX wearing loafers! His skill is truly unmatched, but to be fair, heel-and-toeing is a rather common technique in performance driving. Hell, I do so to match revs on every 3->2 downshift before a corner when driving around town, and I wouldn't call myself a skilled driver.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> > Racing isn't like professional soccer or curling; something that Americans > don't do.

Soccer it top 5 in the USA in most played for both men and women

> and driving a French car (Renault).

Don't tell Red Bull that their car is French

> Americans are too fond of their ovals

Both NASCAR and Indy race on regular racing circuits. The majority of the Indy season this year, 10 of 15 races, is on regular circuits.

> a 120,000-person capacity track. But, said Weaver, a large part of that > audience was from Mexico, Latin America, and South America.

Ridiculous and unsubstantiated. I know a large number of US based fans who went to the race. It averaged 2.2M viewers in the USA.

This article is furthering poor generalizations from both sides of the Atlantic about the various sports.

For a better and more accurate take on F1 in the USA see The Economist:

[http://www.economist.com/blogs/gametheory/2012/07/formula- on...](http://www.economist.com/blogs/gametheory/2012/07/formula-one-united- states)

<comment> k-mcgrady Just to clarify a few things:

> "Don't tell Red Bull that their car is French"

It's not. They use Renault engines but the car is built in Milton Keynes, England by the team.

> "Ridiculous and unsubstantiated"

I'm not sure it's been confirmed but it was talked about that 40% of the tickets to the Austin GP were bought by Mexicans.

</comment></comment><comment><USER14> I'm American, like F1 _and_ NASCAR but rarely spend time watching either (or any other television). I also prefer to drive on a winding country road in a European touring sedan versus more boring routes.

I played soccer (shouldn't he have said football?) when I was younger and I'm fine with the metric system (the real question is why they taught it in elementary schools starting in the '70s, but didn't bother switching).

I think there are a lot of people in the US like me, but we don't spend enough money to get sponsor/advertiser attention. When was the last time you saw F1 tee-shirts, or F1 drivers on beer cans? Which events are offered is all about the almighty dollar.

<comment><USER15> It's 'football' in the UK, but in most of the rest of the Anglophone world, it's 'soccer'. Australia has its own 'football', as does Ireland.

<comment><USER7> Oddly in most of Europe it's 'football' as well, EUFA, IFA, Ligue de Football and so on, seems to be quite fractured depending on whereabouts in the world you are, and with the rise in people learning American English through TV/movies/etc I can see it becoming more popular to call it soccer.

<comment><USER16> it's football in south america too ( Fútbol,Futebol).

Maybe of interest:

<http://en.wikipedia.org/wiki/Names_for_association_football>

</comment></comment></comment></comment><comment><USER17> I guess its the international America-hating crew on HN at this hour but come on, this story has nothing to do with tech and is not even a good sports story. It is just a way for smug Europeans to feel superior. Get over yourselves.

<comment><USER18> It's so rare Europeans get to be superior -- let them have it. They do in fact have superior motorsports. It's okay, whenever an American feels bad, they can just look at the moon or Mars and smile.

<comment><USER19> Every heard about Wernher von Braun? ;)

<comment><USER20> And Sergei Korolev - perhaps the greatest rocket designer of them all?

</comment></comment></comment></comment><comment><USER21> Man, this website has the worst navigational experience ever. I accidentally flicked my magic mouse upwards and I was on another article, I tried to correct it by scrolling to the bottom but I ended up at yet another article instead of the original one.

Before I knew it, I was just lost.

<comment><USER22> Agreed. Can't use my android phone to nav around. It just flips articles.

</comment></comment><comment><USER23> No real meat to this article. Americans don't love F1 because the track isn't oval? Really? And the shot about how poor F1 drivers do well in NASCAR ruins the credibility of the argument even more.

</comment><comment><USER24> I think the culture of NASCAR really prevents people who would be more interested in F1 from approaching motorsports.

The reality is that the Venn diagram of people who shop and Wal*Mart and people who watch NASCAR is probably closer to a circle than a lot of people are comfortable with.

</comment><comment><USER25> "You don't have Javascript enabled" so let's show you just how badly we can make rendered HTML look. Great work there Quartz!

As for the article, it's an article about racing, not sure why they mentioned football or the metric system at all, but to mention it in the context they have, they should've called it by it's proper name "Football" and then perhaps added "Soccer" in brackets.

<comment><USER26> If you don't have Javascript enabled that's a conscious decision you've made, fully aware of what the tradeoff is.

Either turn it on for websites you want to read properly, or just accept the fact that it's 2013 and the vast majority of websites use it.

<comment><USER27> I do have JS enabled but still run into problems. Probably some script blocking plugin that's causing them but the cause doesn't really matter, what does is the fact that it's preventing one from reading the article.

There's really no reason at all to obfuscate text based information in such way unless you want to display ads or track the user. It even shows the actual article behind the loading screen but you can't read the article itself since the loading never finishes. That's just bad design.

It's not the first time I've had to open lynx in order to read an article that's behind some javascript nonsense. (note: the text data is fine, it's actually only broken on modern browsers which actually handle js)

<comment><USER26> _shrug_

What can I tell you? If you are using a script blocker this is what you get in the current landscape. There really _isn't_ a reason why text should be mangled without javascript, but that's just the way it is with some sites.

</comment></comment></comment></comment><comment><USER28> I'm an American and love F1. I hate NASCAR because ovals are boring, like soccer. Hockey is even better. NASCAR also sucks because it uses spec cars instead of letting teams be creative. NASCAR should include real muscle cars and allow the Camry to be front wheel drive if that's what Toyota wants.

</comment><comment><USER29> Just another thought on this. We had an American in F1 just a few years ago. Scott Speed drove for Toro Rosso. Unfortunately I think he was mediocre and drove for a mediocre at best team. American Alexander Rossi tested for Caterham F1. And American Conor Daly is enjoying success in GP3.

</comment><comment><USER30> I am a little surprised that Grand Prix Montreal did not even get a mention in the story. F1 supporters travel all over the globe to watch their teams, so it seems odd not to include an event in a great city within easy driving distance of fans in the northeast.

</comment><comment><USER31> Driving on complicated non oval tracks is just in-American.

What I don't get is how a racing sport derived from bootleggers outrunning police on back country roads turned into driving around an oval track.

<comment><USER32> Streetracing is a topic I'm hoping to somehow appear in Boardwalk Empire in the future. I will be disappointed if it doesn't get mentioned even as a third-rate scene or side joke.

</comment></comment><comment><USER33> Thanks to the sheer weight of numbers of people in the Indian subcontinent, I'd say cricket is second only to soccer in global popularity.

</comment><comment><USER34> The story of sports in America is the story of television interests. The reason the media doesn't promote F1 is that they cannot control the sport from that point of view. What TV (other than specialized channels) is interested in a sport in which half of the races happen before dawn (in Asia)?

The only sports that do well in America are the ones with a powerful league that can control all the TV rights and make the necessary deals with TV networks.

</comment><comment><USER35> Just to note, any discussion of the issue that does not mention Talladega Nights is incomplete.

</comment><comment><USER36> An article like this on the homepage is probably the result of someone gaming the system. This is when a down voting arrow would come in handy.

<comment><AUTHOR> feel free to check my submission/comment history. good day

</comment></comment><comment><USER37> Americans getting defensive ITT</comment>


Ask HN: Obtain a .us domain without a current US nexus? - <AUTHOR> I have secured domain names for a brand idea that would also sound good with a .us suffix ("us" completes the phrase). If the brand gains recognition I suspect the .us version of the domain will be promptly squatted.
The usTLD nexus requirements are stringent: <https://www.about.us/policies/ustld-nexus-requirements>
Neustar even has a clause prohibiting the creation of a nexus in the United States "conducted solely or primarily to permit it to register for a usTLD domain name".
Thank you for discussing whether a foreigner without a US nexus has additional legitimate options to grudgingly leaving the domain name unregistered. <comment><USER2> Find a US person who registers it for you and who also signs a one- paper/contract to give you full power over the use of the domain. I've done this for an Australian domain once. It might get legally challenged by somebody with a similar brand (I personally doubt that) but better than arguing with a domain squatter who surely will ignore any restrictions.</comment>


Google Web Starter Kit - <AUTHOR> https://developers.google.com/web/tools/starter-kit/ <comment><USER2> I'd advocate most people avoid this if their intention is to write an app. As an alternative, I'd suggest evaluating create-react-app [0] or preact-cli [1] if you're looking for something lighter. The lack of testing setup and module support in this kit feels like a regression, although I'll concede that it really depends on your use-case.

I've been using webpack [2] for a few years and wouldn't willingly go back to this style of writing web apps. Once you learn how to use it, the world is your oyster. You can write a loader or plugin to achieve pretty much any kind of requirement that comes your way.

Consider replacing sass with cssnext [3], or even directly using postcss along with the few plugins you need. As an example, you can use native css variables during development and compile em away for production. Another great addition is the :matches selector, which makes for much cleaner selectors in certain cases. I never really found much value in most other sass features.

Instead of running imagemin as part of your build process, consider installing imagemin-cli [4] and applying optimizations before checking in images. That way it only has to done once, regardless of how many times someone checks-out your repo.

Even if you enable ES2015 compilation with babel, you don't get any polyfills. That means trying to use standard ES2015 globals like Map, Set, or Promise will not work on older browsers. If you're gonna tell people they can add ES2015 support by changing a single line, it would seem prudent to mention this gotcha.

[0] [https://github.com/facebookincubator/create-react- app](https://github.com/facebookincubator/create-react-app)

[1] [https://github.com/developit/preact- cli](https://github.com/developit/preact-cli)

[2] [https://webpack.js.org](https://webpack.js.org)

[3] [http://cssnext.io](http://cssnext.io)

[4] [https://github.com/imagemin/imagemin- cli](https://github.com/imagemin/imagemin-cli)

<comment><USER3> As someone who last web-dev'd in the day of ASP.NET MVC, GWT, jQuery, and backbone.js, this post reads like one of those modern JS development satires [0]

I know you meant well, and this is just the state of the world, but I can't help but feel like a dinosaur just because I spent the last 5 years focusing on server/cloud infrastructure.

Is there any hope for someone like me if I ever want to step back into it? I ask sincerely. It seems like every best-practice framework's compelling proposition these days is that it's "like XYZ, but fixes this obscure edge case", where XYZ is something that only came out 2 years ago, so I never used it, never mind understood properly.

[0] [https://hackernoon.com/how-it-feels-to-learn-javascript- in-2...](https://hackernoon.com/how-it-feels-to-learn-javascript- in-2016-d3a717dd577f)

<comment><USER4> The way to step back into it is to ignore the library froth, pick something that looks understandable from the principles you already know, and build something useful.

Many people spend X hours a day obsessing about whether css-turd-polish.io is better than Sassy.js v4. If you spend those hours working on something productive, you're automatically ahead.

The framework churn is increasingly a perpetual motion machine for conference talks. Don't go to conferences and you won't feel like you're missing anything.

<comment><USER5> What if I want to _hire_ frontend devs for a green-field project—what tech- stack experience do I look for?

<comment><USER6> Don't bother with specific tech stacks, because as mentioned, the churn rate is really high. Instead, hire good _problem solvers_ who you can tell from their interviews will be able to choose a framework that works well for your new projects, or adapt to the framework you've chosen yourself for your existing ones.

Understand that good programmers are kind of hard to find, but okay programmers with experience in XYZ stack are not. Why? Because any reasonably competent programmer can become familiar with a new framework or library in about a week or two. Being able to separate the signal from the noise, and architecture an application well within that framework? That's what you're looking for. The tools themselves aren't that important.

<comment><USER7> Of course, to follow this advice you have to be able to identify problem- solving ability, which is hard and why most hiring managers fall back on buzzword bingo--to say nothing of HR departments.

</comment></comment></comment></comment></comment></comment><comment><USER8> > Powered by Material Design Lite

That's a curious choice. MDL isn't being developed further and is being replaced by _" Material Components for the web"_ [https://github.com/material- components/material-components-w...](https://github.com/material- components/material-components-web)

From [https://github.com/google/material-design- lite](https://github.com/google/material-design-lite):

      Limited support
      Material Design Lite is now in limited support, with development having moved to the Material Components for the web repository.
      No further development is taking place in MDL by the core team, but we are happy to review PRs, fix critical bugs and push out new releases. No breaking changes will be accepted.

<comment><USER9> > Last updated February 9, 2017.

[https://github.com/google/web-starter-kit](https://github.com/google/web- starter-kit)

> Last release (v0.6.5) on December 13th

That choice is not that curious if you correct for project age.

<comment><USER10> Seriously... this HTML/JavaScript template is FOUR MONTHS OLD, for God's sake! Might as well be jQuery.

</comment></comment></comment><comment><USER11> Looking at this page, and reading the comments here on HN, I'm glad I'm not a web developer. What a mess.

<comment><USER12> The 'mess' is like trying to buy a car. Once you get through all the annoying sales pitches, conflicting opinions, dealer gotchas, options, and mental monthly payments... you're finally in your new car and happily rolling along, learning how it works and making it fit with your life. Then as time passes you see all your friends and strangers driving X, you hear about Y, and you really wish you could get your hands on Z, and all of a sudden your car feels inadequate so you hate it and complain about it until you can get your new car... or maybe you'll build your own car... hmm.

The mess of Web development is choosing what to use. It's pretty fun once you get behind the wheel.

<comment><USER13> The issue with web development is that there's no good, or working solutions. Every car that's up for offer is missing something.

One of them can only be driven if you control every single circuit manually, the next is missing an engine, and another has no windows, roof, doors, or seats.

Each of the tools would probably be useful for some purpose in a way, but with the entire toolbox of JS utils combined, it's just a fractal of bad design.

On the other hand, you can look over into the JVM world, and, well it just works. There's one option for dependency management and handling of compilation and preprocessing (gradle), you don't have to handle any complicated libraries or anything, you can very easily add annotation processors or asset preprocessors as easily as adding a new dependency, and basically everything works natively together.

I want to add preprocessing so my JVM 8 code works on JVM 6 or later? I simply add the retrolambda preprocessor, and am done. One LOC.

Configuring Babel in the JS world, on the other hand, ends up with several hundred lines of webpack or grunt or gulp configs, you end up dealing with either merging all assets or using system js or whatever the latest fad is.

The JS world has recreated all the complexity of the JVM world, but worse.

<comment><USER14> > _The issue with web development is that there's no good, or working > solutions._

This complaint generally comes from the opposite direction—that the JS ecosystem provides "too much choice", which can lead to FOMO or analysis paralysis if you let it.

> _On the other hand, you can look over into the JVM world, and, well it just > works. There's one option for dependency management and handling of > compilation and preprocessing (gradle)..._

Gradle, Maven, Buck, Pants, Bazel…

<comment><USER13> > This complaint generally comes from the opposite direction—that the JS > ecosystem provides "too much choice", which can lead to FOMO or analysis > paralysis if you let it.

That's exactly the issue. You have two hundred choices, but all are broken. Every single choice is missing something. You could patch them together, and get something that kinda works...

...or the developers of the two hundred solutions could work together on a handful of solutions, and have a handful of working solutions.

> Gradle, Maven, Buck, Pants, Bazel…

Buck, Pants, and Bazel are basically unused for now, as none of them handle dependencies properly, and they are almost exclusively used in large, corporate codebases with vendored dependencies.

They are as relevant to this discussion as Perforce is to a discussion about version control: Most startups or users will never have to deal with it.

<comment><USER15> It's on the way though. I'm amazed that writing javascript is starting to feel (a bit) like scala, once you add transpiling from ES7, lambda syntax, optional implicit typing, modules, a focus on immutability, etc. It's so much nicer than what javascript used to be while keeping full backwards compatibility

And we get to keep the miracle that is robust sandboxing for dynamic code download and execution, and a choice of browsers from vendors consistently following one spec.

<comment><USER13> > It's on the way though. I'm amazed that writing javascript is starting to > feel (a bit) like scala, once you add transpiling from ES7, lambda syntax, > optional implicit typing, modules, a focus on immutability, etc. It's so > much nicer than what javascript used to be while keeping full backwards > compatibility

Even if you use TypeScript, the type system is subpar, the tooling for static analysis is mediocre, and you still need complicated transpilation steps.

As mentioned, I extremely hate the entire build and dependency management infrastructure of the JS world.

<comment><USER15> I'm using flowtype and it's certainly no Java, but it's just enough (for now) to build robust front-end SPAs

Would be interesting to transpile from more strongly typed languages also, that's probably where the mainstream is heading

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Am I missing something? This thing came out like three years ago. If this is news: EVERYONE, CHECK OUT THIS AMAZING THING CALLED BOOTSTRAP!!1!

 _scnr_

<comment><USER17> I had the same question, repo has no commits since April 4 and only one release dating back to December last year, and, as another comment pointed out, it uses MDL which has been discontinued in favor of Material Components.

</comment></comment><comment><USER18> An opinionated Web Starter Kit with no libraries or frameworks included? What is Google's opinion on which way to build a web application, roll your own?

<comment><USER19> > What is Google's opinion on which way to build a web application

Angular! Wait, Angular 2. No wait, Polymer. Sorry, how could I be so rude - Progressive Web App with no framework.

<comment><USER18> Yeah. As usual Google's strategy is fragmented and erratic.

Angular2 looks solid, but I'm happy with React despite the warts in the ecosystem.

<comment><USER20> > As usual Google's strategy is fragmented and erratic.

Tech trends are capricious - perhaps they are covering all the bases and self- disrupting? There is a 2014 Ars Technica article titled "Google's product strategy: Make two of everything"[1].

[https://arstechnica.com/business/2014/10/googles-product- str...](https://arstechnica.com/business/2014/10/googles-product-strategy- make-two-of-everything/)

</comment></comment></comment></comment><comment><USER21> Nobody new to web is going to understand this stuff and people who would really understand this advice could already give it themselves. Not sure who the target audience for this is supposed to be but why do we need yet-another- web-boilerplate

</comment><comment><USER22> The right amount of configuration is zero.

create-react-app gets it.

This does not.

</comment><comment><USER23> Hmm, interestingly I got the foobar challenge when I visited the site.

</comment><comment><USER24> Gulp, how quaint

<comment><USER25> Indeed

</comment></comment><comment><USER26> I'm glad to see they are using gulp. I know webpack is the hot new technology, but in my limited experience with webpack, gulp is easier to use and is more intuitive. Webpack has a lot of loaders, but I feel like gulp gives more flexibility out of the box. When I want to do something with gulp that I don't know how to do, I feel like it is easier to implement with gulp, because gulp seems to be a bit lower level. I noticed that they updated the docs for webpack since I last visited, so maybe I will try again.

</comment><comment><USER27> > _.gitignore: node_modules_

Wait, did I miss something? Wasn't it google who started the "vendor everything" philosophy in the first place?

<comment><USER28> So? What's wrong with this? Why would someone check-in all the 3rd party code, when same can be described in package.json & downloaded again.

<comment><USER29> I started seeing the floating dependency approach at smaller places and personally consider it a bad pattern.

You get everything you depend on, stuff it into a folder named third-party, and check it in forever (or until security bugs, features you need, etc). Include all and any licences, this is important.

When dealing with any software that's supposed to be our there for decades, the last thing you want it to have unplanned work because of missing libraries.

<comment><USER30> I have seen this first hand at a acquisition. Missing licenses resulted in the entire FE team working in finding missing licenses/find alternative module with proper license or worst case scenario; implement our own solution. This literally took 1 week. Shrink-wrap would have saved us a bunch of $$$.

<comment><USER31> You have to be careful about the type of licenses as well. Happened to me, luckily it was a tiny library and there was an alternative available.

See anything with a "cute" license, such as WTFPL? Don't use it for work.

<comment><USER32> What's wrong with WTFPL?

I needed some wtfpl code for something, and asked a team of corporate lawyers to evaluate it.

They deemed acceptable, and whitelisted it at one of the biggest software companies around.

<comment><USER31> Another one of the biggest software companies around came to the opposite conclusion :(</comment></comment></comment></comment></comment></comment></comment>