LA Times and ads - <AUTHOR> https://nelsonslog.wordpress.com/2017/03/25/la-times-and-ads/ <comment><USER3> I resisted using an ad blocker for many years; I kinda felt like if I wanted to use a site, I should be willing to trade for seeing their ads. I've changed my tune a couple of years ago, and this is a (small) part of the reason (but a bigger part of it now that I know how crazy usage for ads has gotten).

I'm on mobile data nearly 100% of the time most months. 14GB costs me $50-$70 (depending on which network I'm on, I have two) to download ("unlimited" plans actually aren't, when used as a hotspot, though T-Mobile now seems to actually have a mostly unlimited hotspot option, I haven't tried it yet). So, not only are ads intrusive, disrespectful of privacy, and generally of negative utility for me as a user...they're also ridiculously costly.

So, yeah, I use an ad blocker. Oddly, I tried disabling it earlier today for an LA Times article (because of their blocker blocker), but it didn't correctly detect that I'd disabled it, so I closed it and went elsewhere. Now I know I should never disable ad block for LA Times, no matter how interesting the story seems.

<comment><USER4> I recently (past year) bit the bullet and began ad blocking myself. My primary concern is the recent proliferation of malicious content through the common ad networks. Supporting websites is great, but not at the expense of your own security.

<comment><USER5> Maybe we need smarter ad blockers.

Publications right now have little incentive to improve their ads with regards to security, readers' resources or quality – because if the LA Times motivates you to install an ad blocker, the NYT is getting hit as well. The tragedy of the commoners, so to speak.

If ad blockers would aggressively judge each publisher, ad network and/or advertiser and rewarded good behaviour by showing the ads, I could see publishers prioritising the user experience. I'm pretty sure the publishers and journalists themselves look at these websites with horror, and they'll jump at the chance to regain some quality.

The adblock+ model is tangentially similar, but charging the publishers is simply too close to blackmail to be acceptable.

<comment><USER6> In other parts of the world they would find who is making those ads and who is in charge of those and burn their houses down or chop them with machetes. Suddenly the number of people willing to produce ads for clients and said clients is dramatically reduced.

I'm not suggesting this kind of extreme response, my point is there's no punishment for putting up those ads so there's no incentive to behave correctly and we're stuck in a spiraling vicious cycle. Breaking this cycle and turn into a virtuous cycle requires a paradigm shift and I'm afraid this is not going to happen by itself. Moving away from ads as a business model means wiping out google, facebook and a few others big players so whatever effort to emerge a new business model will be resisted by those who have the power and can burn money for years without even noticing it.

Until then I have two solution, the first is a combination of noscript[1] and ublock origin[2] in my browser and the the second is wallabag[3] which for the LAT page given as example gives this: [http://share.pho.to/AegpU](http://share.pho.to/AegpU)

[1]: [http://noscript.net/](http://noscript.net/) [2]: [https://github.com/gorhill/uBlock](https://github.com/gorhill/uBlock) [3]: [https://wallabag.org/en](https://wallabag.org/en) and [https://wallabag.it/en](https://wallabag.it/en)

<comment><USER5> Those are some pretty racist stereotypes you have of wherever you think people are going around chopping each other with machetes.

<comment><USER7> I don't think he singled out a specific race. I would say that it's not too far put though. The world is a pretty ugly place in some parts.

I think we in the tech community need to work on smarter ad blocker. The history goes that ad folks abused window.popup and then browser vendors blocked that. Then came chrome who is supported by world's largest ad engine, but they were nice to give us extensions. So we had adblock extensions that gave us a ton of CSS injected in every page. Now need smart js to fool the page thinking it has ads.

I would love to see browser support showing a big fat red icon when you're being tracked and page is misbehaving.

</comment></comment></comment></comment></comment></comment><comment><USER8> I develop software used by newspapers. This is a problem with the whole industry. It's amazing how much crap they load.

These sites all use a third party "tag manager" (Google Tag Manager, Tealium, Piwik etc.) to manage the scripts they load: ads, analytics, trackers etc. The people who use the tag manager typically aren't techies, so they don't understand that adding another tag will cause the page to slow down. Typically I've seen a single newspaper use 3-4 different vendors for the exact same thing, such as analytics. They don't actually use all of them; who knows why they have multiple overlapping ones.

Scripts are often badly written, and it's common to see lots of nonsensical errors spewed to the console. It's very annoying to debug your own stuff when you have that crap loaded, which typically comes from a header/footer combo provided by the customer.

<comment><USER9> The worst type of ad on newspaper sites are the disgusting "chumboxes" (by scumsuckers like "taboola" or "outbrain") that orbit at the bottom of pages and serve up images meant to be as simultaneously repulsive and fascinating as possible:

[https://theawl.com/a-complete-taxonomy-of-internet-chum- de0b...](https://theawl.com/a-complete-taxonomy-of-internet-chum-de0b7a070a2d)

As long as these pages have ads that display utterly gross images (if you doubt me, click the above link) that make _goatse_ look like pure mindbleach, i'll keep blocking JS and ads.

<comment><USER10> It made me sad when boingboing put one of those ad boxes on the site.

I work in digital media. I get why publishers do it. But, sheesh, if you're resorting these ads that insult your audience in exchange for pennies, I think you need to reexamine your approach.

<comment><USER11> Let's not beat around the bush: some publishers do that kind of thing because they are scumbags.

<comment><USER10> I don't really agree. I don't think that's fair.

<comment><USER12> It's presenting your audience with misinformation, false hope, and scams. It's incredibly scummy. Those type of ads prey on people's desperation and gullibility, and there are actually people who will fall for them and waste time and money in the process.

</comment></comment></comment></comment></comment></comment><comment><USER13> > That's a timeline of 30 seconds of page activity about 5 minutes after the > article was opened. To be clear, this timeline should be empty. Nothing > should be loading. Maybe one short ping, maybe loading one extra ad. Instead > the page requested 2000 resources totalling 5 megabytes in 30 seconds. It > will keep making those requests as long as I leave the page open. 14 > gigabytes a day.

It's not quite clear if 14GB/day is an extrapolation based off the author's sample of 5 MB/30 seconds or if the author actually left the page open for all 24 hours. Regardless, that's quite a bit of data.

<comment><USER14> Hi I'm the author. I did the naive extrapolation. 5 * 2 * 1440 = 14,400. Perhaps this number is not entirely accurate. The fact it is any larger than, say, 10 is the problem.

<comment><USER15> That's a terrible methodology, and makes the headline pretty inaccurate. (Edit: looks like the blog headline isn't inflammatory at the moment: did you change it, or did the HN poster insert the 24-hour figure?)

I'm against bad ads as much as everyone else, but I don't think using a terrible methodology to criticize them is a good idea. Making clear what you measured would be much better, and actually leaving the thing open for 24 hours would be best.

<comment><USER16> In the time since I read the linked article, I opened the LA Times site and navigated to a story, opened my network console, and read some comments on HN about the article.

Safari says it's been about 12 minutes. It's requested over 1000 resources (it pegged 999+ at ~2 minutes). It's downloaded 88.4 Megabytes of data. It appears to be continually firing pixels from a multitude of places (openX and doubleclick are common). It's also downloading a number of different videos. The article I opened does not have any videos related to it's content. This article is open in an unfocused window; I have not fired any scroll, click, or touch events natively after the few seconds I opened the link, scrolled a bit, then came back to HN.

88.4 megabytes in a few minutes. I remember when my modem couldn't download more than a couple megs in dozens of minutes, and I'm a shitty stupid millennial, not some graybeard. Maybe it could hit a gig, or 14, in a day, but the point really remains set: the LATimes site is absurd.

<comment><USER14> Your measure pencils out to 10 GB/day. Someone else here found 7 GB/day. Perhaps it's a Safari vs Chrome thing.

(In case the sarcasm is not clear: the problem is that it's anywhere over 0.01 GB.)

<comment><USER17> I only got to 13.6mb/10mins before the page crashes. So I guess that counts as a safeguard.

[http://i.imgur.com/PIcpEPJ.png](http://i.imgur.com/PIcpEPJ.png)

</comment></comment></comment></comment></comment></comment><comment><USER18> So in case you were looking for another reason to avoid the LA Times (or probably tronc papers in general), they're very spammy. I get tons of junk "newsletter" mail from them that I definitely didn't subscribe to, although they inevitably claim I did, and you can unsubscribe, but then they just invent new lists. And sell your address to others.

Sample from only a few days ago.

        From: "San Diego Union-Tribune" <email@example.com>
        Subject: We are proud to offer you Moonlighting - Hire or be hired!
        Received: from mta953.e.latimes.com (mta953.e.latimes.com [220.127.116.11]

        [Blah blah bullshit about their proud partner promoting a soulless gig economy.]

        This email was delivered because you registered for Email Membership at utsandiego.com

This is 100% false. I did create an account for latimes.com (who sent this shit) but not the San Diego paper. Not even close.

<comment><USER19> I've used Mailhero in many places, works great!

See [https://news.ycombinator.com/item?id=11781361](https://news.ycombinator.com/item?id=11781361) or [https://mailhero.io/](https://mailhero.io/)

<comment><USER20> I want something like mailhero combined with a paid email provider like proton mail. Everything sent to $name@$spamkey.$mydomain.$tld would act like a mailhero address and forward to my personal address.

<comment><USER21> Try spamgourmet.com

</comment></comment></comment></comment><comment><USER22> Garbage like this is one of the many reasons I've gone back to print to a large extent. Printed magazines are amazing things, a superior experience and product in almost every way to reading online outlets. This whole ethical conflict over how to deal with invasive advertising while supporting the work goes away when you bought and paid already before you even start to read.

Daily news doesn't fit into this philosophy that well (printed papers is too much bulk for me), but I get pretty much all the "breaking news" I need from Twitter. Stepping away from the 24 news cycle to sit with a piece of analysis from a weekly or monthly (or even quarterly!) magazine is a much better way for me to stay informed and support journalism. And as a bonus I don't have creepy ads follow me around the internet if I want to read a Socialist magazine, or a gun rights magazine, a bridal magazine, or whatever.

<comment><USER23> you can buy digital subscriptions to many newspapers, including the LA Times

<comment><USER22> I don't know about LA Times specifically but the digital product often still includes invasive user-tracking bandwidth-intensive advertising, just toned down to what people consider "acceptable" levels. For example, the NYT digital sub that I pay nearly $200/year for still serves me advertising. So ponying up the cash doesn't do much to address the concerns that are being raised all throughout this thread.

</comment></comment></comment><comment><USER24> This is why data caps are bad. Left open all month that could be 400+ GB of data used on your plan.

Ad networks are being subsidized by data caps and personal/business broadband costs. Maybe if ad serving went through the main host and their own bandwidth then maybe ad networks would have a reason to control this abuse of transfer.

<comment><USER25> Or on the flip side. Data caps will make people care about how much data their site uses. Cause customers will stop using data heavy sites as they have economic insentive not to.

Making the web all around faster as no more 10MiB webpages, and making the industry move back to server side rendering.

<comment><USER18> "total data transferred: X MB ($y.zz)" should be part of a browsers standard status bar.

<comment><USER26> I know we can easily get some info from chrome dev tools and chrome://net- internals/#bandwith. It would be convenient for users if someone put together an extension that would display this information by default, or alternatively browsers just had a setting we could turn on.

<comment><USER27> On it

</comment></comment></comment></comment></comment><comment><USER28> Watching the requests, there's a huge number of mixed content warnings in the console. Attempting to hit [https://www.latimes.com](https://www.latimes.com) to remove the reason for all of those failed requests triggers Firefox to throw a certificate error. Could all of this be a side effect of a certificate that has gone bad?

> www.latimes.com uses an invalid security certificate.

>

> The certificate is only valid for the following names:

> _.akamaihd.net,_.akamaihd-staging.net, _.akamaized- > staging.net,_.akamaized.net, a248.e.akamai.net

<comment><USER28> Folllow-up question.

Do Doubleclick ads typically employ a cache control policy of "no-cache, must- revalidate"?

</comment></comment><comment><USER29> Sites will use the disguise of "Native Ads" to make these links look like standard web page links, and they'll do every attempt to avoid being blocked or hidden.

Using base64 images, websocket/blob: injections, third-party scripts, natively hosting the images on the site and using also webRTC to also inject.

Its a long fight of countering/re-countering, and until website developers listen to its users these type of ads aren't acceptable.

/Fanboy from Easylist here

</comment><comment><USER30> "An attentive eyeball! Fire at will to trigger consumption!"

</comment><comment><USER31> But how many users would actually be willing to pay for the content they consume in order to get rid of ads and tracking and excessive data volume consumption? And how much would they be willing to pay? It seems like they would have to be willing to pay at least an amount comparable to the average ad revenue per user and page view, whatever that actually is.

Just blocking ads is certainly justifiable in the current situation, but it also certainly not sustainable if the ad blocker installation base keeps growing. And buying subscriptions for all sites is not really an option either. It becomes quite expensive pretty quickly, especially if you want the see only a few articles per month on each site but do so on many sites.

<comment><USER11> Lots would if it weren't so inconvenient. I read articles from maybe 100 different news sources in a typical month but realistically I don't want 100 newspaper and magazine subscriptions, or 100 different subscription offers or website accounts.

Why isn't there something like a Netflix for News that just gives me news free of visual cruft and takes care of distributing the revenue from what I read in approximately accurate portions to the content providers, not to mention a seamless interface for socially rating and categorizing news?

Newspaper/magazine subscriptions made sense when newspapers were heavily local and magazines were periodicals. Neither condition really obtains any more and having multiple subscriptions is not worth the overhead for even a small number of publications. The last time I made the mistake of subscribing to a magazine I also saw a huge increase in junk mail for several years afterwards. GFTO of my mailbox with that shit.

<comment><USER31> _Lots would if it weren 't so inconvenient._

I am not really sure about that. About 10 % of all Internet users are currently using an ad blocker. So 90 % are okay with ads or don't care or whatever. Further I would estimate that users would have to pay between $5 and $10 per month to pay for the content they consume to provide an income for sites comparable to that of ads. Maybe 1 % of the ad blocker users - <USER2> pulled out of thin air - would be willing to replace their ad blocker with a monthly payment of $10 if this would would work frictionless, if you could magically convince the entire Internet to create some Netflix equivalent.

In the end that would be 0.1 % of the Internet users which seems not really a huge incentive to bring such a Netflix equivalent into existence.

<comment><USER11> That's exactly what people said about Netflix, so I'm gonna disagree without bothering to support my argument further.

<comment><USER31> I actually tend to believe that it could work but I also have some remaining doubts. In my comments I explicitly focused on dismissive arguments and points where I have doubts, hoping that someone would either back those doubts up or refute them. You should definitely not draw the conclusion that I think I could never work from the way I argued.

</comment></comment></comment></comment></comment><comment><USER11> _They are also the most aggressive ad shoveling website I have ever seen. Their ad blocker blocker and paywall works, preventing me from reading articles._

It keeps working even when I have my ad blocker turned off. Obviously I must have some anti-tracking extension still enabled that it dislikes, but I'm not willing to spend that much time troubleshooting my browser. It's baffling to me, because the LAT is one newspaper I'd consider a digital subscription to, but as this article says the advertising/marketing people have clearly won out over the editorial, so fuck'em until that changes.

<comment><USER18> I would discourage you from getting a subscription for other reasons, but will note that subscribers don't get grief about ad blockers.

</comment></comment><comment><USER32> I have been reflecting on this problem a lot over the past six months since I left the ad tech industry after four and a half years. These posts always sadden me, because I recognize the importance and value that advertising brings to web startups and the level of innovation and growth that it has enabled.

I have a hypothesis on how we can reduce the number of these types of ads, while also not harming advertisers or publishers in terms of reach and revenue.

I believe that we are in an advertising death-spiral. Sites are adding additional impression opportunities and ad placements. This is triggering higher numbers of impressions available to programmatic buyers. The additional number of available impressions is devaluing the impressions (we're flooding the market), which has led to a perpetual decrease in CPMs every year. This leads to publishers pushing higher "engagement" ads, which users just find terribly annoying, as well as more ad units. The cycle repeats, repeats, and repeats, just so both sides can "stay effective" with regards to whatever metrics they are measuring against.

My belief is that the LA times does not need N ad placements per article. They probably only need one. We don't need to junk up quality news organizations with taboola and the other "content" recommendation platforms. We quite literally need a détente.

LA Times goes down to one ad placement per article. LA Times advertiser is guaranteed viewability (high placement in the article, for example), and 100% share of voice. The "impact" of that ad increases, with the overall decrease in other "noise". The cost also goes up, but commiserate with the increased value. Both sides likely end up making / paying the same amount of money, with likely the same level of impact for the advertiser, but they reduce the pain on the user, which they should both care about deeply.

I'd like to believe this is an opportunity from a business perspective. I believe that someone could demonstrate this value, in some way, to both sides of the market. The advertiser would need fewer impressions to achieve the same level of value / impact of their ads, which also has the side benefit of reducing additional costs around TPAT tracking, analytics costs, general tracking costs, etc., which are often priced on a CPM basis (so, fewer CPMs lowers their bill). The publisher would potentially see better engagement from their users, fewer ad blocks, and a higher quality experience.

I think for the sake of newspapers and advertisers alike, some way to make this reality makes this an idea worth solving.

<comment><USER33> Fox tv tried a similar thing a few years ago. Dollhouse and Fringe had fewer commercials. [http://www.nytimes.com/2009/02/13/business/media/13adco.html](http://www.nytimes.com/2009/02/13/business/media/13adco.html) After one season they went back to the same amount of commercials as other shows. [https://mediadecoder.blogs.nytimes.com/2009/05/14/fox- scraps...](https://mediadecoder.blogs.nytimes.com/2009/05/14/fox-scraps- remote-free-tv/comment-page-1/)

<comment><USER32> Thanks for the link. That's a good highlight.

The experimenter in me reads that article (and mind you it's very brief), and I actually get encouraged. They were attempting to measure it on a pure 1:1 basis, where all their other shows, as well as all the other shows on broadcast TV, were following the standard model. Educating advertisers is a challenging step in this process, and so it's no surprise they couldn't get the pricing right on the first go around.

Hopefully they decide to try again, test, iterate, and think outside the box.

</comment></comment></comment><comment><USER34> Well, I can read the article in Firefox with Adblock Plus _if_ I enable Reader View before the modal box opens :)

Learned that trick here. Thanks, guys.

Edit: Automatic Reader View add-on eliminates the race.

</comment><comment><USER35> I visited the article he mentioned had had no issues. Ads and videos and everything from third-party sites were blocked and all I had was the text of the article. I think the author has got to tune his ad blocking tech.

Edit: uBlock Origin blocked 20 third-party domains. Totally typical of web sites these days.

<comment><USER14> I use uBlock Origin too, and the LA Times definitely detects I'm using it and puts a big uncloseable popup demanding I turn it off. I think it only does this after repeated visits though, not the first.

<comment><USER35> Do you block all third-party resources?

<comment><USER14> I don't think so. I have not extensively reconfigured uBlock Origin. What setting are you thinking is relevant?

BTW, this custom filter rule seems to work around the LA Times blocker blocker. [https://news.ycombinator.com/item?id=13567527](https://news.ycombinator.com/item?id=13567527)

<comment><USER35> You have to enabled "advanced user". Then on the "third-party" line you can select to block. Be forewarned that your browsing experience will default to a mid-1990s experience as you'll likely have no JS nor CSS since those are now often served by different domains. But for each domain you can now select which third-party sites to enable and then persist those settings. I have Firefox setup this way. In Chrome I have a default uBlock Origin install, so it is not so aggressive with filtering.

[https://github.com/gorhill/uBlock/wiki/Advanced-user- feature...](https://github.com/gorhill/uBlock/wiki/Advanced-user-features)

<comment><USER14> Oh I see what you mean. Yeah, that's crazy, I'm not doing that.

<comment><USER35> Yeah, that's what my wife said too. That I go to the trouble shows how fed up I am with all this tracking.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> Browse with w3m or elinks, problem solved.

<comment><USER30> Now that you mention elinks, do you know if development continues? I had a question the other day that I couldn't find answered anywhere, but it looks like the main mailing list is entirely lost (I tried to follow these links: [http://elinks.or.cz/community.html](http://elinks.or.cz/community.html)).

<comment><USER37> Just check their git activity. [http://repo.or.cz/elinks.git/shortlog](http://repo.or.cz/elinks.git/shortlog)

</comment></comment></comment><comment><USER38> I find sending LA times articles to Instapaper manages to get me a readable copy of the article. It's a bit more of a hassle, but worthwhile if the article looks really interesting.

</comment><comment><USER39> I work in adtech. The reason this happens is because of poor dev knowledge/resources by most publishers (although shouldn't be a problem with LA Times) and because the ad industry has perverse incentives combined with absolutely no oversight or enforcement.

99% of these companies are in business by running as many impressions/clicks/whatever "engagements" as possible regardless of user experience so we end up with this tragedy of the commons.

</comment><comment><USER40> So glad to see others complaining about this. I am totally dismayed at the sluggishness of LAtimes.com. It was usable with an adblocker turned on but since being forced to turn it off recently the only computer I can use it on is a dual xeon with 32G memory and a modern gaming card and even then it's a struggle. I'm shocked that the this kind of botched hackery can exist at a major newspaper. It's ugly bad.

</comment><comment><USER41> I see this all the time. No regard for mobile users that are paying for data plans. To me the big reason to have ad-blocker is data, not just UX.

I'm focused on getting a mobile article page down from 20+ seconds on 4G with 300+ requests and page-weight of 2MB+ (mostly ads).

Right now, on CI environment it is averaging 2.1s, 350K in size, <45 requests, and no ads in the initial view.

Sadly, Hearst doesn't own the LAT so it won't help them.

<comment><USER42> Since you're paying them nothing at all, it's not exactly like you're a customer, is it? I'm not sure why regard for people offering to pay them nothing at all would be a high priority for the LA Times, but ymmv.

</comment></comment><comment><USER43> First, did others see this HN post? [https://news.ycombinator.com/item?id=13956807](https://news.ycombinator.com/item?id=13956807)

RJ Reynolds recruiting guideline SPECIFICALLY wanted sales (or marketing) people with 2.8-3.1 GPA. NO wonder so many ad server tags by the sales/marketing types are FULL or errors.

Anyhow, the very first time I experience a Mac computer crash HARD was when I opened NYT.com. Yes NYT.com.

It was a typical Mon morning, around year 2011. I got into office, got coffee, tapped keyboard the Mac Keyboard to wake up my iMac and proceeded to open the website I opened every morning, nyt.com.

I noticed some flash based ad doing some fancy thing in the top banner. But whatever.

I continue doing my thing.

Wait what? My iMac is frozen. iMac! This can't be true. I frantically pound on keyboard but nothing works. Out of desperation, I finger it.

When it comes back up, I slowly bring things up one at a time. And I realize it was the NYT.com's flashy flash ad that caused the crash.

When I upgraded my slightly outdated Flash plugin in my Firebox, I could view the nyt.com homepage without my iMac freezing. I could HEAR the mechanical HD in my iMac grinding and CPU widget showing CPU spiking when I open nyt.com homepage.

Because of an ad on NYT.com, I'm pretty sure millions of people experienced their computer crash on that Mon morning.

</comment><comment><USER44> Another reason I keep JS turned off on my phone and most news sites on desktop. Seriously, try it.

</comment><comment><USER45> I've noticed that if you are running an ad-blocker and disable JavaScript (i.e. from the Chrome debugger), you can view the page just fine.

</comment><comment><USER46> Clearly, there's got to be a better way. The question is, will we find it before my "unlimited" data tops out?

</comment><comment><USER47> I'm a frequent visitor of L.A. Times and I've already learnt to press Cmd+. as soon as all the content I want has been loaded.

</comment><comment><USER48> I actually installed uMatrix just so I could disable all cookies and Javascript on LA Times. No more ads or anti-ad-blocker.

</comment><comment><USER49> Does anyone know if you have a paid subscription does the LA Times still insist on sending you 14 gigs of ad data?

</comment><comment><USER50> so, as someone who keeps meaning to try it out but hasn't yet: how does Brave do with this site?

<comment><USER50> self-reply: just tried it. It does well. Alarmingly well. so sad to have to choose between Brendan Eich and Mozilla. :(

<comment><USER51> No need to be alarmed. I have four browsers running rn on my mbp. Could have more but I run out of physical memory too often!

</comment></comment></comment><comment><USER52> Hit Esc (or Cancel) button to stop JavaScript execution. Works well since Netscape 3.x

</comment><comment><USER53> Do they offer an RSS feed? Does adding the article to Pocket or a similar service work?

</comment><comment><USER54> "Their ad blocker blocker and paywall works, preventing me from reading articles."

Well, Adblocker in Chrome seems to be blocking the ads on the page quite well. Some single requests are being logged after the page loads, but nothing as to what the article mentions.

</comment><comment><USER55> [https://pi-hole.net/](https://pi-hole.net/) Turn your raspberry into an ad- blocker.

I just want to spread the word out and make the world a better place.

<comment><USER29> Not enough, using "host files" won't protect from websocket/blob/webrtc/base64 injections.

</comment></comment><comment><USER56> Does buying a subscription remove all these ads?

<comment><USER57> It likely just removes the pay wall. Even subscribers would likely benefit from using an ad blocker.

</comment></comment><comment><USER58> Why I use the Android app TextBrowser

</comment><comment><USER59> The data points for my hypothesis just keep connecting.

edit: so I know, why does something this innocent get downvoted? I don't understand what I did wrong.

<comment><USER60> I think it's more like, you didn't do anything right! It sounds mysterious and all, but does not really benefit anybody else.

<comment><USER59> In that case, HN should brighten up. Cynicism for it's own sake rarely leads to innovation. Thinking based upon First Principles and original insight does correlate with innovation.

This will get downvoted probably because it hurt someone's ego but it's true if you look the history of science and technology.

<comment><USER60> I mean, if your note-to-self system is leaving cryptic comments, you should probably invest in finding something more appropriate.

I'm very happy with Notational Velocity at the moment (not sure about cross platform solutions, but I think most systems do similar things nowadays).

</comment></comment></comment></comment><comment><USER61> "They are also the most aggressive ad shoveling website I have ever seen. Their ad blocker blocker and paywall works, preventing me from reading articles."

So their ad blocker blocker and their paywall kept you from reading the articles for free? Why don't you just pay them?

It's just a shitty thing to do at this point. If they have high quality articles then what would require you to pay them? Do they need to be on Patreon or Kickstarter or something?

<comment><USER62> Why would you reward a website for using dark patterns like autoplaying video ads, popups, 14 bloody GiB of data pushing ads and tracking and bullshit into your browser?

<comment><USER63> Are any of those really dark patterns? Annoying and shitty... sure. None of the above are meant to trick you, they're just a nuisance.

<comment><USER11> And that is reason enough. If I am paying for something you better not treat me that way because I will stop paying.</comment></comment></comment></comment>


Ask HN: Best public-facing issue trackers? - <AUTHOR> we've all struggle with issue trackers, and sometimes it's hard to find just the right one.
I'm struggling to find one for my start-up that is public (customer) facing for closed-source projects that allow users to submit and track bug reports.
Trac has been the go-to for many people for a long time, but it is somewhat long in the tooth.
so, I ask you HN, what issue tracking software do you use for customers?  I'd prefer to find something that I can self-host. <comment><USER2> You can have your private repository on GitLab. They have a Service Desk feature[0] which used to be in the basic tier but was moved not long ago.

Alternatively, if you're on a budget, you can:

\- Set up a firstname.lastname@example.com email address

\- In GitLab, open an account named "SupportStartup" for example with email@example.com

\- As the project maintainer, add the SupportStartup member to the project

\- As SupportStartup on GitLab, you get a custom email address you can create issues with simply by sending an email to that address[1]

\- As the admin of your email server, create an alias or automatically forward incoming emails from email@example.com, to the custom email address you get on GitLab. So any email sent to firstname.lastname@example.com will automatically be routed to the email address that creates issues.

One other solution:

\- Create a form for issues in your application.

\- As a user, I write my complaint into that form, and I hit submit.

\- As SupportStartup, you generate a personal access token on GitLab[2]

\- In the backend, you get that message, and you use GitLab's API to create an issue with the personal access token.

Another solution:

Add an issue button to the application with an `href`:

      Complain!

When the user clicks, it opens their mail client, with pre-filled email addresses, and CC addresses, a prefilled subject, and a body with a template. Everyone gets the email. Everyone gets notified on the most pressing issues, everyone does support, and after the n-th email, people say "Okay, that's enough" and they fix the most irritating stuff with high frequency/high impact.

[0]: [https://docs.gitlab.com/ee/user/project/service_desk.html](https://docs.gitlab.com/ee/user/project/service_desk.html)

[1]: [https://docs.gitlab.com/ee/user/project/issues/managing_issu...](https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#new- issue-via-email)

[2]: [https://docs.gitlab.com/ee/user/profile/personal_access_toke...](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html)

</comment><comment><USER3> Roundup [https://roundup.sourceforge.io/](https://roundup.sourceforge.io/) is free and you could self-host.

</comment><comment><USER4> Product Board includes this but you'll probably want buy in from whoever maintains your roadmap.

<comment><AUTHOR> this is a small startup, I am that person :)

</comment></comment><comment><USER5> osTicket- [https://osTicket.com](https://osTicket.com)

</comment><comment><USER6> Phabricator is an absolute gem...</comment>


UCS vs. UTF-8 as Internal String Encoding - <AUTHOR> http://lucumr.pocoo.org/2014/1/9/ucs-vs-utf8/

<comment><USER2> Random-access idioms where unicode strings are treated as arrays of character data will result in userland code which is either incorrect or inefficient. Incorrect if the implementation cheats and treats variable-width data as constant-width, resulting in severing of logical units and incorrect length values. Inefficient, if each random-access operation counts variable-width elements from the beginning of the string.

It is better to provide string-manipulation facilities which rely on iteration and keep track of offset internally.

For an extended explanation, see Tom Christiansen's comment on this old Python issue: [http://bugs.python.org/issue12729#msg142036](http://bugs.python.org/issue12729#msg142036)

<comment><USER3> If we're iterating characters, we might as well use zlib-compressed 21-bit unicode characters. They save even more room than UTF8, and it's difficult to pretend that characters can be accessed by index.

<comment><USER4> There's an order of magnitude difference (at least) between accessing memory vs unzipping. The constant space overhead isn't great either for small strings.

For big strings like web pages, we already do use zlib (via gzip).

</comment></comment></comment><comment><USER5> Something I've wondered about is why, given Unicode is limited to 21 bits now, nobody seems to be using a 24-bit format ("UTF-24")? If you want constant-time indexing without bit-packing tricks, that'd be the ideal.

Though, of course, constant-time indexing isn't what it's hyped up to be. That's only for codepoints. Actual characters you see on screen are often combinations of codepoints.

So I've answered my own question really. Why does nobody use it? Because there's no point in it.

[http://stackoverflow.com/questions/10143836/why-is-there- no-...](http://stackoverflow.com/questions/10143836/why-is-there-no-utf-24)

<comment><USER6> "That's only for codepoints. Actual characters you see on screen are often combinations of codepoints."

So, there is no encoding that actually has 1 word (of whatever byte length) to a character on the screen?

<comment><USER7> There's an unbounded number of possible graphemes per Unicode, because they are formed of a start character and an unbounded number of combining characters following them. As such, no fixed-length encoding can actually enumerate all possible graphemes.

<comment><USER6> What is the practicality of an unbounded number of possible graphemes? Does anyone in real writing of languages and not some concocted test case need this? I understood there is some conflict in the encoding of kanji into unicode, does this relate?

<comment><USER8> > What is the practicality of an unbounded number of possible graphemes?

That question doesn't really make sense. Unbounded cluster sizes is simply a result of unicode design because there's no reason to bound it.

> Does anyone in real writing of languages and not some concocted test case > need this?

In the real writing of languages there are languages with grapheme clusters of size 4+ e.g. क्षि (Devanagari kshi) is a single cluster made up of क, ्, ष and ि.

> I understood there is some conflict in the encoding of kanji into unicode, > does this relate?

It's unrelated. Han Unification compressed the number of clusters by unifying han characters across simplified Chinese, traditional Chinese, Japanese and Korean. Han characters were an issue in the original 16 bits unicode because supporting all of them was estimated as possibly topping out 100,000 codepoints (where 16 bits unicode only supported 65k codepoints). AFAIK Han characters don't use much if any composition (outside of romanisation). Brahmic scripts, Hebrew and Arabic scripts, on the other hand, pile on diacritics.

<comment><USER6> > That question doesn't really make sense. Unbounded cluster sizes is simply a > result of unicode design because there's no reason to bound it.

If I'm trying to draw a character on the screen, it makes a lot of sense. I guess I'm struck about how hard it would be to select the 4th through 8th character displayed on the screen from rows 3 through 13.

<comment><USER9> Displaying characters on the screen, and giving the ability to select text, is indeed quite a difficult and complex question in the face of full support of the world's written languages.

Glyphs vary in width. There are combining characters. There are ligatures (and in some languages, ligatures are necessary for the text to be readable, not just stylistic). There is contextual reordering of characters. There's bi- directional text, which can switch direction mid-sentence when quoting some Roman text in Hebrew or vice versa. There's vertical text. There are a number of fonts, font weights, font styles, font sizes, font features like alternative characters, language dependent selection of glyphs, and so on, plus fallback if the user doesn't have the designated fonts or fonts that cover the given Unicode range installed. There's line breaking, which can't always operate on spaces because not all languages include spaces between words. There's justification of text, distributing the spacing between characters to make a block of text even on both sides.

All of this complexity exists regardless of the encoding that you use. Simply picking a fixed width encoding will not do anything about the vast majority of the complexity; and the fixed width encoding will cause problems of its own (size bloat of strings in memory), as well as leading people astray in thinking that maybe they can get away with making some of the same assumptions that apply to ASCII on a fixed-width terminal (and even there, assuming that 1 character equals 1 unit of width fails in the case of tabs), when in fact they can't and most text handling beyond simply appending strings together is best handled by dedicated libraries that have had hundreds of developer-years of effort put into solving all of these problems.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> The only reason UTF-16 was so widely used is as a backwards-compatibility measure. All these systems originated in the UCS-2 era, or had to be compatible with ones which did. Then UTF-16 came along, and slotted in where UCS-2 was. This is why you have such sloppiness about treating surrogate pairs as two characters, for instance: the systems were made for UCS-2 and only poorly updated to the UTF-16 reality.

Any modern system would use UTF-8.

</comment><comment><USER10> "UTF-24" feels like the right choice for an internal format if you want true constant-time access to code points with 25% less waste than UTF-32.

I know it's not a power of 2, and that's the most common reason cited against using it, but multiplying by 3 is basically n + 2n or a shift-and-add so it's not really hard to do.

<comment><USER9> Why would you want constant time access to code points? What can you do with constant time access to code points that is actually correct?

Every time someone tries to promote UTF-16, UTF-32, or some imagined encoding like UTF-24, they bring up constant time access to code points, but I have never heard of a reason why you would want that.

Pretty much every use case I have ever heard for constant-time access can be handled just as well by constant-time access at the code unit (byte in UTF-8, 16 bit value in UTF-16, 32 bit value in UTF-32) level. Matching text exactly? Matching works just as well at the code unit level. Doing any kind of fuzzy or regular expression match? You're going to need to iterate over each item anyhow to normalize it or classify it. Need to store offsets? That works just fine at the code unit level.

Most of the other suggestions I've heard for what to do with constant-time access to code points is incorrect when you consider combining characters, normalization, different character widths, need for linguistically appropriate word splitting, etc. If you're doing something that doesn't take these into account, why are you using Unicode instead of just ASCII?

In addition, for the ASCII range, UTF-24 would take up 3 times the space as UTF-8, and the vast majority of text processed is actually in the ASCII range due to verbose markup formats like HTML, XML, etc. Plus if you do anything with the code points in UTF-24, you need to do a bunch of bit-fiddling to move them into 32 bit alignment, so as far as actually decoding the individual code points, it's pretty much a wash with UTF-8.

<comment><USER11> > UTF-24 would take up 3 times the space as UTF-8, and the vast majority of > text processed is actually in the ASCII range due to verbose markup formats > like HTML, XML, etc

Sounds like these "verbose" markup formats are the _real_ problem in taking up too much space, not the Unicode transformation formats.

<comment><USER9> I think that moving the world away from HTML and XML as markup languages is likely to be considerably harder than simply defaulting to using UTF-8 in any new code for which there isn't already a natural encoding to choose based on the platform or APIs you're developing on.

Furthermore, even beyond the markup, the vast majority of written content is in the Roman alphabet, of which most characters are in the ASCII range, and those that aren't fit into 2 bytes of UTF-8. 55% of text on the web is in English, then languages using the Roman script or other scripts in the 2-byte UTF-8 range make up 21 of the next 25 most commonly used languages on the internet; of the top 25 languages, only Chinese, Japanese, Korean, and Thai are in ranges that require 3 bytes in UTF-8 for the majority of their characters ([https://en.wikipedia.org/wiki/Languages_used_on_the_Internet](https://en.wikipedia.org/wiki/Languages_used_on_the_Internet)).

So for the vast majority of text that is processed, UTF-8 is dramatically more efficient than a hypothetical UTF-24 or the real UTF-32. Now, you might say "well, it should all compress away anyhow", but when dealing with text in RAM, it is generally not compressed (and that would make handling it far more complex than just using UTF-8), and memory capacity, latency, and bandwidth can all be important.

Trying to deal with text as fixed-width characters is simply incorrect. Almost every non-trivial means of handling text needs to support arbitrary length strings, needs to deal with clusters of more than one codepoint as a single unit, and needs to iterate over the characters linearly at least once (and can then store byte offsets for random access later on). Dramatically increasing storage requirements of text for the non-benefit of being able to deal with fixed-width codepoints just doesn't make sense.</comment></comment></comment></comment>


World's Largest Video Commercial P2P Deployment - <AUTHOR> http://www.digitaljournal.com/pr/3079128 <comment><USER2> Hey everybody! If you want to learn more about Peer5's Serverless CDN email us at firstname.lastname@example.com</comment>


Google's Nexus 4 Sold Out In Less Than Half An Hour - <AUTHOR> http://www.businessinsider.com/nexus-4-sold-out-again-2012-11

<comment><USER2> Ask me, I am risking my job for this phone...</comment>


Life is wasting my time - <AUTHOR> http://blog.daemonl.com/2013/03/life-is-wasting-my-time.html <comment><USER3> Maybe I misunderstood this because of what books I have been reading lately, but I really enjoyed reading this piece as a piece of irony. Apparently the word irony, pre-14th century had more to do with an author writing an opinion he or she did not hold, as if he or she did hold it.

When I read this as if the author doesn't believe that life is wasting his time, but is being ironic, because the inherent flaw resides within himself, and not within life, then I find the piece to be a really, really interesting and an exposing and humble read.

<comment><AUTHOR> You totally got it. Apparently not many others did, my bad. Thanks for your comment.

<comment><USER3> Thanks again for writing this. You're writing about a feeling that I've experienced and can relate to, and I thought the piece was excellent. Great job.

</comment></comment></comment><comment><USER4> "There was once a boy named Milo who didn't know what to do with himself - <USER2> just sometimes, but always.

"When he was in school he longed to be out, and when he was out he longed to be in. On the way he thought about coming home, and coming home he thought about going. Wherever he was he wished he were somewhere else, and when he got there he wondered why he'd bothered. Nothing really interested him - least of all the things that really should have."

<comment><USER5> Sounds interesting, for those who don't know its from "The Phantom Tollbooth" book:

<http://www.npr.org/templates/story/story.php?storyId=4684236>

</comment></comment><comment><USER6> Great piece, I am sure many people on HN can relate to this. Its especially true in this community where you are constantly reminded that other people "like you" build these amazing things. The project that millions use, the open source software that is a godsend to developers, the game that is getting rave reviews, the prototype that is so amazing in a technical sense.

Add to that the interaction with super smart people that talk alot about programming best practices, new technologies, the future of computing, maths, literature.

I think as a person inside of this world, its really hard to not get sucked into the mindsight of:

* i need to get more work done

* i need to start this amazing project

* i need to learn more

* i need to grow

* i need to make more money faster

All this is well and good, but for me it often results in being impatient when doing things "normal people do". I have this constant feel of "i should be doing something more useful" no matter what i do. This is were it gets dangerous and i think in the long run it will lead to alot of unhappiness.

Atleast that i am aware of it and try to reflect on it, is the first step to more happiness, or so i hope.

<comment><USER7> What if being aware of this mindset problem and yearning to be more content and calm is just another iteration of the exact same generalised problem of being overly mindful of the imperfections in one's life?

<comment><USER8> I think at that point you begin meditating, where the point is to have no mind at all.

</comment></comment></comment><comment><USER9> I felt like my life was being described by the author. However, I don't feel like that anymore. My life changed when I got to be responsible for a kid. There's nothing I rather be doing instead of being with my child; there's no nagging in the back of my mind anymore telling me to go read some more, to come up with the next big thing, to hack something out, to work out math problems.

I still enjoy doing constructive activities, but it's no longer my life's purpose. For me, it's like seeing the 'big picture' of life. I remember, like the author, being extremely impatient with family life and social activities because I would rather be spending time building something, learning something new. Normal human activities seemed boring and purposeless. I made a promise to myself that I would never have a family for the fear of being too draining and becoming frustrated for not having enough time for my projects. All of that vanished in a couple of weeks after meeting my now wife's kid.

The kid I'm responsible for is not my biological child, so it's not just the instinct of caring for my own child that's at play here.

Perhaps that's why the most important scientific discoveries come before scientists have kids; it's not the responsibility and the time suck that impede growth, it's an overwhelming feeling of happiness and indescribable feeling of "doing the right thing" that rearing a child brings.

I honestly thought that child rearing distracted and frustrated parents because they HAD to become selfless. It doesn't feel that way at all. Self- growth seems superficial and meaningless now in the grand scheme of things, and I am a pretty ambitious and obsessed person.

<comment><USER10> Please. Unless you have adopted a goat, don't call it a kid.

I hate the terms 'kid' and 'kids'.

What is wrong with 'child' and 'children'?

<comment><USER9> I'm sorry, English is my second language. Could you explain the difference?

<comment><USER11> There isn't one. "Kid" can mean the young of either humans or goats. "Child" is a bit more formal, but that's about it.

</comment></comment></comment></comment><comment><USER12> I hope the author is reading this thread.

What struck me was this line: "Family time bores me because I could otherwise be doing amazing things".

I felt like this for a long time. I was in a long-term relationship with an amazing woman, yet I spent my free time working or thinking about all the "amazing" things I could have been working on. Up to the point where she left me.

Family time is the one thing you should never consider a bore or a chore.

<comment><USER13> Thankfully, the last sentence of the article states: "Then I'm going to the beach with my partner to 'do nothing' for an evening."

Just to add, it's not mererly a lack of "doing" something, but valuing the "being" part of ourselves: Father, husband, partner, friend, etc - out of which the "doing" bit naturally flows. Due to my personality flaws, I too often "do nothing" when in presence of my wife, which can be just as destructive for the relationship as wishing I was doing something somewhere else.

</comment></comment><comment><USER14> I don't get the nasty comments on his blog, it's clearly a self aware piece poking fun at it's own sense of superiority. If he really had things the way he wanted them, he wouldn't need to be there in the first place.

And on top of that, it's brilliantly poetic.

<comment><USER15> Read the entire blog before commenting? What a waste of time! Better comment first. ;)

</comment></comment><comment><USER16> I felt the same way. But I gave up struggling and accepted that my destiny is to lead sucky life, waste my time here on earth with mortals and mediocre jobs and most likely never accomplish anything non-average.

<comment><USER17> What's a sucky life?

Writing code for other people, even on sucky projects, pays for an awesome life for me :)

</comment></comment><comment><USER18> Sounds like depression.

<comment><USER19> It's actually the very opposite of depression. Depression is generally a lack of hope for the future. This would be a case of so much hope for the future and himself that he is unable to live in the present, as what he is currently doing simply cannot live up to his hopes.

It's interesting how similar to depression the effects would be.

<comment><USER20> Depression is a long period of negative thought patterns. The person is locked in a loop of insatisfaction, disappointment, health concerns, feelings of wasting life (guilt), followed by feelings of worthlessness. It is a terrible place to be. And unfortunately a lot of smart people fall into this mental trap. I am emerging from such an episode myself and I can relate perfectly to the article. I was helped by the book "Feeling good: The New mood therapy" and I highly recommend it to anyone who seeks help.

</comment></comment></comment><comment><USER21> Journey, not the destination.

</comment><comment><USER22> This bring to mind the Kevin Spacey monologue in Casino Jack:

 _Cause in reality, mediocrity is where most people live. Mediocrity is the elephant in the room. It's ubiquitous. Mediocrity in your schools. It's in your dreams. It's in your family. And those of us who know this - those of us who understand the disease of the dull - we do something about it. We do more because we have to._

Read more at: <http://www.imdb.com/title/tt1194417/quotes?qt=qt1477054>

</comment><comment><USER23> I struggle with this myself. But sometimes the problem is actually the thing you're pursuing. What if the thing you're second guessing is a zombie startup? Or really any pursuit that isn't measuring up to reasonable standards set for it.

Setting lofty goals often involves taking on projects and employment opportunities before they are mature ventures. And you end up asking the question "am I being unreasonable and impatient or is this project doomed?" It's not an easy question to answer.

</comment><comment><USER24> Mate, I can also relate to this. It's tough. I know the problem is myself but I don't know how to solve it. Although, I _do_ know how to solve it, yet somehow I don't. Sure, it might be a "humblebrag" but it's a god damned frustrating one. I Think a lot of people, especially people on HN, feel this way.

</comment><comment><USER25> Not sure I agree with you, but I really enjoy your particular version of English-as-a-second-language.

</comment><comment><USER10> You have a partner and access to a beach. I have neither and haven't had a job since 1988. Yet the only thing I have found boring about my life of late has been reading this. I am not going to tell you to stop bleating, to accept the uneliminatable imperfections inherent in life so you can better focus on reducing the recurring overall inefficiencies because I feel it would fall on deaf ears. You can't be helped. You can only help yourself out of this mental rut and change your subjective perspective towards your circumstances by developing not a positive mental attitude but a pragmatic one. I can't reach into your cerebellum and rewire it. You can. It will take about six months - assuming you don't kill yourself in the meantime.

</comment><comment><USER26> My whole life is consumed by this feeling.

I feel like I should already have achieved something great, yet I don't explicitly think I'm special, although feeling like this and letting other people know about this constant irking feeling might understandably lead them to think that I think of myself as someone special or superior to them, especially when talking to people who haven't experienced this kind of push and don't have these kinds of aspirations. I think that in my case there's a healthy part to it and there's an obsessive, blown-out-of-proportions part to it, based on the healthy part. And it's not easy to tell, where one ends and where the other starts.

The most dreaded thought to me is the thought of mediocrity, me being just another working bee as someone put it in the comments, with no power, ability, skills, and certainly no destiny to build or do something great. What "something great" is, I didn't really outline it yet. Maybe this should be the first step towards actually starting a project that matters. I cannot relax. I cannot let go. In my life it is rare, when I can just kick back and relax and enjoy doing something that is not the next step towards something big.

Whenever I'm left alone with nothing to do, the feeling of guilt sooner of later overwhelms me, I cannot have a breakfast without my thoughts rushing. I just keep thinking about what I had done wrong or why I haven't achieved anything of significance in my life. For one part, there is this feeling that I already should have achieved great things and this feeling implies that I should actually be able to achieve great things, and therefore that somehow I am destined to achieve great things. Then rationally I know that I am not special at all, but I can be. I know that things that I consider great can be achieved by just people like me, because I know people who have achieved great things. And that there's no destiny involved, just hard work and a lot of skills which can be learned. The thing that is special about these people is their attitude. The only times I came close to feeling relaxed and being able to kick back and relax, were times when I've felt that I actually had something great going on in my life, something that I've felt could go somewhere, something with potential.

I consider the notion of potential one of the greatest things in life. I would even go as far as to say that I value potential more than I value actual results, more than I value potential realized. Potential is the start of everything, potential contains everything in it, nothing is determined yet, nothing is sure, but everything is possible.

And I think I'm afraid of stepping out of my zone of potential into the real world, because out of the infinite possibilities, I have to choose one, I have to choose a direction, _one_ direction and go there, knowing I will probably never be able to go back. And take directions after directions, and from the abstract notion of being everything at once, out of all the possibilities, I have become only one path, one string of life, that either becomes successful or withers and dies.

From the place where there is no meaning to failure or to success, to certainty or to uncertainty, to decision, because everything is in there all at once, and there is only excitement and anticipation, to the place, where I might fail like many people have failed before.

For now I try to focus on doing things I really like, things that deeply excite and interest me, things that matter to me, and I try to put the maximum amount of effort into doing those things, and now I just have faith that out of these things a project will emerge. And that as long as I can find things that excite me, there will always be a project in there somewhere that's worth doing.

<comment><USER10> It is only healthy to value potential more than actual results if you agree with the Chinese proverb...

'The journey is the reward'

I agree with the sentiment expressed by this and feel that it is silly to defer gratification to the completion of a goal, whether that reward be pride in your accomplishments, money, or fame. Especially as many long term projects may never be completed as your personal circumstances change to prevent it from being realized, or the endeavour taking so long that it is rendered irrelevant by someone else finishing a similar work before you so that the potential audience you were after has been entirely satisfied by their solution.

If you would still work on whatever you do without payment and you are not obsessing daily about fame and riches coming your way through doing it then you are well adjusted. Obviously, a source of income has to be found for your survival and shelter yet a lot of people work in moderately well paid full time jobs in order to fund lifestyles that compensate them for the time that they have sacrificed or their lack of self-worth.

1\. Uncontroversially, nice cars, houses and foreign holidays are paid for largely by not just being part time with maybe some rewarding side-project or voluntary work making them feel that they haven't entirely wasted their week.

2\. Controversially, having children is very expensive and time consuming and bad for the planet as the ecological impact from not having a child is the countless generations that will not exist, consuming and polluting, for centuries to come. It may be a matter of being forced to choose between your brainchild and the fruits of an intimate relationship. Luckily, there are signs that educated women are less interested in having babies so men shouldn't resent heterosexual partners that are smarter than them as it may be to their advantage to have them be the one with the powerful career whilst they run the household and code from home.</comment></comment>


Teaching: Convergence and Divergence - <AUTHOR> https://blog.getify.com/teaching-convergence-and-divergence/ <comment><AUTHOR> self submission</comment>


A report about a vulnerability in Telegram - <AUTHOR> Recently, we found a concerning security bug in the widely-used instant messaging tool: Telegram. In order to explain the criticality of the issue we decided to publish it on our blog.
We are security researchers from Iran and as you may know, Telegram holds the position of the most popular instant messaging tool in the middle east (consequently in our country).
The blog link: http://www.sadghaf.com/ <comment><USER2> Please don't yell fire like this. You haven't found any critical severity vulnerability in Telegram. As written, your report doesn't disclose a vulnerability at all. What you found is a logic error with no evidence of a security implication. You're attempting to promote yourself using invalid findings that, as presented, would be quickly rejected by the Telegram team as not applicable.

Your video details two findings: 1. the ability to empty a contact's internet balance by sending very long messages to them and 2. the ability to cause a contact's client to potentially crash due to an unexpected number of bytes in a single message.

The first finding is neither a Telegram nor a security issue. Does Twilio have a critical security vulnerability because I can use it to quickly exhaust a user's SMS quota for the month? This is an established precedent, and you have not identified a technical security flaw.

The second finding is a legitimate bug, as there is behavior that is implemented differently than the documented design goal of the API. However, you did not provide evidence that this finding can be used to cause a persistent denial of service. Does the application crash every time a user opens it, or is this good for one use? This is not a vulnerability unless you can demonstrate an overflow allowing local memory reads/writes or a persistent denial of service condition.

This is attention seeking behavior. Publicizing a "critical" vulnerability in a high profile application based on the flimsy excuse that you couldn't find an explicit disclosure email address reduces the credibility of responsible disclosure and legitimate security research. If you had actually bothered to search instead of rushing to bring your "findings" to notoriety you would have found firstname.lastname@example.com, which is explicitly for security reports. But that wouldn't have allowed you to make a blog post and submit it to HN, would it?

The next time you think you've found a vulnerability, don't publicize it and try to disguise it as a noble gesture by saying you're not going to "pinpoint" the vulnerability when you clearly walk through the exploitation in your video. Report your findings directly to the vendor, and if the vulnerability is valid and a fix is pushed due to your participation, then you can brag on HN about it.

</comment><comment><USER3> I'm not sure you know what "critical" means—this bug definitely isn't it—but you should probably report it to Telegram instead of posting on HN. You claim you couldn't find a way to do that, but they have a security@ address [1], so you can't have looked very carefully.

[1] [https://telegram.org/faq#q-what-if-my-hacker-friend-says- the...](https://telegram.org/faq#q-what-if-my-hacker-friend-says-they-could- decipher-telegram-mes)

</comment><comment><USER3> An interesting little detail about the authors: [https://www.fbi.gov/wanted/cyber/iranian-ddos- attacks](https://www.fbi.gov/wanted/cyber/iranian-ddos-attacks)

</comment><comment><USER4> Telegram team always say they are too secure, it is interesting that they have such a critical bug

<comment><USER5> They also have a contest for proving secure, have they won the contest?

<comment><USER4> If by contest you mean the link given below, It is just for cracking Telegram encryption, so I don't think they have won it.

[https://telegram.org/blog/cryptocontest](https://telegram.org/blog/cryptocontest)</comment></comment></comment>


An app to browse your friends' trips - <AUTHOR> http://blog.zetrip.com/2013/05/an-app-to-browse-my-friends-trips-we.html

<comment><USER2> Quickly link that top left logo to your main site rather than the blog (or link to both) before everyone looks!

Unless I missed something obvious or an adblocker prevented me from seeing it, there's not a link to your main site anywhere on that page?

Link to main site: <http://zetrip.com/>

\---

I like to travel and I'm interested in this space but I don't use Facebook.

Regardless, I'm not sure if it quite solves a problem I have? I would be somewhat interested in seeing the travel history of friends, but not enough to check it regularly after an initial look.

<comment><USER3> The app described in the post is an iPhone app only. There is a link to the appstore in the post. I changed the post so it's clear an iPhone app.

<comment><USER2> I still like to hit the main site of an app rather than just read a blog entry to seek out more info.

<comment><USER3> Makes sense, I added a link to the site in the post.

</comment></comment></comment></comment><comment><USER4> This is a great idea.

Some suggestions

-Some more links about their destination would be great - links to wikitravel; photos from other travellers, hotel/flight etc.

-Not all photo albums (especially with non-phone cameras) have location information attached as the user has to tag that location. I've noticed many of my friends will name their holiday album with the name of the country or city? Is there some way you would find trips based off photo albums with country names or similar?

I like it a lot, but once I've seen my friends trips in a minute or two; I'm not sure what to do now. Nice work.

<comment><USER3> We actually implemented something similar to what you are describing. We map locations to tokens found in album titles. It's turned off though, until we fine tune this feature a little more, we're getting too many false positives. You're right though, travel related albums are very often labeled with the destination and the date.</comment></comment>


Kindle for Android - <AUTHOR> http://www.amazon.com/gp/feature.html?ie=UTF8&docId=165849822

<comment><USER2> Thanks for posting this. I registered with Amazon for email notifications when this was to be released, but they didn't send me anything.

It works great on my HTC Incredible so far, including Whispersync with my Kindle 2. I wish it supported search and included a dictionary like my Kindle 2 does, but since even Kindle For PC doesn't have these features yet I suppose I'll have to wait.

My one big UI gripe so far is that the phone's back button isn't used for navigation like the back button on the Kindle hardware; instead it takes you straight to the welcome screen. The navigation feature analogous to the hardware Kindle's back button is bizarrely exposed as a separate choice through the application menu.

</comment><comment><USER3> The barcode doesn't work for me: Item not found. I'm on a HTC Hero, Android 1.5 (argh), T-Mobile Germany.

Are there any minimum system requirements?

Edit: Duh, it says on the page that you need 1.6.

</comment><comment><USER4> <http://news.ycombinator.com/item?id=1469466>

</comment><comment><USER5> Doesn't work on my Magic + Cyanogen 5. Random words from my book show up, but they are interspersed with strings of Japanese and other random Unicode characters.

Who knew that rendering a subset of HTML could be so difficult...

<comment><USER6> I don't really think that it's fair to blame Amazon for problems you have running their app on older hardware with a gray market ROM image.

It's hard enough to run tests on the legitimate Android configurations active on the market. Trying to account for homebrew setups like Cyanogen would be a recipe for lots of pain and effort with very little payoff.

<comment><USER5> How is Cyanogen any different from any other Android 2.1 image?

</comment></comment></comment><comment><USER7> As a Droid owner, I'm happy. I've been waiting for this.

That said, I feel as if perhaps Kindle's killed itself. I can buy a $200 Android tablet with a decent, colour TN LCD and run this app on it.

</comment><comment><USER8> I forsee a lot of illicit copying in the future of Amazon's ebooks.

An interesting question is whether this app will work in the emulator. If so, it means you can have ebooks on your laptop.

<comment><AUTHOR> There are already versions for laptops if you use a mac or windows (and at least you can VM this if you run linux and it doesn't work on a linux android VM)

Mac: [http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000...](http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000464931)

Windows: [http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000...](http://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000426311)

</comment></comment><comment><USER9> <50 downloads as of now

<comment><AUTHOR> Android market must be updated nightly or something with download count as there are over 380 ratings.</comment></comment>


European Court of Justice blocks social network's anti-piracy filtering system - Tim-Boss http://www.bbc.co.uk/news/technology-17060112

<comment><AUTHOR> "The European Court appears to have ruled out the idea that operators of social network sites and ISPs can be forced - at their own expense - to impose blanket monitoring and filtering aimed at stopping infringements."</comment>


The New Advertising Outlet: Your Life - <AUTHOR> http://www.nytimes.com/2007/10/14/business/media/14ad.html?ex=1350014400&en=7e99880c32f60165&ei=5090&partner=rssuserland&emc=rss <comment><USER2> What I think is interesting in this approach is that they "got it". The idea of "permission marketing" is something that Seth Godin talks about for years.

Even big companies are seeing the value of providing services as a way of forming branding. It is no longer "guerilla marketing". It is getting mainstream.

Now, PG: wouldn't it be interesting to have a startup that could take this idea and "go meta", finding a way to provide smaller business the means to reach out for the users? :p

</comment><comment><USER3> This is the most exciting article for the tech community I've seen in a long time. Way more exciting than facebook platform, etc.

Look at these quotes:

 _"Nike executives say that much of the company's future advertising spending will take the form of services for consumers, like workout advice, online communities and local sports competitions."_

"How can we provide a service that the consumer goes, 'Wow, you really made this easier for me'?"

"People are coming into it on average three times a week. So we're not having to go to them."

"Nike spent just 33 percent of its $678 million United States advertising budget on ads with television networks and other traditional media companies. That's down from 55 percent 10 years ago, according to the trade publication Advertising Age."

"We're in the business of connecting with consumers."

I'm disappointed that there's not more discussion here

<comment><USER4> I read this and liked it a lot, but I was frankly stumped when I asked myself the question "okay -- how do you take this somewhere else? Make it an engine?"

I'd love to hear suggestions. I mean, custom web/product development is a great thing. You write some code with a business that you co-license the product with. So? Where am I writing a web app that I can apply to many different businesses? Where is this different than in-house promotional coding?

Like I said, I love the story. Just wish I could make something useful out of it.

<comment><USER3> Much of the responsibility is on the marketing side.

BUT

"Interactive" advertising agencies like www.schematic.com are picking up this business...and charging _out the wazoo_ to develop very straightforward applications.

The new bottlenecks are the platforms that service the markets, networks, and communities that consumers [i.e. prosumers] connect on.

There is a lot of money to be made here.

Umair Haque at Bubblegeneration has a great analysis here:

"...for geeks, marketing, branding, advertising, etc are eeeeevil.

"The challenge, of course, is for geeks to understand that it's exactly this value equation they should be disrupting, not ignoring: making marketing, branding, advertising not evil.

"That they're evil doesn't mean you should ignore them - it means you should be destroying them and then redefining them: making them less about Madison Ave and BuzzAgent, and more about the deep 2.0 principles that in fact, are revolutionizing the deep economics of many industries - principles like peer production, gift economies, sharing, transparency, social capital, anticonsumption, and deep culture.

"Let me be a bit more blunt than I'd like to be: geeks (you too, VCs), this is your Next Big Thing - stop blowing it already.

[http://www.bubblegeneration.com/2006/02/industry-note- great-...](http://www.bubblegeneration.com/2006/02/industry-note-great-divide- why-is.cfm)

<comment><USER4> Translation for slow readers like me: disruptive marketing through technology. I think it's the "disruptive" part of it that I was missing.

I'm all over that. In fact, if I understand you correctly, you just made a case for my application to YC. Because I have several dormant startup attempts, I had a lot of sizzle and flash I could have chosen to present, but instead I went with something exactly like this.

</comment></comment></comment></comment><comment><USER5> This reminds me of the proposed "coke spaces" that got some media attention back in 2001. Amazingly the entire term has been mysteriously cleansed from Google, and the only thing I could find to prove I'm not crazy is one cached Slashdot discussion thread:

[http://188.8.131.52/search?q=cache:N03ZKM2QIzMJ:slashdot.o...](http://22.214.171.124/search?q=cache:N03ZKM2QIzMJ:slashdot.org/article.pl%3Fsid%3D01/03/28/1516203+%22coke+space%22&hl=en&ct=clnk&cd=10&gl=us&lr=lang_en&client=firefox-a)

</comment><comment><USER6> Drug companies have been advertising this way to doctors for years. They often hold lectures and give out educational tchotchkes that many doctors find genuinely useful. In fact, drug company lectures and educational materials are the main way that a lot of doctors keep up on new developments in their field.

(All this, of course, is notwithstanding the bad parts about drug companies giving doctors free stuff).

</comment><comment><USER7> hmmm...I think all this tech stuff about sport is cool, but the most important thing in sports is sportsman's will. The one can drip thyself with dozens of sensors, ipods, etc. But if he don't have a passion....it's useless. Nevertheless, smart point for Nike.</comment>


SYN Flood Mitigation with synsanity - <AUTHOR> http://githubengineering.com/syn-flood-mitigation-with-synsanity/ <comment><USER2> tl;dr: They backported an existing kernel feature (per-cpu syn cookie generation) to 3.x using iptables (rather than just maintaining a patchset) because they didn't want to run a current kernel or maintain a fork.

</comment><comment><USER3> I am curious how effective this is at larger synfloods. Obviously when something hits near 1gbps, its game over for any server as that floods the uplink (assuming a standard 1gbps hookup)

How many mb/s or pps can this handle on a average server while still having the server be able to respond to legitimate requests? ( lets say a average server is a quad core, 3.5ghz , 8gb ram)

<comment><USER4> I believe nowadays DDoS defense has to be in depth:

\- Anycast to divide the attack among different datacenters

\- Multiple filtering devices with +10Gbps uplinks at the edge

\- Then things like SYNPROXY and this synsanity at the final servers

My point being: I don't think asking how effective is synsanity against larger synfloods is a complete question.

<comment><USER5> Agreed. For the large SYN floods (X Mpps hitting a single machine) syncookie solutions don't work. What works is identifying the SYN flood itself and filtering it.

<comment><USER6> Generating SYN cookies in Linux doesn't work well at those rates without help. That said, it's very possible. Solarflare cards are good at withstanding several million PPS SYN floods...provided you license and then extend their IP stack with the card.

Many hardware load balancers can do +100M SYN cookies per second (assuming a proxy/gateway deployment instead of DSR).

So SYN cookie solutions do work; they just don't work great on stock Linux.

Edit: Add clarification about LB deployment. Won't work with DSR.

<comment><USER5> _That said, it 's very possible. Solarflare cards are good at withstanding several million PPS SYN floods...provided you license and then extend their IP stack with the card._

Agreed. We use Solarflare cards but we don't syncookie when we get a large flood. We identify the flood and drop it. There's little point firing back millions of useless SYN ACKs per second.

<comment><USER6> _Agreed. We use Solarflare cards but we don 't syncookie when we get a large flood. We identify the flood and drop it. There's little point firing back millions of useless SYN ACKs per second._

How do you know what to drop without SYN cookies? If the attacker isn't advanced, sure all the SYN's will look the same. What if the attacker is smart and the SYN's look legit and are spoofed? If you drop those SYN's, you'll run the risk of also dropping legit traffic if you don't use cookies.

</comment></comment></comment></comment></comment></comment><comment><USER7> Why don't you guys just run the most modern stable Kernel as opposed to 3.X?

You say: While Linux 4.x has a patch to send SYN cookies under a per-CPU-core socket lock, which does fix the problem, we wanted a solution that allowed us to use an existing, maintained kernel with upstream security patches. We didn't want to roll and maintain an entire custom kernel and all related future security patches just to mitigate this form of attack. Patching Linux 3.x to backport the socket lock change was also a similar maintenance burden we wanted to avoid.

But, if this is the case, what's wrong with using Linux's LTS kernel, or the stable current kernel? The kernel.org team does a great job maintaining these. Which upstream vendor are you relying on?

Depending on your workload, and your kernel version, there are some fairly large performance improvements. These performance improvements in my testing primarily land in networking and I/O -- effecting many applications.

I think your work is awesome. I just think backporting, and not installing linux-image-generic might be a lot work for not much benefit. I'd love to hear your reasoning that leads you to believe that's a better option for security or stability compared to using the trusty kernel.

Also, typo: `causese all` -> `causes all`.

<comment><USER8> Great question! A large portion of our infrastructure still runs on Ubuntu Precise, and so the default "supported" options for the kernel on those machines are 3.2 or 3.13. Once you're on newer releases you get 4.x support, at the very least in backports, and at that point I would definitely agree the upgrade is worthwhile.

<comment><USER7> Have you thought of pulling in the latest Ubuntu HWE?

</comment></comment></comment><comment><USER9> So instead of using a SYN attack, attackers can just run a full-open tcp attack. Not as effective if all you have is one or two servers with big pipes, but a botnet should make it feasible.</comment>


Ask HN: What do you use for personal finance? - <AUTHOR>

I'm looking for an income / expense tracking tool, a budgeting / planning tool, and a tool to tie all my spending vectors (cards, paypal, google wallet, square) together.
Ideally, this stuff will all have an API that I can build on top of.  Do such tools exist?
Also, is there a bank or credit union with an awesome API? <comment><USER2> Almost everyone I know who uses a tool for tracking their finances uses Mint. They do not have an API that I am aware of, however.

It appears Yodlee may be something you'd be interested in.

</comment><comment><USER3> I use a couple of Google Apps spreadsheets, with some custom JavaScript functions. Not the most elegant solution, but it works for me (granted, I like to keep things simple, and that includes my finances).

What's nice about spreadsheet software is that you can do whatever you want, there's no fixed way to track expenses or plan/budget. But that can also be a downside, as I've rewritten parts of it numerous times when I found out I forgot to take certain things into account (no pun intended).

</comment><comment><USER4> Moneydance has an API[1]. First heard about it here: <http://tynan.com/hardcore-personal-finance>

[1] <http://www.moneydance.com/developer>

</comment><comment><USER5> Did you try mint.com. There's Yodlee (which mint uses) for API however its not free.

</comment><comment><USER6> Check out Simple (formerly BankSimple). They have an API, but I haven't used it so I can't tell if you if it's awesome or not.

<https://simple.com/api/>

</comment><comment><USER7> A spreadsheet is a great tool for this stuff. It's boring, but it works.

</comment><comment><USER8> mint.com is fantastic

<comment><USER9> they are not good at handling some of alerts(transaction alerts), hard to manage if u have multiple accounts and ur transferring money between those accounts.

<comment><USER8> I transfer between accounts all the time, and think it handles it well. Could you elaborate more?</comment></comment></comment>


Show HN: Dimensional Drawing - <AUTHOR> http://www.dimensionaldrawing.com/

<comment><AUTHOR> 3d (2.5d) collaborative drawing site. Powered by CouchDB and hosted by iriscouch.com. Source code: <https://github.com/clehner/dimensional-drawing>

Inspired by webcanvas.com and my earlier site, theinfinitemaze.com.

Some features I am considering adding: \- more drawing tools, such as line and curve \- a button to jump to areas of recent drawing activity \- more explanatory info

Feedback is much appreciated. Enjoy.

<comment><USER2> Looks great and I really enjoyed the interactivity. One thing that would be interesting would be a "map at one of the lower corners" that showed the whole field. Just like the world map on a video game where you can see where you are. Also, a bigger eraser would be helpful. :)

<comment><AUTHOR> The field is infinite; it expands as you move through it. Of course there could be a mini-map showing a fixed area surrounding the viewport. This would add technical complexity, requiring the client to save an additional scaled down copy of each drawing to the db, but it's possible.

You can change the size of the eraser/brush with the palette that appears when you click the color rectangle. Perhaps this isn't obvious. Or did you mean that the maximum brush size isn't big enough?

<comment><USER2> Didn't see that there was a way to change the size of the eraser brush so I see that you did have it. I just used the brush that was there, so didn't get to see how big the maximum brush size really is.

Understood about the scaled down version to the db. I was curious as I was playing around with the infinite field I ran into some things that I didn't expect to be drawn (basically drawings of nudes) that were far off to the left of what loaded up. With these types of thing I get lost easily, so a map would have helped me. :)

Thanks!</comment></comment></comment></comment>


IPod touch: the hot accessory for your sniper rifle - <AUTHOR> http://www.tuaw.com/2009/01/21/ipod-touch-the-hot-accessory-for-your-sniper-rifle/ <comment><USER2> The "holy shit" feature of that app can be it grabbing the weather where you are and automatically filling in pressure/wind direction/etc, but I don't know if they coded that in. But I guess if you're a sniper, you wouldn't want your location be broadcasted out via GSM.</comment>


Why isn't mesh networking more popular? - <AUTHOR> http://justindunham.net/2014/05/mesh-networking/ <comment><USER2> Very long story short, the overhead in maintaining the link state information in meshed networks swamps the available bandwidth for even modest (think 20-40) numbers of nodes. Basically, as nodes are constantly moving/coming on- and off-line, nodes have to know which nodes are in the connection graph, so they exchange that information. But that eats up all of the bandwidth amazingly quickly, leaving no room for actual traffic.

There are some other issues with meshed networks (latency, battery usage when you're just a client node, etc.), but especially for those of the kind described/dreamed about here (which are also known as MANETS -- mobile ad-hoc networks), the routing issue is a huge one.

Finally, I should note the above isn't just academic; several companies have tried to build products based on these kinds of networks -- military contractors being one of note -- and have pretty much come up short.

So until the really fundamental issues are worked out, which is in the realm of academic research, not implementation, we probably aren't going to see anything like this.

<comment><USER3> I agree that in general the idea is pretty stupid, but what about if we add a couple of layers of master nodes? As Google says, by trading off a bit of decentralisation you can gain a lot of performance (see gfs, etc).

<comment><USER4> route detection would be difficult. you'd throw in leader election on top of the mentioned network mush.

</comment></comment></comment><comment><USER5> The article states, "Perhaps most importantly, the idea of mesh networking seems to be a fit with our current trend toward decentralization..."

I think this isn't really an accurate statement. The examples given in the article (Uber, airbnb, bitcoin) could reasonably be called "decentralized" (though, one could argue that in a case like airbnb, the fact that you go through a company means it isn't actually decentralized), but on the whole, I'd say the trend, for the bulk of the population, is actually towards more centralization. Think Facebook, Google, Twitter, etc. More people are storing their data in fewer places, so I think the trend is the opposite of what the author states. In that sense, it's not at all surprising that mesh networking is not popular.

</comment><comment><USER6> The cellular network example depends on somewhere having a reliable, direct connection to the parent network.

So, the need for a reliable, direct connection trumps the need for mesh networking.

If you solve the problem of having a reliable, direct connection somewhere, it's more effective to extend that solution rather than also covering the problem of mesh networking.

</comment><comment><USER7> Good timing for a mesh networking post, since this year's WirelessBattleMesh starts tomorrow.

"The Wireless Battle of the Mesh is an event that aims at bringing together people from across the world to test the performance of different routing protocols for ad-hoc networks, like Babel, B.A.T.M.A.N., BMX, OLSR, 802.11s and Static Routing."

[http://battlemesh.org/](http://battlemesh.org/)

</comment><comment><USER8> Probably because right now at least, there's little incentive in keeping nodes up. OpenLibernet and Skycoin are trying to change that:

[http://www.openlibernet.org/](http://www.openlibernet.org/)

[https://bitcointalk.org/index.php?topic=380441.0](https://bitcointalk.org/index.php?topic=380441.0)

</comment><comment><USER9> I believe the answer is that it is basically a pipe dream. For some reason, these sorts of ideas infect people with breathless enthusiasm. Telcos won't be necessary anymore, the reliability will be so much better, etc. Of course the reality is different. There are technical reasons for this, such as mentioned in another comment, but what I also think is important is the human factor. People would have to be convinced to administer their mesh nodes, and of course there are network effects here (there's really only a point to this if there's a critical mass, at least around you). When you think of the average user what they really want is to pay some nominal fee to ensure that the maintenance of their uplink is Somebody Else's Problem--they don't want to reconfigure their mesh node just to check facebook &c.

</comment><comment><USER10> Has anyone worked with hybrid networks? I can see how the routing problem grows exponentially, but what if you keep everything to a few hops to a node that offloads the traffic to a more traditional system? It could be a good way to extend network range while reducing infrastructure.

<comment><USER11> I think this is what 802.11s is intended for.

</comment></comment><comment><USER12> There are different tradeoffs when you're talking about a mesh based on physical topology versus the logical mesh of a DHT.

I think we'll see some rapid advancements as Van Jacobson's NDN[0] and Miller's telehash[1] reach maturity.

[0] [http://named-data.net/](http://named-data.net/)

[1] [https://github.com/telehash/telehash.org/blob/master/backgro...](https://github.com/telehash/telehash.org/blob/master/background.md)

</comment><comment><USER13> Looking at trends like that is pointless. Interest in anything technical will decrease because more non-technical people become connected and the Internet reflects that. I bet there is more people (absolute numbers) interested today than in 2005.

Do you think the percentage of technical people will increase over time? In the same way that almost no one was literate 1000 years ago which is now reversed.

</comment><comment><USER14> Wouldn't the latency be just awful if you connected to someone through lots of wifi hops?

</comment><comment><USER15> Disclaimer: I'm creator of a mesh network, or a decentralised, anonymous 'reddit' called Aether.[0] [1] I'm probably biased.

The main problem with these networks is not the declining user interest per se, it's rather that they are by their own nature, a) very hard to engineer, and b) almost impossible to monetise. The engineering effort required to make a decentralised network reach resilience (and visible uptime) of the most basic Rails web app on Heroku is orders of magnitude away from just hosting it.

For A, Decentralisation is a cruel mistress; every assumption you will make about computers connecting to your network will slowly fall apart as you move deeper into the architecture, engineering and design of your services—that makes it a fascinating challenge as much as a hard one fortunately. On the more unfortunate side, you eventually end up with cases that require you to entirely reëngineer your stack to provide for them; and not providing them access is philosophically against the democratic access decentralisation offers. For starters, anything higher than C/C++ is probably a non–starter, a lesson I learned the hard way. My own work is built in Python and getting it to perform adequately well on even most medium–grade computers has been a challenge. Distributed network means distributed loads, and there is a significant amount of computers who aren't able to pull their own weight on the Internet, especially in the developing world.

It also means that you'll be bogged down with a lot of platform support issues, small bugs etc.

For B, there are two issues. The first issue is that in a decentralised network it's almost impossible to target a specific person or entity to pay if you're not willing to create an exception for yourself (i.e. all computers able to call your servers, and consequently in absence of your servers the network goes down) but if you're willing to do that, you can just make it into a traditional system in the first place, and you just made it both subject to your whims, and as fragile as any other centralised service. That's a no-go.

Beyond this, the moral imperative is that you _shouldn 't_ be charging for a service that doesn't cost you money to maintain. For additional services, sure, but you still need to figure out how to attach an additional service without which the core network continues to function.

In general, it's a massive engineering task that isn't lucrative, and the effort required to maintain and keep functional increases exponentially as the network scales. For me, I'm stuck at packaging the new version for the last few months because PyInstaller doesn't like the way I split Aether into two applications—and you end up with these corner cases nobody on the entire Internet has ever encountered before. There's no Stack Overflow for that. It's fun, but it's also tiring.

[0] [http://www.theverge.com/2013/11/27/5150758/aether-aims-to- be...](http://www.theverge.com/2013/11/27/5150758/aether-aims-to-be-a-reddit- for-the-privacy-conscious)

[1] [http://www.getaether.net](http://www.getaether.net)

<comment><USER16> Question: If you assume that at some point (until it becomes ubiquitous), the mesh network must connect to existing broadband providers for bandwidth, how could you avoid charging?

I'm not suggesting profiting off of users, but rather covering the bandwidth costs incurred by each user in the network. In theory, the costs approach zero over time (once density is reached in each distribution of nodes), but surely some monetary transfer is ok.

<comment><USER15> Aether is not a full-fledged mesh network in that sense, it still relies on an existing IP connection between the nodes. But in cases of full blown mesh networks, there needs to be 'exits' from the mesh to the normal Internet, and those points would cost money to run. In that case, though, those exits would be clearly identified, i.e. not fleeting interstitial nodes on the mesh network, and you could direct payment to them. The problem arises when you try to transfer money from a mesh node to another, not from a mesh node to a known location (the exit).

<comment><USER16> Agreed. I'm approaching this thinking that the exit points can be backbone providers and we could build simple software to enable users to pay for the bandwidth (to the exit) that they've utilized. Connectivity within the network would be free and we could even place peering points at the exit to reduce outbound bandwidth.

Then it just becomes a question of incentivizing users by consistently driving down costs (in theory) to promote density of nodes.

<comment><USER15> Yes, this could be an intermediary state between a full–blown mesh network which everything is fully peered, and a fully centralised network such as today's Internet. It all depends on everybody carrying their own weight, though, and of all, that seems to be the farthest away concept so far. Phones and other mobile devices are consuming an increasingly sizeable chunk of the pool and those devices are barely able to connect and to their work, much less work for others due to battery restrictions, which are ultimately bound by the laws of physics.

This is also the reason Aether will most probably never have a mobile version. Not until they finally make nuclear fusion work, and compact it enough to make batteries with it!

Shame, for I would love to see it happen.</comment></comment></comment></comment></comment>


U.S. Navy's Costliest Carrier Was Delivered Without Elevators to Lift Bombs - <AUTHOR> https://www.bloomberg.com/news/articles/2018-11-02/costliest-carrier-was-delivered-without-elevators-to-lift-bombs <comment><USER2> tldr:

> the weapons elevator is among "the most advanced technologies being > incorporated into" the carrier</comment>


Debian removed encryption from bcrypt utility, calling it "a broken toy" - <AUTHOR> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700758 <comment><AUTHOR> I know it is 2 years old news but I just noticed (maybe Ubuntu took longer to import this debian modification) I have only seen bcrypt praised here, so I thought I would put a head up.

<comment><USER2> There's some confusion here, because the bcrypt algorithm people recommend, is unrelated to this Blowfish encryption tool. The product's page suggests it is a long dead project.

[http://bcrypt.sourceforge.net/](http://bcrypt.sourceforge.net/)

That it used ECB seems to have come up on their mailing list in 2003.

[http://sourceforge.net/p/bcrypt/mailman/message/108247/](http://sourceforge.net/p/bcrypt/mailman/message/108247/)

<comment><AUTHOR> Thanks! That clears it up!</comment></comment></comment>