The Internet is Dying - <AUTHOR> https://www.nytimes.com/2017/11/29/technology/internet-dying-repeal-net-neutrality.html <comment><USER2> Sadly, these kinds of attacks on the internet's neutrality shall continue taking place unless we figure out a way to build a completely decentralized version of the internet; as in edge nodes talking directly to each other without any central authority/infrastructure. We could use Blockchain based technologies to manage the whole network and charge + compensate nodes based upon usage + resources contributed.

</comment><comment><USER3> Any chance to vote for google + facebook+ youtube neutrality? Maybe that will save the patient</comment>


Planning a Morrowind all-faction speedrun with simulated annealing, part 3 - <AUTHOR> https://kimonote.com/@mildbyte/travelling-murderer-problem-planning-a-morrowind-all-faction-speedrun-with-simulated-annealing-part-3-46455/ <comment><USER2> That was a lot of fun to read.

I am finally getting to the point in my programming abilities where I have the confidence to solve problems like this.

"throw something together" never is that easy, but its getting easier.

<comment><USER3> I know right. I look at this kind of stuff and im just like, man people are thinking about problems alot cooler than i am.

<comment><USER4> In your free time you can think about any cool problems you want.

It's always fun to bring cool _solutions_ back to work from my own personal weekend hacking.

</comment></comment></comment><comment><USER5> What's interesting here is that the game's addons (or expansions) can "solve" a big problem in a vanilla-only game, i.e.

>The bad news is that these trainers won't train skills above their governing attributes. Raising attributes requires levelling and levelling in Morrowind is a very long story.

This is solved in Mournhold, where you can learn the "Damage Skill" spell and artificially briefly lower your skill by 100 to 0 for 1 second and in that 1 second you talk to the trainer and get the training using that exploit from even the worst trainer of any skill.

</comment><comment><USER6> As a kid I logged hundreds of hours in Vvardenfell, and I love this series of articles, thanks OP

</comment><comment><USER7> I fuzzily remember a scroll near the start that let you jump over about 1/3 of the map, which you could survive with timed use of even a 1/2 second levitate.

Would this help any of the longer walks? Or does speed+levitation mostly beat it anyway?

<comment><USER8> It was a quest called "A Falling Wizard"; the scroll was the "Scroll of Icarian Flight". I spent wayyyyy too many hours of my childhood playing Morrowing. There's a human speed run that relies on it for a blazing fast ~3min completion of the main quest: [https://www.kotaku.com.au/2014/04/this- morrowind-speed-run-t...](https://www.kotaku.com.au/2014/04/this-morrowind- speed-run-takes-just-3-minutes-and-22-seconds/)

Source: [http://elderscrolls.wikia.com/wiki/A_Falling_Wizard](http://elderscrolls.wikia.com/wiki/A_Falling_Wizard)

<comment><USER9> Better source: [https://en.uesp.net/wiki/Morrowind:A_Falling_Wizard](https://en.uesp.net/wiki/Morrowind:A_Falling_Wizard)

</comment></comment></comment><comment><USER10> when i read the first couple posts i was already thinking that mark/recall would be a huge extra step of complexity. adding mark and recall to the simplest traveling salesman problem is already a pretty challenging thing to comprehend. glad this guy didn't just skip it because it doesn't fit into traditional cs graph theory.</comment>


Ask HN: Software archaeology: can anyone help me find an old Z80 game? - <AUTHOR>

I have a nostalgic longing for a game for the Exidy Sorcerer which was a circa 1978 Z80 home computer.
It had a game called "Wilderness" which I would love to find again. I can't see any sign of it in the web.
Can anyone in the HN community help to find any information about Wilderness for the Exidy Sorcerer? Ideally the game itself but any info at all would be good I.e. who wrote it?
Thanks <comment><USER2> Check the #messdev channel. If they don't have it, someone over there would be willing to help you find it and then preserve it.

<comment><AUTHOR> Thanks I'll check it out!</comment></comment>


CRV Ventures: "F*CK TRUMP" - <AUTHOR> https://medium.com/@CharlesRiverVentures/f-ck-trump-691946de213#.k3hsjki80 <comment><USER2> I would hope CRV's immigrant staff are documented. If so, what's the beef with Trump? His official stance on immigration is to try to combat illegal immigration and temporarily pause immigration from unstable countries.</comment>


Microsoft's $10bn Jedi cloud contract "sets dangerous precedent", says AWS - <AUTHOR> https://tech.newstatesman.com/cloud/microsoft-jedi-contract-precedent-aws <comment><USER2> Wondering if anyone in these comments actually read the post.

They are making a legitimate point about an unfair public procurement process that the president interfered in for personal reasons.

> There is a recurring pattern to the way President Trump behaves when he's > called out for doing something egregious: first he denies doing it, then he > looks for ways to push it off to the side, to distract attention from it and > delay efforts to investigate it (so people get bored and forget about it). > And then he ends up doubling down on the egregious act anyway. On JEDI, > President Trump reportedly ordered former Secretary Mattis to "screw'" > Amazon, blatantly interfered in an active procurement, directed his > subordinate to conduct an unorthodox "review" prior to a contract award > announcement and then stonewalled an investigation into his own political > interference. "Corrective action" was used as a way to halt our litigation, > delay further investigations and incorrectly give the appearance that only > one issue needed to be fixed while giving the impression that the DoD was > actually going to fix something. While corrective action can be used to > efficiently resolve protests, in reality, this corrective action changed > nothing, wasted five months that could have been spent getting to the bottom > of these serious concerns, and was designed solely to distract from our > broader concerns and reaffirm a decision that was corrupted by the > President's self-interest

<comment><USER3> I didn't read it, and won't. Amazon got out played by msft. Bezos is an amateur compared to the likes of the DOD team at msft, buying a mansion in DC to host parties, come on Bezos, such an amateur move. Getting into a public pissing match with the POTUS, stupid. Crying foul for months and months and then writing a story about your slippery slope theory, amateur, and locks you out of more cloud business with .gov. I have personally been through this process, albeit not a $10B contract but very very large, and it comes down to relationships. Jeff should be doing everything he can to steal away that msft sales team that came in and made them look like fools so they can win the next bid. He isn't playing against Barnes and Nobles, this is a corporation that will spend tens of millions developing a competing product and give it away for free for years to bankrupt it's competitors, they don't play fair.

<comment><USER4> You're being downvoted for no good reason, fact is MS has a long history of winning government contracts using all available means, Amazon looks to me like the nerd who got into a street fight with only his glasses on, no gloves, no knives, no anything.

</comment></comment></comment><comment> bigcorp-slave Can someone tell me if I've summed this up right?

\- Amazon colludes behind the scenes to get a contract proposal that on paper only Amazon can fill (e.g. memory sizing options exactly matching things only AWS provides)

\- There is a competitive bidding process without prices revealed and Microsoft wins

\- Amazon cries no fair and demands to be allowed to bid again now that they know how much Microsoft bid

\- Government re-evaluates the deal and picks Microsoft again

\- Amazon decides to make whiny posts about how aggrieved they, as a >1.5T company, are

<comment><USER5> I wonder why Amazon is so bothered about this deal. If I remember the time period correctly, this is a $1B/year deal. That is a low single digit percentage of AWS revenue, do they really want to anger the government and let themselves be exposed to antitrust investigations.

<comment><USER6> I wonder if it's less about the revenue and more about the credibility boost that Azure will get if everyone sees the Pentagon going all-in on it.

</comment></comment></comment><comment><USER7> Would the precedent be less dangerous if the contract had been awarded to Amazon?

<comment><USER8> Clearly. Bezos and top brass must be infuriated given that Amazon was involved in crafting the proposal.

It's good for everybody that there is diversity in cloud. We need multiple leaders in the space to keep costs low.

<comment><USER9> They got out corrupted on their own setup. Amazon cry me a River.

</comment></comment></comment><comment><USER10> I don't know how many tens of thousands of small retail businesses are struggling and being hampered by arbitrary government action right now, benefitting Amazon, but it's really hard to feel bad for the $1.5 trillion monopoly right now.

Amazon should probably be broken up and it's whining about losing out on a multi billion dollar government contract.

<comment><USER11> In fed contracting, ironically, small businesses (especially those owned by women, minorities, disabled veterans, etc) are given preferential treatment sometimes to the detriment of thrift.

Regarding this contract, I don't care who wins so long as it's one of the hyper scale vendors. The status quo for DevOps, infra, and managed services in DoD is pure hell.

</comment></comment><comment><USER12> That other guy is dangerous \- _competition_

</comment><comment><USER13> >> Amazon called the single-supplier framework award "politically corrupted"

I wonder when corporations will start taking the place of governments, when they will wage war against each other and kidnap each other's executives? This is the world we're heading towards. There can only be one winner.

If they keep asking for more legal privileges for corporations, this is what we're going to get.

The government should completely cut corporations out of all contracts before it's too late.

<comment><USER14> If we have to live in this kind of world can we at least go the full Shadowrun way pretty please. I could see myself mutated in a giant troll wielding a massive minigun ... and I want to see a dragon fly too!

</comment></comment><comment><USER15> I don't care about the contract one way or the other way.

What I do object to is the use of the word Jedi in this context. Somehow it feels like defiling of a favorite memory.

<comment><USER16> JEDI is an acronym, but HN appears to like not capitalizing it. And to me at least, it feels less bad when its all caps.

</comment></comment><comment><USER17> AWS blog post: [https://aws.amazon.com/blogs/publicsector/jedi-why-we- will-c...](https://aws.amazon.com/blogs/publicsector/jedi-why-we-will- continue-protest-politically-corrupted-contract-award/)

Previous discussion: [https://news.ycombinator.com/item?id=24379304](https://news.ycombinator.com/item?id=24379304)

</comment><comment><USER18> I think the "dangerous" precedent being set is now we can stop assuming AWS is the only "cloud" out there. It always amazes me how 1) so many small companies assume AWS must be the only way to go and 2) once there they are so terrified to run work loads on other services. *

* worth noting this is my anecdotal experience, would love to hear stories of which companies do the contrary.

</comment><comment><USER13> The $10 billion was printed out of thin air by the Federal Reserve Bank and given to the government in exchange for some bonds which they also created out of thin air... And then that money was given to Microsoft as part of this phony contract.

The real story here is that Microsoft is getting $10 billion of free money from the government and Amazon is upset about it.

</comment><comment><USER19> Wow. Amazon's blog post about this comes off as remarkably petty and emotional. Very strange look for a massive corporation.

</comment><comment><USER20> I through it was 10 billion

<comment><USER21> Wikipedia agrees[0]. Looks like the article and headline have now been updated.

[0] [https://en.wikipedia.org/wiki/Joint_Enterprise_Defense_Infra...](https://en.wikipedia.org/wiki/Joint_Enterprise_Defense_Infrastructure)

<comment><USER20> Yes, they updated

</comment></comment></comment><comment><USER22> The history of the JEDI contract is interesting[2018]. It was contested by Oracle and also by IBM, and was widely seen as a last-gasp attempt by two entrenched 'enterprise tech' vendors to remain relevant in the cloud marketplace.

But as [2018] notes, Oracle complained.

> In the complaint, Oracle dives into deep detail about two DOD officials whom > it alleges had ties to Amazon Web Services, the cloud company thought to be > in the frontrunning for JEDI. Oracle believes those two officials influenced > the JEDI strategy to be tailor-fit for an AWS win.

The interesting thing here is that both Oracle and IBM had an initial strategy of painting the JEDI requirements as exceeding DOD's needs, an interesting tactic given their relative lack of scale -- they are in capex terms also-rans in the cloud market.

After a review, in April 2019, the Pentagon said that the employee's actions did not affect the process and further ruled IBM and Oracle out of the process[2019], while retaining Amazon's and Microsoft's bids.

Microsoft was finally awarded the contract in late October, which prompted Amazon to claim "political influence" because of Trump's statements re the contract, and led to a further legal challenge[2020].

[2018] [https://www.fedscoop.com/ibms-protest-10b-jedi-cloud- contrac...](https://www.fedscoop.com/ibms-protest-10b-jedi-cloud-contract- dismissed/)

[2019] [https://www.nextgov.com/it-modernization/2019/12/after- two-y...](https://www.nextgov.com/it-modernization/2019/12/after-two-years- jedi-finally-underway/162005/)

[2020] [https://tech.newstatesman.com/cloud/amazon-pentagon- contract...](https://tech.newstatesman.com/cloud/amazon-pentagon-contract- appeal-us-judge)

</comment><comment><USER23> [https://m.youtube.com/watch?v=n-86ax7TYNM](https://m.youtube.com/watch?v=n-86ax7TYNM)

</comment><comment><USER24> From the AWS blog post [0].

> This time, AWS offered a lower cost by several tens of millions of dollars.

On a contract worth $10bn does tens of millions really make a difference?

[0] [https://aws.amazon.com/blogs/publicsector/jedi-why-we- will-c...](https://aws.amazon.com/blogs/publicsector/jedi-why-we-will- continue-protest-politically-corrupted-contract-award/)

<comment><USER25> > On a contract worth $10bn does tens of millions really make a difference?

In government contracting, if cost is supposedly the formal deciding criteria, yes.

The allegation isn't that the cost amount was significant as a value amount, but that it's one of many examples raised of the DoD allegedly making decisions for which pretexts are offered that are inconsistent with the facts.

The laws of government contracting don't allow the kind of arbitrarily moving goalposts that Amazon's description of the DoD behavior would indicate, and the reason it doesn't is as a safeguard against corrupt political favoritism with contracts as patronage.

Focussing on whether the cost _qua_ cost is significant in isolation is focussing is missing the forest for the trees.

<comment><USER10> The laws of government contracting? What laws do you speak of? By the way there is corrupt political favoritism going on at all levels of government and it is naive to assume otherwise.

</comment></comment></comment><comment><USER26> You've set a truly dangerous precedent of not giving me billions of dollars. I wasn't aware that AWS executives were whiny babies.

I know HN doesn't like a non-serious tone, but do these clearly massively self-interested guys really deserve more than mockery? They're not trying to alert the public to the horrors of a bloated military-industrial complex. They're trying to get their beak wet and crying when they didn't get any.</comment>


Ask HN: What self-hosted PaaS do you use for Rails/Django/Phoenix web apps? - <AUTHOR> <comment><USER2> Check out Dokku >> [https://github.com/dokku/dokku](https://github.com/dokku/dokku)

<comment><USER3> Yup. This is an amazing little script. I use it to run my side projects, and the upgrade path to heroku, deis, or openshift is effortless.

Using this with my own docker image repo makes this even easier.

<comment><USER2> Do you have any notes on moving a Dokku project to Deis?

</comment></comment></comment><comment><USER4> Openshift.com</comment>


Google Buys Schedule Management Startup Plannr - <AUTHOR> http://techcrunch.com/2010/09/28/google-plannr/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=My+Yahoo

<comment><USER2> _Plannr is bootstrapped which means that whatever the undisclosed purchase price was, Eidelson and Prado must be somewhere celebrating hard_

That must be a really nice feeling to sell to Google without having a bunch of investors in line to get their cut.</comment>


Ask HN: Where to sell your profitable company - <AUTHOR>

I am a student living in Canada, over the last 2 years I have built out a company in a niche market where at the time there were a couple of competitors (now around 5-6). 3 of them are VC funded.
I am doing this part time still and trying to earn my business degree but now I am finishing up and want to sell this business so I can try something new, the business generates around 2 million a year (CAD) in profits, so I am wondering what sort of 'investment banks' or people I should get in touch to sell this company.
I love working on this and would not mind working on it a more, the sad part is, being in Canada and not a active guy in the 'VC/Tech' scene so I don't know which route to take or who to approach. <comment><USER3> I've got to ask why sell? If it generates 2 million in profit a year, it should be generating plenty of cash to bank roll your next endeavor.

Since you are the only one maintaining you can simply hire 2-3 people to do the work you are currently working and keep the rest of the profit. Most people here would kill to have a business that is generating 2 million in profit.

<comment><USER4> Totally disagree. As soon as you're strongly think of selling, it means it was time to sell yesterday. If you can get anything fair, do it. Once your heart's not in it, it's good to move on and mentally cut ties. You won't be able to keep innovating if you're not mentally with it, and nowdays businesses can fall apart rapidly even if their founder is totally onboard, let alone if he's not.

People who have never built a successful business won't understand. As soon as you strongly feel it's time to sell, do it. Get out and build your next thing. Later you might regret it, that's natural, but better than having things decay on their own if you're not fully with it. My advice - yes, sell.

</comment></comment><comment><USER5> > the business generates around 2 million a year (CAD) in profits,

Are you serious? In Canada? Why in god's name would you sell this? Hire someone to do the dirty work for 50K and live off the rest until you grow old and gray.

Why would you even think otherwise?

</comment><comment><AUTHOR> Forgot to mention, I built it up myself and still maintain it myself only and that I am looking for a exit because I want to pursue something even bigger with the funds I get from selling this.

<comment><USER6> You might want to edit your original post to include this info.

</comment></comment><comment><USER7> Go straight to your well funded competitors. They'll love the chance to talk acquisition more than likely.

<comment><USER8> No so sure informing your competitors that you want out is such a great idea. Depends highly on your market or product/service but I'd be weary of anyone approaching me with the same offer.

</comment></comment><comment><USER9> Can you share what it is? I can atleast intro you to some of my investors if the business/product is compelling and you would at all be interested in taking some investment and continue working on it? Or you can email me (see my profile).

</comment><comment><USER10> There are private equity groups that acquire companies with profits of this size. But I don't know the industry well enough to suggest names. I would try and get some names from any investment bankers you know -- maybe alums from your biz school if you don't know anyone personally.

</comment><comment><USER11> Can't help you with finding a VC, but I can tell you that others will be interested in the following:

How will this business fare with you gone completely?

Is it something anyone can be trained to do?

If so, what barriers to entry are there to keep someone else from duplicating what you've done without buying you out?

<comment><AUTHOR> The business is 80% automated, the rest is just maint. work such as: sys admin, emails, approving certain things etc. so yes someone can be trained very easily. Barriers to entry... none really in the sense we do not necessarily have much proprietary 'technology' except we have the users/the revenue/infrastructure in place.

<comment><USER12> Hey I'll help with the maint if you are looking for somebody ;)

</comment></comment></comment><comment><USER6> I suspect the most likely buyers would be: (a) A competitor in the same space looking for market share or (b) A firm in an adjacent market looking to diversify

Those are only my initial thoughts and there are probably other ways of looking at it.

I'm guessing that one of the the three VC funded competitors could be a likely acquirer. Given that there are three of them, you might even be able to create a bidding war (assuming you have something worth bidding for, e.g tech, market insight/share).

I'd do some research on each of those companies to make sure you have something of value to them and then try to meet with the founders/CEOs informally, if possible.

</comment><comment><USER13> Talk to a bank who can represent you. Typically they come up with a pitchbook/deck and try to pitch to prospective companies. They charge anywhere between 5-7% depending on your business. Best way to get to a banker who can sponsor is to talk to a lawyer who is in the startup world.

If you want to send direct messages, do the pitching and negotiations yourself, try linkedin paid service.

<comment><AUTHOR> I have talked to td waterhouse private investment people and were going to be setting up a deal. Going to look for startup lawyers on linkedin in my area.

</comment></comment><comment><USER14> You say you're based in Toronto. Have a look at the people behind <http://www.startupnorth.ca/> and get in touch with them, I'm sure they'd either be interested themselves, or would be happy to make some introductions.

</comment><comment><USER15> Where in Canada are you based? Your options may vary if you're in a big market (TO, Vancouver, Montreal...) or not.

That said, I'd imagine your best route is to find local investor/angel/business-mentor types who can recommend a firm that specializes in getting companies acquired. I'm based in Vancouver, and my business partner has definitely had getting-to-know-you meetings with a law firm - <USER2> by an investor - that handles that sort of thing.

<comment><AUTHOR> Only Tdot :)

</comment></comment><comment><USER16> Have you been approached by any VCs in the past? I would revisit that if possible.

In my experience, there is no shortage in VC contact for any, even modestly, profitable business online. So, I am sure you've heard from at least a small handfull.

</comment><comment><USER17> Talk to Benjamin Yosko => <http://www.instigatorblog.com>. He is very approachable, lives/works in Montreal, and recently sold his startup. Tell him Captain Recruiter says hello.

</comment><comment><USER18> Ping me, I know a few people who may be interested...</comment>


Show HN: A countdown timer for your life. - <AUTHOR> http://tejaswi-yerukalapudi.com/2012/09/10/a-countdown-timer-for-your-life/

<comment><USER2> Just watched In Time [1] huh?

1: <http://en.wikipedia.org/wiki/In_Time>

<comment><AUTHOR> Y'know, I did watch it, but wasn't on the back of my mind when I was making this one :)

</comment></comment><comment><USER3> seems nice!

how do I build it on linux?</comment>


Ask HN: When you wash your hands, do you apply water before applying soap? - <AUTHOR>

I've seen people rub their hands with soap before turning on the faucet at all. For no meaningful reason, I'm trying to apply this same practice to my hand washing.<p>Happy Friday. <comment><USER2> You should wet your hands before applying soap. Running water is an important part of hand hygiene.

The CDC have some useful information about how to wash hands. This link has a bunch of infection control information, but look for the PDF of "Hygiene of the Skin: When is clean too clean?" (<http://wwwnc.cdc.gov/eid/content/7/2/contents.htm>)

Notice the 'Right way to wash your hands' tells you to wet your hands first (but does not say why, frustratingly.) (<http://www.cdc.gov/handwashing/>)

The WHO have a comprehensive document about hand hygiene in health care, with a lot of information about different solvents and etc etc,

</comment><comment><USER3> I don't, I think it is wasting water for no reason (of course it has little impact). The only problem is when, at times, I have discovered there is no water through the faucet :(, then I end with my hands full of soap.

</comment><comment><USER4> Yes. I require a tiny bit of water to reduce friction.

</comment><comment><USER5> Hand washing requires both soap and water.

If I were to apply soap first I'd be unable to turn the water on without smearing soap onto the faucet.

So yes. I apply water before the soap because getting water on the soap dispenser causes no harm to others -- whereas getting soap on the faucet handle does cause (a tiny amount of) harm.</comment>


Google pulled Iranian coronavirus app from its app store - <AUTHOR> https://www.businessinsider.de/international/iran-coronavirus-app-pulled-by-google-2020-3/?r=US&IR=T <comment> chupa-chups I do understand the general reasoning of google complying with the embargo on Iran. In this case though I really hope this app gets an exemption.

I'm in europe in a region with lots of connections to Milan, and extrapolating from what's going on there right now to what must be going on in Iran exceeds my imagination.</comment>


WanaCrypt0r Ransomworm - <AUTHOR> http://baesystemsai.blogspot.com/2017/05/wanacrypt0r-ransomworm.html <comment><USER2> > The initial infection vector is still unknown. Reports by some of phishing > emails have been dismissed by other researchers as relevant only to a > different (unrelated) ransomware campaign, called Jaff. There is also a > working theory that initial compromise may have come from SMB shares exposed > to the public internet. Results from Shodan show over 1.5 million devices > with port 445 open – the attacker could have infected those shares directly.

I think this is an important take-away. I found it strange that so many media outlets and IT departments were jumping on the "do not open suspicious emails" bandwagon even although there hasn't been a lot of evidence of such phishing emails. That is: screenshots of infected devices have been popping up all across the world, but almost no examples of a particular entry email have been shown.

Of course, it might be easier for an IT dep. to state: "it must have been unleashed by someone clicking on some email they got" rather than "oops, we still had unpatched Windows machines exposed to the public internet". Why go through the trouble of sending out emails when your worm already contains a replication/infection mechanism. Just use a botnet to scan those 1 million IPs and see if SMB is open.

That being said, it does not surprise me to see yet again an issue in SMB. This has been a particularly weak point in Windows for decades now. I remember "hacking tutorials" from 15 years ago where you'd just go out and nmap public IP ranges to see if you could access hidden shares (e.g. like so: [http://www.madirish.net/59](http://www.madirish.net/59)). Also there was this issue of Windows keeping weak NetBIOS password hashes around which could be trivially unhashed ([https://vuldb.com/?id.13824](https://vuldb.com/?id.13824)), years ago.

<comment><USER3> A fair amount of ransomware is distributed via email, so it's not such a bad idea when this issue is front and centre and all over the news to reinforce good behaviour amongst users.

It's not like 'stop clicking random shit in emails' is bad advice.

<comment><USER4> Why the hell can't I click shit in random emails?

It's a friggin email and data transfer for crying out loud.

Stop blaming users.

<comment><USER5> Oh, you _can_. Just like you _can_ inject any random substance given to you by a stranger.

Being aware that both are _high risk activities_ is the point, methinks.

<comment><USER6> There's absolutely no reason that sending a link to someone should be able to pwn their box. There's no reason to make such fragile email systems.

<comment><USER7> What if they click the link, run the downloaded invoice.EXE, and enter their password when prompted? At a certain point, the user needs to be educated enough to avoid this.

PDF/Office macros are a whole other topic though.

<comment><USER6> There's a really big gap there. Look at chromeOS - you can click a lot more email links on that OS without getting ransomware'd.

<comment><USER5> Is it because the OS is inherently more secure, or because the malicious code is not written for that OS?

<comment><USER6> Yeah, the sandboxing helps a lot. I mean look at iOS - super popular, huge target for malware, but it hardly ever gets hacked.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm surprised by how carefully the worm seems to be coded. They make sure they have an internet connection, they check for disk space in order not to run out while encrypting, they save a backup copy of the "tasksched" executable before replacing it, they shutdown databases (I assume in order to prevent corruption?) etc...

I guess they want to make sure the decryption process will work without any issue so that the victim will be more likely to pay other ransoms or spread word of mouth that it does actually work.

I wish all software devs were as thorough as these people...

<comment><USER9> I would guess the shutdown of apps are not of good intent, rather to release file locks so they can delete the unencrypted database and exchange files.

</comment></comment><comment><USER10> Evil Ransomware improvements we may see:

1\. New address per machine (easier to detect payments made, hides profit total.)

2\. Deterministic wallet stores all profit in a simple 12 word seed "password."

3\. Phone numbers directly to bitcoin vendors. (people running insecure systems love phones.)

4\. Phone number to tech support company that bills your credit card to walk you through paying the ransom.

5\. Delayed symptoms. Secretly encrypt backups (windows efs might be able to do it nonobviously) Then once all your backups are secretly encrypted, it encrypts the key, and now you can't use backups to save yourself.

6\. Advertise affiliated antivirus (I hear this is what cloudflare does by hosting bad actors, they inflate their demand from protection from bad actors, just a rumor though.)

7\. Infect a friend. Get a discount on your ransom if you infect a friend and they pay.

It doesn't seem reasonable that 300k infections= less than 1 in 1000 payments. Are peoples files really so worthless, or bitcoin really so hard, or people so untrusting of unencrypt. I imagine they could have sold their 0 day idea for more money to a whitehat perhaps? Maybe more generalized bug bounties could be deployed to offer financial incentive to harden systems and be non evil.

<comment><USER11> I don't know a single person who would pay upwards of $300 to get their files back if they got hit with ransomware. Hell, I've got something like 10 years of personal files on my machine and I wouldn't pay that much for them. I would bet a lot more people would be willing to pay if the fee was more like $50. That takes it out of the category of 'a lot of money for computer files' for a lot of people and puts it in the category of 'minor inconvenience'.

I sometimes fix friends & older family members computers as a favor and I've noticed that they usually don't really have any files anyway. I always make a backup before reformatting them and usually it includes their bookmarks and maybe 2-3 random files scattered in their 'Documents' folder, none of which are important. Their machines are more like just gateways to the internet than anything.

Through machines moves over the years I'm sure I have multiple copies of the most important ones anyway (keys, etc). If not oh well, life goes on. Shoulda made backups in the first place if they were that important to me.

<comment><USER10> Sounds like it would be more profitable to just lock out the device than encrypt the files, for its internet browsing value may exceed its file storage value.

<comment><USER12> It's much easier to recover from lock out (without losing data) than decrypting the file.

<comment><USER10> You can do both.

</comment></comment></comment></comment></comment><comment><USER13> I always say that visual studio 6 was the best version they ever made. At least somebody out there agrees with me.

"As noted in our attribution post last year, use of Visual Studio 6.0 is not a significant observation on its own – however, this development environment dates from 1998 and is rarely used by malware coders. Nonetheless, it has been seen repeatedly with Lazarus attacks."

<comment><USER14> 1998 was still a great year in Windows world. In 1999 the DotNet vision made lot's of things kind of legacy - kind of, because despite all odds Win32 and shell32/Explorer are still thriving where as DotNet Framework is now officially legacy tech. And UWP hasn't caught on, as mobile is dead end for MS and their Store is incredible bad.

True Visual Studio was really great. And like many, one had a VS6 and VB6 install still around. Even if VS6 C++ is really outdated nowadays, it doesn't contain this spy-home feature that shipper with VS 2015 and VCredist 2015 (RTM, patch 1, patch 2). Back in the 1990s MS was a good company.

<comment><USER15> "Back in the 1990s MS was a good company."

Umm, isn't that precisely the period when they were charged with antitrust violations? Such a short memory we have.

<comment><USER16> I think the OPs context for "good company" is "good company _for coders/hackers_". You can have a company behaving in an anti-trustworthy way, but their software still be _good_.

Also, their antitrust violations was due to the Windows OS and anti- competitive behaviours, if i'm not mistaken? If so, then this is not really relevant to their software or OP's post, but more their business approach of locking out competition, which is a question of legality and economics.

<comment><USER15> Part of the anti-competitive behaviors were anti-Linux and open source which I feel is "bad for coders".

[http://catb.org/~esr/halloween/](http://catb.org/~esr/halloween/)

</comment></comment></comment></comment></comment><comment><USER17> according to the article, the balances of the bitcoin addresses collecting the ransoms are

15.13562354 BTC = $26410 13.78022431 BTC = $24045 5.98851225 BTC = $17361

Assuming $300 per ransom, this works out to a total of 226 victims who paid. this seems a little low compared to the huge amount of infected devices.

<comment><USER18> Did you check the transactions?

They could have already moved a part of the coins to an exchange.

<comment><USER19> According to blockchain.info, no coins have been moved from the addresses in the article.

</comment></comment></comment><comment><USER20> Isn't it curious that folks like kim dotcom who do not hold hospitals or anyone to ransom earn global notoriety, are raided by swat teams and face the full force of the law while those that hold hospitals to ransom can operate with impunity with people reduced to tracking their bitcoin earnings on twitter.

Is it the job of NSA and all the global security services with their overarching reach, resources and power to warn, track and disable these activities or is to spy on citizens?

Half or more of these activities are used by agencies to shut down or sabotage unfriendly interests and I suspect that's the only reason these shady figures are allowed to exist, treated with kid gloves, operate with near impunity and rarely see consequences. They serve as 'assets' to provide cover. Without consequences these activities will spiral.

Things like ddos ultimately benefit companies like cloudflare. And the preponderance of these kind of worms force people to move their data to the cloud or give up more control to large companies who promise security. This is a subtle form of extortion. We don't know the extortionists but we do know the beneficiaries.

This slowly but surely disempowers individuals and takes control away and shifts it to large companies.

Holding a hospital ransom whatever its security policies is a serious crime and treating it as just another hack rather than extreme criminality and blaming the victims is an extremely self serving technical perspective.

<comment><USER21> _Isn 't it curious that folks like kim dotcom who do not hold hospitals or anyone to ransom earn global notoriety, are raided by swat teams and face the full face of the law while those that hold hospitals to ransom can operate with impunity with people reduced to tracking their bitcoin earnings on twitter._

It's a very classic and widespread law enforcement problem: They catch those who are easiest to catch. There's an anecdote that so beautifully displays this fallacy.

 _A police officer sees a drunken man intently searching the ground near a lamppost and asks him the goal of his quest. The inebriate replies that he is looking for his car keys, and the officer helps for a few minutes without success then he asks whether the man is certain that he dropped the keys near the lamppost.

"No," is the reply, "I lost the keys somewhere across the street." "Why look here?" asks the surprised and irritated officer. "The light is much better here," the intoxicated man responds with aplomb._

</comment></comment><comment><USER22> Does anyone else find it a little odd that something as big (and corporate as BAE) are running a blog from blogspot on an unsecured domain?

Is this site legitimate?

<comment><USER23> Yes. There's a link to that blog on [http://www.baesystems.com/en/cybersecurity/home](http://www.baesystems.com/en/cybersecurity/home)

</comment></comment><comment><USER24> How does payment work? Seeing as how there are 3 addresses to send to.. Maybe the amount of satoshis identifies a certain machine?

</comment><comment><USER25> Quote: "The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (unrelated) ransomware campaign, called Jaff."

Would it be easy to find it if the initial attack vector uses some semi- obscure torrent? Would people find out quickly?

</comment><comment><USER26> Notable that he calls the "kill-switch" a "mistake". For example, Chrome does the same thing. When it starts it checks for some presumably non-existant domain name.

<comment><USER27> Yes, but the key difference is that chrome uses a randomly generated domain name, while the ransomware has it hardcoded.

<comment><USER26> Yes, this sounds right. It has been a while since I looked at it. Is it just one name? I have a faint recollection it tried more than one.

Anyway, how is the difference significant?

A localhost cache can point at a custom root.zone. The user can make her own authoritative nameserver assignments for any given zone or domain. Zone files can contain wildcards.

Responses can also be rewritten on the fly.

The end user can exercise full control over what is and is not a "valid" domain name. She can prevent her applications from ever receiving an "NXDOMAIN" response.

Maybe I am missing something but this "test" seems brittle; it only tests ICANN DNS.

</comment></comment></comment><comment><USER28> Did these happenings had any effect on windows market share? Hope somebody will blog on that too.

I hope many people have understood to not have public windows servers at least. It could most probably affect their business in the long run (Not saying that GNU/Linux is safe. But it is _safer_ ).

<comment><USER29> If you think about it, it's actually safer, from a malware perspective, to use Windows Phone instead of Android. And for the same reason.</comment></comment>


A functional reactive alternative to Spring - <AUTHOR> https://stacksandfoundations.wordpress.com/2016/06/09/a-functional-reactive-java-web-framework/ <comment><AUTHOR> The GitHub project is: [https://github.com/rchodava/datamill](https://github.com/rchodava/datamill)</comment>


Weekly Newsletters with the Best Reddit Content - <AUTHOR> https://unread.it/ <comment><USER2> I am the dev behind the project. Happy to share some technical details and answer any question you may have!

The project is written in Python/Flask, with Celery tasks that run every day to create newsletters. We have also an admin to do light editing of the issues and add intros.

Emails are sent with the excellent Mailtrain ([https://mailtrain.org/](https://mailtrain.org/)), an open source alternative to MailChimp, that we self-host on DigitalOcean. Mailtrain is plugged with Amazon SES, that allows as to send a ton of emails for as little as 0.1 USD per 1000 emails sent.

Our hope is to completely automate this product and maybe sells ads some day if we reach a good number of users.

</comment><comment><USER3> Not bad.

I recommend to separate Web design from other design stuff.

E.g. I want Web stuff but not the wooden spoon innovation.

<comment><USER2> Thanks for the feedback. Aside from n/design, what other newsletters did you subscribe to?

<comment><USER3> I think your are point with the design stuff just the fact that 99% is web related subreddits and one is r/design.

Only my opinion though.

</comment></comment></comment><comment><USER4> The design is really on point! I love the upvotes animation</comment>


Videogames And The Impossibility Of Escape From Planet Earth - <AUTHOR> http://rossignol.cream.org/?p=844 <comment><USER2> _Perhaps it simply is the case that we're trapped on this planet, or in this solar system._

When I read articles that discuss the vastness of the cosmos and the trillions upon trillions of stars that inhabit our universe, and the likelihood that there are perhaps billions of inhabitable planets out there teeming with life, the emotion I feel most is not awe, but a deep sadness for all that we'll never know or understand about the universe. Many of these galaxies are tens of billions of light years away, so unless there's some pretty impressive loopholes in the laws of physics as we understand them today, we as a species will never know what lies beyond the tiniest fraction of our little corner of the universe.

And that's depressing.

<comment><USER3> As an individual who will likely not be around in 100 years or so, it's mildly depressing to know that I won't see the next 500+ years of advancement.

As a species, I'm not worried. Who knows what discoveries will be made, and what kind of subsequent technological achievements will be made in the future? If the history of science has taught us anything, it's to not underestimate the power of the undiscovered.

If you figure, there are a handful of things that we know we don't yet know (grand unified theory). Just think of the things we don't know that we don't know.

<comment><USER4> > If the history of science has taught us anything, it's to not underestimate > the power of the undiscovered.

well said

</comment></comment></comment><comment><USER5> _It doesn't have to mean "exploring a jungle in the Congo", or "exploring that nice little village in Tuscany", it could just as easily mean "exploring the physics of this peculiar puzzle game", or "exploring the inside of a psychotic milkman's imagination"._

This reminds me of the sort of artist whom we're implicitly supposed to regard as brilliant simply by virtue of being audacious. They're always exploring stuff and it's usually stuff you can explore from your own comfy chair without much physical or even terribly much mental effort. Like, "A poet, sculptor, and political activist from Portland, Oregon, H. Remington Jackass explores the connections between race, gender, and the challenges to the nature of self imposed by modern capitalistic society."

</comment><comment><USER6> Of course, the opposite of the "aliens just stayed home" hypothesis is the hypothesis that we're the first species in the universe to acquire technology, and that we'll spread throughout it within a few more decades, eliminating any possibility for any other species to do the same.

Personally I doubt it's possible to exceed the speed of light. I think it's more likely that we'll slowly spread throughout the Milky Way, and that while simple life and complex-but-unintelligent life are likely to be pretty common, the average distribution of technological species is probably something on the order of one per galaxy.

Just a hunch.

</comment><comment><USER7> The author says that exploring inner worlds instead of the real universe "...It could be incredible, or unfathomably horrible..."

I think its much more likely over hundreds of years it will just slowly degrade into complete inaction and senility -- a species reaching its old age.

<comment><USER8> Perhaps we are already sliding into senility:

<http://news.ycombinator.com/item?id=654578>

Maybe capitalism and digital networks are a dead-end? Perhaps we will just be pulled into ever-faster cycles of incomprehensible introspection and cultural remixing? Perhaps only a few species ever escape this trap, which is why we've never seen any.

<comment><USER7> Yes a species has to be dynamic and chaotic enough to explore, yet docile enough to somehow live with itself.

Too chaotic and you have lawlessness and lack of trust in contracts -- the basis of economic performance. You can't trust the future. Too docile and nobody truly takes risks which carry great rewards, such as ocean travel. You stagnate.

It is completely possible that most species are unable to keep the right mix long enough to conquer deep space exploration. Instead they just turn into themselves and wilt, doing less and less and consuming more and more until the species itself is homogeneous and unable to survive natural challenges like plagues. I think we can see the beginnings of this already.</comment></comment></comment>


No Time for Coffee? Spray Caffeine On Your Skin - <AUTHOR> http://www.fastcompany.com/3015961/no-time-for-coffee-spray-caffeine-on-your-skin

<comment><USER2> Wait, what's the appeal of this over caffeine tablets?

I like the taste of coffee/tea so I prefer it as a "caffeine delivery system", but if I really hated all caffeinated beverages I'd just buy caffeine tablets, which last time I checked were ridiculously cheap (like $0.10 a tablet).

Often the tablets are so potent that splitting them makes sense, making them even cheaper.

I guess I don't see the appeal.

<comment><USER3> > I guess I don't see the appeal.

It's novel.

</comment></comment><comment><USER4> If you think you don't have time for coffee you need a therapist, not a spray bottle.

</comment><comment><USER5> Personally, I've been wanting years for someone to come out with (a) steady release caffeine patches and (b) [I don't know why I want it in this form factor] quick acting caffeine eye-drops.

</comment><comment><USER6> There's always time for coffee.

</comment><comment><USER7> Looks intriguing!

</comment><comment><USER8> Wait, something actually came out of the Theil Fellowship?

<comment><USER9> Funny statement coming from Brom Rector, 2011 Thiel Fellowship finalist that wasn't selected. Bitter much?</comment></comment>


Is Your Snazzy New Site Cloaked in Invisibility?  - <AUTHOR> http://adage.com/digitalnext/post.php?article_id=131555 <comment><USER2> Summary: know your audience and use the corresponding lexicon.

Safe to skip.</comment>


NanoPi M3 Octa Core 64-bit ARM Development Board - <AUTHOR> More About NanoPi M3: https://www.reddit.com/r/raspberry_pi/comments/4xi8vq/nanopi_m3_octa_core_64bit_arm_development_board/
    The NanoPi M3 uses the Samsung Octa-Core Cortex-A53 S5P6818 SoC. Its dynamic frequency scales from 400M up to 1.4GHz. It has Gbps Ethernet port, built-in WiFi and Bluetooth. Its AXP228 PMU supports software power-off, sleep and wakeup functions. In addition the NanoPi M3 has MicroUSB port for power supply and on-board porcelain antenna. On this tiny board various ports and interfaces are integrated. It has DVP Camera/LVDS/HDMI/LCD interfaces, Gbps Ethernet, I2S, 3.5mm audio jack, four USB ports and a serial debug port. <comment><AUTHOR> [https://www.reddit.com/r/raspberry_pi/comments/4xi8vq/nanopi...](https://www.reddit.com/r/raspberry_pi/comments/4xi8vq/nanopi_m3_octa_core_64bit_arm_development_board/)</comment>


New Deadly Fungus Found in U.S., Has Already Killed Six - <AUTHOR> http://news.nationalgeographic.com/news/2010/04/100421-new-fungus-cryptococcus-gattii-deadly-health-science/ <comment><USER2> A quick look at the Wikipedia article and the BC CDC website seem to indicate that intravenous antifungals are effective, although removal of infected portions of lung tissue is sometimes required.

Digging through the CDC website now; looks like the first cases appeared around 1999, and that it's a fairly rare disease. So, as always if you've got a cough that's stuck around for awhile, see a doctor.

Fungi are nasty things when they get in the human body, because just like human cells, fungi are eukaryotes, and so a lot of the tricks that work against bacteria don't come into play.

<comment><USER3> _looks like the first cases appeared around 1999, and that it's a fairly rare disease._

[original research?] Oddly, I actually know someone here in the United States who had an infection like that more than a decade earlier, after travel to a tropical country. There probably wasn't such elaborate genetic testing for specific strains available in those days, so the infection was only classified as to genus, Cryptococcus, in that patient. The infection was so puzzling to the doctors at a major metropolitan research and teaching hospital that treated the patient that even the hospital's director of infectious disease gave the patient a bedside visit.

AFTER EDIT: From another news story, a link to the PLoS report on the newly reported strain of Cryptococcus:

[http://www.plospathogens.org/article/info%3Adoi%2F10.1371%2F...](http://www.plospathogens.org/article/info%3Adoi%2F10.1371%2Fjournal.ppat.1000850)

This link

<http://www.cdc.gov/ncidod/eid/vol4no1/buchanan.htm>

on the related fungal species Cryptococcus neoformans describes why usually fungi of this genus are not particularly pathogenic and what characteristics of Cryptococcus fungi most influence disease virulence.

<comment><USER4> Interesting. Cryptococcus neoformans is a relatively common cause of fungal infection.

</comment></comment></comment><comment><USER5> "the infection can be treated with antibiotics". I thought antibiotics didn't kill fungus ?

<comment><USER4> Possibly a mistake for "antifungals".

<comment><USER3> Yes. "Antimicrobial" would be the general term.

<http://en.wikipedia.org/wiki/Antimicrobial>

</comment></comment></comment><comment><USER6> If six people have died from this, is it really a cause for alarm? I'd be more concerned with falling down the stairs honestly, not to mention that this is treatable (the fungus that is, not the broken neck.)

<comment><USER7> But the fungus is spreading!

So do houses with stairs though. Hm...</comment></comment>


RWW web predictions for 2008: 335 days later, hardly anything comes true - <AUTHOR> http://news.ycombinator.com/item?id=92588

<comment><USER2> Confusing, I clicked through on my RSS reader, and somehow landed on the original version of that post being submitted to HN -- and accidentally left a comment on that page. Anyway, now that I'm in the right place...

I think I did alright in that post. #3 came true (for the most part, though none of the big boys are relying parties). #2 was sort of half right. Sort of. And, #5 was a little bit right -- iPhone 3G has been one of the best-selling phones of the year and mobile apps are finally a big story (big enough to get mainstream television coverage, at least).

Now, quick... someone buy Tumblr.

<comment><AUTHOR> half right, little bit right, sort of.. :) But agreed yours is better than the rest. But your predictions were also pretty broad. [On #3 - we all know OpenID hasn't taken off. <http://news.ycombinator.com/item?id=375011>]

I found dcurtis predictions then a lot better. Except for #7 which was a total give away.

1\. Semantic web searching will not even dent Google.

2\. EVDO/UMTS/WiMAX will finally make the internet as ubiquitous as cellular phone technology. 2008 is the year of connected portable devices. Kindle, iPhone, and Dash are its origins.

3\. The iPhone will gain a huge chunk of the mobile device market, and after the 3G version is introduced with a spiffy sdk, it will engulf Windows Mobile like a bear eating an ant.

4\. This election will have the most informed voters in history due to the ease of research through Wikipedia. (Though the actual voting will be just as aimless.)

5\. OpenID-based login systems will grow in popularity.

6\. Michael Arrington will be punched repeatedly.

7\. Ron Paul Graham will be elected president

[<http://news.ycombinator.com/item?id=92635>]

</comment></comment><comment><USER3> I would love to see a site that tracks predictors' prediction records.

It seems that almost all predictors' (or maybe all of them) have a dismal accuracy record. (Especially in the financial sector as we've seen this year)

</comment><comment><USER4> That's why I don't play the stock markets (that and a lack of cash).

</comment><comment><USER5> Ouch!</comment>


Google "niche design sites" - <AUTHOR> http://www.google.com/#sclient=psy&hl=en&source=hp&q=niche+design+sites&pbx=1&oq=niche+design+sites&aq=f&aqi=g-v1&aql=&gs_sm=e&gs_upl=947l4257l0l4445l18l11l0l4l4l0l580l1715l220.127.116.11-1l8l0&bav=on.2,or.r_gc.r_pw.&fp=ae1bafe2df197d5b&biw=1224&bih=706 Just as a mental note, this search led me to a page on google where the first hit was a link to a Turkish porn site (https://twitter.com/#!/kirillzubovsky/status/105751771233783810). I thought it was a little strange/funny. <comment><AUTHOR> Just as a mental note, this search led me to a page on google where the first hit was a link to a Turkish porn site ([https://twitter.com/#!/kirillzubovsky/status/105751771233783...](https://twitter.com/#!/kirillzubovsky/status/105751771233783810)). I thought it was a little strange/funny.</comment>


Ask HN: Biggest pet peeves with job posts? - <AUTHOR>

What are your biggest pet peeves with job posts? For example, one of mine regarding programming jobs is when they list a bunch of technologies that you "need to know", but in reality the company only uses half of them.
On the flip side, what makes a good job post? How do you make your company stand out to potential employees?
Thanks! <comment><USER2> A good job posting in my opinion must include:

\- LOCATION or REMOTE. You can talk all about your great company, awesome team, great perks but if you don't tell me where do I need to go, it is really not very useful.

\- COMPANY NAME: I hate it when recruiters post "Fortune 500 client". Really ? Could you be any more specific ? </sarcasm>

\- SALARY RANGE: "Market Rate Salary", "Salary: Competitve", "Salary: commensurate on experience" is all bullshit. Give me a range. I understand that the exact salary could depend on how good you are but every employer has a range. Specifically big companies.

\- TEAM DESCRIPTION: Describe the team as much as possible without necessarily revealing personal info. I would rather like to read "We are a team of 5 people spread across the globe where 2 of us do the back end dev in NYC.......". Don't give me generics like "Excellent motivated team working on world changing projects looking for the next ninja to join our awesome team". Really again ?

\- WHY ARE YOU LOOKING TO HIRE: This is a must for me. Is this position open just because you have some cash to burn to show good to the management that you are "growing" the team or is there really a pain point that can be addressed by hiring. What problems are you facing currently that could be solved by this hire ? It is better to be needed than being a nice to have.

\- BENEFITS: This one is a nice to have. But again be specific if you can. You offer 401K ? awesome. now tell me what the match percentage is. Or at least link to your HR benefits site if it is externally available. I am always surprised to see how little you know about benefits until you are hired. In the US, health insurance is a big deal. I want to know upfront what kinds of plans are offered which could impact my salary requirements as well.

On a fun note, I wish we could do the same to the bad job postings. Want to know how much Java I have done ? "Depends on the salary range being offered" and so on...

</comment><comment><USER3> I like to see a salary range. Just putting "Salary: competitive" means your probably aren't.

I like skill requirements broken out into "should have" and "nice to have". Even better are the jobs that list "nice to have but we know you can learn our stack".

Totally hate any job board that wants your email to see their jobs. I use their own email address (email@example.com) when they ask. Let them spam themselves. :-)

Could care less for the "We were voted blah blah. With more than three decades of experience and innovation in the sales, use and value-added tax (VAT) tax- compliance arena, Bloatware stands as the leader in providing automated solutions..."

</comment><comment><USER4> "Entry Level" in title, 3-5 years experience in requirements. Fuck me

</comment><comment><USER5> They don't say what they want. Why can't they say something like "We have developed 5 or more web apps using J2EE technologies and we want to upgrade them to Spring related technologies. 30% of your time will be on upgrading, 70% on adding new features based on customer requests".

No need to list a bunch of technologies without explanation.

</comment><comment><USER6> Show us an example of your work.

All of my stuff is in house. If I have a side project, I will be looking to earn some money from it, so I don't want to put it on github. And I have other hobbies so I don't have the time to contribute to open source (though I would like to).

</comment><comment><USER7> I hate seeing requirements for college degrees - creativity begot know-how, not the other way around.</comment>


Solar Impulse breaks solo record - <AUTHOR> http://www.bbc.com/news/science-environment-33362290 <comment><USER2> There was some serious concern that they wouldn't find another opportunity with good weather this summer. The Japan - Hawaii leg was the longest planned leg, and really stretched the aircraft's capabilities. If they couldn't find a good weather window in June (near the summer solstice), they faced ever shortening-days, and may have had to wait until next year for another attempt. They may have run out of funding during that year-long wait!

I'm glad they made it!

</comment><comment><USER3> "Now you can fly longer with no fuel than you can with fuel. So, what Andre has done is not only a historic first for aviation, it's a historic first for renewable energies"

<comment><USER4> Ok, but how much energy and manpower does it take to keep this in working condition? Even moving the crew from china to japan to service the plain would have cost money and used fuel from conventional transportation.

It's a vehicle on life-support from fuel but not using it directly.

Cool to see things moving along in the right direction though

<comment><USER5> One step at a time. It took 11 years to get from the Spirit of St. Louis to the first commercial transatlantic flight.

</comment></comment></comment><comment><USER6> Another comment asks about what kind of support was necessary to make this solar-powered flight. It happens that Gizmodo (yeah, I know) has a detailed article about that issue, "Flying a Solar Plane Around the World Takes One Hell of a Ground Crew," published today.

[http://gizmodo.com/flying-a-solar-plane-around-the-world- tak...](http://gizmodo.com/flying-a-solar-plane-around-the-world-takes-one- hell-of-1715625434)

<comment><USER7> Very interesting link. Highlights the fallacy of ecologist marketing operations: Good intentions, but negative carbon footprint.

Anyone else wonders why both Space and the Solar Plane mission have screens under the desk level? Ergonomists and chiropractors clearly point this out as a bad setup for employee's bealth, plus they're all ridiculously moving their laptop sideways to look at their 27" screen. It seems their desk design wants to communicate a "space mission" ambition although it couldn't be worse for the body.

<comment><USER8> So we should avoid talking about ecology if the communication itself has a non-negative carbon footprint ? Good luck with that!

As the article quotes: the goal never was to prentend making a zero emission operation, but rather to sensibilize people to the fact alternatives can exist, and are worth studing.

A guy dedicates everything to build a solar powered plane that can travel around the world, just for the sake of it. If that's not some pure Hacker spirit, then I don't know what it is...

The press is the press, it is optimized for presenting it's own perception as an absoluth truth.

<comment><USER7> > we should avoid talking about ecology if the communication itself has a non- > negative carbon footprint

No, we shouldn't. But we often advertise non-green products as green solutions, and that's terrible because it disrupts people's understanding of global climate change. People believe the electric car is green, whereas its carbon footprint is sensibly equal to the petrol-based car if you include the electricity/petrol lifecycle. People dodge the idea that the carbon footprint will always be further reduced by carpooling/public transports/not moving across the Earth every week, rather than by saving 5% or 10% of the petrol.

Yes, we should advertise about ecology. No we shouldn't advertise anti- ecologist products. If you read between the lines, that's what the author is demonstrating.

<comment><USER8> Solar Impulse is not a product, it's a hack.

Electric cars carbon footprint will eventually decrease with massive adoption.

Petrol sucks. doesn't scale.

EDIT: And yes, it's true that selling something as a ecological when it isn't, is bad. But at least it's a small step in the right direction.

</comment></comment></comment></comment></comment><comment><USER9> FYI this story is a little behind. Borschberg safely landed in Hawaii after a solo flight of some 117 hours - breaking the previous record by a huge amount along with some other ones. You can check out the whole last leg on the flight log, with pics and tweets and such:

[http://www.solarimpulse.com/leg-8-from-Nagoya-to- Hawaii](http://www.solarimpulse.com/leg-8-from-Nagoya-to-Hawaii)

</comment><comment><USER10> Impressive achievement! A further update: Solar Impulse landed today at about 6:00 AM local time in Kalaeloa airport after a 118-hour flight. [http://www.bbc.com/news/science- environment-33383521](http://www.bbc.com/news/science-environment-33383521)

</comment><comment><USER11> Congrats to the Solar Impulse team. Surprised this isn't being commented on more here.

<comment><USER12> There is a limited AP and he did naps at max 20min each.

<comment><USER13> This is crazy - just put yourself in that scenario and pause for even a minute.. Amazing to say the least.

</comment></comment></comment><comment><USER13> Hah, wow, interesting timing. I just finished reading a decent book on Kindle about Solar Impulse: [http://www.amazon.com/gp/aw/d/B00Q56MYUC](http://www.amazon.com/gp/aw/d/B00Q56MYUC)

It was a bummer Solar Impulse wasn't able to do the non-stop pacific ocean leg, but still, it's pretty amazing. I'm surprised that this just hasn't picked up more news coverage. :( It's completely historic..

</comment><comment><USER14> Has he actually been awake for 76 hours straight or is there an autopilot feature he can enable to get a few micronaps in?

<comment><USER9> AFAIK he sleeps for short periods when the plane can cruise without intervention. The ground crew would wake him if anything needed attending to. He also does yoga in the cabin to stay limber.</comment></comment>


IO domain DNS failure - <AUTHOR> For 3 or 4 hours, IO domain DNS lookup often fails. Now, only 2 out of 7 IO domain nameservers respond, and other 5 DNS nameservers are dead. <comment><USER2> AWS response:

Hello,

Some customers have reported intermittent resolution issues with .io domains. We can confirm that Route 53 DNS services are operating normally at this time and these issues seem to be related to the .io top-level domain provider.

We've investigated the issue and are primarily seeing incorrect responses from two of the .io nameservers: ns-a4.io and ns-a2.io. These nameservers are returning NXDOMAIN intermittently for domains that do exist. As a result, once a resolver receives the erroneous response, it will cache the non-existence for the negative TTL, which for .io is set to 3600 seconds (1 hour).

One suggestion we have is to increase the TTLs for your domains in Route 53 so that the resolvers cache DNS answers for a longer duration.

Best regards,

(Customer support rep name redacted)

Amazon Web Services

We value your feedback. Please rate my response using the link below.

</comment><comment><USER3> I recieved this reply from nic.io support a few minutes ago: [http://imgur.com/a/wV2Kk](http://imgur.com/a/wV2Kk)

</comment><comment><USER4> I have been seeing the same failures for many IO TLDs

[https://www.whatsmydns.net/#A/gitlab.io](https://www.whatsmydns.net/#A/gitlab.io)

Example: [https://i.imgur.com/SU4BAHK.png](https://i.imgur.com/SU4BAHK.png)

I have noticed the failures occurring moreso in Asia and Russia than in other regions.

</comment><comment><AUTHOR> So, "ns-a4.io" is the culprit! On ns-a4.io, xxx.io can be resolved, but yyy.xxx.io cannot be resolved(delegated). Ref: [http://qiita.com/MasahitoShinoda/items/40cd312fabc6db604b39](http://qiita.com/MasahitoShinoda/items/40cd312fabc6db604b39)

</comment><comment><USER5> We are also having issues resolving some .io domains from AWS Sydney (ap- southeast-2)

</comment><comment><USER6> For those interested, we wrote a blog post about single points of failure with DNS last Friday when the Dyn attack happened. Our strategy ensures our customers are mostly unaffected by issues like this. See [https://blog.ably.io/routing-around-single-point-of- failure-...](https://blog.ably.io/routing-around-single-point-of-failure-dns- issues-7c20a8757903)

</comment><comment><AUTHOR> There are 7 IO nameservers (ns-d1.io, ns-l1.io ,ns-y1.io, ns-a1.io, ns-a2.io, ns-a3.io). Only ns-a4.io and ns-a3.io respond.

</comment><comment><AUTHOR> It looks, the the problematic nameserver "ns-a4.io" is down. So, the problem should be disappeared...

At the same time, it looks, there is only one "ns-a3.io" nameserver working for IO domain, at now...

<comment><USER2> Yep, rather than no such domain or a bad delegation, the "bad" servers seem to just be down now.

</comment></comment><comment><USER7> For Planio ([https://plan.io/](https://plan.io/)), all accounts are available via yourname.planio.net as an alternative while this outage lasts.

</comment><comment><USER8> We've been seeing this for exactly five hours now, all across East Asia.

Edit: Looks like .io is managed in London, and their customer service off hours match the downtime.

</comment><comment><USER9> Two of their servers were sending out NXDOMAINs which are then cached by downstream forwarders. It seems they have turned those off now.

</comment><comment><USER6> This is still affecting us. Our customers on Heroku seem to be the worst affected as Heroku is unable to resolve the DNS

</comment><comment><USER10> We are experiencing the same from Vietnam

</comment><comment><USER11> .sh and .ac are also run by the same folks - looks like there are issues with those tlds as well.

</comment><comment><USER12> Having the same issue in Singapore. got nothing to do, helpless.

</comment><comment><USER13> Same here in South Korea. Still not fixed.

</comment><comment><USER2> Getting significantly worse now.</comment>


We Must Prepare for the Next Pandemic - <AUTHOR> https://www.nytimes.com/2019/06/17/opinion/pandemic-fake-news.html <comment><USER2> This is the one time I vehemently disagree with Schneier. Creating mass censorship infrastructure to automatically ban stuff that isn't "truthy" can easily be abused for totalitarian ends. He's right that it would be easier to set up such infrastructure if you have an apolitical pretext, but that doesn't make it any less dangerous.

<comment><USER3> I have a personal belief that if something can be gamed for power, it'll be gamed for power. It's not a possibility, it's just a matter of time. No-go for mass censorship devices.

<comment><USER4> Democracy selects for people who are the best at playing the election game is it any surprise they are good at other types of games as well?

</comment></comment></comment><comment><USER5> Well, on the other hand: if there was a Pandemic, Google and Facebook are trusted enough to put some kind of official info out there that could help to mitigate the problem. I'm by no means a Google or FB fan, but if they showed a big banner on their websites what to do to deal with the Pandemic, many people would probably consider it legit.

</comment><comment><USER6> In the U.S. we have a medical system where people avoid going to the doctor for fear of cost. I feel like this is not the best system to have in a pandemic or epidemic situation.

</comment><comment><USER7> When I saw the title, I was expecting an article about how we need to: educate citizens ahead of time about the different ways that disease can spread ensuring they don't fall prey to misinformation, fund more research for monitoring and mitigation, invest in stuff like "you need to let your employees work from home if there's a pandemic if possible, you need to emphasize to healthcare and transportation workers that in an emergency they are going to be needed the way that soldiers are needed in wartime and pay them extra".

But, it's just another demand for everyone to build a permanent apparatus to censor every communication that doesn't come from a very official and accurate source such as the publisher or the author's employer. This line of thinking is basically saying that democracy is a failure -- that most people are a bunch of easily deluded simpletons who have to be herded around for their own good, and _they can 't even learn ahead of time_ what they might need to know in a pandemic. Maybe that's part of the answer to a very important question behind all this, which is "why are people losing trust in society's most basic institutions, even when they're right?"

<comment><USER8> _"and they can 't even learn ahead of time what they might need to know in a pandemic."_

They can, but why would they? The power of society is that we work together. You don't need to know how to grow wheat, bake bread, or herd cows anymore, either, but that doesn't make us simpletons.

<comment><USER7> I looked into some recent disease-related misinformation (re Zika) and honestly it would be hard for many people to look at it and immediately say _why_ it was wrong (it was extremely wrong). It wasn't like "putting Vaseline under your nose stops you from getting the flu". So I don't think people can really be prepared for everything ahead of time & there has to be some authority.

I still think that the key problem is that people distrust health and government institutions, not that they're allowed (for now) to post quackery or misinformation. I don't really understand how one gets that way. There are perceptions that public health institutions are politicized. Maybe they've never been friends with a doctor or a health official. Maybe their trust has been broken re health or even some other part of government. You can delete someone's posts pretty easily, but you can't force someone to trust the CDC or whoever. It needs to be built over time.

</comment></comment></comment><comment><USER9> We're not even acknowledging that climate change exists despite 99.999% of scientists agreeing.

Hoping that we'll actually prepare for a pandemic seems remarkably long sighted for such a short sighted species as ours.

<comment><USER10> I used to think those doomsday preppers are crazy, not anymore.

</comment></comment><comment><USER11> >> Much of it will be well-intentioned but wrong — like the misinformation spread by the anti-vaccination community today — but some of it may be malicious.

Well, a lot of the misinformation about vaccines has clear financial motives: it's spread by people selling "natural" remedies, homeopathic "vaccines" and so on or making their living by writing books and speaking in talk shows etc.

So not at all well-intentioned, I'd say.

<comment><USER12> A while ago, I searched around to find info about a recent glyphosate panic surrounding the Impossible Burger. I kept finding multiple, obscure sites (some nakedly involved in selling "natural health" products) with the same copy-pasted article[0][1][2] but not much else. The article even gives itself away to any sober reader; it's obnoxiously loaded, with a heading, "Impossible Foods Resorts to Insults, Name-Calling to 'Defend' Their Fake Burger". Still, it's cute to see disinfo in action.

No legitimate-seeming news source was saying much about the issue at the time, and older sources were saying the glyphosate levels were within safe limits[3].

[0]: [https://articles.mercola.com/sites/articles/archive/2019/06/...](https://articles.mercola.com/sites/articles/archive/2019/06/04/impossible- burger-glyphosate-residues.aspx)

[1]: [https://healthtipdaily.com/impossible-burger-attacks-moms- fo...](https://healthtipdaily.com/impossible-burger-attacks-moms-for- publishing-pesticide-results/)

[2]: [https://healthvox.net/2019/06/04/impossible-burger- attacks-m...](https://healthvox.net/2019/06/04/impossible-burger-attacks-moms- for-publishing-pesticide-results/)

[3]: [https://www.cnet.com/how-to/impossible-burger-everything- you...](https://www.cnet.com/how-to/impossible-burger-everything-you-need-to- know/)

</comment></comment><comment><USER13> SHUT. DOWN. EVERYTHING.

<comment><USER14> At least Madagascar will make it out alive.</comment></comment>


Ask HN: Any Atlassian/HipChat employees willing to answer a couple questions? - <AUTHOR>

A recruiter reached out from the Austin office. I respect what you guys do as a company, and I was hoping to ask some questions about the general culture, interview process, etc.<p>Twitter is the easiest way I can think of to exchange info (@loeschg) <comment><USER2> Why don't you speak with the recruiter or ask them to forward you contact information for an engineer there(or whatever it is you'd be doing)? The questions you want to ask are literally exactly what the recruiter or another employee are there to answer for you.</comment>


Consolidating Common Lisp Libraries - <AUTHOR> http://fare.livejournal.com/169346.html

<comment><USER2> There is a missing step:

Rewrite library to use dependencies that are a result of all the other libraries going through this step.

I have had programs that used 3 different utility libraries with largely overlapping features, despite having none of them as immediate dependencies.

</comment><comment><USER3> Another step to reduce friction and increase productivity. Very nice.</comment>


Dudes, this is so not REST - <AUTHOR> http://jens.mooseyard.com/2011/03/dudes-this-is-so-not-rest/

<comment><USER2> After reading the title I was all set to come in here and complain about "REST" Nazis and make some comment about how real life situations tend to supersede strict adherence to conventions.

But then I read the article and I have to admit this is a pretty egregious break with how REST services are supposed to work.

<comment><USER3> I came here to say the same thing. For those of you who aren't going to bother reading the Rdio API spec (I did, because there's something I want to hack together with it): the whole API is literally just a single URI that accepts a "method" param, where the method is a list of verbs like "get all tracks in this playlist" or "add a friend".

There's a case to be made for relaxing the definition of REST to accept "just a bunch of URIs" APIs that don't follow the discoverability/transparency conventions of REST. But you can't call "here's a list of verbs" a REST interface.

What you'd want to see in a Rdio REST interface would be:

* /rdio/api/1/playlists * /rdio/api/1/playlist/foo * /rdio/api/1/artist/1 * /rdio/api/1/artist/1/tracks/2

&c &c &c. But, from what I can tell, _none_ of the state inside Rdio's database is mapped to a URI.

<comment><USER4> I don't like API version numbers in the URI.

It implies that a resource is different just because you are using a newer version of the API.

My own most recent implementations use Accept: and Content-Type to define version compatibility, which is what content negotiation is supposed to be about.

Versioning in the old web API sense meant changing the way the protocol works, and REST will always be REST and the resources will always be resources.

All that is likely to change between 'API versions' is formats, which you negotiate with headers, and adding new fields, which old clients can either ask not to get through content negotiation or can safely ignore.

<comment><USER5> I can see it both ways.

APIv2 is not the same resource as APIv1, so why send it to the same location? Similarly, APIv1/user/1 may very well not contain the same information as APIv2/user/1, so are they really the same resource? They _likely_ refer to the same _semantic_ resource, but if user/1 != user/1, they're not the same from a data standpoint, which is what APIs are generally used for.

<comment><USER4> If version 1 of a resource is not a subset of version 2 of a resource, and they are not accessing the same record, then they should be separate resources

what 'API' is signaling is what the client is capable of understanding, which is what content negotiation headers are for

I think of it no different to the same resources for web browser consumption (for humans) - I don't place new designs of a website into /design1/ /design2/ etc.

<comment><USER6> Bear in mind the more things like "Well, you just have to properly use the content negotiation headers" you add to your API, the more the "simplicity" argument of REST goes out the window. I'm not sure I've ever seen really correct use of the content-negotiation headers and claiming it's a solution is dubious... sort of like how I'm still waiting to see proper use of XML Namespaces in the wild. They seem relatively simple to me but the evidence suggests strongly otherwise.

That doesn't make REST "bad", but I think it does start to make the quasi- religious aspect of it less obviously correct.

<comment><USER7> Using content negotiation, I can--if the server supports it--take the same URI (e.g. <http://www.jerf.org/>) and pass it to an image viewer to see your face, to my address book to fetch your contact info, etc.

Anything else requires the client knowing how to mangle URIs (e.g. adding /avatar.jpg, /contact.vcf).

<comment><USER6> I know what content negotiation _is_ ; I've never seen it _done right_. The theory is all beautiful but in practice content negotiation never seems to work right because you never get two people to agree very well on what things are. Another manifestation of the usual semantic classification problem.

It has a dubious track record in X as well. X has been able to do content negotiation for _decades_ for the clipboard but even now it's _still_ spotty and buggy, and that's with everything actually running on the same system. It looks easy. Heck, it looks _very_ easy. It isn't. I can't even tell you exactly why it isn't as easy as it looks (beyond the semantic thing I mentioned above), but the state of the world is pretty clear.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Actually, what the blog author is talking about is a resource-oriented architecture (ROA), which is typically implemented in a RESTful fashion over HTTP but has recently been conflated with REST itself. ROA != REST.

<comment><USER9> Just to amplify: there's more than a pedantic difference beteen the two. REST has a lot of serious advantages related not only to application architecture and interoperability but also to system architecture and scalability. There's a lot in the original REST dissertation about removing shared state and enabling cacheability.

The crowd that mistakes ROA for REST (I think) sees the stuff in REST that relates directly to development and gets excited - but the stuff related to making their app scale, they ignore. If you don't want to learn a little bit about everything, at least follow the rules that relate to the things you don't know about.

<comment><USER10> "we'll make the URLs pretty, but we'll ignore the stuff about statelessness."

</comment></comment></comment><comment><USER11> Why does it matter? Ok, I agree that you probably shouldn't label something with an incorrect term, but does not having more than one URL, and not using the different HTTP methods really make a difference in terms of programmer usability?

I personally find that sometimes I have trouble spotting the "oh! I forgot to make it DELETE instead of GET" bugs. When the parameters of the API are all in the url and/or query, it feels better encapsulated.

(promise I'm not flaming, and I fully expect to get told, yes it matters, and here's why! ;)

<comment><USER3> Yes. In this case, it makes an enormous difference. Your application can't just go to rdio/api/1/artist/whatever to look up the tracks for an artist; it has to make a SOAP-style request for the tracks for a given artist. This isn't a style nit.

<comment><USER12> It can probably be argued to be: you can't just go to rdio/api/1/artist/whatever, but you can get the exact same thing via RPC calls.

I often think that, via REST APIs and content negotiations, API can become browseable and self-descriptive but I've yet to see _any_ example of such a thing. Furthermore, just because an API is restful doesn't mean it's well- designed, and doesn't mean it has descriptive APIs (the artist's track could just as well be in rdio/api/64D89CAC?q=42, that wouldn't inherently make the API non-restful)

<comment><USER13> > I often think that, via REST APIs and content negotiations, API can become > browseable and self-descriptive but I've yet to see any example of such a > thing.

It should be trivial with AtomPub/GData/OData APIs. REST itself is not specific enough for that.

</comment></comment></comment></comment><comment><USER14> I once worked on a project where 'REST' was synonymous with 'putting query data into the URL before the query string', and this was done so that the webserver could cache the response.

I died a little inside every time I wrote a 'Restful' servlet there.

</comment><comment><USER15> This is an increasingly common extension of the REST paradigm. Google ran into a number of problems with the restrictions of REST, so their new APIs all work this way. See their justification in this video: [http://www.google.com/events/io/2010/sessions/how-google- bui...](http://www.google.com/events/io/2010/sessions/how-google-builds- apis.html)

<comment><USER16> Slide 87 of the pdf has the best summary, but the main thing w/r/r REST is that get/put of entire resources can be too heavy.

1\. custom methods let you get/put specific fields, without having to transfer the whole thing or split resources up as you add new methods.

2\. custom methods avoid needing to implement complex or heavy state mutations on the client. the example was rotating an image 90 degrees; you wouldn't want to download an entire full-res image to your wimpy battery-powered phone, rotate it, and re-upload it when you can just do that on the server.

(... of course this should just update some orientation metadata instead of resampling the image -- it's just an example)

<comment><USER17> As for your point 2, if you consider a REST resource as a collection of fields, you can update it without custom verbs:

      GET /resources/picture/orientation => 0
      PUT /resources/picture/orientation?value=90

REST is not so much about a simple API, but a scalable service. Custom verbs break scalability.

</comment></comment></comment><comment><USER18> '''Maybe we should just give up on the term REST, since it's become so diluted as to mean nothing more than "HTTP API that's not as hard to use as SOAP"?'''

To be fair, I thought we were at this point already. It seems safer to assume that when one advertises a "RESTful API" they are really referring to a "REST- like" API which basically means "Hey, we don't use sessions!"

While I believe that the term is already diluted to that point, I still think it's valid to point out when people are doing it wrong.

<comment><USER19> It's diluted for sure, but it still carries a strict interpretation that is worthwhile and that some of us are still using.

My main problem with its dilution is that it's usually totally meaningless -- usually other terms like RPC or just plain old "proper HTTP" accurately describe what someone is calling REST, to there point where its supposed RESTfulness can be nothing more than for the sake of buzzword compliance.

</comment></comment><comment><USER20> REST is now just a generic term for any HTTP API that's not SOAP. Like Xerox and Kleenex, the popular usage is technically incorrect, but in practice, it doesn't matter.

Most REST API consumers today are more like CURL than a web browser. In the CURL-like case, the RPC pattern works quite well. HATEOS and other browser- centric REST ideas often just don't fit naturally into a simple API consuming app. People need to move on.

<comment><USER21> "Like Xerox and Kleenex, the popular usage is technically incorrect, but in practice, it doesn't matter."

The integrity of some acronyms is worth defending. I wouldn't want 'ACID' diluted to mean anything less than its strict definition, and I think the same holds true for 'REST'. The benefit of these distinctions is twofold: 1) we encourage the advantages of good RESTful practices and 2) we can communicate consistently without spending unnecessary effort qualifying our meaning. If REST means 'Anything but SOAP' then at some point we'll have to come up with another shorthand for 'Real REST' or spend lots of time re-stating the principles of REST every time we need to communicate architectural strategies that use them.

I should be able to say 'Singleton' or 'MVC' or 'ACID' and know that there is enough integrity to those ideas that a competent coder will know what I mean without me having to pseudo-code or UML the concept for them. The same should hold true for REST.

</comment></comment><comment><USER22> "It screams RPC. There is so much coupling on display that it should be given an X rating."

\-- Roy Fielding @ [http://roy.gbiv.com/untangled/2008/rest-apis-must-be- hyperte...](http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext- driven)

</comment><comment><USER23> This sort of API is not RESTful at all, regardless of whether the method name is in the HTTP header or a form variable. It's still an application-specific protocol that requires out-of-band knowledge to use. REST resources are supposed to be self-describing, which doesn't make much sense for an API like this. RPC is what is required here, so just tunnel RPC over HTTP in whatever way is most practical. And don't call it REST.

If you want a bucket of cold water over the head on this topic: [http://roy.gbiv.com/untangled/2008/rest-apis-must-be- hyperte...](http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext- driven)

</comment><comment><USER24> Instead of fetishizing REST for its own sake, how about appreciating an HTTP API that can be used (read/written) with a browser via form elements and hrefs?

<comment><USER25> I completely agree with you. There will always be a contingent of developers who believe enforced standards trump simplicity. As we see here, when the CORBA then SOAP crowd realized they'd lost that fight, their ilk started judging other projects by adherence to strict API structural definitions like formal "REST". That said, I do believe this constant dialog between ad-hoc simplicity and rigid standards is good for the industry; in each area, accepted practice evolves to meet the needs of its current application.

<comment><USER13> REST is as simple as it gets. You could make that argument if someone were to advocate using REST outside of HTTP. But HTTP _is_ inherently REST, so you should have a good reason to _not_ use REST rather than the other way around.

<comment><USER12> > REST is as simple as it gets.

It is not. It's quite complex actually. And I'm betting what most people who believe they have a clue think of "REST" is actually "RPC over pretty urls".

<comment><USER13> But that's just because of a general ignorance of how HTTP protocol works. If someone were to be explained, how it should work from the beginning, I'm sure they'd have no problem with grasping the subject.

Actually some Google engineers do a very good job of explaining how AtomPub and GData APIs work just with short Youtube videos.

</comment></comment></comment></comment></comment><comment><AUTHOR> We might be getting close to this point: _Maybe we should just give up on the term REST, since it's become so diluted as to mean nothing more than "HTTP API that's not as hard to use as SOAP"?_

This is a shame, because RESTful APIs are (for me, anyway) usually a joy to build and to use.

<comment><USER13> There's already a specific term for the kind of API that rdio has: RPC. Remote Procedure Call.

I mean, come on, how can you say you have REST (with R standing for Representational) if you have section called "Methods" in your API documentation. HTTP API sounds okay, but in fact their API is not even HTTP specific (actually, it abuses HTTP).

</comment></comment><comment><USER26> I've worked with APIs that return XML containing one node, which contains escaped XML. So when I read something like this it doesn't seem that bad.

<comment><USER19> That's fine. Just don't call it REST. Does buzzword compliance matter so much? Call it what it is: RPC.

</comment></comment><comment><USER27> In the Java world REST was pretty cool for about 18 months. And then annotations came out, and instead of all the JAX-RPC bondage and discipline, you get JAX-WS, where to make something a webservice literally all you need to do is shove the @WebService annotation on it and you are good to go†.

All the WSDL and SOAP crap gets auto-generated for you. Thereby eliminating in a single stroke REST's advantage.

Now, it is true that there is some stuff†† you can do with SOAP that you can't do with JAX-WS, but really unless you like making life difficult for yourself then don't.

Especially for a big Java to Java solution there doesn't seem to be any compelling reason to go with REST anymore. Even if _everything_ you do maps exactly to the four SQL ops (select, update, insert, delete) it is still just as easy to use the annotation as it would be to use REST.

†C# has something similar I think.

††Example: JAX-WS is limited to what you can do with a method and parameters in Java. In your SOAP schema you can specify for instance that the array you get passed shall have between 1 and 3 members, two is okay but 4 is right out. Whereas in Java (and hence JAX-WS) if you have an Array parameter, you can't specify that it must have a certain number of elements in it.

<comment><USER28> The simplest method of creating SOAP-services is use of SQLServer SOAP Endpoint.

Just one line for SOAP from stored procedure or function.

Is it beautiful? I don't think so. SOAP remains SOAP, ugly remains ugly.

</comment></comment><comment><USER29> The author gives WebDAV as an example of a good standardized REST API.

Is adding new HTTP methods (like PROPFIND, MOVE, COPY, etc.) considered to be RESTful? I always thought you were supposed to structure all actions around the main 6, and add extra functionality in the data payload or query parameters.

</comment><comment><USER30> Summary:

Rdo: "Yeah, we have POST!"

Thought Palace: "What about the rest?"

</comment><comment><USER31> FTA > In fact this is why Tim Berners-Lee used the word "method" in the HTTP protocol in the first place.

Does he have a source for this? Coincidentally I had just read the HTTP 0.9 the other day and I didn't see "method" being used that way at all. I think method, in HTTP, just means "a means to retrieve / put data", not method in the object oriented sense.

</comment><comment><USER32> Yep, our API isn't really technically REST in the classical use of the term. We changed some of our wording and made a blog post: <http://developer.rdio.com/blog/read/No_REST_for_the_wicked>

</comment><comment><USER33> This is a good example of a REST anti pattern. It can be easier to understand REST, when you know what it's not.

</comment><comment><USER34> So it's an HTTP-based API rather than true REST. Move on. _shrug_

</comment><comment><USER35> Yes! Yes! Yes!

"HTTP API that's not as hard to use as SOAP"

My current employer calls our API ...

... RESTful like .

</comment><comment><USER36> I am all with you on using GET and POST properly, but is there any REST API that actually uses PUT and DELETE?

<comment><USER19> Take a look at Sun Cloud API. It's one of the best examples.

For APIs that need regular browser support, it's fine to add fallbacks like query params to specify PUT or DELETE. But these are hacks.

</comment></comment><comment><USER37> _It's object-oriented, where objects are identified by URLs_

I'm not so sure that "object-oriented" is the right term here, but totally agree with the premise: this isn't REST. It's more like XML-RPC Jr.

</comment><comment><USER38> how about calling it RESTish? <http://news.ycombinator.com/item?id=2242162>

<comment><USER12> How about calling it what it is, namely RPC?

<comment><USER19> Yes. The terms "RESTish" or "lower REST" are just a way to stay buzzword compliant, not actually a way of elucidating anything. They're catch-all buzzword substitutes for more accurate terms.

They're particularly bad since a strict interpretation of REST can still be valuable, yet it makes REST itself seem overly nebulous and fluffy.

People advocating terms like "RESTish" or looser definitions of REST seem to think that REST is an ultimate goal of any decent web API. It's not, REST doesn't need to be used everywhere, your API isn't crap if it's not REST. So stop calling it REST like you're embarrassed to admit it's "just" RPC.

(Sorry for ranting in reply to you -- you seem to get it)</comment></comment></comment>