Why Japan Is Doomed - <AUTHOR> http://www.oftwominds.com/blogaug10/Japan-doomed07-10.html

<comment><USER2> Here, I'll turn on the Patio11 signal:

          00000
         0000000
        000P11000
         0000000
          00000

<comment><USER3> I love you guys, but a) it is 4:50 in the morning and I am scarcely coherent and b) there are several dozen HNers in Japan.

<comment><USER4> Do they have signals? Do their signals work so effectively (4:50? Yoiks)?

I think we need a signal-tweet-feed, so someone can set up an alarm system for when their signal is activated. For great justice!

</comment></comment></comment><comment><USER5> The original article title is "Why Japan is Doomed (and the U.S. and the E.U. too)". The Greek debt crises seems to be looming in the future for Japan, the U.S., and the E.U. as well. There doesn't seem to be very many serious plans to stop the accruing debt, and those who think that the debt is no problem are addressed in the article:

 _Those in denial about Japan's reliance on ballooning debt to fund its status quo (and on America's exact same reliance) basically claim that "It can't happen because it hasn't happened."_

</comment><comment><USER6> If the US, EU, and Japan are doomed, who isn't? I don't think the answer is China and India. China's plan seems to be to lurch full steam ahead (no pun intended) into our style of entirely non-sustainable petroleum and coal fueled over-consumption.

</comment><comment><USER7> Will someone be able to exploit this for profit? I haven't enough macro- economy knowledge to evaluate this, but looks likely. Sadly, i haven't seen yet any article on future scenarios in case of a global crisis caused by multiple nations going to default... any interesting link about this will be highly appreciated.

<comment><USER8> Credit Default Swaps could be purchased on the relevant sovereign debt.

Given the success that various hedge funds had with this strategy during the crash of mortgage backed CDOs a couple of years back I would have thought that there must be a lot of speculation of this kind going on.

Assuming that there are still sellers of CDSs out there...

<comment><USER9> And remember: timing is everything. Japan has been obviously f __ked for a long, long time now, but hasn't paid much of a price for it in the bond market. Now that they are going to have to finance their debt externally, maybe reality will assert itself.

But maybe not.

Cheers, Carson

<comment><USER10> You're exactly right, many people have lost a lot of money trying to bet against the Japanese debt situation.

"Markets can remain irrational longer than you can remain solvent." -Keynes

</comment></comment></comment></comment><comment><USER11> We're borrowing 43% of our budget? Talk about unsustainable.

I would seriously make plans for when the US is forced to stop this destructive pattern. Its going to be ugly.

<comment><USER12> The US is in a somewhat unique position - as the de facto reserve currency, it can inflate its debts away.

Like Monopoly's "Get Out Of Jail Free" it's a card you can only play once, though.

<comment><USER13> Am sure Japan can do that also since they have their own currency and can print plenty of money.

One person mentioned some numbers however, such as 2500 Yuan per hour. I am sure that figure one day was 25 Youan, but inflate and inflate, some zeros have been added.

I guess however having prices go up also, such that say bread is 1000 Yuan you do not get real inflation if you print slowly. But, I doubt anyone want to take a chance.

I would think also that it is not so easy and it is not really a get out of jail card. Money have value as long as they have power. They can print as much as they like, as it seems to be the case with Japan, but if prices go up accordingly, they would need to print more, and prices go up and print more and Germany 1930s or Zimbabwe 2007.

Paying off debt is a good policy, whether be it a country or individual. Saving is a good policy too.

<comment><USER14> The US can inflate ultimately because the USD is what oil and other major commodities is traded in. Anyone who needs to convert their currency into another to trade doesn't have that luxury. Not even the CHF, the EUR or the GBP.

<comment><USER13> What they can't just start trading in Euro? Do they have some sort of contract or is there some sort of law which says you can trade oil only in dollars?

I think if the dollar became a fonny currency people would switch quickly. It would for example not make any sense for a British man to trade in dollars if he gets say one pence for every dollar. Especially if by the next day it is worth 0.5 pence.

<comment><USER14> Well there is a conspiracy theory that Iraq was invaded because it was on the verge of switching to EUR, and if it had OPEC would have followed and the dollar would have collapsed, taking the US economy with it.

<comment><USER15> at the risk of sounding crazy, has there been a more rational explanation for our actions?

<comment><USER14> If there was, I haven't heard it. The idea it was about securing access to oil is laughable. The oil isn't in Baghdad, the oilfields are out in the middle of nowhere. They could have been taken and held without going anywhere near the cities.

Plus there is the small matter that we already know how to get oil from Middle Eastern countries... We buy it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The part I don't understand is why Japanese citizens would accept such low returns on their investment for so many years, when so many investments outside of Japanese government debt would give them higher yields.

Is it a cultural thing? Is it just pure altruism? Do they want to support their government that much that they're willing to ignore better investments for their savings?

<comment><USER16> Seems like a version of this:

<http://en.wikipedia.org/wiki/Equity_home_bias_puzzle>

I don't know why US savers don't invest in Australian dollar accounts either. They pay about 6 times as much as US term deposits.

[http://www.infochoice.com.au/banking/savings-account/term- de...](http://www.infochoice.com.au/banking/savings-account/term-deposit- interest-rates.aspx)

<comment><USER17> I just checked two of those term deposits and they both require Australian residency. Can I get one of those without living in Australia?

<comment><USER16> In Australia HSBC offers foreign currency bank accounts, but I can't see that on the US site.

I work for a fund manager not a bank. Would an ETF for high yield, first world, countries fixed income products work?

<http://us.ishares.com/product_info/fund/index/FI.htm>

</comment></comment></comment></comment><comment><USER18> What does it look like when a nation becomes insolvient? How does it affect its citizens? Its public services?

<comment><USER19> It looks a lot like how Greece was looking a few weeks back. (Probably still is looking in all likely-hood)

Most of the national debt is written off, public services are cut or re- financed through printing money which has the nasty side effect of inflation and then eventually hyperinflation.

Here's some examples: [http://en.wikipedia.org/wiki/Hyperinflation#Examples_of_hype...](http://en.wikipedia.org/wiki/Hyperinflation#Examples_of_hyperinflation)

<comment><AUTHOR> Anybody with personal accounts from Iceland?

<comment><USER20> Yes. And since I lived in the UK my government impounded Icelandic owned assets up to their value[1] to pay me back my money. Yay for international relations!

[1] [http://www.telegraph.co.uk/finance/businesslatestnews/318519...](http://www.telegraph.co.uk/finance/businesslatestnews/3185190/UK- freezes-4bn-of-Icelandic-assets.html)

<comment><USER13> Yeah. Those were strange times. The PM had the decency to threaten to use anti-terrorism laws against Iceland!

</comment></comment></comment></comment></comment><comment><AUTHOR> "Millions of Japanese aged 25 to 34 toil as temps or contract employees-- up from 1.5 million 10 years ago, according to the Ministry of Internal Affairs. These workers tend to earn about one-third the typical "salaryman" wages that their fathers earned"

I lived in Tokyo last year in a cheap apartment with alot of young Japanese people, and I was very surprised by their lack of work ethic/prospect from my first time in Japan. They would bounce from temp work (typing) to temp work (waiter) to temp work (salesperson walking everywhere in tokyo door to door), quitting every 2-3 weeks. They would sometimes sleep in and not show up for interview, and wouldn't even call to reschedule. The way they would quit a job they didn't like is by....not showing up anymore. Keep in mind these are people that went to pretty decent universities in Japan, and speak ok english. And when they do get a full time job offer, they would have to wait almost half a year to a year to start working (which I would think depress their morale).

<comment><USER21> > and I was very surprised by their lack of work ethic/prospect from my first > time in Japan

Why would you be surprised by their "lack of work ethics"? They got fucked hard, so it's understandable that they aren't going to care much for "the man" anymore: they were told their contract was to work like mad in their studies, get to a good university and end up landing a good job in a multinational where they'd work their whole life slowly climbing up the hierarchy and pretty much guaranteed they'd be there for life.

Instead, at the end of their studies they found an utterly slaughtered job market and a crappy economy in which Japan has been stuck for 20 years (especially those who got out during the Lost Decade of the 90s).

They don't have "good work ethics" because they've managed not to be stockholm syndrome victims, and because reality showed them strong work ethics didn't matter, and promises were there to be broken.

<comment><USER22> Oh bullshit - I'm surprised you got as many upvotes given that this is supposed to be the entrepreneurial bunch (and our previous mega-thread involving Scott the useless college grad).

Boo hoo, so the economic sucks and you were lied to your whole life about how your employment situation was going to work. So? This does not excuse laziness and a crappy work ethic.

Perhaps their chronic unemployment stems from the fact that they meander through life rather than actively fighting for what they want. Japan isn't some third-world backwater, there are opportunities abound for people who are willing to work and fight for it - just like it still is in the US. The ones that sit and pout all day (like Scott, from the NYT article) are the ones who will _never_ get out.

<comment><USER23> If you are implying that the opportunities in Japan are equal to those available in the US, then I wholeheartedly disagree. Both in terms of startup culture or slogging through a corporate job, Japan is vastly different from the US.

Opportunities exist everywhere, and a poor economy is certainly no excuse for apathy. However, discounting the challenges the economy posed to the rising generation of Japanese is pretty unfair IMO. The 90's really really sucked.

<comment><USER22> I did not mean to make light of Japan's economic challenges in the past two decades - nor do I mean to imply that Japanese opportunities are equal to that of the US.

What I mean is, Japan is still an industrial power, and far from a decrepit backwater - while opportunities were not what they once were, they are still there for those who seek it.

If anything, a shitty economy and hard times should create people who fight harder and take less bullshit, not the other way around as the poster had indicated.

<comment><USER24> Japan is still an industrial power, but that does not imply that "opportunities ... are still there for those who seek [them]". It means that there are opportunities. To whom they are available is quite contingent upon social conditions. It is quite common for opportunities to exist, but to still only be available to a tiny group of people.

</comment></comment></comment></comment></comment></comment><comment><USER25> For us, there's a music video:

<http://www.youtube.com/watch?v=gEmJ-VWPDM4></comment>


Show HN: CUSTOMISE and STAR in an interactive STORY-APP, and gift it to your kids - <AUTHOR> http://gingersnap.tv/ <comment><AUTHOR> Hi, would love your feedback.

We've been concentrating on making a system so that remote parents and long- distance relatives can stay in touch with what their kids/ grandkids are doing on mobile devices.

In our early user-research, it transpired real-time tools (Skype and Facetime) weren't that great because schedules didn't coincide. Any tips on UX for late- adopters welcome :-)</comment>


Follow up on the reverse job application. - <AUTHOR> http://www.reversejobapplication.com/followup/ <comment><USER2> "why didn't you spend your unemployment working on a project to flesh out your portfolio?"

Could the real answer be that you are just the kind of person who considers spending time on a reverse job application and then advertising it to be time better and more efficiently spent than working on a portfolio? And that is at least one of the reasons that you were probably hired by hopefully one of the better employers that were able to recognize that.

<comment><USER3> While that may be true, if I recall correctly he was unemployed for over 2 years. I have a feeling the reverse application didn't take up all of his time.

<comment><USER4> Look at the bottom of the article for an explanation of why he hasn't an impressive portfolio.

</comment></comment></comment><comment><USER5> Such an interesting reaction. I'm at the company that hired Andrew. Since he didn't post our name on his blog, I won't reveal his secret destination here. But we are both awesome and a start-up.

That said, we obviously saw Andrew the way that cosgroveb and mcknz. He seemed opinionated, smart, and very creative. We were pretty sure he'd fit culturally and be interested in learning the type of development we do.

Is he a master of OO design patterns? Probably not. Were you when you just graduated college? Once again, probably not.

Should he have developed more of a portfolio and completed a few personal projects? It might have shortened his job search. Was putting together reversejobapplication.com a very creative and effective solution to the problem of getting hired without said portfolio or personal projects? Yes. Yes it was.

See you Monday, Andrew.

<comment><USER6> You DO realise that people can look at your previous comments and see what startup you work at/for? No such thing as secrets on the interwebs :)

<comment><USER7> and it happens to be the comment before this one :D

</comment></comment></comment><comment><USER8> Wow. The guy creates an entertaining, creative, and novel approach to finding a job, succeeds, shares his story for the benefit of others, and is apparently still getting beat up.

I'm just going to say thanks and congratulations.

<comment><USER9> I think part of the problem was the use of "cover letter/resume" language in the context of a blog posting.

On a job application, it's ordinary to praise your own accomplishments and abilities. So you declare things like "excellent writing skills", and nobody really bats an eye [1]. However, if you were at a dinner party, and you praised your own "excellent cooking skills", it would probably rub people the wrong way. Blogs fall more into the second category, I think, which may account for some of the reaction.

All in all, this was a clever approach that worked out well, and maybe it _should_ be more of a norm. Unlike Andrew, I've been in the workforce for well over a decade, but I think that I may have a skill set that doesn't match up neatly with a most job descriptions. As a result, want ads don't do much for me. I always figured that this is just because really good jobs are never listed on recruitment sites - they're the jobs you create and grow into. But who knows, a reverse job application might be a good way to see if there's one out there.

If I try it, I'll make sure to heed the lessons I learned from this first go- around, which is when many of the mistakes are first made.

[1] Watch out, though. In the tech world, describing yourself as an expert in a programming language may be a bit like waving a red flag in front of a bull.

</comment></comment><comment><USER10> He hacked this terribly inefficient system we call the "jobs market." I think that's impressive.

To everyone who still thinks he's arrogant, or narcissistic, or whatever... Meh.

<comment><USER11> That's the point... he didn't "hack" anything. He posted an ad, it got a desired result. Good for him, but nothing remotely special.

<comment><USER10> It may not be unique but it is at the very least a very unusual approach. So I respectfully disagree that it is nothing remotely special.

</comment></comment></comment><comment><USER12> Maybe this is better addressed to his site than this one, but I'm curious what type of job he netted with his reverse job application. Many people postulated it would be something in marketing, I wonder if that's true.

<comment><USER13> I don't think I'm entitled to share the company, but based on a certain comment in this thread, it looks like he's landed in real estate.

The positions currently listed on the Jobs page for that company are:

* RoR developers

* Customer Acquisition / Marketing

* Loan processing

I imagine that he'll be trained for the first category.

Hope this isn't too intrusive - kind of reminds me of that analysis of patio11 from a month or two ago. Willing to remove this post if requested.

<comment><USER14> Removing the post doesn't hide it. Anyone with showdead turned on in their account will see it.

</comment></comment></comment><comment><USER15> And as promised, i'm going to give you a follow up on the 'reversemarriageproposal'. The next lady that my mum found as a suitor (which was last week), i went in with a view that she had to impress me!

Lo and behold. She has said 'yes' to moving things forward. Its not an official engagement or anything like that, but suffice to say, i've gotten further than i have ever before.

So there you have it! :D

<comment><USER16> Ha ha - I remember your reverse marriage proposal comment from the original thread.

Congratulations :)

<comment><USER15> Thanks! I'll keep you posted ;-)

</comment></comment></comment><comment><USER17> The thing which made this more appealing to me is the fact that (would-be) job seekers could learn a lot from how he approached the situation.

1\. Use your creativity and imagination.

2\. Make the people (and employers) get curious about you.

3\. There are a lot of ways to achieve the goals you desired.

At the end of the day, we should simply be happy that he shared with us something we can learn a lot from and he was able to get a job with a company that realized his potentials.

</comment><comment><USER18> He still sounds self-centered, and I do have a psych degree. He took credit for everything that worked ("Look, I got a job!" "Look, my bold daring attempt at being clever worked!") , then dismissed any naysayers almost entirely out of hand (Paraphrased: "It's easy to be anonymous on the internet", "Oh, you thought I was being serious? I was just exaggerating for my silly website", "You think I'm "x"? LOL well, you're the expert")

I'm glad he got a job, and working at a start-up will definitely be a great learning experience. But I wish the followup focused on things he did both right and wrong, and how he or other people could improve the experience next time, instead of acting so defensive.

<comment><USER19> With people like you who have never had a real conversation with him judging him based on a single action, how can he be expected _not_ to act defensive? Was part of that psych degree learning how to form opinions of someone based on one piece of his writing, without even seeing him in person to see his body language?

And who cares if you're self-centered, anyways? The world you see is _your world._ You can take control of it and make your life what you want it to be, or you can float along on the tides of fate and call the ones who don't self- centered.

The funniest part, to me, is that you call him self-centered, but at the same time you expect him to write _his article_ in a way that _gives you_ value.

<comment><USER18> One of the argument he makes is that everyone on the internet is an amateur psychologist, and that anonymity was the only prerequisite for a psych degree. He then used this to assume that people who called him self-centered had no basis for doing so. I was asserting the fact that he came across as self- centered, and I did, in fact, have a psych degree. His response wasn't a good argument, it was dismissing naysayers out of hand as not having expertise in the area. What will his response be to me? That I don't have a PHD? That I have never met him? If I met him, and still thought he was self-centered, would that change his mind? What about 50 people who meet him? Even if he knows he is not self-centered, if his perception is as such, wouldn't that warrant addressing outside of "no you guys don't understand me, you never met me, you guys are a bunch of amateur psychologists".

You do three things in your post: claim that I can't tell he's self centered, claim that self-centeredness isn't important, then call me self-centered. Which is it? Is it all three? If so, what does it matter that I think he's self centered, since it doesn't matter?

As for the final statement, I gave my opinion as to how I think his post could have helped more people, including me. Is it self-centered to lament that there could have possibly been a better way to go about the followup? Or should critique not be part of any article or post at all?

<comment><USER19> I wish your followup focused on things I did both right and wrong, and how I or other people could improve my comments next time, instead of acting so defensive.

<comment><USER18> This is a completely wrong analogy. In the original post, I said he should have used his followup to focus on what HE did right/wrong. Why in your comment has it suddenly changed to me improving what YOU did right/wrong? This seems like a straw man, that is also trying to be an Ad Hominem attack.

</comment></comment></comment></comment></comment><comment><USER20> Glad that he bothered to follow up but disappointingly short on the details.

When I read the original I thought it was all good, apart from:

1\. <<Possess strong written, verbal and interpersonal communication skills. If you can't tell the difference between "you're" and "your", your never going to be able to get you're points across to me.>> There are plenty of people out there who have correct grammar but terrible communication skills.

2\. he seems to think that people are unable to type their e-mail address correctly and that they have not yet figured out how to copy and paste their e-mail address on web forms.

These seemed very arrogant to me and the anonymous psychologists comments in the follow-up re-inforce that.

<comment><USER21> I thought it was supposed to be a parody of real job adverts / application forms, which are usually quite arrogant and ridiculous and almost never evidence of 'excellent interpersonal communication skills.'

</comment></comment><comment><USER22> I wonder how much of an impact HN had on the success of this. Did he get any job offers _before_ it was submitted to places like this? In this case, the success is based more on the exposure provided via HN then on the actual idea. HN adds a level of credibility that simply putting up a website does not.

<comment><USER23> How do you separate the credibility of a website on its own from the credibility lent to it by exposure on websites like HN? Ideally you'd hope that the reason something gets exposure on HN is because it meets a minimum level of inherent credibility on its own, wouldn't you?

<comment><USER22> > Ideally you'd hope that the reason something gets exposure on HN is because > it meets a minimum level of inherent credibility on its own, wouldn't you?

Ideally. In practice, I think HN lends more credibility to some things that don't deserve that extra credibility.

I'm not trying to suggest that the original article was wrong or not credible. Rather, would it be successful without the HN influence? While I don't think the original idea is bad, I think the success was due to HN.

</comment></comment></comment><comment><USER24> I'm glad this guy took a chance and that it worked out for him. I can't speak for all members of Generation X, but this member is a little tired of how much GenY is being picked on. Lazy, selfish, slovenly, worthless -- everything that we were called, and that the baby boomers were called, too. It's called _youth_ , people. And you were young once, even though you may pretend you don't remember it.

<comment><USER25> With respect to this, I think that people are jealous of youth, which is why the generation that has it catches all the flak. Youth and Freedom travel together. Looking at youth from the other side of marriage, job, mortgage, kids only amplifies the jealousy for that freedom we've long given up (and in my case, I would give up again, but still the calling of freedom is there).</comment></comment>


Show HN: A puzzle game based on the wireworld cellular automatan - <AUTHOR> http://www.thereisbeauty.de/wireworld/ <comment><AUTHOR> Hi, I did this little puzzle game based on the Wireworld cellular automaton some while ago. It proceeds from basic puzzles to building logic circuits in wireworld. I think it could still need some polishing, but I am quite happy with it's current state. Feedback is appreciated.

<comment><USER2> That's pretty neat!

Some comments:

\- Description of "copper cell", "on or two" -> "one or two"

\- Level 2, "this is for Dummies". You really should not be insulting your players, if I'd been playing for fun rather than in the spirit of giving feedback, I probably would have closed down the game at this point.

\- I think this needs more time controls than just a single "play" button. A typical setup would be: play, pause, single-step, reset

\- The visual effect for "cell that the player has placed" is a bit too subtle.

\- A level number or name should be displayed somewhere.

\- I don't know where the level design goes later on (only up to the XOR gate). But I wonder if it would make sense to highlight the goals of the puzzle on the board, rather than have it be in text descriptions?

<comment><AUTHOR> Thanks for the useful feedback. What you are saying makes a lot of sense to me.

The levels after the XOR gate allow you to use higher level components/gates rather than single cells, so the games changes a little after that.

I guess reducing the amount of "work" one has to do, by e.g. replacing text with visual hints, is a good idea.</comment></comment></comment>


How Hate Groups Forced Online Platforms to Reveal Their True Nature - <AUTHOR> https://www.nytimes.com/2017/08/21/magazine/how-hate-groups-forced-online-platforms-to-reveal-their-true-nature.html <comment><USER2> I know everyone is going to say "but Nazis", but I think this incident should really drive home just how quickly dissenting opinion can effectively be purged from the Internet and just how much power tech companies truly wield over us. Yeah yeah I know, it's great because they stood up to Nazis but next time it won't just be them. It's very easy to label just about anything as "hate speech".

And yeah yeah, "private companies can't censor, only the government can", but has anyone stopped to consider that Google et al have very obvious political affiliations and can exert their control over the Internet in order to further their agendas? If you're not concerned with the implications of this you're not paying attention.

<comment><USER3> "...but has anyone stopped to consider that Google et al have very obvious political affiliations and can exert their control over the Internet in order to further their agendas?..."

Have you, yourself, stopped to consider the possibility that large corporations have had very obvious political affiliations, and have been exerting their control to further their agendas since long before Google existed?

<comment><USER2> Have you considered that Google, Facebook, etc. can control public discourse and what information people can see in ways never before thought possible?

<comment><USER3> Have you considered that advisers for Nixon's first Presidential campaign made the same complaint about network television?

My only point here is that many, many companies have been exerting their control for many, many years to further the varied agendas of their principal shareholders.

This really is nothing new.

<comment><USER4> Not new. But better. More effective. Which is worse.

<comment><USER5> more effective than the kronen-zeitung?

[https://en.wikipedia.org/wiki/Kronen_Zeitung](https://en.wikipedia.org/wiki/Kronen_Zeitung)

</comment></comment></comment></comment></comment></comment><comment><USER6> > Everyone has the right to freedom of opinion and expression; this right > includes freedom to hold opinions without interference and to seek, receive > and impart information and ideas through any media and regardless of > frontiers. - Article 19, Universal Declaration of Human Rights, 1948

A lot of people here have been trying to defend free speech as a human right, and a right that all people and corporations have a responsibility to preserve. No matter how many appeals to authority, appeals to history or long- winded explanations used all these arguments have fallen flat on people who either don't agree with free speech, or believe it's only the problem of a small number of institutions.

I believe there's enough people who support speech as a human right that these companies will end up on the wrong side of history and be superseded by more content-neutral hosts. It would be nice if this had more support, but there's enough people demanding companies, who are denying service to groups with the intention that they are unable to find hosting elsewhere, that I think the near future of speech is safe, and will come back stronger.

EDIT: Reworded second paragraph

<comment><USER7> I am having a hard time deciphering what your position is.

<comment><USER8> Appears to be: pro free-speech and against the moves of censorship by companies like Facebook and Cloudflare.

</comment></comment></comment><comment><USER9> Key point of the article:

> Questions about how platforms like Twitter and Reddit deal with disruptive > users and offensive content tend to be met with defensive language invoking > free speech.

> In the process of building private communities, these companies had put on > the costumes of liberal democracies. They borrowed the language of rights to > legitimize arbitrary rules, creating what the technology lawyer Kendra > Albert calls ''legal talismans.''

> What better way to avoid liability and responsibility for how customers use > your product? It was also good marketing. It's easier to entrust > increasingly large portions of your private and public life to an > advertising and data-mining firm if you're led to believe it's something > more.

I've noticed this most distinctly with Reddit. Why haven't all the hate subreddits been banned? /r/physical_removal was exhorting for the deaths of thousands months prior to Charlottesville. The admins proclaim free speech, but under this thin excuse, lies their business model.

Toxic users are extremely active. They have to be. Spewing vitriol, spreading hate, posting canards necessitate constant engagement.

Looking at the tables of monthly metrics, who is more valuable? That one user with 10,000 internet points flaming other users every hour of the day, or the occasional commenter who writes longwinded but intellectually honest posts?

I can tell you which one is far more numerous, and I can tell you which one Reddit raised millions on.

Ultimately, I would argue that this pretense is is designed to morally justify the power these platforms wield over their users. To do any less, especially for an overly-dominant player, sets the stage for regulatory action, backed by popular demand.

edit: removed slight political slant.

<comment><USER10> >Why hasn't /r/the_donald been banned?

He did win the election. You can ban extremists but I'm not sure banning fairly mainstream stuff is the way to go.

<comment><USER9> Correct, I have shifted my intro to focus on extremists.

</comment></comment></comment><comment><USER11> > The platforms' sudden action in response to an outpouring of public grief > and rage resembles, at first glance, a moral awakening and suggests a > mounting sense of responsibility to the body politic.

Resembles is the key word here. Many of the sites knew this stuff was going on and didn't mind at all. Unfortunately I think this is all reactionary and they're not going to keep these policies up. They only care they're getting bad press, not because they ACTUALLY care about the issue.

For example it's nice that Twitter removed a bunch of problematic accounts, but there are TONS more. Reddit still has plenty of very problem subreddits. I'm sure there are still problematic Facebook pages.

Will they clean those up as people stop watching? Or did they 'do somethinrg' so now they're good?

<comment><USER12> > Will they clean those up as people stop watching? Or did they 'do > somethinrg' so now they're good?

If companies were honest in their EULA (or employment agreements), they would simply say that you will be removed if you cause the company to receive bad press.

<comment><USER11> Much like Apple and many of its app review terms I wish some of these companies would actually enforce their EULA.

</comment></comment></comment><comment><USER13> This endless stream of articles, posts on HN, counter demonstrations, is giving to a tiny minority of a few thousand extremists a media coverage they could only dream of. Kind of like terrorism, the more you make a big deal out of a terrorist attack, the more you encourage the next one.

But newspapers and TV news aren't in the business of rational moderation.

<comment><USER14> The interest from HN isn't about the Nazis, but the changing attitudes in the tech industry towards censorship and ideological homogeneity. It would be just as interesting and alarming if it was the other way and communists were getting banned and fired.

<comment><USER15> It is, in fact, alarming that the communists aren't being silenced, since this is how we ended up with communist regimes the first time around.

</comment></comment></comment><comment><USER16> A good part of it is that regular people don't want to deal with them. They don't want to hear from them, and they definitely don't want to be harassed by them.

Look at the "free speech" platforms, the *Chans. They may not have started out as bastions for neo-nazis and racists, but they became that because, as hate speech and such was not really policed on there, normal people stopped going altogether, leaving only those people behind.

<comment><USER17> > leaving only those people behind.

If you think only neo-nazis and racists hang out on the Chans, you definitely don't hang out there.

"The strategy [of people who consider themselves the protectors of decency] is weaponized stereotype campaigns. If a site tolerates witches, describe it as a witch site about witchcraft populated entirely by witches. It's super easy." \- [http://slatestarcodex.com/2015/07/22/freedom-on-the- centrali...](http://slatestarcodex.com/2015/07/22/freedom-on-the-centralized- web/)

<comment><USER16> I'm not saying they're the only ones, but you cannot deny that those sites have a large proportion of that kind of content.

<comment><USER15> Ironically, it's much easier not to interact with that content on 4/8chan than it is on the wider Internet. If you're not there for political shitposting, don't visit /pol/.

</comment></comment></comment></comment><comment><USER18> I just cannot see the difference between banning those 'far right' groups while allowing 'far left' which are basically the same. The red flag, pictures of Mao, Stalin are as hateful to me as Hitler and Nazi imagery, especially given the 10x body count that revolutionary communism resulted in.

<comment><USER12> > The red flag, pictures of Mao, Stalin

Where do you live that you see people marching in the street waving flags of communist dictatorships and ranting against immigrants and... whatever the leftist version of anti-Semitism is... maybe... anti-vaccination? (that's sorta equally irrational)

<comment><USER2> The left is very much pro-Palestine, anti-Israel. You must not be paying attention.

And if you want to see Communist flags, go to any Bay Area protest. There's always Communist hangers-on in attendance.

<comment><USER12> > The left is very much [...] anti-Israel.

That's funny, someone should tell that to המחנה הציוני

</comment></comment></comment></comment><comment><USER19> The irony of this article is deep. It is literally making a "First they came for the neo-nazis, and I said nothing" argument. As a coworker of mine just said, "We might be standing on a slope here, but it isn't really slippery."

<comment><USER20> First they came for the damn commies, but McCarthy was before my time.

</comment></comment><comment><USER10> >...Forced Online Platforms to Reveal Their True Nature

The article seems argue that it's just been revealed that Facebook, Twitter, Reddit et al are, shock horror, "profit-driven entities, free to do as they please." As if we didn't know that already. It also kind of paints them as faceless corporations with shady agendas but in the case of Facebook and Reddit they are both still basically run by the programmers that wrote the first code and try run them in a common sense sort of way. Here they are chatting about these kind of things

Zuck [http://www.ibtimes.co.uk/zuckerberg-investigating- facebook-c...](http://www.ibtimes.co.uk/zuckerberg-investigating-facebook- censorship-after-staff-admit-deactivating-trending-stories-1560059)

Huffman [https://youtu.be/CbGxKKJb7vk?t=12m14s](https://youtu.be/CbGxKKJb7vk?t=12m14s)

Edit - changed the Zuck link...

</comment><comment><USER21> I do wonder how this disagrees with the popular argument in favor of net neutrality? The point being that limiting who can distribute and therefore create access to information is generally agreed upon as unacceptable.

Would it be different if service providers (your ISP) made some content they select inaccessible (not net neutral) rather than Google et al?

</comment><comment><USER22> Sites have been doing this for ages for things like terrorist materials and other forms of extremism, but as soon as white people get censored everyone suddenly gets up in arms.

</comment><comment><USER23> >It is worth noting that the platforms most flamboyantly dedicated to a borrowed idea of free speech and assembly are the same ones that have struggled most intensely with groups of users who seek to organize and disrupt their platforms.

THIS is what ultimately changed my mind about whether Internet companies should offer "free speech" as a positive. I used to believe that the antidote to hateful speech was simply more speech. But every site that's been tried on, fell to more and more hateful speech, pushing and bending and breaking the norms, until sane people left out of disgust or were relegated to their own, more moderated, parts of the site.

Germany and other European countries with anti-Nazi laws have it right (and no, they haven't descended into totalitarian regimes, the slippery slope simply stopped at "Don't be a Nazi".)

<comment><USER17> The laws against hate speech are great until suddenly they aren't. Germany's laws are making it criminal for citizens to engage in honest debate about the refugee crisis.

[https://www.usatoday.com/story/news/world/2017/06/30/germany...](https://www.usatoday.com/story/news/world/2017/06/30/germany- passes-law-against-online-hate-speech/442031001/)

</comment></comment><comment><USER24> Interesting argument. Usually when people make this sort of "virtue signaling," they don't provide much analysis of the history and ramifications, as this article does.

Democratically accountable decision makers, uniformly enforced policies and standards, and making these systems actually function like our legal systems, rather than shallowly mimicking them sounds like a huge improvement over the status quo.

<comment><USER25> "Virtue signalling" is the most tired cliché of an argument. It's cynicism is best demonstrated by the simple fact that it works against anything someone says, as long as it is somehow not completely offensive.

It's also a great example of assuming bad faith, and failing Occam's razor: instead of the obvious conclusion that most people tend to emphasise with victims of injustice, it constructs a complicated mechanism to explain how someone can be a bad person using their words and actions that say the opposite.

<comment><USER26> Are you also against the terms 'hypocrite' and 'cheap talk'?

<comment><USER27> Those are more neutral, less loaded terms. Like it or not, virtue signaling is one of those neologisms that has become ideologically slanted, like "homicide bomber" or "microaggression."

By all means, it is far better to use common parlance.

<comment><USER26> It's not loaded. These terms are synonymous.

The word is an apt description of something very real and very common [0]: people hiding their greatest moral failings behind ultimately empty virtuous performances.

It's unsurprising that the only people calling it 'loaded' and despairing over the existence of the term, identify with the group it's most often used to describe. And it's unsurprising that they would misunderstand it to be a term that you use to describe virtuous acts instead of sanctimonious frauds.

Desperately wishing that you were able to police the language of your political rivals isn't a good argument for getting rid of a phrase.

Also, if every time somebody uses the term, and somebody jumps in to say "I think you mean 'they're being a sanctimonious hypocrite'" then really it will just be emphasizing the meaning. I don't see what you expect to gain from this...

[0] [http://www.thewrap.com/joss-whedon-feminist-hypocrite- infide...](http://www.thewrap.com/joss-whedon-feminist-hypocrite-infidelity- affairs-ex-wife-kai-cole-says/)

<comment><USER27> There are some phrases which, despite their ostensibly unbiased definition and utility, end up being colored by overuse by one partisan side or another. Immediately jumping to accuse critics of those phrases of being on the opposite partisan side only reinforces the biased nature of the phrase. Are you triggered?

It is interesting that one of the earlier pop uses of "virtue signaling" was on LessWrong, and hence fairly apolitical [A]. But it seems to have been mostly used by the right. If one was to see a lot of leftist groups calling freedom of speech protesters or statue protectors "virtue signalers", then the phrase would indeed retain its original apolitical, universal nature. The article also gives some interesting analysis about how the original term has semantically drifted over the years to become watered down in meaning- at least according to Sam Bowman.

[A] [https://en.wikipedia.org/wiki/Virtue_signalling](https://en.wikipedia.org/wiki/Virtue_signalling)

<comment><USER26> Good response.

I do agree with Sam Bowman that the term is often misused (and that it doesn't make as much sense as it should since the word 'signalling' is meant to refer to costly signals and not 'cheap talk'), however my belief is that people are critiquing because the term is hitting 'too close to home' rather than because the term warrants serious criticism.

<comment><USER26> @matt4077:

      > Here's an analogy, a term I abhor for the
      > same reason: "mansplaining".
      >
      > It's a similarly cheap and unfair argument, because
      > it's completely generic and can be used in any
      > discussion. It's also impossible to argue
      > against, because it uses any answer as proof.

Yes, agreed. That term often gets used when somebody isn't merely re- explaining what somebody already knows and is in fact giving new information from their own personal experiences in good-faith.

I don't really use the term 'virtue signalling' anymore, but I do get annoyed when somebody uses it and another person jumps in to tell them that they're not allowed to say it because it is used by the wrong sort of person or because it has no meaning. It does have a meaning and it is sometimes appropriate: male feminists who turn out to be using this identity to cloak their misogyny, politicians preaching about peace but consistently voting to bomb countries, Ivanka Trump harnessing a feminist image to hawk sweatshop clothing, etc.

Actually, I feel the same way about 'mansplaining'. There are cases where men step-in to re-explain what a woman just said to her or to others in a louder, more-confident tone and in these cases I think it's a great word.

 _Edit: You deleted your comment but I had already written this so I 've posted it anyway._

<comment><USER27> But none of those examples actually involve self-sacrifice in order to perpetuate falsehood. Those are examples of hypocritically showing off. It's an example of specialized technical jargon that does have valid specific use, but has been watered down to score cheap ideological points, an indictment of the target of being textbook irrational. How ironic that the use of the phrase has become an act of virtue signaling, in of itself!

<comment><USER26> Er, yeah, a more legible description is "virtue cheap talking" and not "virtue signalling".

But it's quite likely that usage of the latter term has always been a sarcastic jibe about the fraudulent/low-investment quality of the 'virtuous' acts that are being performed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> "This was also a moment these hate groups were anticipating; getting banned in an opaque, unilateral fashion was always the way out and, to some degree, it suits them."

I think this is the viewpoint all coverage needs to employ. That these groups are already trying to frame themselves as victims and media needs to preempt this by framing their cries for what they are, a quick slip and fall scam.

*Edited for clarity

<comment><USER29> Surely your irony detector must have went off writing this statement. One of the core message of these groups is that the media is biasing their coverage against them in an attempt to sway public opinion and your suggestion is to prove their point?

<comment><USER28> My suggestion is to highlight the tactic so others can see it for what it is.

<comment><USER29> I honestly don't know if it would help. You could try and argue that they're setting themselves up as victims but the other side of the coin is that they're exposing the true feelings and cruelty of the people they've been claiming are using their power to discriminate and silence them.

I don't think there's much to be gained by putting on a circus that exposes the Nazis as the scheming bad guys -- it's already in the name. They're provoking a reaction from groups and people who have been long claiming to be tolerant and respectful of dissenting views.

The way I see it the only way out is to be the better people, let them say and do as they please, challenge and criticize their ideas openly, respectfully, and with evidence, and be secure in the fact that in the long run they'll be proven wrong.

</comment></comment></comment></comment><comment><USER30> "There are hard-right alternatives to Twitter, to Reddit and even to the still-mostly-lawless 4chan."

The writer obviously has no idea what 4chan looked like before the fappening.

</comment><comment><USER31> I keep wondering how this meshes with the common carrier rules/designation. Does it put Facebook, Twitter, et al at more or less risk as a result? How does this fit with the pro-net neutrality positions that these companies have staked out?

"Put simply, common carriers are private companies that sell their services to everyone on the same terms, rather than companies that make more individualized decisions about who to serve and what to charge. [snip] Congress created laws to make sure that phone companies provided basic phone service to all customers on a non-discriminatory basis and at reasonable prices, and created the FCC to regulate them."

Ref: [https://www.ncta.com/platform/public-policy/why-its-a- good-t...](https://www.ncta.com/platform/public-policy/why-its-a-good-thing- that-broadband-isnt-a-common-carrier/)

<comment><USER25> Those things have nothing to do with each other. Common carrier rules and net neutrality are attributes of companies enjoying a natural monopoly: that of often being the only one running a cable to your door.

Besides, Facebook, Twitter etc. crossed that particular rubicon long ago when they started deleting, for examples, images of nudity.</comment></comment>


Show HN: I built a royalty-free indie music marketplace - <AUTHOR> https://musicmaker.site <comment><AUTHOR> For many years my good friend Evgeny Teilor (@evgeny_teilor on Twitter) has been composing music professionally and working on the sound design for commercials, movies, games, and TV-shows.

Nowadays, he is a professional digital producer and prolific creator. He works with musicians, movie directors, internet personas and influencers in composes music of all possible styles and genres.

YouTube: 2.2M views Jamendo: 2M plays Soundcloud: 340k plays

I'm happy to announce that we have just finished composing, designing, coding and testing the collaborative product that we merrily call 'Unsplash for music'.

Music Maker is free music for everyone.

\- Need soundtracks for your podcasts?

\- Wanna find your unique sound?

\- Trying to spice up your indie game with an epic soundtrack?

Then you can choose to download Music Maker's free universal music pack, which includes:

\- 21 tracks in mp3 format (3 per theme)

\- 1 set of stems* included

Total size: 445 Mb

* A note for tech-savvy people and enthusiasts. We are not only sharing the mixed tracks, but also the 'stems': sets of music files for each instrument/voice. You can put your musician hat on and use remix, reuse, recycle them the way you'd like.

To get the most value out of Music Maker's marketplace, you can get Giga pack.

Truly one-and-only all-in-one pack. You will get access to _all music_ the talent has created so far _and will create in the future_. This way, you will never run out of music material and support the indie artist.

\- 100+ tracks in .mp3 and lossless format

\- 20+ stems included

\- 1 year of free updates

\- Priority support

Total size: 11.2 Gb

The plan is that Evgeny and I will be creating 1-5 new tracks each week. Invest once and get dividends in new tracks and stems.

</comment><comment><USER2> Thanks for the free pack just downloaded, will be checking it out later this evening, but would be nice to have the preview on the website. Nice site btw thanks again

</comment><comment><USER3> Website looks really good but I am missing the preview feature.

Surely you don't buy music without even hearing it, just because it supposedly matches the theme you want?</comment>


HTML/CSS as a Prelude to Programming - <AUTHOR> http://catsonkeyboards.blogspot.com/2008/07/htmlcss-as-prelude-to-programming.html

<comment><USER2> Nice. I would even suggest learning HTML/CSS, followed by Javascript as a first true programming language. Many a CS professor may disagree, and for the true hardcore CS students, JS will only take you so far. But for the average high school student who has no desire or need to understand the complexities of compilation, GUI libraries, memory allocation, etc., Javascript is a great way to learn programming quickly and visually without the "voodoo" involved in getting a C script to run.

Not to mention, limited experience with HTML/CSS/JS is probably far better on the resume/useful in the job market than limited experience in C/Java/Python.

</comment><comment><USER3> This is sort of the self-taught path I've followed, but I have no idea how to use an IDE. Can anyone recommend a good one for beginners (assuming that may not be the same as the wonderousness of some emacs thingermajig I don't understand either). Right now I use vi and see what changes in the browser. Where's the IDE come in?

<comment><AUTHOR> IDEs are useful for helping you match tags, see what part of your page is affected by which tags, and checking your HTML. They're also just handy as editors, e.g. they allow you to open multiple files simultaneously (e.g. your html file in one tab and your stylesheet in another.)

Not that there's anything wrong with vi. I use it and an IDE.

You might want to give Arachnophilia a try. It's simple, configurable, multiplatform, and does more than HTML/CSS: <http://www.arachnoid.com/arachnophilia/>

Amaya is prettier, and focused on web page design: <http://www.w3.org/Amaya/>

Neither one breaths fire like the big IDEs, but both do a great job on what they do. ;)

</comment></comment><comment><USER4> This is a fantastic little write-up. So many kids these days miss out on the benefits of understanding what is actually going on under the hood of that flash DX/OGL GUI. There are bits and bytes, logic and complxity. I don't know what I would do without the technology of computing systems; maybe try to invent them?

</comment><comment><USER5> ESR also recommends learning XHTML before taking on programming, saying it can teach a person certain mental habits. This fellow however, enumerates those mental habits quite well and accurately, based on my own learning experiences anyway. A great blog entry indeed.</comment>


Demystifying CORS - <AUTHOR> https://frontendian.co/cors <comment><USER2> This post never actually explains why any of this was needed. The closest it comes is this bit:

"If [...] the same-origin policy for XMLHttpRequests relaxed, said services could now receive a deluge of DELETE, PUT, etc… requests from any origin"

But why on earth is this a problem? And in any case those services _always_ could receive requests from any origin, browsers aren't the only HTTP clients in the world. In the old days you could simply proxy through a server if you needed to get around the same-origin policy, and I'm sure lots of people did.

I'd love if someone could explain why the whole CORS rigmarole was considered ncessary.

<comment><USER3> CORS was designed to mitigate e.g. the following attack:

* You are logged at with service X, which uses a Cookie to store your authentication code.

* Service X offers an endpoint to change your password, as well as an endpoint to retrieve your user account.

* You visit malicious website Y, which uses JS to send requests to the "change password" and "view profile" endpoints of service X (which without CORS would be accepted as the browser sends your authentication cookie with them), getting your profile information and changing your password, thereby taking over your account.

With CORS, for requests from third-party domains the browser first sends an "OPTION" pre-flight request to service X, which would then respond with a set of CORS headers from which the browser can determine if the given domain you're on (Y) is allowed to send requests to the service. If not, the request (e.g. GET, POST, PUT, DELETE) is not even sent. CORS therefore protects the user from malicious websites while still allowing requests from specific third-party domains (as there are legitimate use cases for sending API requests to a third-party website).

Note that CORS does not protect you from user-triggered requests (e.g. actively submitting an HTML form), for which you need CSRF tokens if you use cookies for authentication (which are sent automatically with each request).

<comment><USER4> If you need CSRF tokens for forms, etc, then what does CORS give you above CSRF tokens?

<comment><USER3> CSRF tokens are usually only used for state-altering requests (POST, GET etc.), though one could use them for GET requests as well. The reason people don't do use CSRF for GET is that there's usually no risk involved when calling a GET endpoint from your browser, as it's not supposed to change the state of a resource in any way. And since an HTML form submission or included link will take the user directly to your API, there's no way for the attacker to extract the information afterwards (which is of course given if the attacker can make the request asynchronously via Javascript).

You can also use the "Referer" and "Origin" headers to defend your API against form submission from third-party websites without using any CSRF tokens (as browsers will include the URL/domain of the site from which the form was submitted), though there were numerous cases where browsers or e-mail clients didn't set these headers correctly, so if you really want to be sure the only way is to use a CSRF token. You can put that token e.g. in a JS-readable cookie, which will not be accessible on third-party websites but which you can read out via JS on your domain and then include in the POST/PUT/... request. If you want to run your code from different domains as well you will have to provide an endpoint from which users can get the CSRF token though (as Cookies from your API domain will not be readable there). You will then need to restrict that endpoint using CORS, as otherwise an attacker will be able to get a valid token and e.g. inject that into an HTML form which he/she can then submit.

So CORS and CSRF do different things, but for API-based apps that should be able to run on multiple (non-sibling) domains you need both mechanisms to ensure security (and CSRF needs CORS in that case to function).

<comment><USER5> You meant "POST, PUT, etc"

<comment><USER3> Yes, GET doesn't make any sense there.

</comment></comment></comment></comment></comment></comment><comment><USER6> Alex Hopperman talks about XMLHttpRequest starting as an initiative to port exchange/outlook email to a browser: [http://www.alexhopmann.com/xmlhttp.htm](http://www.alexhopmann.com/xmlhttp.htm)

XMLHTTP actually began its life out of the Exchange 2000 team. I had joined Microsoft in November 1996 and moved to Redmond in the spring of 1997 working initially on some Internet Standards stuff as related to the future of Outlook […] I don't recall exactly when we started working on Outlook Web Access in Exchange 2000. I think it was about a year after I joined the team, probably sometime in late 1998 […] we were already a milestone or two into the Exchange 2000 (or "Platinum") project and had been carefully ignoring the issue of OWA [Outlook Web Access] mostly because the old version was such a hack. […] The basic premise of Outlook Web Access was that you could walk up to any computer that had the browser on it and just get to your email […] The [XMLHttpRequest] beta shipped and the OWA team was able to start running forward using the beta IE5,

<comment><USER7> Looks like his site is a bit clobbered, there's an archive.is copy here:

[http://archive.is/7i5l](http://archive.is/7i5l)

You'll likely need to do an "inspect element" over the annoying AdChoices bar on the left and delete its containing div.

Back in 2000-2002 I was lucky to work with a team that leveraged XMLHttpRequest (it was an internal corporate thing for a customer so we could get away with only supporting IE) to build single page apps before much of this stuff had a name.

</comment></comment><comment><USER8> I've never understood why so many people seem to find this confusing. CORS is really simple: if you want third-party sites to be able to access the contents of a given page, you need to send `Access-Control-Allow-Origin: sitename.com` in your response. If you don't send that header, the browser will default to the more secure behavior and just deny access. (Yes, it can get more complicated when you need to allow credentials or access to other HTTP methods but the concept itself is dead-simple.)

Maybe people are just confused about the same-origin policy in general? (Which is not the same thing as CORS, but related.) That's more understandable, but still really easy to explain; if you're signed into a site or have access to a non-public (corporate LAN) site, you _don't_ want every third-party site you visit to have unrestricted access to all your personal data on that site. Therefore browsers, by default, don't allow third-party access to a given origin; simple as that.

<comment><USER9> People get confused because it's two requests, first the options one, then the normal one. Their web frameworks are largely built on single connection handling, but because CORS isn't used by many people it's often a tacked on afterthought. For example, in Rails they briefly made it impossible to manually handle Options requests (something that I fixed).

Then there is the core weirdness of subdomains and security headers in general. Most developers don't really care about security. They'll do what they're told and like to do a good job overall, but deep down they don't enjoy spending time thinking about how to pwn the app they're building. They just want someone to use what they've built and love it.

<comment><USER8> There aren't two requests; at least not normally.

Preflight requests are only needed if you want to send unusual headers in your request or use HTTP methods other than GET or POST. See [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS#Simpl...](https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS#Simple_requests)

But you make a good point about developers not caring about security. If I look at it from that perspective it totally makes sense. If you don't have any reason to care, CORS headers may just seem like an unnecessary annoyance that you don't want to bother learning. "Not allowed access? Why? I don't care about your darned security headers, I just want to make an API request."

<comment><USER9> You're right.

I forgot about the simple requests angle because 100% of the requests I make are non-simple. I need custom headers and JSON Content-Types. Yet again why this area is so annoying.

</comment></comment></comment></comment><comment><USER10> interesting article, although unfortunately it mentions but doesn't currently cover one of the more mis-understood parts of CORS, which is the Access- Control-Allow-Credentials part.

The fact that Access-Control-Allow-Origin: * doesn't work with Access-Control- Allow-Credentials, for example, is something I've seen sites get wrong quite a lot.

there's a good post which covers it [https://mortoray.com/2014/04/09/allowing- unlimited-access-wi...](https://mortoray.com/2014/04/09/allowing-unlimited- access-with-cors/)

</comment><comment><USER11> Where CORS got complicated for me was adding custom request and/or response headers to a cross-origin GET request. Different browsers handles this differently. For example, Safari would make a pre-flight request if certain request headers are sent, while Chrome would just send it. And Chrome would not make a pre-flight request, and won't populate the "Origin" request header, but will then drop "unknown" response headers (and doesn't give you any way to force a pre-flight request or Origin header). I eventually figured out you can just always respond with `Access-Control-Expose-Headers`, even though it doesn't look like a CORS request, and then Chrome will expose the headers to the JS.

<comment><USER12> That's really odd. There are shared tests for all this stuff, and browsers should really be doing it identically.

Did you happen to report bugs on this to browsers? If not, do you happen to have a link to a page that shows the behavior difference?

<comment><USER11> Nope, never got around to debug in depth. Will do that when I have some time again.

<comment><USER12> Thank you! Even just a page that shows the behavior differences, without much debugging, would be really helpful; this sort of thing is something browsers very much aim to have working identically.

</comment></comment></comment></comment><comment><USER13> Nice article, though it doesn't cover CORS with NTLM/Kerberos auth (ie. .NET on windows).

To my mind this is the most baffling aspect here, as preflight requests shouldn't carry an auth token (according to the spec), however IIS is an all- or-nothing auth which will thus reject the preflight request, unless it is specifically handled.

Additionally, there are different ways to handle preflighting for owin and aspnetcore vs .NET framework (IIS hosting), and these methods also change depending on the technology - MVC, WebAPI, OData.

[edit] Hit return early:

MVC (pure) requests can be handled in the web.config to set custom headers. WebAPI uses annotations on the controllers. See [https://stackoverflow.com/questions/29970793/enabling- cors-t...](https://stackoverflow.com/questions/29970793/enabling-cors-through- web-config-vs-webapiconfig-and-controller-attributes)

OData follows a different path through, so the above won't work. You would need to modify Application_BeginRequest() See [https://stackoverflow.com/questions/31459416/how-to- enable-c...](https://stackoverflow.com/questions/31459416/how-to-enable-cors- via-attribute-instead-of-via-application-beginrequest-when-pr)

The above is all for .NET framework (IIS host). For OWIN you need to modify HttpListener as per [https://stackoverflow.com/questions/42104716/owin- preflight-...](https://stackoverflow.com/questions/42104716/owin-preflight- requests-are-not-processed)

For aspnetcore the pipeline again changes: [https://weblog.west- wind.com/posts/2016/Sep/26/ASPNET-Core-a...](https://weblog.west- wind.com/posts/2016/Sep/26/ASPNET-Core-and-CORS-Gotchas)

Lastly, all of the above should be using xhr.withCredentials = true; on the client (javascript) side.

Note that this is not present for breeze-odata4 (I'm patching when I have time) but is present on Jaydata (though it's a shame Jaydata doesn't play nicely with webpack, only browserify).

</comment><comment><USER14> My biggest frustration with CORS is that none of it is technically needed.

We could have skipped the whole thing if subresource integrity (SRI) had been implemented much earlier, possibly in HTTP 1.0, which makes its absence one of the great blunders of the web:

[https://en.wikipedia.org/wiki/Subresource_Integrity](https://en.wikipedia.org/wiki/Subresource_Integrity)

On top of that, SRI would have allowed us to use standardized versions of libraries like jQuery and Angular from their home URLs, which would have reduced the initial load size of single page applications by megabytes via caching (because those libraries would have already been loaded long ago from other sites).

Which naturally would have led to content-addressable data, Merkle trees, etc which would have given us performance more in line with BitTorrent (at least for commonly used files/scripts).

On top of that, I'm not completely convinced that CORS avoids IP address spoofing, DNS poisoning etc. It probably needs to piggyback on HTTPS to be sure, which is a common way to avoid that can of worms so I can't criticize it too badly for that.

I should add that SRI has one critical flaw in that it's still vulnerable to user-posted content (like comments) trying to embed a <script> tag containing a fake hash in the body. I haven't been deep enough in SRI to know if it's possible to specify hashes off page, maybe someone knows? Otherwise we may still need something like CORS, or better yet, something that blocks further includes altogether rather than conflating the issue with focusing on where they came from.

</comment><comment><USER15> We really need Authorization added to simple headers. Needing to preflight every single SPA request either causes a huge performance hit or else forces super hacky workarounds that introduce their own security issues. Not good for the web.

</comment><comment><USER16> I feel like that part at the end is very misleading. GET and POST with simple headers are still subject to CORS. The distinction between a form submit and an ajax request is that you are reading the response from javascript. Same origin policy only kicks in when you attempt to read a response from JavaScript. It's why Fetch API has a 'no-cors' mode where you can make cross- origin requests willy nilly so long as you don't attempt to read the response values. The idea is prevent "secret" background requests being sent by malicious sites. Form submits are handled by the browser and will incur a page refresh.

</comment><comment><USER17> So if I manually pull up an about:blank page and start screwing around in the devTools console, what are my options for pulling in junk from, say, Wikipedia?

Is it only jsonp?

<comment><USER18> You could disable cors for your browser.

</comment></comment><comment><USER19> If you set CORS, you'll see option request on every request. You can set a cache expiration header on option request to prevent it on each request and potential denial of service or slow frontend. It's shocking how few developers know this.

</comment><comment><USER20> What I find perplexing is that for this and every other web technology, there doesn't seem to be a central comprehensive resource that explains it all in great detail.

It's like we have to pick things up as we go along, from tidbits and articles here and there, not of it complete or comprehensive, and often there'll be little mistakes or misleading bits.

<comment><USER21> I think MDN is doing a great job of becoming the go-to resource for everything: [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)

<comment><USER20> It's the best surely, and that article is decent, but there are so many areas wherein information is lacking or incomplete. One-line examples for entire modules or lack of explanation for specific parameters etc..

It's amazing that Google and Apple rely so much on browser use but they can't publish comprehensive information on them.</comment></comment></comment>


Peer Pressure (misperception) boosts college drunkenness - <AUTHOR> http://www.sciencedaily.com/releases/2009/07/090709205421.htm

<comment><USER2> There's a lesson for startups: Marketing need only give people _a feeling_ that you're "the thing" to give your sales/visits a boost and/or staying power.</comment>


The Simplest Technique for Sticking to Your Habits - <AUTHOR> https://medium.com/be-unique/how-i-learned-to-stop-worrying-and-love-the-habit-tracking-a1ab8594cced <comment><USER2> Here is a pad of paper with 31 numbered lines and 9 columns which makes it easy to track habits on a monthly basis:

[https://smile.amazon.com/gp/product/B006OI27QC/ref=ppx_yo_dt...](https://smile.amazon.com/gp/product/B006OI27QC/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1)

</comment><comment><AUTHOR> We all set goals for ourselves but seldomly are able to keep those. Habit tracker can go a long way to help you in accomplishing those goals.</comment>