Defending A16Z - <AUTHOR> http://blog.garrytan.com/defending-a16z-noam-sheiber-mistakes-a-vc-portfolio-for-his-401k <comment><USER2> A16Z isn't doing $500k checks in the next Facebook. They're waiting for the "15 important companies" to emerge every year and trying to snatch them up on the basis of their superior brand and checkbook. Exactly what the old guard of VCs used to do.

They used to claim their partners were all successful founders. They gave that up a long time ago. Now they hire pedigreed market analysts to be partners. Their primary job seems to be to judge startups and tweet wisdom about them, even though they've never done it themselves.

They passed on investing in Oculus because they thought Microsoft would crush them. Probably because they underestimated the creator of Oculus, Palmer Luckey, because he didn't go to any of the fancy schools.

Then, later, when they realized what millions of Carmack fans had already realized (Carmack was involved long before any investor) they bought their way in to a later round and flipped the company to their friends at Facebook for a cool $2 billion.

And of course, when it came to funding RapGenius.com, they had tens of millions to spare. They weren't worried Microsoft would beat them at the lyrics SEO game.

The ultimate test of a Silicon Valley investor is whether they help bring about great new stuff that would otherwise not exist. Most VCs do not pass this test with a very high grade.

<comment><USER3> Actually, the ultimate test of a Silicon Valley investor is their return on capital. Your test is _projecting your desire_ onto investors.

<comment><USER2> I was obviously not making a claim about how LPs judge VCs, just stating my own opinion about how I think VCs should be judged.

Try to imagine every sentence in a comment is prefixed with "I think..." to test if you're just being snarky or not. In this case, you're just being snarky.

(And like most snarky comments, it's not even correct. There is in fact no official test for VCs. Some LPs are socially motivated and would rather lose money than invest in evil companies. Your test is not the one they use.)

<comment><USER3> The bulk of your comment is an highly speculative attack on A16Z. Chris Dixon publicly stated they passed on investing initially because of technical obstacles.[1] Their investment in RapGenius was in part because Marc Andreessen tried to build it himself as part of Netscape.[2]

A VCs job is to make an ROI for the LPs. "Socially motivated" is just window dressing to attract capital that might otherwise go to a different fund.[3] The significant LPs are primarily restricted by asset allocations. You are projecting your desires onto VC to hope that it is anything different.

[1] [http://www.wired.com/2013/12/oculus-vr- funding/](http://www.wired.com/2013/12/oculus-vr-funding/)

[2] [http://genius.com/1107425](http://genius.com/1107425)

[3] Pessimistic? Sure. Better to be honest about the underlying motivations and surprised by the outcomes than not.

</comment></comment></comment></comment><comment><USER4> | Noam doesn't make a data-based argument. He uses an anecdote.

And that argument is then countered with another anecdote. The only way to really win this argument is by releasing all the data. Not thinking that's likely to happen.

<comment><USER5> It's also a very strange anecdote since the NYT articles primary point is that A16Z are pushing up valuations so deals like the one Peter Thiel made are no longer possible.

Quoted in this blog post from the NYT article: "It's easier to triple or quadruple your money when you've invested $10 million in a $100 million company than when you've invested nearly $100 million in a $1 billion company [...]"

Peter Thiel invested $500,000 for 10.2% i.e. in a $5 million company.

Unless there's something I'm missing here?

<comment><USER6> The point is that A16Z is paying high prices (and you correctly note that everyone is). Tan's point is that there are still power laws at play, and that choosing one random investment to disprove portfolio theory is incongruent.

<comment><USER7> _" Tan's point is that there are still power laws at play, choosing one random investment to disprove portfolio theory is incongruent."_

Except that he made no such point and just countered the anecdote with his own anecdotes. The original NYT article comes across as a well-researched, sensible piece of writing compared to this lazy, ill thought out blogpost.

<comment><USER6> > Multi-billion dollar companies happen when non-obvious ideas and huge market > needs meet perfect execution. We've seen it before our eyes — Uber, Airbnb, > Dropbox, Stripe, Instacart — and when you have the potential for 100X to > 4000X returns, it's not about avoiding loss or minimizing downside. A proper > venture portfolio is not like your 401K. The only way startup investors > truly lose is if they miss the Uber.

</comment></comment></comment></comment></comment><comment><USER8> That's a silly comparison. Avatar was made by James Cameron, someone as established as it's possible to be in Hollywood. If Mark Zuckerberg or Larry Page or Jeff Bezos started a new company, then that company would be a good analogue because you aren't going to get the terms that you'd get out of a long-shot like Facebook. A better comparison would be something like Paranormal Activity (12,893x ROI) or the Blair Witch Project (11,111x ROI). Avatar is a good proxy for how much _revenue-generation_ Hollywood is capable of, not its profitability measured by ROI.

<comment><USER9> I was thinking the same thing, quora has a list of highest ROI films of all times. Most are low budget break away global success's.

[https://www.quora.com/Which-movies-have-the-highest- Return-o...](https://www.quora.com/Which-movies-have-the-highest-Return-on- Investment-ever)

</comment></comment><comment><USER10> I have great respect for Garry Tan. However, I find the key quote on "how profitable Hollywood can be at best" a bit strange, and want to correct his statement below based on specific data. Here's the quote "...11X return on capital. That's the highest grossing film ever made, and a good proxy for how profitable Hollywood can be at best." Since 3,800X return on capital for Peter Thiel's FB investment is an obvious outlier/best case scenario, let's compare apples to apples and take the best case for Hollywood-type investments: "Paranormal Activity With just $15,000, the visionaries behind this project created a movie that took in a worldwide gross of almost $197 million." That sounds like 13133X return to me, which is even greater than 3800X... See [http://www.businesspundit.com/10-most-profitable-low- budget-...](http://www.businesspundit.com/10-most-profitable-low-budget- movies-of-all-time/)

<comment><USER11> The real point here isn't really Hollywood vs SV but rather that VC portfolios can outperform on just one stellar investment despite the rest being losers bc the ROIs can get so high. So paying a premium to get into a contested round of a high growth startup is worth it if you think the company can be one of these outliers. For example: a "mere" 20x return on one of ten companies will more than pay for the other 9 companies that lost you money on.

<comment><USER5> I just don't see how that invalidates the anecdote. Because if you're investing "$100 million in a $1 billion company" you're probably aren't expecting a 20x return, not to mention a greater one. So that would suggest that there is something else going on, which is the greater point of the NYT article.

<comment><USER11> If you are investing at that late of stage you'll likely negotiate downside protection like liquidation preferences which significantly de risk the deal. In which case a 2-10x return is actually really good b/c you are not expecting to lose all your money in your individual investments. So in a late stage portfolio you would break even on a few and hopefully make returns on one or two.

<comment><USER5> Sure. I'm not saying it's a bad deal, just that it supports what the NYT article is saying and that the anecdote would therefor be relevant.

> Within Silicon Valley, Andreessen Horowitz is famous for bidding valuations > to heights that make rivals uncomfortable. To offset the dilution of > ownership that comes from such prices, Andreessen Horowitz [...] increases > the amount of money it invests. The firm often kicks in more than the > entrepreneur asks for, according to rival V.C.s who have been involved in > these deals. "They want to basically change the table stakes in a poker > game," said Greg Kidd, an angel investor in several companies Andreessen > later funded. "There are some other folks who can cut checks like that, but > there aren't that many."

> More than is the case with other firms, the fate of Andreessen Horowitz may > be closely tied to that of the overall tech market. If prices remain > buoyant, the eye-popping valuations of the firm's top-performing companies > will keep it profitable and losses will be containable. But if the market > turns, Andreessen Horowitz could have serious trouble.

> Worse, Andreessen Horowitz isn't just a beneficiary of behavior that's > driving up valuations. If a bubble is forming, it is ultimately because too > much money is chasing too few companies. But the firm's own aggressive > bidding may be partly responsible. "Because there is competition for deals, > when you have actors in the market showing no price discipline, it drives up > the cost for everyone," said one investor.

And by the way, for completeness, the company in question sold for $2.6 billion three months after the article and post was written.

</comment></comment></comment></comment></comment><comment><USER7> The OP starts off with: _" Noam doesn't make a data-based argument. He uses an anecdote"_

And then goes right on to the rest of the post with zero data and a couple of anecdotes to make his case.

</comment><comment><USER12> I suspect that due to the well known creative accounting in Hollywood, Avatar returned significantly more than 11x. Top line costs are inflated.

<comment><USER13> That's interesting, could you elaborate on "creative accounting"?

<comment><USER12> [https://en.m.wikipedia.org/wiki/Hollywood_accounting](https://en.m.wikipedia.org/wiki/Hollywood_accounting)

</comment></comment></comment><comment><USER14> The only fact I'd point to is that if A16Z were to raise a new fund, it would be wildly oversubscribed as with most other top VC firms. If I'm Andreesen, that's the only thing I'd point to.

</comment><comment><USER13> So the nytimes article goes like "maybe, just maybe if we are in a bubble then it is going to hurt. and here are some signs that it is indeed a bubble". And the response is like "don't worry there is no bubble because you know, facebook is huge and software is eating the world". Not very convincing if you ask me.

</comment><comment><USER15> I'm not sure why this even needs a rebuttal. If venture capital wasn't profitable, Sandhill Road wouldn't exist.

<comment><USER16> Because when you're A16Z and take a 3% management fee, regardless of profits, you don't need venture capital to be strictly speaking profitable.

You need your particular brand of venture capital to be perceived to be profitable. If you have $4.2 billion under management during a year, you took $126 million in non-performance based fees that year. A16Z could make a ton of risky investments, collect fees, and die out in 7 years (2009 + 7 = 2016)—it really doesn't matter to its partners. They banked their fees.

Mutual funds aren't necessarily more performant than buying index funds. Many forms of investment aren't. You're not appreciating how a smart manager can use time and a fee structure to enrich himself handsomely without actually delivering results for investors.

Venture capital wouldn't exist if it wasn't profitable, sure, but Sandhill Road? That's an artifact of how venture capital is done and taken advantage of by real human beings, not of how profitable it is.

<comment><USER6> But A16Z isn't doing that.

The people who started A16Z have had multiple billion dollar exits, and are investing their management fee in services for their founders. They only make money from carry (if the fund is successful).

</comment></comment></comment><comment><USER17> > Multi-billion dollar companies happen when non-obvious ideas and huge market > needs meet perfect execution. We've seen it before our eyes — Uber, Airbnb, > Dropbox, Stripe, Instacart...

It's kind of funny to see some of these companies uses as examples of "perfect execution." Two of Dropbox's latest late-stage investors have already reportedly written down their investments by ~20%[1], and Uber and Instacart are facing class action lawsuits that, in worst-case outcomes that are not entirely improbable, could upend their business models.

> ...it's not about avoiding loss or minimizing downside.

This is silly. Good fund managers are _always_ concerned about downside. That doesn't mean they don't take on risk, but they try to understand and mitigate risk as approprite for the kind of fund they're managing. In the world of VC, there's a reason liquidation preferences, ratchets, etc. exist.

Just because FOMO in this market has made it difficult for VCs to get terms they'd normally like doesn't mean they aren't exposed to downside risk. As Warren Buffett once said, "Only when the tide goes out do you discover who's been swimming naked." When the cycle turns, we'll learn which VCs didn't have their speedos on.

[1] [https://www.theinformation.com/mutual-funds-mark-down- dropbo...](https://www.theinformation.com/mutual-funds-mark-down-dropbox- holdings)</comment>


Childhood Obesity Is Rising 'Shockingly Fast' Even in Poor Countries - <AUTHOR> https://www.npr.org/sections/goatsandsoda/2019/10/17/770905500/childhood-obesity-is-rising-shockingly-fast-even-in-poor-countries <comment><USER2> My daughter is in 3rd grade (in Greece) and she is the only kid in her class getting packaged food everyday with her without any money in her pocket. All the other kids have money, which use regularly to buy potato chips, beverages, sweets, etc from the school's shop.

Also, from what I hear from other parents, other kids regularly eat out, with the Greek souvlaki being the main food they get (which comes with fried potatos and pita), burgers and pizza.

Parents don't want to face their kids when the kids whine all the time, and in order to shut them up, they buy whatever the kids want.

The above, coupled with lack of physical activity due to various reasons, creates the obesity epidemic for kids, at least in my country.

<comment><USER3> Same thing in Cyprus here. My daughter is in 3rd grade and nearly all Cypriot kids in the class are fat. While Cypriot ones are of course, a minority these days in Cyprus schools.

<comment><USER4> > While Cypriot ones are of course, a minority these days in Cyprus schools.

I don't follow.

<comment><USER3> Most seem to be Russians, Chinese and the like? Even Cypriots kids themselves are whole lot whiter-skinned now, due to a lot of British, then Russian and other Eastern European wives brought in over last couple generations.

</comment></comment></comment></comment><comment><USER5> I wonder if it has something to do with body-positivism? Why would anyone get himself in shape, if he/she is beautiful no matter what they say?

<comment><USER6> I think it has to do with how food quality keeps hitting new lows. We really don't need sheep hair and 5 types of artificial sugars in our foods. We don't need everything bulked up with hydrolyzed soy bean. We really don't need purple plastic gel "berries" in our breakfast. Etc. Surely we can find a way to get foods from the farms to our tables fast enough that they don't have to be picked before they develop full nutritional profiles.

Most of all, that is to say we really don't need 80% of our diets to be empty calories and sugars.

Of course, there is the problem of sedentary living. I can't believe how lazy kids are these days - they don't even go for aimless bike rides anymore, because chatting online and playing 5-hour video game marathons is way more fun than real life apparently. But I'll leave that for someone else to cover.

Let's just say our culture is feeding it, and it takes willful blindness to be at all surprised.

<comment><USER7> > _" sheep hair"_

That's a new one to me, which foods have wool in them?

<comment><USER6> Look for the word lanolin in your ingredient lists. It's basically boiled down sheep hair. It's a source of vitamin D, but mainly it's used to make things really crispy (when fried) or shiny and slippery (when straight up).

You get vitamin D from a whole lot of other things you eat (it's not rare), and it takes some laboratory wizardry to derive the vitamin D3 from it (versus simply eating normal food to get it...) so nobody is adding lanolin to your food for it's wholesome goodness. It's literally only there for the texture. That's why its in your shampoo, chewing gum, leather polish and french fries, amongst a whole lot of other foods you eat.

<comment><USER7> Seems a tad misleading to call that hair; lanolin isn't keratin.

<comment><USER8> Yeah and lanolin would have been of use for cooking for millennia even if it wasn't appetizing just from sheer calories and survival. That fits the pattern of PETA style vegan fanatic "too important for the truth" propaganda. Like claims that sheep are skinned for their wool.

<comment><USER9> Can you link a source for "Like claims that sheep are skinned for their wool."?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I blame processed foods and all the additional additives and ingredients. Foods have dozens of ingredients now. Simpler foods are better for people. Count ingredients AND calories. Plastic packaging, nonstick chemicals, and antibiotics are also to blame. Plastic and nonstick chemicals change your hormones. Antibiotics kill gut bacteria and make your digestive system absorb more energy. But of course, all of these things are making the few rich at the expense and health of the many. I think sugar and sedentary lifestyles also contribute, but to a lesser extent, and are jut easy scapegoats.

There was an article by The Atlantic that covered this a few years ago. I linked it in a previous comment somewhere, but can't find it at the moment. Basically, there was a study that controlled for exercise and calories intake and showed even adjusting for that, people weigh 10% more than in the 1980s and 20% more than the 1950s. So exercise and calories aren't the entire cause.</comment>


Modern Linux service isolation - <AUTHOR> https://defenceforstartups.com/posts/modern-linux-service-isolation.html <comment><USER2> I'm confused why the author doesn't mention cgroups, but did mention rlimits. rlimits have a whole host of issues that are not really solvable without going straight to cgroups. cgroups also have much more knobs than rlimits.

The quite odd thing is that they explicitly mention RLIMIT_NPROC, but not the pids cgroup (which has effectively the same systemd interface). I'm quite biased of course (my first kernel contribution was the pids cgroup implementation).

<comment><AUTHOR> You're right. Cgroups could be added, but I didn't do it on purpose. One reason is that they're a pretty big topic and would deserve a post on their own. Another is that as far as security is concerned, I don't think they provide more restrictions than rlimits. (they do make process management easier though!)

For sharing compute resources - they're great. But apart from resource consumption, do you think they make any specific attack vector impossible, or harder? I couldn't come up with a specific example, but happy to learn otherwise!

<comment><USER2> > I don't think they provide more restrictions than rlimits.

They provide knobs which actually reflect backing resources rather than limiting something arbitrary like the number of open files. Not to mention that you can limit the amount of kernel memory used by a process (not possible with rlimits).

Also, rlimits have interesting interactions once a process starts changing its user ID or session ID. cgroups are actually linked directly to the set of processes in the cgroup, and it's completely transparent what's going on. rlimits are not transparent and have odd semantics that aren't described in the man page.

Not to mention that rlimits use _signals_ for communicating when you've started to hit some of the limits. This is not a good idea (Unix signals are just bad in so many ways it's not funny). So you can't be sure that your process will ever figure out that its hitting a limit.

> do you think they make any specific attack vector impossible, or harder

Kernel memory exhaustion is harder because you can be sure that your limits are actually limiting the backing resource you're trying to protect. The rlimits for open files and similar things are just not useful for things like that.

Also, there are things like the blkio cgroup which don't have an rlimit analogue. And then there's the fact that RLIMIT_CPU is completely useless (you shouldn't care about how much _real time_ a process runs for, you should be limiting what fraction of the total cpu power it can take up from the system).

In general, POSIX rlimits are just underpowered as a resource control mechanism IMO. Especially since many are more historical artifacts than anything else.

<comment><AUTHOR> Thanks. The kernel memory limit is interesting. I'll have to read some more details there.

</comment></comment></comment></comment><comment><USER3> Was expecting generic, run-of-the-mill "just containerize using Docker/LXC", found a refreshing perspective on dealing with services without explicit containerization. Awesome post and thank you!</comment>


Recover Deleted Files Using the Free Open Source Tool PhotoRec - <AUTHOR> https://ubuverse.com/recover-deleted-files-using-the-free-open-source-tool-photorec/ <comment><USER2> It's hard to find in the article anything more than what already is on Photorec homesite since a number of years, the "Photorec step by step" page:

[http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step](http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step)

is actually more comprehensive.

<comment><AUTHOR> Yeah, you're right. Their guide even has screenshots for each step, which I hadn't noticed before. Anyway, the purpose of the article was to increase awareness of those amazing tools. I find it surprising that many people are not aware they can recover their data without paying for a commercial application.

<comment><USER2> Well, then Photorec (which is in itself an excellent tool) is not the _only_ one, personally I am particularly fond of a lesser known tool, DMDE, JFYI:

[http://dmde.com/](http://dmde.com/)

which is provided - besides the licensed/commercial version - also in a free version with only minor limitations (and it exists for DOS, Linux and Windows).

Maybe the object of a next article?

<comment><AUTHOR> TestDisk/Photorec is not just free, it is open source as well, and is available in most Linux distributions' repos. It may not be right for everyone, but it is my tool of choice.

<comment><USER2> Sure, but then the point is not about the "many people are not aware they can recover their data without paying for a commercial application".

Rest assured, and specifically I have used (besides Testdisk) both Photorec and DMDE extensively, that no tool is "perfect" and each tool may have some particular function that works where another tool doesn't, so when the game is "data recovery" the first rule is "throw (at the device) _anything_ you can", beginning with one's tool of choice obviously, but without setting aside any other one.

</comment></comment></comment></comment></comment><comment><USER3> Yes, have used both - TestDisk and PhotoRec (CentOS) extensively and both work like a charm.</comment>


Show HN: Comprehensive Search Engine for Marketing Designs - <AUTHOR> http://www.crayon.co

<comment><USER2> Nice. Im designing and redesigning pages often. So this comes in handy. Where does the data come from? What is the business model?

One thing: The way you intercept clicks is very annoying.

Clicks on the images don't work at all for me. Because I open everything with a middle-mouse-click in a new tab. And you intercept that and open an in- browser popup instead which I hate.

So I work around that by clicking on the url. You intercept that too and show a "redirecting you to..." popup. Very annoying. When I browse examples of design, I want to go fast. Not be interrupted all the time.

<comment><AUTHOR> Thanks for the feedback.

The data comes from a lot of web crawling and parsing. There are some gaps in our data, and we have a project scheduled in which we will focus on getting our structured data really, really clean.

Wrt clicking on the screenshot or the source URL... I agree that it would be frustrating given your process of opening things in a new tab. Let me provide a little context and also ask a few question.

Context: When you click through on a link, the page you are taken too may not resemble the screenshot. The screenshot was taken on a particular date with a particular user-agent and accept-language. So, if you are on a PC and click through on a mobile screenshot, the page will almost certainly look different. The popup is intended to inform folks of this. (True, we could show the warning only once.)

Questions: 1) What are looking for when you open the underlying site? There are certainly good reasons for going to the site. For example, you may want to see the dynamic aspects of the page that we cannot capture with a simple screenshot. I just want to understand if there is a way for us to delivery directly some of what you are looking for.

2) Would this process work for you? - We already have the concept of Collections -- a "directory" in which you can save a group of screenshots. What if we had a "quick save" button that would save the screenshot to some default folder without the overhead of the popup that asks you where you want to put the image. Then you could quickly save off 100 or so images that you found interesting. Next, you could make a second pass and go through the the images you saved, clicking through to the sites etc.? What if you could export the URLs from a Collection?

Thanks!

John</comment></comment>


How fast can you type? Free online touch typing speed test - <AUTHOR> http://www.typeonline.co.uk/typingspeed.php <comment><USER2> 104wpm and then 96wpm

This is considerably higher than I usually score (which is why I took it twice), especially considering I was on a laptop keyboard. This leads me to question the accuracy of this test.

</comment><comment><USER3> 95 wpm with no mistakes. This is 20-30 wpm lower than I usually score, probably because I found the text stilted and difficult to type. I'm also a bit faster when I can use vim's ctrl-w (erase most-recently-typed word) to correct mistakes rather using only the delete key.

<comment><USER4> I use ctrl+backspace to delete last word in any/most editors.

<comment><USER3> Thanks for the tip, but it doesn't seem to work in OS X's TextEdit application or in Chrome textareas.

</comment></comment></comment><comment><USER5> I find myself "allowing" typos for spellcheck lowering my WPM considerably from several years ago when I had to remember and not "offload" to spellcheck "easy" errors of words. 45 WPM (ugggg) vs 90%+ several years ago. Spell check is the bane of some quality writing :)

</comment><comment><USER6> 100wpm with 1 mistake.

Edit: Could feel the stress in my hands towards the end, could not keep that rate up for long.

</comment><comment><USER7> 69 wpm with this typing test. Though i didn't like this, because it does not start and stop the clock itself.

</comment><comment><USER8> 80wpm with 1 mistake and 82wpm with 0 mistakes, which is about right.

</comment><comment><AUTHOR> I got 50wpm, but I can type much faster if I'm writing things from my own head, rather than copying stuff someone else has provided.

</comment><comment><USER9> I personally like TypeRacer. You get to practice your typing and you get to race against other people. Plus, there's no need to start and stop the clock. That might add a couple WPM to fast typists.</comment>


Popehat Signal: Urologist Threatens Forum - <AUTHOR> https://popehat.com/2016/02/17/popehat-signal-urologist-threatens-penis-enhancement-forum/ <comment><AUTHOR> "Mr. Benjamin sent a legal threat to both thundersplace.org and, incredibly, Cloudflare."</comment>


Google Cloud Platform adds two new regions, 10 more to come - <AUTHOR> https://cloudplatform.googleblog.com/2016/03/announcing-two-new-Cloud-Platform-Regions-and-10-more-to-come_22.html <comment><USER2> We've been waiting for this confirmation for a long time! Excellent timing with GC Next happening in San Francisco from tomorrow ;-)</comment>


The Arrogant VC: Why VCs are disliked by entrepreneurs - <AUTHOR> http://venturehacks.com/articles/arrogant-vc?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+nivi+%28Nivi%29&utm_content=Google+Reader <comment><USER2> Or you could just poke around TheFunded.com for a couple minutes to get the same gist with names named.

<comment><USER3> His fund gets 2.8/5.0. Partners themselves get 4.0/5.0.

<http://www.thefunded.com/funds/partner/3803?name=Fred+Destin>

Also, Destin really needs a new headshot. The one he has up is a pretentious sneer -- kind of the look of surprise one might have when one's "lessers" accost you. Stands out and not in a positive way.

</comment></comment><comment><USER4> Being outside the valley (and being outside of much of anything, really) my startup experience hasn't had that many VCs. But any time I deal with money people it always seems to seem like a heroic waste of time. Sometimes, as the article points out, it's almost comical.

For instance, I was interested in some grant money the state had available to high-tech startups who were pre-launch. Hey -- states need businesses to grow, and micro-investments at the pre-prototype stage looks like it makes a lot of sense. Their website bragged about the mission they had to encourage innovation, especially in the web and communication sectors (which I'm in)

So I get a referral from a couple of folks who know them (referral: check). I was introduced via email (personal introduction: check) Then they had me complete a form that took 3 hours which asked ridiculous questions like income projections for three years out. Finally I get a phone interview.

The interview lasted ten minutes, in which time I learned that a) the interviewer hadn't bothered to read my application before now, b) they were really interested in post-launch businesses with a growth record, c) really what they wanted to do was bigger-money investments, d) the interviewer had no experience in how to monetize the type of business I was in and didn't seem to want to hear anything I had to say about it, and e) no, the answer isn't no, just let's talk again in a month or so.

I mean come on. Let's get real. Until you respect my time as much as your own we're not going to get very far, whether you choose to invest or not.

From all I can see, something is deeply wrong in the way most all of these relationships are being created. I can see and understand that most companies fail and that most interviews are a waste of time from the interviewers standpoint, but that's the name of the game, folks. You don't let customer service slump and lose screening quality simply because you're playing a numbers game. That's idiotic.

</comment><comment><USER5> Sounds sort of like any business deal where you have to sell yourself as part of the transaction. Coming in with a better attitude might help, Think of the process as a non contact boxing match instead of a show and tell.

</comment><comment><USER6> I've seen many of these behaviors again and again.

Wish there were more details on the "long term implications" of terms as signed.</comment>


Security tests pre-launch are pointless. Developers are taking over AppSec - <AUTHOR> https://whitessource.com/Dev-Security-Report- <comment><USER2> The "security tests pre-launch are pointless" part of your title doesn't seem to appear in the article, which also seems to simply be an ad fishing for work emails that you also submitted 19 days ago.</comment>


Scoble's New Thing: Building 43 - <AUTHOR> http://www.techcrunch.com/2009/03/14/scobles-new-thing-building-43/ <comment><USER2> I have a question maybe someone here can answer for me. It's going to sound snarky but I don't mean it to be.

What is Scoble's biggest industry success so far? Not career success; I mean, what's the thing he's best known for accomplishing?

<comment><USER3> He had something to do with Dave Winer's Userland Software - that developed early blogging software (Radio). Probably his biggest success, though, is his blog.

<comment><USER4> He fits into a similar niche of inane punditry as Winer, except s/software/marketing/g and s/entrepreneur/leech/g.

People seem to find his enthusiasm endearing, unlike Winer (who has profound mental health problems).

<comment><USER2> What are Winer's profound mental health problems?

<comment><USER3> Wealth.

</comment></comment></comment></comment></comment><comment><USER5> I'm just as curious about Scoble's new relationship with Rackspace as I am about his new project.

<comment><USER6> You forgot something. Here, let me lend you mine:

<heavy_sarcasm_dripping_with_cynicism>

</heavy_sarcasm_dripping_with_cynicism>

</comment></comment><comment><USER7> This is bizarre. He's naming it after... another company's building?

I didn't understand it until the article explained it. And I really ought to have gotten it.

Definitely trying to hard.</comment>


Open source wired alarm system retrofit works with SmartThings and Home Assistant - <AUTHOR> https://www.kickstarter.com/projects/nateclark/konnected-alarm-panel-revive-your-wired-alarm-syst?ref=81o2lj&utm_source=hackernews&utm_medium=post&utm_campaign=nc-hn <comment><USER2> This project passed it's goal of $25k in two hours.

<comment><AUTHOR> we had lot of great support from our 600+ user community</comment></comment>


Billionaire Gives Away His Fortune to Help Save the Ocean - <AUTHOR> http://www.ecowatch.com/rokke-rev-ocean-plastic-2411450525.html <comment><USER2> The idea of the ultra-rich taking matters into their own hands is an interesting one. It seems like the world's governments are unable to reach a consensus about what to do about these issues. As a side note, has anyone ever compiled a list of all the crazy (but potentially feasible) actions individuals could take to combat climate change and pollution etc but that are far too expensive to attempt?</comment>


Mars Lander Succumbs to Winter - <AUTHOR> http://www.nytimes.com/2008/11/11/science/space/11mars.html?_r=1&hp&oref=slogin

<comment><USER2> It makes me feel happily small inside to think that we can successfully send an 800lb machine tens of millions of miles to Mars and have it dig stuff, and send back pictures.

I have no real basis for understanding the complexity involved, and I tend to take this stuff for granted, but whenever I do stop and think about it, it's pretty amazing.

Of course, they started all this space stuff before I was born (1986?). That's extra-crazy, since to my mind, 1986 technology sucked.</comment>


J-Bob – The proof assistant from "The Little Prover" - <AUTHOR> https://github.com/the-little-prover/j-bob <comment><USER2> I have the book but haven't opened it yet. Can someone who has comment on whether the proof assistant is tightly integrated with Scheme or whether it might be possible to implement it in another language such as Clojure ?

<comment><USER3> It's very small so you can do it easily in clojure, [https://github.com/the- little-prover/j-bob/blob/master/schem...](https://github.com/the-little- prover/j-bob/blob/master/scheme/j-bob-lang.scm) defines the language used and [https://github.com/the-little- prover/j-bob/blob/master/schem...](https://github.com/the-little- prover/j-bob/blob/master/scheme/j-bob.scm) is the proof assistant. There's absolutely nothing fancy there.

<comment><USER4> " _We include the necessary code to run J-Bob in ACL2 and Scheme, as well as a transcript of the proofs in the book. J-Bob is also included in the Dracula package for Racket._ "

Isn't ACL2 Common Lisp based? If it runs on Scheme/Racket and CL (or at least ACL2), it should be pretty easy to translate.

(ACL2? It's theorem provers all the way down!)</comment></comment></comment>


The Unfortunate Battery Tetrahedron (2015) - <AUTHOR> https://medium.com/the-unfortunate-tetrahedron/the-unfortunate-tetrahedron-ce1e44d0b961 <comment><USER2> Liquid electrode batteries transcend the "unfortunate tetrahedron" paradigm in many ways. By isolating the reactants from the reactor, "unlimited" storage and near-instant "recharging" (exchange of discharged for charged electrode solution) are possible.

This seems to be the most promising paradigm for achieving the needed energy / power density without making a more than mediocre bomb in the process.... Unfortunately, the process is best suited to larger installations due to the inherent complexity, and scales poorly to portable applications.... So still tradeoffs, of course.</comment>


Senator Asks US Agencies to Remove Flash from Government Websites - <AUTHOR> https://www.bleepingcomputer.com/news/government/senator-asks-us-agencies-to-remove-flash-from-government-websites/ <comment><USER2> While the end-of-life, security issues angle is a perfectly valid one I'm surprised this isn't about accessibility. I would imagine government websites should provide information in an accessible way which Flash definitely isn't. The recent HN post about the UK government moving from PDF to HTML[0] springs to mind as an example of a move in the right direction but given that it took a lawsuit to make laws publicly and freely accessible I think that isn't a goal in US government somehow.

[0] [https://news.ycombinator.com/item?id=17541045](https://news.ycombinator.com/item?id=17541045)

<comment><USER3> Two notes, though I doubt anyone working on government pages will actually read them:

1) PDF -> HTML improves accessibility. HTML -> content rendered by JS via an SPA framework is _worse than PDF_ , and approaches Flash. Please don't do that.

2) Think of the robots :). One of the problem of government data is that while you can usually find the scanned PDF or an XLS file with the data you're looking for, it's completely useless for automated processing. Making public data easier for machines to read enables citizens to build interesting tools on top of them.

<comment><USER4> I'd usually be right beside anyone wanting to begin JavaScript bashing but it feels like you are conflating two issues.

Whilst the (for lack of a better term) JavaScript / SPA ecosystem encourages (especially to novices) people to do things in the Wrong Way, I wouldn't say that an SPA is inherently less accessible, and I definitely wouldn't say that it's less accessible than a PDF.

I—like I'm sure the rest of HN—have experienced many a terrible SPA, but from my JavaScript dabbling it's becoming more and more apparent that it's due to bad developers more than anything else.

<comment><USER3> > _I 'd usually be right beside anyone wanting to begin JavaScript bashing but > it feels like you are conflating two issues._

I'm not really bashing JavaScript per se, I'm bashing modern web development ecosystem.

Sure, you _can_ use JS and modern SPA frameworks to build lean, accessible, progressively-enhanced pages. But that's _not the default_. That is not what tutorials will encourage you to do. That is not what those tools were designed to facilitate. And your typical developer will absolutely follow trends and "industry standard" in the technologies they use.

It's kind of like with bashing PowerPoint. To be completely honest, PowerPoint is a very powerful tool that can help you deliver amazing presentations _if you know how to use it_ for that goal. Most people don't, and the _defaults_ of PowerPoint encourage bad style - hence people bash the tool.

</comment></comment></comment></comment><comment><USER5> The adblocker suggestion is particularly interesting and I don't think is getting enough press. I would bet that a lot of smaller federal agencies wouldn't be as timely with IT updates as they should be. As it happens one of those malicious payloads could indeed be a Flash applet, so the overall push away from Flash should help, but there are many other ways in. Unfortunately I think it's local agencies that would need this extra layer of defense most, having seen how neighbouring municipalities maintain their systems (or don't).

<comment><USER6> And really the blocker could be (and probably already is) implemented at the DNS level with something similar to PiHole's blacklist. I'm sure big switch/network gear manufacturers have something similar to block ad/tracking traffic.

</comment></comment><comment><USER7> How did I know before clicking that the Senator would be Ron Wyden?

<comment><USER8> Because it's always Ron Wyden.

<comment><USER9> 50/50 Wyden or Warner

</comment></comment></comment><comment><USER10> While they're at it, they should request that all government websites with news feeds provide it in RSS format. A lot of agencies do this, I have a list of almost 100 US government feeds - but it's unfortunately absent from some agencies.

They really shouldn't make people to go to twitter or facebook to follow their press releases...

</comment><comment><USER11> Ron Wyden again. He's making a habit of this. Anyone know who Wyden's tech- focused staffer is?

<comment><USER12> I'm not sure if he has others, but Christopher Soghoian is a prominent one: [https://en.wikipedia.org/wiki/Christopher_Soghoian](https://en.wikipedia.org/wiki/Christopher_Soghoian)

<comment><USER11> Thanks!

</comment></comment></comment><comment><USER13> I'm a bit shocked someone needs to ask for this in 2018. All those Flash things must have been empty rectangles for the last decade or so.

<comment><USER14> It's the difference between building a product to spec and building a product so it's usable by the actual demographic that needs to use it. US Digital Service talked about finding these Flash barriers and building quick webform replacements making a HUGE improvement in usability (like from ~5% completion to 90%+ completion IIRC).

I wouldn't be surprised if those same government departments are stuck on WinXP SP2 with IE6-8 with Flash enabled. IT at huge orgs moves extremely slowly.

<comment><USER13> > those same government departments are stuck on WinXP SP2 with IE6-8 with > Flash enabled

I'm not sure how their sysadmins can sleep at night with this ;-)

</comment></comment></comment><comment><USER15> I knew this must be Wyden. I'm a fan, he seems like one of the only members of Congress with a strong understanding of technology.

<comment><USER16> I was amazed that there is actually a Senator who actually understands technology...

</comment></comment><comment><USER17> As an outside observer of the US, Ron Wyden seems to be one of the few that tries to stay informed and isn't totally self-interested.

He seems like someone I would vote for.

</comment><comment><USER18> Flash and ie6 need to be completely left unsupported. I'd go so far as Adobe and Microsoft should put a Killswitch that removes them or simply makes them unusable.

</comment><comment><USER19> can we remove captcha while we're at it? its the same sort of lazy bs flash is -- yes, it does serve a purpose, but at the expense of your users

<comment><USER14> > yes, it does serve a purpose, but at the expense of your users

That has _always_ been the tradeoff of captcha.

The other side of the equation is how relevant/useful is the data submitted? So long as the captcha isn't unreasonably difficult for a human, I would rather my government not spend resources to follow through with every single spammy form submission.

<comment><USER19> ideally you'd implement something that inconveniences machines (ie spam bots, aka the sole reason captcha needs to exist) but doesnt inconvenience humans

in particular, the v2.0 of captcha implements this time delay.. where you click a picture that matches a description but the images do not appear instantly. its like, wait a random amount of time before you can continue.. you cant even login to our service until you wait a random amount of time.. its insane, piss off, you know, these captchas can actually be broken easily, its just not common yet...

</comment></comment></comment><comment><USER20> The article conspicuously doesn't mention his party.

<comment><USER21> Does his party matter? For reasons other than knowing if he's on my team or not?

<comment><USER20> It's _precisely_ the case where you're _not_ committed to a "team" forever and ever that knowing which party a representative belongs to would be an informative data point. Whether they are doing something notably sensible or dumb.

<comment><USER22> >It's precisely the case where you're not committed to a "team" forever and ever that knowing which party a representative belongs to would be an informative data point. Whether they are doing something notably sensible or dumb.

Quite the opposite for me. Because I'm not committed to a team, I have little reason to care, and that piece of information is not at all informative for me. I vote for people, not parties.</comment></comment></comment></comment>


Fork on Xen is extremely slow (Redis documentation) - <AUTHOR> http://redis.io/topics/latency <comment><AUTHOR> Linux beefy VM on VMware:

        6.0GB RSS forked in 77 milliseconds
        (12.8 milliseconds per GB).

Linux running on physical machine (Unknown HW):

        6.1GB RSS forked in 80 milliseconds
        (13.1 milliseconds per GB)

Linux running on physical machine (Xeon @ 2.27Ghz):

        0.9GB RSS forked into 62 milliseconds
        (9 milliseconds per GB).

Linux VM on EC2 (Xen):

        6.1GB RSS forked in 1460 milliseconds
        (239.3 milliseconds per GB).

Linux VM on Linode (Xen):

        0.9GBRSS forked into 382 millisecodns
        (424 milliseconds per GB).</comment>


Launching StartUps Everyday - <AUTHOR> http://startupcrunch.org <comment><AUTHOR> This is an article some may find interesting about Charles Saatchi and his latest stunt</comment>


Ask HN: Game Project on Kickstarter to Raise Money - <AUTHOR>

Hi HN,
I quit my corporate job to start a game studio a couple months ago. I have been trying to bootstrap the company as much as possible without outside funding, while at the same time keeping an eye out for alternative funding sources. I discovered Kickstarter a few months back. After meeting with a few people who have successfully funded their projects on it and also people from Kickstarter, I decided to put my first game project on it. (http://www.kickstarter.com/projects/pepwuper/the-giant-of-the-river-thames-little-megans-giant). It's also on the Recommended page (http://www.kickstarter.com/projects/by/recommended).
So far it hasn't really been very active, and I am not sure how it will pan out. Does anyone have any experience with kickstarter or this type of fund raising? I'd love to hear what you think about this model, and what you think about my project on Kickstarter.
Finally, if you like the game (playable demo on the project page), please support the project! You can make a pledge (and get awesome rewards!), or forward it on to people you think might be interested. Thanks! (Project page: http://kck.st/cNnvZS) <comment><USER2> Couple things:

      Great project, but it's obviously dev'd for the mobile platform. Downloading the Unity project thing makes for too much friction already. I'm on a PC, in Linux, and I'm not going to do that, to do what is essentially a favor for you.

      I think a great potential here would be to include some sort of financial incentive to those people willing to invest up to $1,000 into the project.

Why not let them share profits?

Also, your gaming dev credits are awesome. Put those further up front. Make that much more bold. I see that people will get to work with you, explain more about how great an experience that would be. Either way, love what you're doing, more power to you for putting yourself out there. It's difficult, but worth it!

</comment><comment><AUTHOR> After 4 weeks of fund raising, I wasn't able to raise the full funding target amount. I've written a blog post on some of the things I learned from having my project on Kickstarter.com for those of you who might be interested in using it in the future.

3 Quick Lessons from My Failed Project on Kickstarter [http://www.plinan.com/3-quick-lessons-from-my-failed- project...](http://www.plinan.com/3-quick-lessons-from-my-failed-project-on- kickstarter-kickstarter-indiegames/)

</comment><comment><AUTHOR> Thanks for the comment! Sharing profits is a good idea, but it's not allowed on Kickstarter as it cannot be used for investment purposes due to the fact that they use Amazon payment platform.

Good point about the dev credit. I wasn't sure if people would care much about it, but it sounds like some would and I'll move the rewards up (or lower the cost).

Thanks again!</comment>


Ask YC: What does one do when one has explosive growth and no money? - <AUTHOR>

Let's go with a theoretical application, which is gaining thousands of users everyday, but is not producing income. The web server costs are mounting, the application can hardly handle the strain, what exactly does one do then?<p>One needs to throw more servers at the problem, but how would that be possible if the site is not producing income? <comment><USER2> Post on the site, explaining the situation, asking for donations. If the users are enthusiastic about it, as it sounds, the money will come.

</comment><comment><USER3> Get funding? This is the classic case for VC, assuming that you eventually plan to convert those users into revenue.

<comment><AUTHOR> Is that not too small for funding? And funding is a long process, is it not?

<comment><USER4> Angel investors, then.

</comment></comment></comment><comment><USER5> I applied to Y Combinator.</comment>


A Celebration of Steve Jobs' Life - <AUTHOR> http://events.apple.com.edgesuite.net/10oiuhfvojb23/event/index.html

<comment><USER2> I found this somewhat uncomfortable to watch. I like Apple products, Steve Jobs is interesting, and I was bummed to hear when he got sick and of course when he died. But I didn't know him, and he definitely didn't know me. I bought products that his company made, and that's it. I like the products a hell of a lot better than, say, than 10 gallons of gas I just bought from Shell, but still the relationship between me and the company CEO was pretty distant.

Back to the video... Many of the Apple people probably didn't know Steve either, but they sure knew more about him and the idea of an Apple family and Steve as the patriarch is pretty clear. I've been in corporate "families" before and there can be real emotion between colleagues with shared passion in a company. I think it's great that they had a celebration like they did, but I felt like I shouldn't be there, even through a web video. I felt somehow like an intruder, spying in on their private event, and that the heartfelt speeches from one Apple employee to the others should have just stayed in their family.

I'm not saying it was necessarily bad to post or was in poor taste. In fact many others may be heartened to watch it. I, to my own surprise, wasn't.

<comment><USER3> But that's just the thing. A lot of the stuff that many people have an _emotional_ connection with, those products were driven by Steve, so people feel a connection with Apple and Steve.

There's only a couple of inanimate objects I've really ever loved. One was my Peugeot 205Gti, and the other was my first Mac, a Aluminum Powerbook G4 12", though I think my iPhone 4 has a chance of getting on that list.

</comment></comment><comment><USER4> I can only dream of achieving so much such that when I die, I can have popular bands play at a memorial event for me. That aside, I strongly suggest everyone watch the segment where Ive spoke. It's quite touching.

</comment><comment><USER5> Dammit, Steve. You really had to make it so hard for non Apple users to watch it...

After some digging, I made Totem open [http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23...](http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23ohfoihqw/0640/prog_index.m3u8) but it doesn't preload the smaller sequences and forces a pause every 10 seconds...

edit:

      $ for i in $(seq 0 486) ; do curl http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23ohfoihqw/0640/fileSequence$i.ts >> celebrating_steve.mov ; done

may do the trick. Hope it works.

<comment><USER6> I believe VLC has support for HTTP Live Streaming since version 1.2 or so.

<comment><USER5> Still pauses to catch up with every piece.

On a sidenote, I am somewhat proud my curl hack produced a video file Totem can play (provided you don't try to skip parts of it) but that confuses VLC.

My previous experience with VLC is that if I stick a piece of wood into the USB slot, VLC will be able to play it flawlessly.

</comment></comment></comment><comment><USER7> On a Mac, you can have the QuickTime app open this URL:

[http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23...](http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23ohfoihqw/sl_mvp.m3u8?expectingMovieJson=%20false)

</comment><comment><USER8> Preference is given oddly to Snow Leopard and iOS devices.

From page source: / _snowLeopard url_ / var slURL = "[http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23...](http://qthttp.apple.com.edgesuite.net/11ajdjnvkjnd10weoihf23ohfoihqw/sl_mvp.m3u8);

/* non-snowLeopard url _/ var nonSlURL='[http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/checkba...](http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/checkback.jpg);

/_Windows url _/ var windowsURL = '[http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/checkba...](http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/checkback.jpg);

/_iphone url _/ var iphoneURL = "[http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/memoria...](http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/memorial_iphone_ref.mov);

/_ipad url*/ var ipadURL= "[http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/memoria...](http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/memorial_ipad_ref.mov);

<comment><USER9> Audio link which will also work on Linux - [http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/memoria...](http://stream.qtv.apple.com/events/oct/10oiuhfvojb23/memorial_audio_ref.mov)

</comment></comment><comment><USER10> "The old king is dead, long live the king"

interesting song choice by Coldplay.

</comment><comment><USER11> Damn those onions. Again.

</comment><comment><USER12> On YouTube:

<http://www.youtube.com/watch?v=nPUsuY8JZJI>

</comment><comment><USER13> When will the video be available?

<comment><USER14> Use Safari. The video doesn't seem to be loadable in any other browser. It WFM in Safari and iOS Safari. Other browsers say "Check back soon."

<comment><USER3> I just tried to play from Safari on my Mini. Check back later. Was working great on my iPhone 4.

The wife doesn't care anyway. Oh well.

Just a quick thank-you to Apple for covering the replacement motherboard for my 17" MacBook Pro, and kudos to the online folks who spent a good 20 minutes checking up on the Nvidia bug for me.

</comment></comment></comment><comment><USER15> I think it's time to stop the crocodile tears.

</comment><comment><USER16> Could we stop with the retarded cult of personality already? Seriously, celebrating the life of Steve Jobs? That's the most stupid thing since... I don't even know. This guy _sold computers_ , nothing more. It's beyond me why people revere him like some sort of computer Jesus. Sigh...

Edit: Aaand downvotes proving my point. Thanks.

<comment><USER17> By this logic you cannot admire anyone: because each and everyone was just the guy or girl who did [some mundane stuff there]. Newton? The guy just did some math. Armstrong? He was just stuffed into a tin and sent to walk some dust ball. Why some people refer him like some sort of computer Jesus? Because of the influence: the stuff coming from Apple influenced a lot of people, users and makers alike. Take a look at the phone market before and after iPhone, take a look at the tablet market before and after iPad, observer the influence of MacBook Air… Not to mention ITMS. Of course you can easily dismiss each and any of these for whatever reason and then indeed indeed there will be nothing do admire. But I guess that would say more about you, not the Jobs.

(I don't get how down voting proves your point).

<comment><USER18> But there is a huge difference in admiring someone and worshiping someone. Some seem to worship Jobs.</comment></comment></comment>


First US-wide Visa debit card you can load using Bitcoin - <AUTHOR> https://blog.bitpay.com/introducing-the-bitpay-visa-card/ <comment><USER2> Buying bitcoins just to load them into card and spend in regular shop. Makes no sense since you can cut out the middleman and spend them directly via Credit/Debit Card.

Also xapo was offering this long time ago and there is nothing disruptive in bitcoin loaded card (since visa is doing card balance accounting in USD and paying merchants in USD)</comment>


Abandoned S3 Bucket Allows Malicious Script to Run on 800 Sites - <AUTHOR> https://www.bleepingcomputer.com/news/security/abandoned-tweet-counter-hijacked-with-malicious-script/ <comment><AUTHOR> I changed the title from "Abandoned Tweet Counter Hijacked With Malicious Script" because the interesting thing to me was the attack vector being the recycling of the S3 bucket name. Of course the same thing could have happened with an abandoned domain name.</comment>


Show HN: Why we killed imwith and launched GIFted (Guggy YC S17) - <AUTHOR> Hey everyone,
6 months ago we launched imwith - a NLP-based GIF messenger. I'd like to share with you why we decided to discontinue imwith and launch GIFted.
imwith enabled you to chat and get automatic suggestions for relevant GIFs based on what you type. The experience for adding GIFs to your conversation was sleek, seamless and much much better than other messengers. The UI was unique as well. For example, there wasn't any 'send' button. You'd send the message by swiping it. It was extremely novel, but it didn't really take off (retention wise).
We tried a lot of things and nothing really worked. We had endless debates of whether we should optimize the product or start from scratch, it was pretty frustrating.
At some point we decided to follow a hunch we had for a while, and enabled users to direct and act GIFs for pre-defined tags (#smile, #grouphug etc.). We were excited about the idea that our NLP engine will offer users their own GIFs.
The results were great! Users recorded 50, 60 and even 90 GIFs in their first session and under 15 minutes, they loved that part. But unfortunately they didn't use the GIFs in the messenger. They actually didn't use the messenger at all.
We decided to discontinue our messenger and to launch GIFted, a GIF community in which people GIF themselves to express their take on specific situations, emotions and gestures. A month ago, we silently launched our early beta and so far thousands of teens across the US have created so many hilarious, creative GIFs…repeatedly, check the user @maxdd4l. He's going to become famous one day :)
GIFted users can browse GIFs, act their own GIFs and participate in a daily GIF challenge. Things look much better now (retention wise).
What do you think about GIFted? I'd be happy to get any feedback and answer questions about our journey.
https://itunes.apple.com/us/app/gifted-gif-yo-self/id1435132... <comment><USER2> Thanks for sharing your update. We tried imwith and enjoyed seeing your UI and other ideas in action. Best of luck with GIFted.</comment>


Range - <AUTHOR> http://patdryburgh.com/blog/range

<comment><USER2> just want to share a (kinda related) story:

three years ago i ran 0.5 kilometers - and i was absolutely exhausted, i could not take another step, i was completely devastated (sitting in an office chair for 14 years does such things to your body). three days ago i ran - i think - a little bit more than 22km (on a beach in peru, it was awesome). after that i played with my son and went partying that night.

ignorance is a bliss! i never thought about my range, my limitations, i just focused on running at least one step more with every run. (well this, and i invested in really, really good running shoes).

<comment><USER3> Curiosity: Which shoes?

<comment><USER2> supernova glide (but just like with emacs and vim, you have to find your own)

</comment></comment></comment><comment><USER4> Heard a beautiful quote related to that on NPR. They had a guitarist who was heavily inspired by Django Reinhard, but does his own thing now.

The way he put it: "At some point, I realized that I could either imitate Django and live in his shadow, or learn from him and live in his light". (Paraphrased)

</comment><comment><USER5> Forget Ben Gibbard's range, Adele's range is even higher. But then again no one ever complained about Dylan's monotone singing and C-G-F chord progression. Some say that it's a constraint that forces you to be creative, which forced him to focus on songwriting and live performance. Ditto for Chris Martin and Tom Petty whose melodic range is very limited and could produce haunting songs with the simplest chord palette.

I used to (actually still do) fixate how fast someone can play and how many techniques someone is using. But then I realized that I'll never be able to jump taller or run faster than some 18 year-old young buck in some inner-city pickup game - being outrunned and outgunned just made me frustrated. I had to work on cross-over dribble and step-back jumpers that relied on fakes instead of speed to score. More importantly, I had to work on being not being frustrated in-games on being blocked, dunked on, ball being stolen and missing shots; focusing on making the open shots that I have after missing the first five. Music is the same thing for me.

</comment><comment><USER6> The thing about software and engineering is that it isn't like singing--you aren't stuck in your range. You don't have to grow comfortable and complacent.

The wonderful thing about learning to program and engineer is that you can, on any day, pack up your bags and head to the new frontier and makes friends, and soon you'll be a part of that community too until it's time to move on.

It's liberating.

<comment><USER4> And yet, over time, a "range" develops. I've got 20+ years in low-level, C++, systems, desktop client work. Yes, I work on other areas. But if I want to really shine (or make nice amounts of money), this is my "range".

The same goes for music. Your range is not cast in stone, but it takes a lot of hard work to push it. This is not what you do on stage, or even in most of your practice. That's what you deliberately work on, without using it on stage for a long time.

</comment></comment><comment><USER7> björk and mike patton are clearly outliers</comment>


Avoiding shell injection in Ruby, Phython, and PHP (2008) - <AUTHOR> http://blog.littleimpact.de/2008/08/11/avoiding-shell-injection-in-ruby-python-and-php/ <comment><USER2> Python part is a bit out of date. Otherwise a good read.</comment>


Use Managed Services. Please - <AUTHOR> http://www.mooreds.com/wordpress/archives/3358 <comment><USER2> Managed services are great until they don't support something you need. For us this was postgres replication to non RDS, we tried bucardo however that didn't go well (this was a few years back, may be possible now)

</comment><comment><USER3> And if a service is not yet available as a managed service from at least couple providers - it's quite likely it's not mature enough for 99% of businesses to use. You're not Google, Facebook, etc.</comment>


Spherical Flying Machine Developed by Japan Ministry Of Defense #DigInfo - <AUTHOR> http://www.youtube.com/watch?v=pF0uLnMoQZA&feature=youtu.be

<comment><USER2> Wow, this is SO like the Half-Life scanners... Life imitating art??</comment>


Microsoft fails to notice the death of the PC, posts record revenue figures - <AUTHOR> http://arstechnica.com/business/2013/01/microsoft-fails-to-notice-the-death-of-the-pc-posts-record-revenue-figures-instead <comment><USER2> The death of the PC is overrated. Tablets aren't going to run your IDEs soon enough and don't even try to argue that you code on Macs. Not everyone wants to run their web services off the big cloud providers either and you need PC parts to run servers right now. Even Amazon and Google need PC motherboards. The last thing is everyone threw code optimization out of the window and the ARM or MIPS architecture though powerful don't go well with the bloat that permeates the IT industries today.</comment>


'We're watching a company explode': is Snapchat becoming irrelevant? - <AUTHOR> https://www.theguardian.com/technology/2018/feb/23/snapchat-redesign-scandal-kylie-jenner-what-went-wrong <comment><USER2> Snap chat was a gimmick: A message/photo/video lasts for a short time and then goes away. That started to loose steam so they went down the route of becoming more like a traditional social network. As the lines blurred between Facebook and Snapchat people decided to start going back to what worked and from Snapchat for the top down. Then the new gimmick networks start getting popular eating away at Snapchat's popularity from the bottom up.

Snapchat is getting eaten away from both ends. And teh bad PR is just next steps.

Snapchat has to do a vertical move. Maybe get into the through-away camera (not the expensive on they tried), cheap Android devices like what TracFone does for quick snaps on the go, or make a partnership with Urbanspoon/Yelp and do a go branded marketing campaign for the best snap with friends.

<comment><USER3> "A message/photo/video lasts for a short time and then goes away"

Not to mention this was never the case. The messages disappear from visibility on your phone, but those messages are preserved forever for the NSA, the FBI, the local police and most importantly, internal analytics for SnapChat.</comment></comment>


A Cure for Cancer? Royal Rife - <AUTHOR> http://www.youtube.com/watch?v=tEc-80gw1xI

<comment><USER2> Why is there woo here?</comment>


Data-Efficient Image Recognition with Contrastive Predictive Coding - <AUTHOR> https://arxiv.org/abs/1905.09272 <comment><AUTHOR> "When used as input for non-linear classification with deep neural networks, this representation allows us to use 2–5× less labels than classifiers trained directly on image pixels."

Interesting paper on an unsupervised pre-training approach using overlapping image fields to massively reduce the amount of labeled data required to train image classification models.

Reminds me a lot of the way word2vec is trained with overlapping word vectors and negative sampling...</comment>


Caffeine and Cannabis Effects on Vital Neurotransmitters in Rats - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5448447/ <comment><USER2> Nothing has ever done me more good than this combination. My biggest success in work at my current company, a big API-first platform for insurance comparison was built from scratch in 2 weeks time, spent locked inside my apartment, coffee machine running 24/7, a 100mg cookie in the morning and a joint every 2 hours. No one knows.

<comment><USER3> I hope we start studying this more. I was never a regular user, but I tried it a few times and spent a lot of time in smoky rooms.

One of the reasons I didn't use it was that it really impacted my ability to do things like mental arthmetric. I worked in sales in school and I remember being freaked out as it felt like a part of my brain was powered down.

I can normally do most addition/multiplication/approximate averages faster than I can type. The time I ran into this I couldn't spit out an answer for sales tax or add a few numbers together! :)

I'm curious as to why the effect on me was so different than what you experience!

<comment><USER2> Definitely depends on yourself and the strain. I will mostly be able to think extremely abstract and with a very high level of creativity and detail, multi- layered even. Meditation has changed the effects considerably, as long as you're lost in the content of thought, interpreting it as new thoughts, the high is just too overpowering. When you're present you can direct your paradigm and steer the direction of thought waaay better. I guess it all comes down to how self aware you are. I've noticed a general trend to calmer, more tranquil highs as 1) I got older, 2) smoked longer, 3) meditated more and 4) with rising tolerance. Also after psychedelics for some weird reason.

</comment></comment></comment><comment><USER4> I am a total layman, so could somebody explain the significance of this study? Obviously those substances alter the brain chemistry, that is not surprising, I think. How are those changes significant? Is there cause for concern?

<comment><USER5> Caffeine and cannabis work together.

> However, the combination of cannabis and caffeine mostly caused synergetic > response in the level of the neurotransmitters; this implies that both > substances produced their individual effects and did not cancel out the > effects of one another. This is also expected since they bind primarily to > various receptors. Thus, the resultant relative hyper increase is the > cumulative effect of their individual influences.

<comment><USER6> Colloquially known as a hippie speedball.

<comment><USER7> I rarely enjoy this during the work week, but it is definitely a Sunday morning staple. Great for steady mellow productivity.

</comment></comment></comment></comment><comment><USER8> Please stop posting these pre-clinical studies on rats and mice! No one should ever be taking anything away from these sorts of studies for human health.

</comment><comment><USER9> The article mentions "cannabis abuse" a few times, what metric is there to put use into the abuse column?

<comment><USER10> Use turns into abuse when the person is aware of harmful effects but continues to use. Or when the person wishes to discontinue use but is unable to.

Some definitions include very high rates of use.

<comment><USER11> It has to be more than just "is aware of harmful effects but continues to use", otherwise anyone who is aware of the existence of hangovers (or other negative effects) but continues to drink alcohol is "abusing" it.

It would have to be something like "the person using the substance doesn't feel that the positive effects are worth the negative effects but they still cannot stop using it."

<comment><USER10> Yes, sorry, "is aware that harm is caused but continues to use".

BTW if people are drinking alcohol and regularly (once a month) getting hangovers they're absuing alcohol.

<comment><USER11> Oh, I thought that's what it was for. :P

</comment></comment></comment></comment></comment><comment><USER12> Coffee, weed and _plenty of water_.

</comment><comment><USER13> > 100 mg/kg

I don't know about mice, but for a human, that would be a _lot_ of caffeine.

<comment><USER14> yes, that's about half the LD50 for humans. Definitely more than you would consume as a non-addict on a regular day.

<comment><USER11> A cup of drip coffee is what, 90mg? (Source: [https://www.coffeechemistry.com/chemistry/alkaloids/caffeine...](https://www.coffeechemistry.com/chemistry/alkaloids/caffeine- content-in-espresso-vs-drip-coffee)) So 100 mg/kg would be 70-90 cups of coffee. I'm wired after 4-6 cups.

</comment></comment></comment><comment><USER15> Maybe more informative is [https://www.annualreviews.org/doi/full/10.1146/annurev- nutr-...](https://www.annualreviews.org/doi/full/10.1146/annurev- nutr-071816-064941)

Maybe paywalled so I'll emphasize the last sentence of the abstract: "Given the spectrum of conditions studied and the robustness of many of the results, these findings indicate that coffee can be part of a healthful diet."

</comment><comment><USER15> paper affiliation [https://en.wikipedia.org/wiki/Babcock_University](https://en.wikipedia.org/wiki/Babcock_University)

</comment><comment><USER16> Mac Lethal made a song about it:

[https://youtu.be/DTY3GQPXU7A](https://youtu.be/DTY3GQPXU7A)

</comment><comment><USER17> What is a vital vs non-vital neurotransmitter? They don't define this in the paper so that term seems totally superfluous.

</comment><comment><USER18> This paper is useless garbage in terms of telling us anything about humans who consume either or both of these drugs.

</comment><comment><USER19> Anyone else in the UK unable to access ncbi.nlm.nih.gov? I couldn't access it yesterday either.

<comment><USER20> My subnet is blocked, but I'm going through my VPS...

Apparently the subnet I'm on has been blocked for bulk downloading.

</comment></comment><comment><USER21> If both can't significantly change neurotransmitters, that would be a splash

</comment><comment><USER22> Looks like a crap article in a crap journal. In the abstract they refer to cannabis as a stimulant, which seems quite incorrect. Also the results are unsurprising and not very exciting.

<comment><USER10> The word "stimulant" refers to this:

> The levels of G-6-PDH were increased in the brain tissues of all the treated > animals (Fig. (Fig.5).5). Caffeine produced quite more significant effects > relative to cannabis and the combination of both increased the level of > G-6-PDH greatly.</comment></comment>


Overstock CEO Patrick Byrne resigns following 'deep state' comments - <AUTHOR> https://www.cnbc.com/2019/08/22/overstock-ceo-patrick-byrne-resigns-following-deep-state-comments.html <comment><USER2> I am extremely confused:

> Starting in 2015 I (operating under the belief that I was helping legitimate > law enforcement efforts) assisted in what are now known as the 'Clinton > Investigation' and the 'Russian Investigation' (in fact, I am the notorious > 'missing Chapter 1' of the Russian investigation)," he wrote, going on to > say that this was "the third time in my life I helped the Men in Black."

</comment><comment><USER3> Big question that springs to my mind - what happens to tZero now, Byrne's blockchain security trading platform?

I can't see Overstock staying with the bitcoin and blockchain stuff - it was always Byrne's special interest.

</comment><comment><USER4> I really do not want to view the link. What happened?</comment>


Ask HN: How is Apache Tapestry to use? - <AUTHOR> I was recently looking through some of my older books, and came across one (from 2006) teaching web development using Apache Tapestry for the UI. Anyone have a take on this system?<p>It's still in development; they released 5.4 in December. <comment><USER2> Looks pretty cool. I have know about it for a long time but never actually looked into it. Now I am considering using.

I am planning on rebuilding a site of mine which was originally built with Wicket. I have been debating about whether to use Play, Spring MVC, Wicket, or something else.

Tapestry seems to have most of the things I like from Wicket but in a less verbose way.</comment>


Introducing Supersonic Query Engine - <AUTHOR> http://google-opensource.blogspot.com/2012/10/introducing-supersonic-query-engine.html <comment><USER2> Is Google doing stuff like this more in recent times (open sourcing things related to their core competency, search), or have I only noticed recently?

Like <https://github.com/refr/> also.

[side note: I wish they'd put all of this on github in an organized fashion like <http://github.com/linkedin> or <http://github.com/facebook> ]</comment>


Top Facebook Developers - Guess the Top 5 Before Clicking - <AUTHOR> http://www.insidefacebook.com/2009/04/20/6-weeks-after-redesign-a-look-at-the-top-10-app-developers-on-facebook-by-reach/

<comment><AUTHOR> I got 4/5</comment>


Chrome 56 Beta: "Not Secure" Warning, Web Bluetooth, and CSS Position: Sticky - <AUTHOR> https://blog.chromium.org/2016/12/chrome-56-beta-not-secure-warning-web.html <comment><USER2> So their example use case for `position: sticky` is putting a distracting header onto a space constrained mobile device __where the browsers own address bar has the good sense to disappear__ when scrolling down. Not rise from the page like some pixel craving zombie element.

And let's keep in mind in the real world, it's going to be at least 3 times bigger than that because it's not a sticky bar for ants after all. And it'll be rocking its best friend Mr Hamburger Menu, some social-tracking-sharing- buttons, and a banner ad for whatever was mis-classified from the background of the weighted average of the last 10 Facebook pictures you appeared in.

Just the text please! Viva le reader mode!

<comment><USER3> > distracting header onto a space constrained mobile device

This is my pet hate with Google's AMP mode which most sites seem to be switching to.

On my iPhone 5S it breaks hiding the browser's address bar when you scroll, then you have the AMP 'address bar' of the same size, then you finally get to the site's sticky header and footer. On Huffington Post the content is around 50% the size of my screen. Oh and it breaks Safari's Reader mode, which I assume also means accessibility features.

[http://i.imgur.com/PNOQ4Hk.jpg](http://i.imgur.com/PNOQ4Hk.jpg)

If anyone from Google is here, please do something about this as it is ridiculous.

<comment><USER4> Google fix = buy a bigger phone, so you'll see same amount of content then 4 years ago.

And in case if someone from Google is listening, give the option to opt out of this AMP crap, I'll gladly pay for extra bandwidth.

<comment><USER5> Well, I do not because I am in a limited connection (~1.5GB per month). I gladly appreciate that sites loads faster when I am using a mobile connection too.

While I understand the pain of (sometimes) having broken sites when AMP is on, this really helps when someone is on a country where mobile internet is expensive.

<comment><USER6> Which is why an option was suggested

</comment></comment></comment></comment></comment><comment><USER7> One of the coolest features in this release:

""" When content changes above the viewport, Chrome now automatically adjusts the scroll position to keep content in the viewport fixed unless the CSS overflow-anchor property is set. """

<comment><USER8> Not only that, but "Showing and hiding the URL bar on mobile no longer resizes the initial containing block or elements sized with viewport units such as vh." Thank God! I thought they were never going to reverse this horrible decision. These two changes should substantially reduce scroll jumping on Android which is one of my biggest annoyances on the web these days.

</comment></comment><comment><USER9> So if I just redirect all http requests to https, what unexpected consequences might I run into?

Not-for-profit hobby site/community with a couple hundred regular users. Have been running https with Let's Encrypt certs for a year but not advertising or defaulting to it. No legacy systems or other entanglements.

There is a forum that allows users to post inline images and media from other domains.

<comment><USER10> If you have absolute URLs ([http://..../foo.jpg](http://..../foo.jpg)) saved in documents or a database or something like that, you would need to rewrite them to be protocol-relative or just [https://](https://) .

<comment><USER11> Hmm, but they said SSL is already enabled if you visit the site with https. Shouldn't redirecting http > https be completely risk free then or am I missing something?

<comment><USER12> If you visit a secure site (https), embedding insecure items (http) will fail because they could do just as much damage as loading the entire page over http.

<comment><USER13> It depends on what the insecure item is. If it's just an image, it won't fail, it will just grey out the https and not display a lock icon.

[https://mixed.badssl.com/](https://mixed.badssl.com/)

<comment><USER14> That's current behavior, but I wouldn't guarantee it will remain that way, an http image compromises the integrity of the site: it could be manipulated to change the meaning. Imagine reading a news site using an unencrypted CDN and whoever runs the WiFi (or the country you're in) is replacing the images with similar yet different ones, giving a different impression that what the creator intended.

You could do this quite subtly as a way to influence people by making certain figures appear more sinister.

These warnings tend to get tougher over time, so what's grey now may be red next year.

</comment></comment></comment></comment></comment></comment><comment><USER15> >the Web Bluetooth API [...] enables web developers to connect to bluetooth devices such as printers

Feeling nostalgic for FAX spam? Let's update it for the modern era!

(Kidding. A little bit. The Web Bluetooth spec addresses these concerns at length -- [https://webbluetoothcg.github.io/web-bluetooth/#security- and...](https://webbluetoothcg.github.io/web-bluetooth/#security-and-privacy) \-- but mostly as a "here are the many, many ways this could be used maliciously", with not nearly enough "and here's how we plan to prevent that" for my taste.

I gotta say this is an attack surface I'd prefer we'd left buried deep underground; I can't think of any device I'd feel safe allowing a website to pair with. Keyboard? Keylogger. Printer? Physical spam. Headphones? Audio spam. Who wants this?)

<comment><USER16> I can think of a couple of things at least in the prehospitalmedial field. Bluetooth ekg machines are used to do documentation and needed to have their data sent to the hospital as fast as possible. Also Bluetooth scanners are used to scan drivers licenses and triage tags.

The less manual input a provider has to do, the better. Then they can spend their time making sure the patient is being taken care of.

Most ems documentation is done on web applications instead of desktop apps so it can work on anything from an iPad to a surface to a tough book.

You don't want to know how these things are hooked up today.

<comment><USER15> Those are... pretty darn good examples, actually. Thanks!

</comment></comment></comment><comment><USER17> FLAC support seems to be merged to M-56 too:

[https://bugs.chromium.org/p/chromium/issues/detail?id=93887](https://bugs.chromium.org/p/chromium/issues/detail?id=93887)

<comment><USER18> Mozilla is shipping FLAC support in Firefox 51, which is currently the Firefox Beta channel and will be released to everyone on January 24.

[https://bugzilla.mozilla.org/show_bug.cgi?id=1195723](https://bugzilla.mozilla.org/show_bug.cgi?id=1195723)

</comment></comment><comment><USER19> This is too soon if Google goes forward with the red exclamation point "insecure" flag before there is a free solution for wildcard certificates.

What are free sites that give every user a subdomain for their profile/site/etc supposed to do? There are many open source multi-user site platforms that follow this pattern, and all of these platforms now effectively have a huge monetary subscription fee associated with them due to the fact that you now need to purchase a wildcard certificate in order to not scare away users.

There is no free wildcard SSL certificate service, so Google is essentially forcing you to pay money to not scare users away from your site.

I am all for this change eventually happening, but not until _all_ DV SSL use cases are covered by free services. Until then, this change is inappropriate.

If Google wants to punish sites that can't afford or won't pay for expensive wildcard certificates, then they should offer a solution of their own (like their own ACME CA that supports provisioning wildcard certs).

<comment><USER20> The only problem is if those subdomains have a password input field "somewhere" on their sites, AFAICT. Or are you referring to google's "later" plans to add a red exclamation point "insecure" flag to the url bar for all HTTP pages?

I'll admit when I first heard of them flagging HTTP password fields, my instinct was to write a little javascript to "mimic" password input field behavior (and store the real password away somewhere else, then at submit time, it sends in the correct data). But if it's just a tiny warning on the url bar, meh, not sure if I care...

Also note that [https://letsencrypt.org](https://letsencrypt.org) appears to offer free CA certs.

<comment><USER21> I doubt most will even go that far. You can pretty much expect those that won't go HTTPS (for whatever reason, and there are many) to change their input type="password" fields to input type="text" fields.

That is probably what I am going to do for the internal site I maintain at work, since I can't get an SSL certificate for such a thing.

All this change is going to do is make password eavesdropping in person easier.

<comment><USER22> If it's hosted in local IP space and therefore you can't get a certificate, you can setup a CA and push that CA certificate through Group Policy. I had to do it myself and it took 3-4 hours (mostly because I'm bad at Group Policy)

<comment><USER21> The problem is that I'm a developer on a team of six. And my site is used by another five or six teams. It's a little tools site that does various SQL queries and such against databases other teams don't have access to. They're not going to allow me to push my signing certificate onto everyone's computers. I'm very low on the org chart.

<comment><USER22> Well I assume in a companywith that many teams they would have already came across a need to manage their own simple, internal CA. Maybe you can be the person to set it up, trust me it's scarier than it looks

</comment></comment></comment></comment></comment></comment><comment><USER23> So, how do I manage a website where I allow users to embed arbitrary URLs as image, so I don't even know which protocol they'll use, but where I want HTTPS for the page itself?

Will I just have to deal with the yellow "mixed content! insecure!" warning? Will I have to proxy requests?

There's many forums like that in the web.

<comment><USER24> Who cares about warnings? Do your users browse with devtools open?

At worst the users see the grey "i" in circle icon: [https://googlesamples.github.io/web- fundamentals/fundamental...](https://googlesamples.github.io/web- fundamentals/fundamentals/security/prevent-mixed-content/passive-mixed- content.html)

<comment><USER25> A single HTTP request in an otherwise HTTPS page can compromise the privacy and integrity of a user's connection. SSL/TLS isn't just about checking all the boxes so Chrome will give you the prettier icon, there are real stakes for users.

<comment><USER26> To expand on this--

Imagine you have a website with a payment form on an HTTPS page, but you embed some external analytics script over HTTP. If your visitor's request is MITMed (e.g. they're in a coffee shop or some other insecure WiFi access point, etc), then an attacker can modify the script (that's over HTTP) to send these credit card details to the attacker's server. Once there's a single HTTP resource on the page, HTTPS means a whole lot less, hence the scary warnings.

<comment><USER27> >Once there's a single HTTP resource on the page, HTTPS means a whole lot less, hence the scary warnings.

More like if there is a single line of 3rd party code.

</comment></comment></comment></comment></comment><comment><USER28> Hmm I don't understand bluetooth protocol well. What are some security issues I should be aware of if a rando site ask for bluetooth permissions(assuming this feature is gated) and I accidentally click yes?

Will it be able to take over bluetooth speakers or robot toys? They must be in discovery mode for it to connect so I am safe right? Then it will just be privacy issues which I can live with.

Otherwise it looks pretty cool. E.g, controlling a drone from a webpage: [https://www.youtube.com/watch?v=gXu3G3cg52k&feature=youtu.be](https://www.youtube.com/watch?v=gXu3G3cg52k&feature=youtu.be)

<comment><USER29> At a glance, here are some issues:

Every bluetooth device has a unique MAC-like address, which could be used to track you (or your device, at least).

There are also obvious privacy/security issues with the fact that device- stored information (full name, location, biostatistics, etc) can be accessed by any JS loaded onto the same page (read: analytics companies).

The whole Web Bluetooth spec is online[0], if you'd like to read it for yourself.

[0]: [https://webbluetoothcg.github.io/web- bluetooth/](https://webbluetoothcg.github.io/web-bluetooth/)

</comment></comment><comment><USER30> Web Bluetooth?! Am I the only one who just learned this was a thing?

Recently I have grow interest in progressive web apps, I wonder if there is a list of the sensors/interfaces that can now be accessed from a web browser, it will certainly be helpful

<comment><USER31> WebUSB and webserial are things too ( not necessarily implemented yet)

<comment><USER32> Not to mention WebVR, Web Payments, the Presentation API, the Gamepad API, and the Web Speech API.

</comment></comment></comment><comment><USER33> I wish they implemented text reflow on mobile devices, it'd make the web so much more readable for end-users and websites which are not mobile optimised.

<comment><USER34> And usually having control over the zoom level and get reflowed text makes a vastly superior reading experience than TEN LINES IN HUGE LETTERS PER SCREEN like many mobile-optimised sites sadly do.

</comment></comment><comment><USER27> >Chrome no longer allows opening of pop-ups during inputs which represent a touch scroll, such as touchstart and touchmove.

Wow. I remember, people were complaining that Google were the only major ad network company that did not forbid onthouch* code in ads, and on that has picked a principled stance on allowing them.

</comment><comment><USER35> There's too much potential for abuse in web technologies; it's past time for web browsers to clearly divide their capabilities into higher-level buckets that have restrictions.

Two buckets that come to mind: maybe you should have to specify that either you are developing an "app" or you are developing a "page". And no _page_ should be able to do things like create sticky-elements (not to mention a zillion other capabilities) because we all know some Obnoxious Clueless Ad Company will take about 13 seconds to start ruining your browsing with it. Anything identified as an "app" should be impossible to load in a normal browser, accessible only under a dedicated home-screen icon with a special sandbox, etc.

<comment><USER36> I agree, and it seemed like Chrome was aiming for something like that model for a while. But then Google seems to have backed away from it. Except on ChromeOS, Chrome apps are supposed to be phased out by 2018.

Personally, I am really unhappy with the direction of the web right now. Ads have gotten more and more intrusive (particularly on mobile), and it seems like every site is doing some sort of shitty "sign up for our newsletter!" or "but wait there's more!" overlay. Blocking and display-control mechanisms have seemingly fallen behind (again, especially on mobile, where for the typical user there's basically no viable ad blocking solution).

I've heard web developers defend all of this from a business perspective (we need the ad revenue), but it seems really shortsighted. All it's going to do is drive users to walled-garden apps, probably dominated by one or two big players in each market category, and the friction to get your content or product in front of customers will increase tremendously.

<comment><USER37> On iOS, you can just download a content blocker in the App Store and it'll just work in safari.

</comment></comment></comment><comment><USER38> "Web Bluetooth", as well as the "Physical Web" sound very scary.

Who's going to ensure all of these devices that are accessed this way don't get hacked? Google?

</comment><comment><USER39> While this is obviously useful for anything with a login, there are many content and consumption sites that simply don't need HTTPS.

<comment><USER4> Yeah, can't wait till my CV and project descriptions (not hosted there) static Jekyll site is somehow insecure and dangerous.

[edit] I'll guess I'll have to find a new host then, since Github pages doesn't support https on custom domains. Perhaps Netlify, seems to support Github hooks.

<comment><USER13> Well China intercepts http traffic and inserts javascript malware joining users into a botnet that DDOSes github pages of human rights organizations. It depends on what you mean by insecure and dangerous.

<comment><USER22> Link?

<comment><USER13> [https://citizenlab.org/2015/04/chinas-great- cannon/](https://citizenlab.org/2015/04/chinas-great-cannon/)

[https://en.wikipedia.org/wiki/Great_Cannon](https://en.wikipedia.org/wiki/Great_Cannon)

</comment></comment></comment></comment></comment><comment><USER40> Opening up a secure HTTPS iframe (for example from another domain) on a non- secure HTTP website labels the entire site as "Not Secure". This will generate an unnecessary warning to the user when the login form or the payment form is really secured by HTTPS.

If the Chrome development team implements this new security feature they need to check that the window where the form exists is secure by HTTPS or not, and not only check if the top window is secured with HTTPS or not.

<comment><USER41> A warning which is completely applicable if someone modifies the HTTP transmitted site and replaces the secure iframe with a phishing version of it. And since the browser can't tell when that happens, it displays the warning always.

<comment><USER40> You are correct about that.

I think that the main problem with iframes (and frames in general) is that it's impossible for the user to check in an easy way where they originates from. If the URL bar would automatically change to the iframes URL when the user hovers the iframe it would at least give the user a possibility to check where the iframe originates from and there would be no need to label the entire site as "Not Secure".

<comment><USER42> > I think that the main problem with iframes (and frames in general) is that > it's impossible for the user to check in an easy way where they originates > from.

Exactly, just like all other resources (assets, media).

> If the URL bar would automatically change to the iframes URL when the user > hovers the iframe

Not only is this extremely confusing for anyone who isn't an expert it also breaks when you don't use a mouse. It can also be circumvented really easy by simply hiding an iframe.

\-----

Why exactly don't you like the current behaviour? If you load a page over HTTPS that loads a bunch on insecure pages inside iframes, the page _is_ insecure.

<comment><USER40> I'm my example it was the other way around. You load an insecure page over HTTP without triggering any visible warning. And then you load a secure iframe over HTTPS with a login form and this triggers the "Not secure" warning. The only reason to do this that I can think of is because of MiM attacks like detaro wrote about.

</comment></comment></comment></comment></comment><comment><USER43> Curious, will position:sticky work for a thead tag? or a tr? All the workaround for this have their faults.

<comment> iso-8859-1 Probably, since position:fixed works: [http://jsfiddle.net/brettadamsga/yeAhU/](http://jsfiddle.net/brettadamsga/yeAhU/)

</comment></comment><comment><USER44> I'm excited for the Web Bluetooth feature. Also position:sticky is very welcome...

<comment><USER45> position:sticky first appeared in Chrome Canary in 2012, somewhere around Chrome 30, but then they pulled it because of the issues.

A coworker was looking for a JavaScript sticky solution for an internal tool, and since that team could dictate what browsers the users should use, she started building it around position:sticky. Soon enough the property disappeared and she had to go with JS anyway.

The company got bought by their largest competitor a few months ago. I never would have guessed that the company would be gone before this finally got released.

</comment></comment><comment><USER46> it's a shame Apple keeps castrating iOS safari by not adopting open web standards to keep the app store relevant

</comment><comment><USER47> >"Not Secure" Warning

Nice!

>Web Bluetooth

What the fuck?

>Position: Sticky

Nice!

</comment><comment><USER48> EDIT4:

Bah, it's not free on HostGator even with a free certificate:

_Do you authorize the $2 / month or $24 / year dedicated IP charge? (Dedicated IP required for SSL) *_

_Do you authorize the $10.00 SSL Installation fee?_

EDIT3:

Re: having to buy a SSL on a hobby site / forum ...

Ok I see HostGator allows third party SSL it's not super straightforward but at least it seems possible to use a free SSL from Let's Encrypt and then get it installed...

I have shell access too, but it's not "administrative" access so afaik, the Let's Encrypt "Certbot" would not work?

Would [https://gethttpsforfree.com/](https://gethttpsforfree.com/) work on HostGator with a shared shell access (not administrative), anybody knows?</comment>