Private APIs and Why Apple Bans Them - <AUTHOR> http://cocoacoding.com/2011/04/14/why-apple-bans-private-apis/

<comment><AUTHOR> I just wrote this article about Private API use and Why Apple is so strict on enforcing it. Although some might say this topic is old, I recently found myself getting an app rejected for it. I had been searching on Stack Overflow for a quick way to insert a textField into a UIAlertView and found an user posted answer which used an unofficial way to include one. Months later, Apple rejected my application because it used this undocumented code.

My question to other iOS Devs, have you ever been caught using code which is deemed undocumented?</comment>


Nestlé runs GPS-fitted chocolate bars competition - <AUTHOR> http://www.campaignlive.co.uk/news/1150168/nestle-runs-gps-fitted-chocolate-bars-competition/

<comment><AUTHOR> Would love to see technical detail on this if anyone has a source.</comment>


Show HN: Dcron – Distributed, fault tolerant job scheduling system - <AUTHOR> http://dcron.io/

<comment><USER2> You may want to rename your project. dcron is Dillon's cron for quite a lot time already.

<comment><AUTHOR> Right I know, but if he don't mind, both projects are enough different to not create confusion.

Need more time to see if this will be necessary.

<comment><USER3> Honestly, it's just the classy thing to do - the impact of changing your name is nominal, the potential confusion with the other Dcron is significant.

</comment></comment></comment><comment><USER4> Man, how I wish Kala and Dcron would just work together.

[https://github.com/ajvb/kala](https://github.com/ajvb/kala)

[https://github.com/victorcoder/dcron](https://github.com/victorcoder/dcron)

Fusing both would be AWESOME (I'd even like to help).

What Dcron gets right:

\- Distributed by design

\- Raft for the reliable parts, gossip for lightweight sync, a match made in heaven

\- Linux mentality

\- Dashboard included

\- Good docs, nice website, looks serious

What Kala gets right:

\- Built much more directly after Chronos, which has an amazing and battle tested API

\- Using ISO durations instead of NIHing their own format

\- Dependent jobs

<comment><USER5> While Metafora doesn't support cron-like syntax for job scheduling or tag- based node targeting (yet!), it does support distributed fault tolerant task running. We hope to build out a webui soon as well.

However since Metafora is written as a Go library and provides a statemachine implementation for task handlers to use, it requires writing your distributed tasks in Go.

[https://github.com/lytics/metafora](https://github.com/lytics/metafora)

</comment></comment><comment><USER6> I have a bunch of Python scripts that run a various intervals (hourly, daily, monthly, etc). I have trouble keeping track of which jobs fail -- unless I notice an email doesn't show up, or a metric is missing. Is Dcron something I would use to keep track of my cron jobs and whether or not they ran successfully?

At this point I don't need my jobs to be distributed, I'm just looking for a way to keep track of them all and visualize characteristics of the job (start time, length, successful, etc). Ideally, I'd have a way to re-run the job within the UI.

<comment><USER7> _Disclosure: I work for Iron.io_

If you're open to a hosted solution, check out IronWorker: [http://www.iron.io/worker](http://www.iron.io/worker)

It's an async task processing service with a built-in job scheduler. You can upload your python scripts to Iron.io, then set schedules and other triggers to execute on-demand. We have a dashboard to manage tasks and schedules, see what ran and what failed, and you can visualize the characteristics you're looking for. We do distribute the workloads for you, but sounds like it could be a good fit.

</comment></comment><comment><USER8> I haven't done any digging, but I'm assuming this uses etcd for membership? How does that work - how does a server know whether its a leader, and how does failover work?

<comment><AUTHOR> Nope, it uses serf for membership.

</comment></comment><comment><USER9> How do I define jobs? Can they be written in any language? I didn't see anything in the documentation.

<comment><AUTHOR> Added to the docs, big omission, sorry! [http://dcron.io/docs/api/#create-or- update-a-job](http://dcron.io/docs/api/#create-or-update-a-job)

<comment><USER9> Any change that dcron could manage the job scripts itself? I.E. you store the raw command scripts in dcon, then reference them in the create a job endpoint?

For example:

        POST /scripts --data 'node /home/node/myJob.js'

That returns a script id { "script_id": "507f1f77bcf86cd799439011" }

Then:

        POST /jobs --data '{
           "name":"cron_job",
           "schedule":"@every 2s",
           "script": "507f1f77bcf86cd799439011",
           "owner":"foo",
           "owner_email":"email@example.com"
        }'

This way you don't have to manage/create the scripts on each node manually.

<comment><AUTHOR> I think you missed the point, jobs are stored in etcd so they're distributed and all dcron (server) nodes will see it. You can even create jobs from any node. Note that, non server nodes doesn't need access to etcd.

</comment></comment></comment></comment><comment><USER10> Cool! Might use this when I renovate http.sh</comment>


Decades-old GnuPG bug allowed hackers to spoof just about anyone's signature - <AUTHOR> https://arstechnica.com/information-technology/2018/06/decades-old-pgp-bug-allowed-hackers-to-spoof-just-about-anyones-signature/ <comment><USER2> [https://news.ycombinator.com/item?id=17309987](https://news.ycombinator.com/item?id=17309987)

</comment><comment><USER3> Can someone explain how bad this is in multiples of Heartbleed? Any big time automated processes with decades of dubious history now, etc?

<comment><USER4> It's difficult to be precise, but I'd bid it out as a _minimum_ of 6 orders of magnitude less, and if someone wanted to bid out 8 or 9 I wouldn't fight them.

It's not a zero-impact issue, but there's so many differences between this and Heartbleed that it just can't be that large. For one thing, there's several orders of magnitude fewer users of GPG than SSL. Then you need a vulnerable configuration. Then you need to have been exploited. Those three things multiply out to quite a few orders of magnitude.

</comment></comment><comment><USER5> Sorry to be pedantic, but it appears to be a bug in GPG, not the PGP spec.

<comment><USER6> PGP is a trademark currently held by Symantec: [https://www.symantec.com/about/legal/trademark- policies](https://www.symantec.com/about/legal/trademark-policies)

The spec is OpenPGP and both PGP and GPG implement it: [https://tools.ietf.org/html/rfc4880](https://tools.ietf.org/html/rfc4880)

<comment><USER5> That is even more delightfully pedantic (and I learned something)</comment></comment></comment>


MobileFusion: 3D scanning using mobile phones - <AUTHOR> https://www.youtube.com/watch?v=5tsLLq02xnk

<comment><USER2> This is really, really, cool technology. Would love to learn what's going on behind the scenes!</comment>


Facebook says millions had phone numbers, search history and location stolen - <AUTHOR> https://www.washingtonpost.com/technology/2018/10/12/facebook-says-fewer-users-were-affected-by-data-breach-more-information-was-taken <comment><USER2> Here we go... the slow trickle of them saying every few days that the data breach is MUCH worse than what they had said days ago. Boil the frog.

1 month from now, compare what they've said to what they said this week.

<comment><USER3> Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been described like another issue in the same vein as Cambridge Analytica and Google+.

I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.

<comment><USER4> > there's no "View As" which will show you someone's search and location > history

Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides.

When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.

<comment><USER3> Interesting, thanks.

I had only followed general-consumption reports here, and hadn't seen that the attack involved obtaining a token that allowed the attacker to authenticate as the user, and I didn't realize that the API included support for pulling search history data. Given that, I understand much better why this was a disaster from the beginning, and why people are so mistrustful of the rolling "and also this..." disclosures.

</comment></comment></comment></comment><comment><USER5> Why is it that all of the times Facebook claims a "hack" it's really Facebook giving away or selling user data via an API, getting caught and than claiming it as a "hack" to avoid responsibility?

<comment><USER3> This story looks like the exception, though?

The app piggybacking and the initial "View As" stories constituted Facebook handing out data sloppily. But location records, search history, and TFA-only phone numbers are internally held data Facebook wasn't showing to anyone. This moves things from "faulty visibility settings" and "shady data sales", which we've seen before, to "outright security breach".

<comment><USER6> Recent search history is accessible in the UI when you click on the search box. Assuming someone could see "what FB looks like from your perspective", they'd be able to access the last dozen-or-so searches.

</comment></comment></comment><comment><USER7> More Facebook user data leaked or "stolen"? Must be a Monday.

</comment><comment><USER8> Great that Facebook stores these things, otherwise it could not have been stolen.

<comment><USER9> People put their phone number and location on Facebook for public display. It seems hard to blame Facebook for storing them.

<comment><USER10> ...and what about search history? I don't use Facebook but do people also put their search history on display there?

<comment><USER11> I imagine search history data is used to facilitate and optimize repeat searches, e.g. repeatedly looking up your secret crush or exes.

<comment><USER12> It does actually... there used to be a way to pull out what people facebook "ranked" highest for you above others. That's why search isn't always alphabetical when you use it, it sorts the list by a preference score they generate based on how you interact with profiles

</comment></comment></comment></comment></comment><comment><USER13> > _User messages could have been exposed in one specific use case, officials > said. If an affected user had been the administrator of a Facebook page, and > the page had received a message from another user, that message may have > been compromised, Facebook said._

Isn't this a common use case? Are we administrator to our own FB account?

<comment><USER14> A Facebook page is different from a Facebook profile in the way it's presented so most likely the messages are made available through different mechanisms. I guess they are suggesting the particular hack didn't directly give the attackers full access to the users' profile pages (including messages) but when it comes to Facebook pages the messages are directly exposed.

With FB and Google getting free passes (as in no penalty that hurts) after this kind of incident I don't see them doing much else beyond the minimal diligence.

</comment></comment><comment><USER15> Imagine if "page views" of your friends profiles were leaked...

<comment><USER16> LOL Then we could no longer pretend that Facebook doesn't still exist because of e-stalking unrequited loves and exes.

</comment></comment><comment><USER17> Looks like the first huge GDPR fine the EU will be able to get.

</comment><comment><USER18> Hmm, Facebook has said that I was not included in this latest data breach, but on the other hand, the amount of spam that I've received in the email address that Facebook knows about has skyrocketed in the last few days... Correlation doesn't necessarily imply causation, and there's a million and one ways that spammers could get that address, but it certainly is curious.

</comment><comment><USER19> search history is the most problematic, IMO, shows intent. But combine all three and you have a problem.

I think we need a new internet rule /law:

if it's online, it will hacked /stolen soon or later.

So they should not save most of the stuff.

<comment><USER20> Isn't that what GDPR aims to do?

</comment></comment><comment><USER21> Is this the search history that appears in the activity tab? So, if you keep that clear, nothing could have leaked, right?

</comment><comment><USER22> Are all these the same hack? I'm losing track.

</comment><comment><USER23> Good thing I never gave them my phone

And that I got tracking and location blockers specifically for fb</comment>


Zynga stock 'scandal' overblown - <AUTHOR> http://finance.fortune.cnn.com/2011/11/10/zynga-stock-scandal/

<comment><USER2> Big surprise, something bad happens to Zynga PR and Dan Primack is out there with a story about how it's not actually bad.

This sequence of events is getting old.

</comment><comment><USER3> I usually like Primack's work, but he is so wrong here it hurts.

<comment><USER4> A willingness to do so is why he gets paid the big bucks. Why people would consider the words to be anything but the lies of a scoundrel remains a mystery.

</comment></comment><comment><USER4> Also in the news: Zynga's PR agency wakes up from their hookers 'n blow coma.

</comment><comment><USER5> > What Zynga did ... is little more than morally-acceptable business as usual

Exactly. I'd like to congratulate Zynga's PR team for both disseminating their message in a prominent publication in an urgent fashion and for dumbing down the issue into Red Sox hyperbole so that even the most simple reader can grasp the wrongs to ownership in having to over-pay an under-performer like Carl Crawford.

But what they fail to mention is that outside of few very talented developers who can keep the ship above water, Zynga is free to scrutinize any and all employees using whatever standards they deem fit and demote the lot of them, recovering as many outstanding options as they want.

This is all probably legal, of course, and given the economic times, I'm sure many Zynga employees will be happy just to have a job. But make no mistake about it, Pincus isn't building a company with an eye on the future, he's selling it. And the more he has to sell, more money in the bank for him, even if he has to repeal every single stock and option grant that he can. In the end, even those who help him get away with this will be so few in number and power that they too will get the Pincus treatment. Buyer beware.</comment>


How Climate Migration Will Reshape America - <AUTHOR> https://www.nytimes.com/interactive/2020/09/15/magazine/climate-crisis-migration-america.html <comment><USER2> [https://archive.is/uv6Tq](https://archive.is/uv6Tq)</comment>


Introduction to the ad auction - <AUTHOR> http://googleblog.blogspot.com/2009/03/introduction-to-ad-auction.html <comment><USER2> This video explains the mechanics of the single most important online business. This is how Google makes ~98% of its $20 billion/year revenues, and probably 100% of its $13 billion/year profit.

Online startups would do well to learn how this works. I'm surprised it hasn't gotten voted up more.

</comment><comment><USER3> This is great info, but I would have liked it if the video looked at more sides of the equation. Granted, the advertisers have the most complicated corner of the triangle, but figuring out what I earn as an ad seller is equally useful... which also lets us solve for what Google's share is.

</comment><comment><USER4> If you want to learn more about this topic, check out the book mentioned in this <http://news.ycombinator.com/item?id=509407> thread

</comment><comment><USER5> This video is not available, Is anyone else facing the same problem.

</comment><comment><USER6> Carrot should be placed very close to donkey head. "Just one cent above my bid! Beat it!"</comment>


An open letter to the security community - <AUTHOR> http://alexgaynor.net/2013/aug/03/open-letter-security-community/

<comment><USER2> As an attendee at Defcon right now I agree with you, it is a rather hostile group.

> Invites to parties being handed out to male speakers and not female speakers

My guess is this was a result of an oddball selection process rather than anti-female bias. I have never seen a party at Defcon didn't already have a huge surplus of males.

> Women stripping being used as a prize in hacker jeopardy

> Jeopardy game features the category "hot pussy"

> Objectifying content on slides

I find this whole Las Vegas scene to be gross. Most indoor places stink like cigarette smoke.

Nevertheless, let's not take Defcon and other Jeff Moss/Dark Tangent productions as representative of the "security community". There are a great many other people in security who go out of their way to be welcoming and respectful.

> Hacking devices of new users at conferences is considered completely > acceptable

This is well known. One of the functions of Defcon is as an exploit/malware trading market.

> I can only conclude you don't want to be welcoming to new users.

Should they be? It's a place for amateur hackers, pros, double agents, Feds, and internationals to gather in the same place for a few days with a tacit understanding of some relaxed rules. It's a once a year opportunity for many attendees but its not for everyone.

</comment><comment><USER3> This should be directed at the convention instead of the entire security community.

</comment><comment><USER4> this is probably not the best argument, because DEFCON has been this way since the beginning (I have been to a lot of them) and the security community as a whole has never really been accepting, forgiving, or inclusive.

so when you make a post that says "your community stinks and I won't be a part of it", the majority response will be "good, we didn't want you anyway".

maybe you could point out that the community loses a lot of potentially awesome contributors by being so exclusive, but the community will be quick to point out the large number of awesome contributors they already have, and how those contributors themselves are prickly, women-hating and exclusionary, and they'll be right.

in short, I don't know what you can do as an outsider beyond ignore it. as an insider, those in the community who agree with you are in the minority, and generally disinterested in engaging with the majority of the community because they are terrible (and also generally quite stupid). I don't really have a long-term interest in being associated with the security community, and am not at DEFCON this year for that reason.

it's a weird, insular and perverted thing that has marginal societal good. the societal good that comes out of computer security is often not connected to what you conceive of as "the security community", but rather professional researchers and engineers that work for universities and major corporations. so, my advice is, ignore the "security community". it will die. let it die.

</comment><comment><USER5> This is like ranting at a beehive. The security community is not the homogenous, closed group this poster seems to assume.

</comment><comment><USER6> The issues with sexism are terrible indeed, organizers should be ashamed of allowing such things to happen.

But the thing with hacking devices.. that's exactly what makes the security conferences so awesome. I've been wanting to go to a real security conference since I was 12 because of things like that. You say it scares away new users, I say it draws them in.

Complaining about people breaking into your phone, what are you doing at a security conference anyway? Last time I checked the site of a security conference it had a detailed guide on how to prevent this from happening to you.

It would be a terrible thing if the baby was thrown out with the bathwater.</comment>


The futures of Facebook and Google are embedded in these two images - <AUTHOR> http://www.robinsloan.com/note/pictures-and-vision/index.html <comment><USER3> "Google is getting good, really good, at building things that see the world around them and actually understand what they're seeing."

That statement spells it for me. With Google I see research, I see pushing tech boundaries and hardware experiments, I see new ways to interpret the world. With Facebook I see a huge lump of data but nothing really too groundbreaking. I don't deny Facebook's momentum... it's huge and it's valuable... but is it future proof? Are they thriving on momentum alone?

Which wins the race? Dunno yet. Maybe it's just not the same race.

<comment><USER4> There's a lot of truth to this (though I'm generally a big skeptic when people talk about "research" in the abstract; and I remain genunienly "WTF are they thinking!?" about Glass).

Google tries stuff, fails a lot, and stumbles on as many successes as they engineer.

Facebook has executed really well on their core stuff, but... what else? I mean, they've been on a huge hiring binge now for four years. What do they have to show for all that talent? It seems like a big waste to society if nothing else.

<comment><USER5> Being able to connect with people from around the world and share content is not a big waste to society.

<comment><USER6> > _Being able to connect with people from around the world and share content > is not a big waste to society._

That's correct. However, the ability to "connect with people from around the world and share content" is, as your parent post notes, is Facebook's "core" functionality. What does Facebook have to show for the engineers they've hired this year, engineers they've hired last year? Are read receipts on Facebook chat more beneficial to "society" than other endeavors the engineers could be working on instead?

<comment><USER5> When Google changes its icons for special occasions is that more beneficial to "society" than other things they could be working. Is ANYTHING people do really the best they could do for society.

I just don't understand why you are holding Facebook to some arbitrary standard.

<comment><USER7> Actually, Google Doodles educate the society at large about people that made a difference in this world. So yes, work on Google Doodles is beneficial to society.

</comment></comment></comment></comment></comment></comment><comment><USER8> Facebook as a photo sharing app is a fascinating example of the service being generic and the context for the service being the main focus of competition. A bar sells drinks, but providing a competitive lineup of drinks is much easier than providing a competitive context in which to consume them. Coffee shops sell coffee and wifi, but they compete against each other as contexts within which to consume coffee and wifi. As a photo sharing app, what distinguishes Facebook from its competitors is the context it provides.

The context is nothing by itself, of course, and this is what is rarely mentioned about social networking. A bar without drinks would be dry and boring: a Boys and Girls Club for adults. Similarly, the essential, defining factor of social networking -- the network, the web of connections between people -- is lame and reductive by itself. But it's the perfect context in which to share photos.

Social networking is also a good context for non one-on-one communication. (For one-on-one communication, it offers nothing except a convenient way to initiate a conversation with other Facebook users, a small advantage that can't make up for the fact that it isn't as universal as e-mail or texting.)

I suspect the growth of Facebook as measured by users and usage will depend on discovering other services for which social networking is the perfect context.

<comment><USER9> >a small advantage that can't make up for the fact that it isn't as universal as e-mail or texting

Well, I'm a teenager, and sadly Facebook is far more universal as a means of contact than texting or e-mail, personally. I don't have the email addresses or phone numbers of most of the people I know (often because I don't know them well enough), but I do have them friended on Facebook.

<comment><USER8> By sheer numbers I may have more Facebook friends than phone numbers or emails, but a significant proportion of the people I communicate with regularly aren't on Facebook anymore or never were. So I agree that Facebook is more inclusive in the sense that people friend a lot more people on Facebook than they share their email address and phone number with, but when it comes to real friends and family, I can reach all of them through email or texting but only some of them through Facebook.

</comment></comment></comment><comment><USER10> I agree.

I made the argument only this weekend with a family member that technology companies come and go and tend to be cyclic. However, Google is here to stay. They might be search/advertising at the minute but those guys are really taking crazy problems head on and I wouldn't be at all surprised if Google had a breakthrough product in 5years with Cars.

We can all criticize Google+, but Google is one of those companies that I look at and stand in awe of day after day.

</comment><comment><USER11> It is unfortunate they are both scary companies. They both know too much about their users, and their users connections.

Even if you don't have a Facebook account, there is probably still some evidence of you in their system. Unlike Facebook, it would be pretty hard to not use Google at all, but it's at least possible to use their services and remain unidentified.

Photos are over-rated, but tell that to the ~500 million people stalking each other on Facebook. Glass is an incredible vision into the future of computing, or a chilling vision of the future where there is no disconnecting from the web of surveillance.

<comment><USER12> The fact of the matter is that most people are less concerned about personal privacy and data security than they are maintaining social relationships, so while I don't disagree with your premise I would argue that your point is fairly inconsequential in the grand scheme of things. I fully expect we'll end up with a few competing Skynets in the next couple of decades, but the best we can hope for is that their overlords are reasonable people. Imho, trying to avoid this is a fool's errand; we're better off educating people and creating peripheral controls to help guide the megaliths into an agreeable position.

<comment><USER13> Surely that's not the best we can hope for—or work for. It is not out of the realm of possibility that distributed social networks, like email or Diaspora, can gain popularity. But I don't know how to make that appealing to average people.

<comment><USER14> If your concern is that a single entity is going to have your information, then Diaspora wouldn't help you anyways, as long as at least one of your friends is using a federated service that is a majority service (like blogger).

</comment></comment></comment></comment><comment><USER15> to gauge marginal positive externalities, invert the principal component & see what remains.

as an example - suppose you wake up tomorrow and google search stops working. never mind why - some random bug impossible to figure out, so it just stops working. Then what are the positive externalities that remain ? Well, gmail. youtube. android. gdrive. maps. picasa. blogger. reader. googledocs. googlecheckout. etc etc etc... and that's not counting a single api / framework / language( gwt, go , dart, chromium, etc etc...)

now suppose you wake up tomorrow and facebok stops working. Then what are the positive externalities that remain ? Well, ???

<comment><USER16> Reminds me of a Charlie Munger quote:

 _that to get closer to the right answer, scholars should "invert, always invert."_

You have a strong point there. Most top 100 websites I see are just _frontends to databases_.

I kid you not.

Their competitive advantage is proprietary data holding and network effects to get more data.

      Google - search + database frontend.

      Facebook - database frontend.

      YouTube - database frontend.

      Yahoo! - search + database frontend.

      Baidu.com - search + database frontend.

      Wikipedia - database frontend.

      live.com - database frontend.

      Twitter.com - database frontend.

      QQ.COM - database frontend.

      Amazon.com - database frontend.

Most of the stuff is just a front end to a database.

Their positive marginal benefit derives from holding that data, using it as leverage to get more data, and then serving it back to their users in a tight loop.

<comment><USER17> Interesting point. However, I'll disagree with Amazon.com. Purchasing real world products is much more than just a database frontend.

<comment><USER16> If you're talking about warehousing/logistics - that is true.

However they only did it because they had to reduce costs and simplify processing. I'm pretty sure Amazon would be much happier to just dropship by making an API call to third party logistics - which is essentially an inventory database from Amazon's point of view - _but they are just too big now_.

I think they still do that with long tail items (don't store, but use third party logistics with an API call).

<comment><USER18> Would not having a 3rd party handle the logistics cut into their profit margins? I would assume because they do it in house and at such a large scale they save money vs hiring a 3rd party that would want their own cut raising logistic costs.

<comment><USER16> Yes. They did that at the beginning, but since they scaled up they have brought a lot of it in house.

I was addressing the fact that even though they did logistics/warehousing, I still believe them to be a database frontend (inventory/customer/credit cards), and I disagree with the above statement:

> _However, I'll disagree with Amazon.com. Purchasing real world products is > much more than just a database frontend._

</comment></comment></comment></comment></comment></comment><comment><USER19> I agree that all of the Google X projects of today will ultimately be what defines Google tomorrow. The fact that they have the guts to tackle projects that are incredibly risky for a business but meaningful for humanity is a major reason I'm happy to use their products. I love the geek factor.

<comment><USER20> I'm not sure it's that risky for them. Google tends to try a bunch of different stuff, but doesn't seem too shy about cuttings its losses and failing reasonably fast when needed.

<comment><USER21> What happens when they fail one too many times and the seemingly endless supply of R&D money runs out?

</comment></comment></comment><comment><USER22> Every day I become a little more scared I will live my adulthood in an episode of this: <http://www.youtube.com/watch?v=CWN9WEU2NP8>

EDIT: I see it has been mentioned downthread. Charlie Brooker is indeed a genius.

</comment><comment><USER23> Two things:

Both facebook and google are playing catchup on social. Facebook with monetization, google with popularity. This leaves them wide open to disruption from companies that nail the fundamentals from the get go and bring significant value-add to the table.

Second, both companies view users like cattle. Just headcount to convert to dollars.

Overall my hunch is that there's a 50/50 chance that neither google nor faceebook will be king of social in 2020. There's a lot of potential for disruption right now and both of these companies are so focused on each other I doubt they'd even notice a successful upstart until it was too late. The real risk to both, I think, is small companies which don't have billion dollar obligations on their backs already.

<comment><USER24> While I agree that both Facebook and Google have those respective problems, I think social is an area where user base is not easily portable. It would be tough to convert all the moms and dads to switch from Facebook to another platform...It was difficult enough to get them on Facebook.

</comment></comment><comment><USER25> Some trust fund kid spouting off, blah blah blah.

Farcebook is of grannies and prole working moms.

Most of farcebook's income is from games. The rest is just the internet with training wheels for morons, just like AOL was a few years ago, and we all know how well that worked out.

The Google glasses thing is beyond stupid. Any fool can stream video from a strap on mini cam hat, have been able to for years. Ever wonder why that has not caught on?

Nice try at topicality and posing as someone in the know.

</comment><comment><USER26> For anyone who didn't rtfa, here's a cool link of Sebastian Thrun demonstrating Project Glass on Charlie Rose:

<http://www.charlierose.com/view/interview/12321>

<comment><USER27> i did read the article, clicked to the interview link, saw only a picture and left.

now i saw your comment, clicked the link and was about to dismiss the page a second time thinking all it had was a silly image when i finally decided to click it.

so much for usability. how difficult it is to add a "play" triangle to video?

<comment><USER28> Charlie Rose, despite his quality as an interviewer, is still part of "Old Media" and their crotchety inability to get "New Media". I don't mean Rose specifically, but the people he's paid by.

Also, I sound completely stupid in that paragraph but I can't figure out how to say it better. :P

</comment></comment></comment><comment><USER29> Google needs to have some sort of brain interface to project glass. I.e. control it via your mind.

The speaking out loud is distracting. It wont work. It's too complicated. And nobody wants to talk with his glasses (like noone wants to talk to Siri in public). People will not use it.

<comment><USER28> None of the demos I've seen have involved any speaking. They've involved tapping something and what might be eye tracking or head movements, but all the speaking was pretty obviously superfluous.

</comment></comment><comment><USER30> It seems that Google's products have future utility to them that seems to be lacking from FB.

Facebook is focused on sharing. That can be an action, but until the action is focused, it doesn't seem to be useful (other than as a time-suck of course).

<comment><USER5> I fail to see how photos which provide pleasure, foster relationships, enlighten and educate is not useful but a camera you wear on your head is.

<comment><USER30> The camera is a prototype for the direction they're headed. Driverless cars and glasses which provide information about objects you look certainly have more utility than a "camera you wear on your head."

</comment></comment></comment><comment><USER31> Ultimately he's making a pretty big claim about Google's future here that isn't grounded in reality. This is the same sort of talk that crowned Microsoft the tablet king over a decade ago while reality waited for Apple to _actually build a consumer viable version_.

Whether it's the usual suspects like Google, MS and Apple who we know are already spending R&D here or a new entrant like Instagram which came out of nowhere with a handful of user friendly features, or some China anointed alternative it should be obvious that it's way to early to start counting chickens.

<comment><USER32> Author here: You're right that it's a big claim, and I think it requires a lot of imagination & even some suspension of disbelief. It's safer to be skeptical.

But specifically re: competition of all shapes & sizes, I do think that two of Google's long-term investments give it a pretty strong position:

1\. Google Maps & Street View, which together comprise an amazingly detailed model of the real world. There are alternatives like OpenStreetMap of course, but there's a lot more going on in those products than just navigation.

2\. The technology embedded in the self-driving car. I mean, a system that can interpret a live feed of the chaotic world around it and make important decisions based on what it sees? It doesn't feel to me like you can Instagram your way into that capability. (But, I don't know: maybe it's more commodified than I realize.)

<comment><USER33> To lend some credence to these claims: other than the well-known Sebastian Thrun, Google also has at least a _dozen_ world-class computer vision researchers working on a variety of different products, from Maps to the self- driving car to Goggles and others. This is some serious fire power, and in so far as the technical problems are unsolved (which they mostly are right now), no other company can touch them in the near future.

Of course, there is always the important step of making something that consumers will use, but that's only possible if the technical problems are solved first. And perhaps Google is learning how to make more consumer- friendly things...

<comment><USER34> I don't have numbers to back it up, but I would gather that at least MS has as many if not more world class researchers in those fields.

</comment></comment></comment></comment><comment><USER35> I don't think Google Glass is about taking photos (or videos) of your life. If anything, it makes the most sense to think of it as the next step to Google Goggles, and halfway to a Google Goggles HUD.

</comment><comment><USER36> As a moot sidenote, this story was submitted yesterday <http://news.ycombinator.com/item?id=4038962> (yes, coincidently by me)

<comment><USER37> For me personally it was the title. For me, I am not as interested in "pictures and vision" as I am interested in the ongoing dominance struggle between Google and Facebook. Sensationalism, or at least a good teaser title, wins the day for me I'm afraid. It is a good find though. Good luck next time!

</comment></comment><comment><USER38> Here's the thing I see, Google has no meaningful history of monetizing things like self driving cars or video glasses or anything else except for via advertising. Yeah, they sell some web services, but that's a lot different from going head to head with companies that know about manufacturing like Toyota and BMW or those that know about consumer electronics like Samsung and Sony.

I guess they could create an advertising sponsored self driving car or vision glasses that pop up ads (ala Walter Williams recent novel "The Fourth Wall" ISBN-13: 978-0316133395). But how is either going to be more profitable than their current model given the fundamental retooling of their business which would be required and the radically different cost structures associated with making real stuff?

That's not to say Facebook is destined for significant innovation. As an advertising platform, they may be Yahoo 2.0 over the long term - <USER2> profitable from advertising to pivot and not growing fast enough to get love from analysts.

<comment><USER39> Why stick to ads if you can sell / license software for cars?

It could both work from a manufacturer or a personal POV.

        Buy my car, it comes with Google.

<comment><USER40> Hopefully they'll be smart enough to actually license the software. I half- suspect they'd do something stupid, like open-source it on the assumption that it would increase the demand for web advertising (since you could just use a tablet or laptop during your commute instead of driving).

</comment></comment></comment><comment><USER41> What is interesting is that we think of Facebook as a social networking company, but they are mostly a hacker company whether it is hacking social networks, photos, servers, phone, etc. They have a similar culture to Google except coming at it from a DIY, teach yourself, pull it apart to put it back together again better angle and not a academic PhD research angle.

Facebook is a global company and if they come out with a phone it is most likely not going to be pointed at the US market alone. They will be developing a phone aimed at the developing country markets where they have much of their traction. My guess is that the phone will have a low price point so that it is affordable to anyone in the world who wants it who currently doesn't have a smartphone. This included with mobile payments is what Facebook is after, they want to own the global mobile market.

</comment><comment><USER42> I still think that the future of Facebook is data (not specifically picture data, that's just one piece). Advances in hardware and cloud computing have kick started an era where data mining and machine learning are pervasive in every field from pharmaceutical research to banking to sports and everywhere in between. Facebook is the single authoritative source for a whole bunch of personal data. People have started thinking about the basic applications for that data when it comes to things like online shopping (you're a 31 year old white male with an 8 month old daughter who likes rock and roll, so you probably want to buy diapers, zinfandel, and a radiohead album), but I think that lots of new interesting applications will emerge over the next several years that don't violate user privacy and will monetize well.

</comment><comment><USER43> when he talks of sharing vision he nailed what google glasses is going to be. example:

[https://plus.google.com/111626127367496192147/posts/CGR7sCzm...](https://plus.google.com/111626127367496192147/posts/CGR7sCzmDD7)

Post of a video from a person jumping on a trampoline wearing the glasses.

</comment><comment><USER44> I'm not sure I understand this article. What is it that he imagines actors and athletes doing that they don't do with Twitter now? People hold up their phones pretty close to their face when capturing photos and videos so it is already the first person POV. And it is pretty easy to do, I'm sure it will be harder taking pics with Glass than a phone, it is more flexible taking pictures with your hands than your face. The only successful consumer head- mounted cameras that I know of are the Go Pros which are used mainly for niche action shots. If the main advantage of Glass is just that you can take pictures in situations where both your hands are busy that does not seem like the huge use-case that is going to take down Facebook.

<comment><USER45> He imagines that the feed from, oh, say, a baseball player? (football is too violent) will, someday, be wearing one of these, and then you'll get to see the game from their perspective while they're doing other things, and it'll be awesome.

... I'll believe it's awesome, with copious amounts of editing. If you're just watching it raw, it'll be disorienting and shaky and distracting. :P I'm also dubious exactly what baseball team would bother to wear these things in the general case. Presumably they would just be a distraction to the players. Maybe someone like, oh, downhill skiiers would have a better time of things?

<comment><USER46> Go to youtube right now and watch any number of first person downhill skiing videos. What does Glass add to that?

<comment><USER47> Convenience

</comment></comment></comment></comment><comment><USER21> Google has a huge revenue generating machine in search, and adwords. This allows them the opportunity to spend massive amounts of money on a lot of projects that will mostly fail. They're hoping, at some point, one or more of these projects will turn profitable. But they're burning millions doing it.

The problem with this approach is that they end up neglecting their core search product, which I don't think has evolved much in the past decade. If someone else comes along and disrupts search, its goodbye Google.

</comment><comment><USER48> In short, the most important company in our lives will be the one that best looks after our memories.

</comment><comment><USER49> Despite of all innovation Google does, still past several years nearly 90% of their profit comes from online ads.

</comment><comment><USER50> Google could have been the picture sharing site of choice with Picasa but for it's broken paradigm.

</comment><comment><USER51> The only reason I don't delete my facebook is because of the pictures...and im not alone.

</comment><comment><USER52> I view Google as a simulation company. The end game will be a real time whole earth simulation, with predictive power, and the associated opportunity for massive profits in any field where being ahead of the competition is an advantage.

</comment><comment><USER53> This guy is reaching with a few of his statements

</comment><comment><USER54> re: Google Glasses

I can never wear a pair of glasses that has a 3G connection.

For better or for worse, I experience heightened ElectroSensitivity to the point where a 3G device that's operating within a few feet of me gives me a headache.

Most mobile carriers are already starting to deprecate their 2G networks.

Wearable wireless devices like Google Glasses will be a hazard for me, and many others.

Within the next few years, I won't even be able to use a cell phone.

<comment><USER47> I find that hard to believe. Have a friend put a box beside you. Ask him to flip a coin every day for a week. If it comes up heads, he will put a 3g phone in that box. Otherwise, it should be empty.

I will bet you that you wouldn't be able to tell the difference.

<comment><USER54> And why would make that up?

I've done experiments like that plenty of times to prove it to people. I can tell whether my iPhone is in 2G or 3G mode with my eyes closed.

It's well-documented. Search for "ElectroSensitivity."

Phones with a high SAR value cause headaches for a subset of the population - I'm one of them.

</comment></comment></comment><comment><USER55> Old Google = GoogleX (try outrageous things, see what sticks)

Current Google = Google+ (a beautiful bouquet of socially unified product experience)

Future Google = ??

<comment><USER56> GoogleX is still there.

</comment></comment><comment><USER27> Glass will be google's newton pad.

a new world promise, but in reality totally uncool and only used by a few san francisco hippies-yuppies. And then forgotten.

With a chance of a decade later becoming a game changer.

<comment><USER57> Sir I challenge you to a bet, $100 to our respective favorite charities.

In my opinion Google Glass is set to be a game changer from the start. I wager that when google glass is launched, it will be a cultural icon no more than 1.5 years later.

It's clear WHY google needs glass. Owning the channel between my eyes and the world is a huge potential pot of money. Targeted ads have a lot of potential to disrupt the ad space, and if facebook ever decides to make their own ad network (such as Google's ad sense) competition will be fierce. Google glass is a really good way to increase their competitive advantage, and cement their position in the advertising arena.

Additionally, of the companies that would be interested in making a product like google glass (facebook, microsoft, IBM etc) Google probably has the best mix of engineers to do it. I've always said that Google is an AI company first. Well a huge part of AI is machine vision, and a large part of successfully monetizing google glass is machine vision. Additionally, with street view, and other aggressive initiatives Google is in one of the best positions to actually understand what and where the world you are looking at. Finally, while google has proven in the past they are weak as a hardware company (nexus 1) they have demonstrated they are capable of bringing a consumer product to the mass market... though perhaps maybe not enough to make it anything less then a wild card.

Finally the last point is one of consumer adoption. The newton pad was not successful in part because the hardware was premature. But I would speculate it was also in part because consumers weren't at the point of understanding the value. The hardware in Google glass is unknown at this point, and potentially could under-deliver... and that will cause it to be a newton.. but for the reasons i said above I think Google is capable of delivering a quality product. However consumer readiness will not be an issue. 1 billion people are already on Facebook. Social interaction through technology is accepted today more then ever before. Using smartphones in public is not only accepted, its normal. Years ago using a PDA might have made you look like a yuppie, but today no one would notice.

<comment><USER27> 1\. i don't believe in paying third party charity

2\. you think all that for the same reason I also think all that: Wishful thinking... but deep inside i can see the truth. we are the hippies-yuppies who will buy it :)

put yourself on the shoes of people hearing about the newton back then: handwriting recognition!! how wouldn't want that instead of a 3x4 phone keyboard? Turned out 99.9% prefered T9. it's all the same. we are thinking as if the implementation and day-to-day use would be perfect on such a new concept on the first try. well, odds are it wont. but in one year can get back to it and see if my money goes to one of your charities or if your money will buy me something shinny (that's one bet i'd like to lose...)

<comment><USER58> So wait, you're morally against giving money to a charity but you're perfectly okay with betting his charity against your free money? Honestly curious.

Also - implementation and day-to-day use don't have to be _perfect_ for it to be a game-changer/overnight success/cultural icon. As evidenced by... Well, pretty much every piece of successful consumer electronics ever made that has gone through multiple generations/revisions.

<comment><USER27> yes, I AM against. but if he wins the bet, my money goes to it since for me to lose means he won. as it seems to be what he's into.

and yes. they work like that. the discussion is if it will happen in 1 year as he says or in 10-15 years as history says.

see what i did there? i put my words as valid as "history". hah. clever.

</comment></comment></comment></comment></comment><comment> excuse-me "Imagine actors and athletes doing what they do today on Twitter—sharing their adventures from a first-person POV—except doing it with Glass."

Imagine having to click on a dozen copyright notices and pay for each image you see on Google/Facebook because the image they just took is owned by $ACTOR in europe, but $STUDIO in USA and $AGENCY in Japan but a blank page because Facebook doesn't have a right to use it in Canada.

<comment><USER59> Why is this different than say Instagram by a celeb which happens all the time?

<comment> excuse-me People don't "follow" images on Instagram by actors - the google glasses example is proposing a twitter-like system where users follow an actor's view live.

Imagine a system where Napster had a musician bugged and could stream what they were playing in the studio - think there might be right's issues ?

</comment></comment></comment><comment><USER60> Naive question:

The author says image views are a subset of page views. Is this accurate when the photos are shown in a light box capable of cycling through thousands of photos without leaving the initial page?

<comment><USER61> Good question, I'd like to know the answer too. Javascript abstracts the whole theory of a "webpage" but I'm sure the image viewer reports back metrics and they have some system to track it all. In the end I'd guess it's probably treated similarly for marketing purposes.

</comment></comment><comment><USER62> Google is really good at seamlessly integrating the companies they acquire to give the appearance to users that Google develops much more than they actually do. The Google brand becomes synonymous with development that they actually did not themselves do.

</comment><comment><USER63> Smart. Facebook nailed photos and now they need to nail mobile. No wonder they bought Instagram.

</comment><comment><USER64> Saw this on reddit yesterday. Hacker News is the new Digg.

</comment><comment><USER65> Show me google glass embedded in a pair of contact lenses, and then we'll talk.

</comment><comment><USER66> That google glass picture scares the fuck out of me. It instantly devalues humanity and values voyeurism and narcissism over family.

If this becomes the norm, I'm going all Luddite.

I think it will also become: <http://www.youtube.com/watch?v=Ma8NbpCvSwo>

<comment><USER67> Can you elaborate how a picture taken with a camera you wear like glasses "devalues humanity and values voyeurism and narcissism over family" compared to a picture taken with a more (I guess) traditional camera?

<comment><USER68> A camera is alienating, and a camera that you constantly wear is even more alienating; like a locked cell is more imprisoning than a locked country.

Recommendation: [https://en.wikipedia.org/wiki/Black_Mirror_%28TV_series%29#3...](https://en.wikipedia.org/wiki/Black_Mirror_%28TV_series%29#3._.22The_Entire_History_of_You.22)

<comment><USER66> +1 for black mirror and well anything by Charlie brooker. Definitely worth watching!</comment></comment></comment></comment>


Not implementing features is hard - <AUTHOR> http://weblogs.mozillazine.org/roc/archives/2010/06/not_implementin.html

<comment><USER2> Not implementing features is easy. Explaining your abstract minimalist reasoning to users who have legitimate needs for the features is the hard part.

<comment><USER3> Explaining/justifying the reasoning may be hard, but it's not abstract minimalist, is it? More like idealistic about open standards?

</comment></comment><comment><USER4> Well this is interesting: "I don't think those [SVG Standards] are good enough reasons on their own to make SVG Fonts an essential part of the Web platform."

<comment><USER5> That's not really what the sentence is saying - taking it out of context and quoting it here is a bit of a disservice.

<comment><USER6> Is it that far out of context? My reading of it was that he feels that SVG fonts is an unnecessary solution to a problem that is solved better by other options. Thus, he thinks that just because it's in the standard doesn't mean it's actually important.</comment></comment></comment>


You Can Now Mine Cryptocurrency to Bail People Out of Jail - <AUTHOR> https://motherboard.vice.com/en_us/article/vb3j93/you-can-now-mine-cryptocurrency-to-bail-people-out-of-jail-bail-bloc <comment><USER2> So the average bail is $75? That seems extremely low, and if true, isn't there some sort of loan service that will lend those amounts to be repaid by the convict shortly after release? Mining cryptocurrency today is extremely worthless, and you will spend much more on the hardware and power than the cryptocurrency you mine.</comment>


Paper bag reveals forgotten history - <AUTHOR> http://blogs.bl.uk/untoldlives/2017/10/paper-bag-reveals-forgotten-history.html <comment><USER2> The Parsi ([https://en.wikipedia.org/wiki/Parsi](https://en.wikipedia.org/wiki/Parsi)) angle of this story went unaddressed!</comment>


Microsoft is starting to pivot - <AUTHOR> http://www.tnl.net/blog/2012/06/23/below-the-surface/

<comment><USER2> I'm sorry, but the writing is just absolutely awful. Content-wise there's nothing insightful or new here either. Just personal opinion, conjecture, and projections based on absolutely no hard facts at all. Seriously, this reads like a 16-year old's Reddit comment.

</comment><comment><USER3> Why do people use the word "pivot" to mean "change direction"?

The word pivot has many meanings but most imply some sort of stability or immobility. It can mean a physical peg or stick around which things turn, or the fulcrum of a lever which is also stationary. According to wiktionary it can also mean turning with one foot on the ground or to turn in a single spot.

I can somewhat understand when startups like to use cool lingo to imply how agile they are by being able to change direction in an instant, although I still find it annoying.

But Microsoft? Pivot? As in change direction nearly instantaneously? The answer is no. The title itself acknowledges this, since it includes the word "starting". If you're "starting" to pivot you're not pivoting. You're changing direction.

<comment><USER4> piv·ot noun \ˈpi-vət\

1

: a shaft or pin on which something turns

[http://www.merriam- webster.com/dictionary/pivot?show=0&t...](http://www.merriam- webster.com/dictionary/pivot?show=0&t=1340690904)

I always imagined it as turning (pivoting) on one leg to change the direction you're walking

<comment><USER3> Which is precisely something a behemoth like Microsoft can't do.

Can an oil tanker pivot?

</comment></comment></comment><comment><USER5> Having read the article I call FUD; Nothing to see and realy not worth reading. I could do better with a few grep lines a awk script and /dev/rand.

<comment><AUTHOR> Then please do :)

</comment></comment><comment><USER6> This is tangential point but if you need to make images fit into a smaller bounding box, crop them. Do not just rescale with a different aspect ratio. Stretched/squashed images look terrible.

<comment><AUTHOR> Thanks for the insight. I've been debating that for a while. I do create crop them initially and then do a rescale. Maybe I need to do something different.

<comment><USER6> I actually really like how you've kept the images as thin bands, really keeps the continuity of the text going. I'd just recommend that you use source material that looks good when cropped to fit such a wide aspect ratio without any stretching.

Other than that, great blog!

</comment></comment></comment><comment><USER7> Does anyone else think that the DOJ would go after Microsoft for anti- competitive behaviour if it sunk $10B into selling hardware below cost to move into a new market?

<comment><AUTHOR> I would disagree here because of the situation. Microsoft is no longer the dominant force it once was and thus can do what it want to compete against a larger company (ie. Apple). The DOJ would probably not see it as anti- competitive as, in this case, it would be more of a question of trying to crack through a market that is dominated by another player.

</comment></comment><comment><USER8> The lack of crapware in the new products can be a good start.

<comment><USER9> I know you got downvoted and while I agree with you, it's not really Microsoft's fault. Microsoft is actually trying to stop it themselves by offering the same (sometimes) PCs in their own stores that come without the crapware.</comment></comment>


If healthcare learns to share, blockchain could transform radiology - <AUTHOR> https://www.healthimaging.com/topics/imaging-informatics/healthcare-hare-data-blockchain-radiology-siim <comment><USER2> Take the all occurrences of the word "blockchain" out of this text, and it would not take away anything from this article.

Sounds like the author has no idea what he is talking about, and is forcing blockchain into the article when it has no relevance.

<comment><AUTHOR> This article [https://www.theatlantic.com/health/archive/2019/06/why- arent...](https://www.theatlantic.com/health/archive/2019/06/why-arent- electronic-health-records-better/592387/) about e-Estonia exposes the health record-blockchain connection but it too is thin on the details.

</comment></comment><comment><USER3> What exactly is happening here?

Is the information stored on blockchain just "Yes this provider can see my records?"

That doesn't strike me as something that requires blockchain, and maybe isn't even the hardest part...

<comment><USER4> Agreed, working with a group that is taking on this problem and doing very well. They get their hardware and ML onprem. Then comes distributed, differential training on encrypted EMRs.

The big key to success is creating a system radiologists want to use. Focusing on quality control before FDA. Building an ecosystem where hospitals make money be granting access to the data from the ML apps which can be uploaded through the dev portal and trained on data they would never have been able to access.</comment></comment>


The Grazr widget will stop functioning - <AUTHOR> http://mikepk.com/2010/07/the-grazr-widget-will-stop-functioning/ Grazr was an awesome project that was too early for its time. Now might be the good time to revive this? <comment><USER2> Is there room to innovate in RSS / Feeds / OPML? Is it worth it to try and rebuild the feed and widget technologies in Grazr now that they're shutting down?</comment>


Browser History (2013) - <AUTHOR> https://madhatted.com/2013/6/16/you-do-not-understand-browser-history <comment><USER2> I don't get what he doesn't understand: when the user goes back, the browser is supposed to show the document he saw when he left, as it was when he left it (so long as that view hasn't expired out of the browser's cache completely). This is intuitively what a user expects, right?

> Note: if history list mechanisms unnecessarily prevent users from viewing > stale resources, this will tend to force service authors to avoid using HTTP > expiration controls and cache controls when they would otherwise like to. > Service authors may consider it portant that users not be presented with > error messages or warning messages when they use navigation controls (such > as BACK) to view previously fetched resources. Even though sometimes such > resources ought not to cached, or ought to expire quickly, user interface > considerations may force service authors to resort to other means of > preventing caching (e.g. "once-only" URLs) in order not to suffer the > effects of improperly functioning history mechanisms.

I don't get what he fails to understand: if the back function obeyed expiration headers, then going back could potentially reload the page, potentially causing a re-GET or even a re-POST.

<comment><USER3> As I read and see this, it is not about normal HTML pages. The issue probably is more important for SPAs.

For example, you post something that increases your total message counter, and the URL is changed (single page app: the page is not reloaded, only modified by Javascript), for example showing the new message (think "forum" as an example). If the user clicks "Back" they may get the page-state with the previous counter value, confusing the user. Ideally you would want the counter to be updated.

One can construct similar scenarios for regular web apps/pages where a new page is loaded, but I think the caching behavior is more out of line for SPAs. It comes down to the web serving as app platform and not just as "HTML pages for reading". You don't expect - _in an application_ (compare behavior of a regular non-web application) - that when you go back the GUI may not reflect current state, in an app it always does, even if you go back to a previous form.

I think there will always be misunderstandings because of people who always think of the original web, a bunch of linked pages, and others who see it as (also) an application platform. The requirements needed for either often are fundamentally or sometimes subtly different. Is it ideal that we have a platform that is supposed to do such extremely different things all in one? Maybe not, but I think we actually managed surprisingly well to reconcile two very different concepts and requirements in the "web platform" thus far.

I think it would be valuable for discussion when authors a) state if they are talking about one or the other kind of web platform use b) consider that the other one that they are not talking about also exists and has equal value.

<comment><USER4> I would expect that if one _must_ write a SPA then one will hijack the Back button, no? So one could implement whatever logic makes sense within the SPA.

But really, one should avoid SPAs like the plague. Write web sites consisting of web pages. Only if the site or pages need more should one add JavaScript, and only if it's insufficient to purpose should one write an SPA (as an example, I have a hard time envisioning Mattermost, IRC or Slack working as web pages).

<comment><USER3>
        > one should avoid SPAs like the plague

Why? I don't see any basis for such a statement, but I'm more than willing to learn.

<comment><USER4> SPAs are basically an exploit, taking advantage of a dynamic document model and a language intended to layer a little bit of behaviour atop that model, and using it instead to deliver entire applications. It's a little like noticing that sed is Turing complete, and thus writing a text editor in sed.

The Web is supposed to be about resources and links between them; that's what REST is about (in a very real sense, REST is the driving principle behind the Web). In pretty much every case, those resources can have an attractive, human-readable HTML representation (but they may of course also have easily- parsed JSON or high-performance Thrift, flatpack or protobuf representations). One should be able to use a browser as one's user agent to use a web site built on REST principles to perform any sequence of operations that web site makes available.

Now, one might provide quite a lot of JavaScript over top of that REST interface, in order to provide a more user-friendly experience (one could imagine HN using JavaScript to allow inline commenting, while still preserving the ability to POST). In general, one should provide the plain resource- oriented interface first, and only add JavaScript later. For one thing, this helps one think clearly about the API; for another, it's a lot easier to take a clean REST API and use it from JavaScript than it is to take a purpose-built SPA and try to turn it into a proper REST system.

Now, there do exist some systems which really, _really_ don't make a lot of sense as primarily REST apps — in my post, I used the example of chat apps. Certainly, they should _have_ REST APIs, but honestly I can't see most people wanting to use them that way (although … it may be convenient in order to avoid distraction). For that sort of app, it's conceivable that one might properly begin with the SPA. Another example might be the 2048 game, or similar things. As much as I'd prefer a native gtk+ game, it is true that most people haven't yet upgraded to Linux; it's also true that as terrible as the JavaScript privacy & security stories are, they are much better than the native app privacy & security stories.

All those are good reasons to write an SPA.

But if one is building a brochure site, or a blog, or a magazine, or a trip planner, or an e-commerce site, or pretty much anything that most of use — then starting with an SPA is _wrong_. All of those should be modeled as resources and state first, with UI added later.

An example would be that I discovered it's impossible to checkout using Target's website without JavaScript; I was just trying to send a gift certificate to a friend, and now Target isn't seeing that money, due to a poor design decision. There's absolutely no reason that Target should require me to enable JavaScript in order to POST them a credit card number and a quantity.

<comment><USER3> You are not giving reasons against SPAs which is what you said earlier, you are giving reasons for using the right tool for the job. Which nobody disagreed with from the beginning, not me anyway.

<comment><USER4> > You are not giving reasons against SPAs

I think being inefficient ('writing a text editor in sed') and impeding doing things the right way ('it's a lot easier to take a clean REST API and use it from JavaScript than it is to take a purpose-built SPA and try to turn it into a proper REST system') are reasons not to write SPAs, no?

And the presence of reasons _to_ write proper HTML/HTTP apps implies why one shouldn't write improper SPAs, no?

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> The way I've always wished the back button worked is as though I had just opened a new tab (instead of clicking a link/submitting a form), and now I've just closed that tab and once again see the original tab I'd left.

I assume this is actually a big reason people use (so many) tabs... the back button doesn't work right!

Sigh!

<comment><USER6> It used to work like that in an old version of Opera back in the day (perhaps Opera 5.0? I think it was the same version that introduced gestures),but a bunch of sites saw it as insecure and blocked Opera users from their sites so they backed down and switched to the standard method.

</comment></comment><comment><USER7> I generally want a back button that rewinds time (server side be damned).

usually I'll right-mouse-button click + open in new tab on any link instead of just clicking on it.

Eventually, like garbage collection, I'll stop, go back to the start of the tabs and close a bunch of them, then go back to what i was looking at.

And if I'm on a site that doesn't allow right clicking on a link? well the site had better be important otherwise it's gonna get closed.

<comment><USER8> Use middle click (or for those without a middle mouse button on a computer they can't reconfigure, use ctrl/cmd + click)

<comment><USER9> Sometimes middle click gets swallowed by bad code.

But more importantly, you can't use either method if the link is a javascript function.

</comment></comment></comment><comment><USER10> You can use the pageshow event to detect when the browser navigates back in history to a page in the back/forward cache: [https://developer.mozilla.org/en- US/docs/Web/Events/pageshow](https://developer.mozilla.org/en- US/docs/Web/Events/pageshow)

More generally, you shouldn't make a "single-page app" unless you really need to. The web is designed for navigating between multiple documents. Browser features like history and bookmarks will work better if you stick to the standard behavior.

</comment><comment><USER11> > Today, the only option for ensuring an XHR request is made when the user re- > visits a page via the back button is to (1) add an unload handler then (2) > use cache busting.

I'm sure there is exceptions, but in general, the last thing I want my browser to do when i press back, is to start making requests. I expect the requests to have been already made.

<comment><USER12> The result of this thinking is when I press the back button, I have to refresh the page manually because the data is stale.

My daily use case for this is Github Issues. Simple repro: Click an issue, make a change, press back.

Now the list view is out of date and doesn't show my changes. So I have to refresh.

I think a background XHR request is the best approach (until browsers fix this issue for real). On page load: pull latest from server (if network is down, then no-op). If no changes, then don't change. If there are changes then replace inline without a new page reload.

<comment><USER8> No!

If I click back I want to see what I saw last time. e.g. I might have seen 3 news articles I was interested in, I click though and read the first one. When I click back I want to see the exact same list as before, and be able to read the next article I saw; not _new_ articles that have been written while I was reading the last one.

You can s/news article/github issue/ and my response is the same.

</comment></comment></comment><comment><USER13> Author here, happy this popped up and to see the HN community thinking through it. A few people have brushed off what I sketched as uninteresting and don't see any issues. I'll try to explain it another way (with three years reflection to help).

Single page applications are now quite popular. _Most single page apps use a different definition of "back" than browsers do_, and there are times when the two treatments conflict.

Many, or most, use a local in-memory database to keep track of information without going to the server. They update that in-memory store as you make changes. For example you see a list of names: Mary, Robert, John. You click Robert and edit the name to "Rob", the name auto-saves. Then you click "back".

Because single-page apps control "back" when in the SPA, they do what most developers want. They return to a semantically correct page, showing Mary, Rob (just edited), John. Tons of apps do this. _This is not what the browser does_. The browser, if following the "back" specs, would show the out-of-date names of Mary, Robert, and John.

The theoretical conflict can also become practical. Think through this flow:

* Visit /names

* AJAX for GET /api/names

* See Mary, Robert, John

* Edit Robert's name to Bob, autosave

* AJAX for POST /api/name/4 with the new name Bob

* See Mary, Bob, John

* Click on a link, lets say to Mary's website URL

* Mary's website, new domain, loads.

* ...click back

The SPA loads up, and attempts to GET /api/names. However, the bfcache is at play since the native "back" behavior is running. So the stale API response, with the original names Mary, Robert, John is returned. _The list of names on the screen is DIFFERENT than what the user saw after they edited_.

Additionally most SPA apps presume AJAX calls return accurate data, however here the names are _not_ the names currently in the database. They are only in the bfcache. You can imagine, with more complex data, ways this can cause complex and unforeseen failures.

This is a very poorly understood corner of JavaScript development even today.

[edit]: formatting

<comment><USER14> > So the stale API response, with the original names Mary, Robert, John is > returned.

This seems like a bug -- if you click back, it should take you to the page you saw before, not an earlier version of it.

AIUI the bfcache doesn't "remember and replay" API requests; it just caches the entire DOM and JS state.

Do you have something that can demonstrate this behavior?

> Because single-page apps control "back" when in the SPA, they do what most > developers want. They return to a semantically correct page, showing Mary, > Rob (just edited), John. Tons of apps do this. This is not what the browser > does.

This is not necessarily what users want (as evidenced by discussions on this post). Many people want the old page, especially if there's information there (form fields, or other state) that might have gotten lost by a misclick. As someone else noted here, the "back = reload page" behavior can be emulated in the bfcache world by back+reload, but if you don't have a bfcache you can't emulate the "don't lose state" behavior that the bfcache gets you.

It seems like a new meaning is being shoehorned into the "back" button, and then you're complaining it doesn't work.

<comment><USER13> Sorry :-( You are correct. What I described is not be behavior of the bfcache, it is the network behavior described under the heading "In practice". And there is a link there to a server that can help you play with the behavior.

Apologies for using the wrong term and causing confusion.

> This is not necessarily what users want (as evidenced by discussions on this > post).

HN not being representative of an average user aside, I don't disagree. My point is that there are two different expectations of what should happen and they can conflict and cause errors.

> you're complaining it doesn't work

I'm really sad you got that impression. I'm fascinated and think this an architectural problem of the web. My post is an attempt to describe the issue and raise awareness.

<comment><USER14> >it is the network behavior described under the heading "In practice". And there is a link there to a server that can help you play with the behavior.

Right, except requests aren't being made there, it's just that the devtools seem to say that they are. The scenario you gave as an example (with the /names API call and whatnot) isn't possible AFAICT. Maybe I misread something?

> My point is that there are two different expectations

Yeah, agreed, there are two expectations here.

APIs that let you explicitly invalidate bfcache entries (something on pushState() maybe?) or detect bfcache loads would be interesting, and would let SPAs deal with this problem, perhaps.

</comment></comment></comment></comment><comment><USER15> On the desktop, I like having the option to see what a page just looked like, without reloading any data.

If I hit the back button, it's usually because something on the previous page caught my attention and I want to find it again. If I want to reload a page, I'll refresh or click on the site logo (in the case of getting to the root of the site).

<comment><USER16> I hate when I go back and things change. I went back for a reason!

But I'm also of the school that wants View Source to view the source that was just downloaded, not re-download a new copy of the source.

<comment><USER17> I've never understood why View Source would do anything but show me the source of the page I'm looking at - not the source of the page as it is "now," which could be seconds, minutes or hours later. If I'm looking at a page, the browser has or could have a copy of the original stream sent from the server, why not just display that?

<comment><USER18> What browser(s) are you using that have such behaviour? Is this a new "feature" in the very latest versions? I don't think I've ever seen View Source make another request on Chrome, Firefox, IE, or Opera.

<comment><USER17> Chrome does.

"Yes, when you "view source", you're really opening a new tab that opens the page again and displays the source rather than renders the page."

[https://bugs.chromium.org/p/chromium/issues/detail?id=4650#c...](https://bugs.chromium.org/p/chromium/issues/detail?id=4650#c2)

</comment></comment></comment></comment></comment><comment><USER14> Note that the behavior described in the post is per spec -- the cache spec is a red herring and doesn't apply here. The web specs override the HTTP spec in various spaces.

The relevant spec is at [https://html.spec.whatwg.org/multipage/browsers.html#the- ses...](https://html.spec.whatwg.org/multipage/browsers.html#the-session- history-of-browsing-contexts)

Note:

> An entry with persisted user state is one that also has user-agent defined > state. This specification does not specify what kind of state can be stored.

> User agents may discard the Document objects of entries other than the > current entry that are not referenced from any script, reloading the pages > afresh when the user or script navigates back to such pages. This > specification does not specify when user agents should discard Document > objects and when they should cache them.

and from [https://html.spec.whatwg.org/multipage/browsers.html#travers...](https://html.spec.whatwg.org/multipage/browsers.html#traverse- the-history)

> If entry no longer holds a Document object, then navigate the browsing > context to entry's URL

and

> If entry has a different Document object than the current entry,

> ...

> Make entry's Document object the active document

\</comment><comment>

Browsers try to treat the back button as if the user had never left the page. So the XHR requests aren't re-made because the page simply isn't reloaded, it's just made active.

The fact that Chrome says "from cache" might be a bug here, but what the devtools show isn't visible to JS/etc, so this isn't a compatibility issue. AFAICT Chrome and Firefox (and presumably Safari) behave the same here, except from a difference in how the bfcache is invalidated. (chrome seems to invalidate when the domain changes).

I'm not clear why all of this is a problem though. If the page is reloaded, it's reloaded. If it's loaded from the bfcache, it's as if it was never unloaded (almost the same as the user switching a tab and coming back, except of course JS was suspended). Both behaviors seem ... fine for a webapp?

</comment><comment><USER19> It's hard to take this seriously because the page itself does not work correctly w.r.t. the back button.

For example, if I click through to the http 1.1 spec in the first paragraph, then hit "Back" I see the scrollbar shrink as new content is loaded and uBlock's block count increases as new content loads.

If I scroll to the bottom of the page, click a link, and then click back, I don't even go back to the same spot - I'm at the end of the article and content loads below it...

My expectation as a user, regardless of the spec, is that I should see exactly what I saw when I was just on the page. Render to a bitmap, and when I click "back" display the bitmap. If going back to the page requires any network requests then the page is doing it wrong.

The exception that proves the rule would be streaming content.

</comment><comment><USER20> This isn't an all-or-nothing issue. The author generalizes that developers and users today use browsers/html differently than they did before, but what I'm hearing is actually a new way to use the word/button for "(go) back".

The back button has not changed functionality--it still works as expected on all non-webapp webpages.

From my perspective, I think the author should be asking for browsers to implement a new button that follows his desired "load previous URL" behavior.

</comment><comment><USER21> This article no longer reflects the behavior of Safari at least as of version 10 (the version that ships with macOS Sierra). In my tests, the second version of the page that attempts to bust the bfcache behaves identically to the first version, i.e. the bfcache is not in fact busted.

</comment><comment><USER22> bendmebackmeanywayyouwantme? That rang a bell... but according to [http://www.azlyrics.com/lyrics/garbage/ithinkimparanoid.html](http://www.azlyrics.com/lyrics/garbage/ithinkimparanoid.html) it should actually be bendmebreakmeanywayyouneedme ;)

</comment><comment><USER23> [2013]</comment>


The Day My Coworkers and I Chose Our Survival over Our Supervisor - <AUTHOR> https://jacobinmag.com/2020/05/coronavirus-covid-911-september11-attacks-ground-zero <comment><USER2> Drives home the point that leverage is really everything, and having some way to push back against a boss really matters.

<comment><USER2> In other news:

[https://twitter.com/atrupar/status/1264996588834996226?s=21](https://twitter.com/atrupar/status/1264996588834996226?s=21)

</comment></comment><comment><USER3> There are a few details missing from this story that I would have liked to have known:

* What happened to Billy?

* How close was the store to ground zero?

* What ultimately happened to the workers who walked out? Obviously they weren't fired, but was there a disciplinary process, etc.?

</comment><comment> nca-peripherals Don't be led around like a slave to other people's money.

Think for yourself and f corporations.

Too many Americans falsely believe hard work, sacrifice, and personal risk will be rewarded when they are in-fact risking everything for next to nothing.

<comment><USER3> Exactly. To the corporation, you're "human capital stock." [0] Never forget that.

\---

[0]: [https://news.ycombinator.com/item?id=23316697](https://news.ycombinator.com/item?id=23316697)

</comment></comment><comment><USER4> This guy has a decent overall point but you know he's a prick when he implies being able to acquire a big flag quickly means ignoring the need for acquiring masks.

Does he know the persons tasked with acquiring those things? Does he know that getting the flag delayed getting the masks? What if multiple people were tasked separately and the flag simply easy to get?

Then he goes on to assert that governors and CEOs are opening up too quickly: "before it's safe". Get over it, people. It's time to go back to work. It can and is being done well.

I don't understand this desire by many people to be remain in panic mode. Is it comforting or something? How bizarre...</comment>