SoftBank Leads $164M Bet on Mapbox - <AUTHOR> https://www.wsj.com/articles/softbank-leads-164-million-bet-on-digital-mapping-startup-mapbox-1507640404 <comment><USER2> Where I live OpenStreetMap data is superior to Google maps. There are streets that are several years old that aren't in Google maps yet, and their satellite photos really needs updating too. Strava uses Mapbox instead of Google, and it's much better because of it. I'm happy for the competition in the maps space, and the promotion of open data.

<comment><USER3> there is also HERE map app. it started in nokia, microsoft, and now under new management. Don't know if it is going to get better or worse because of that.

<comment><USER4> Owners:

1985–2007: Navteq

2007–15: Nokia

2015–present: Audi, BMW, Mercedes, Navinfo

2016–present: Tencent, GIC Private, Intel

On 3 August 2015, Here was sold to a consortium of German car makers Audi, BMW, and Mercedes. On 4 December 2015, the consortium completed the acquisition for 2.8 billion euros (2.9 billion US dollars).[33][34] As of December 2015 the company had 6500 employees.[35]

In December 2016, Navinfo, Tencent and GIC Private Limited (the Singapore sovereign wealth fund) agreed to buy a 10% stake in HERE.[34] In January 2017 it was reported that Intel was taking a 15% stake in the firm.[34]

Captain Wikipedia flies away.

</comment></comment></comment><comment><USER5> Mapbox is an amazing product, it's super expensive and pretty hard to swallow the bill every month as a small startup, but the product is just so good, their APIs are fantastic. For sure a company to watch, their COO Roy was the COO of Twilio and he knows what he is doing.

<comment><USER6> Can you name a few usecases where you would pay them? Doesn#t have to include your own.

<comment><USER5> We build a data store for municipal governments, we have a very light weight data viz tool that allows municipal workers to view the data on a map: [http://john.je/mzHm](http://john.je/mzHm)

<comment><USER6> And why didn't you do it in an open standard data format and just present it on Google Maps?

<comment><USER7> Google Maps itself isn't exactly open standard... See the woes of OpenLayers, for example.

<comment><USER6> Yes, that's why I put these as two separate points.

</comment></comment></comment></comment></comment></comment><comment><USER8> Having used Google Maps in a professional context for quite some time, I certainly welcome the competition. Their data is the gold standard, but their Enterprise licensing team is difficult to deal with. One example: We were sold a license that we were subsequently told was inadequate. We were then forced to use a 3rd party broker to negotiate a new deal, and even then the terms were unclear. Also strange because you get 75% discounts at each pricing tier, so we ended up in a tier that gave us "lots of room to grow".

</comment><comment><USER9> Zero mentions of OpenStreetMap in that story. Can't be surprised I guess.

<comment><USER10> There are zero mentions of any other open source project too.

The good news is that having a commercial platform on OpenStreetMaps is a good thing (tm) - they are driving a lot of improvements to the dataset and the licensing on it means that they have to as they improve it.

That's a good thing in my book, but yes, all of this investment would be impossible without OSM.

<comment><USER11> They are also driving a lot of crappy contributions.

They have huge power to push their own vision in terms of data and tags based on their money.

There are many other commercial providers based on OSM's many possibilities. Mapbox have great marketing.

<comment><USER12> What are the worst examples of money driven tags?

</comment></comment></comment></comment><comment><USER13> I trust the MapBox team to execute and innovate on complex technical challenges. Personally, I hope this investment translates into MapBox sending a lot of the high resolution LIDAR derived data back to OSM or similar.

</comment><comment><USER14> Supporting Development Seed in developing Mapbox is one of the Knight Foundations biggest successes and is on point with their mission.

</comment><comment><AUTHOR> Paywall Aversion:

Archive.is: [https://archive.fo/IdXZD](https://archive.fo/IdXZD)

FB: [https://www.facebook.com/flx/warn/?u=https%3A%2F%2Fwww.wsj.c...](https://www.facebook.com/flx/warn/?u=https%3A%2F%2Fwww.wsj.com%2Farticles%2Fsoftbank- leads-164-million-bet-on-digital-mapping-startup- mapbox-1507640404&h=ATO15fivQaJd4hCklK0rTI4otGpSuNecQByMxBAb2rkYkXGr67An1yh9cJdyDtuAuR3jOqcLMv3VRCMDyA7LQSkcs4AelUGKqC7jqOs&_rdr)

<comment><USER15> You can also prepend 'outline.com/' to bypass the paywall.

<comment><USER16> Never knew of outline.com. I now have a new favourite site.

</comment></comment></comment><comment><USER11> So how will Mapbox fill the $164M dept of required "growth".

<comment><USER17> One way is by being bought for $164m + x, where X >= $0.

</comment></comment><comment><USER18> <shameless but relevant self-promotion> I work on a similar product, one more focused on analytics for location data. We also use OSM as our datasource, and it's cool to see other companies in this space. So far most of our customers are less technical (we have an Excel Plugin which interacts with our API). We also have a python client which can do geocoding, driving distance/time, and US census data lookup. We're a small team and offer competitive pricing. If you're interested, or just want to check it out, please shoot me an email or go to [https://cairngeographics.com/](https://cairngeographics.com/) . Lastly, for those who are interested, we're using Elixir on our backend!

</comment><comment><USER19> My main gripe with Mapbox and perhaps it's something that's been fixed recently? Is that you could never force place names to English whe available. So if you're making a map of Tourist map of thailand then the default for all places will obviously be in Thai, if you want to use the English translations which is in the underlying OSM data you can't. But you can if you roll your own...

<comment><USER20> The `{name}` field that's the default for most place labels in styles is the "local name", in the local symbol system.

Change it to `{name_en}` in your style for place labels, and you'll get English-script names where available.

<comment><USER19> Thank you, I will look into it again, admittedly I think it's been at least a year since I last checked into see if it's possible.

</comment></comment></comment><comment><USER21> SoftBank, it seems, has and is continuing to make investments in startups with unique/proprietary data... smart team...eg recently uber, nauto, mapbox..

</comment><comment><USER22> Smart bet.

</comment><comment><USER23> Paywall.

</comment><comment><USER6> Congrats to the Mapbox guys. Always looked like a cool team.

However personally I'm not sure it's a business case that will survive the time. But doesn't matter, with that kind of investment and their current track record they probably live 10+ years, which is well enough in times like these.

<comment><USER24> FTFY - Mapbox guys + gals + non-binary folks + dogs

<comment><USER6> No.

<comment><USER25> Yeah. It's not all guys. [https://www.mapbox.com/about/team/](https://www.mapbox.com/about/team/)

<comment><USER6> "No." means: I don't care if you identify as Apache Helicopter and feel disrespected for being called "guy". This planet has some real issues we need to solve. But that is not one of them.

You can be called "guy" AND be awesome.</comment></comment></comment></comment></comment>


Shopify has paid over $300k in security exploit bounties - <AUTHOR> https://hackerone.com/shopify-scripts <comment><USER3> This wasn't unexpected outside of the extend of the bounties.

What you have to realize is how important Security is to Shopify. We are a trust based business to an extreme extend. We host the livelihoods of hundreds of thousands of other businesses. If we are down or compromised all of them can't make money ( as some of you saw during Black Friday, to the tune of $300k+ a minute at times ).

One of the best ways for us to augment our internal security team is to work with the white hat community. This was a pain before Hacker One but now is significantly easier.

One challenge is that Shopify (still) hasn't really got the profile in the tech industry that a lot of Silicon Valley local companies have. This is totally fine by me, but it's means that if a top white hat sits down and decide what to work on, we are not automatically top of mind.

So we decided to overspent as a kind of "marketing" investment. Hacker one is a classical two sided market place. There is plenty of supply of skilled researchers but also a lot of demand for their services. We want to be known for being one of the most responsive companies and also pay top dollars for top findings.

So the basic idea is that when we launch something new, we 10x the payouts to bootstrap the process of familiarization. We also provide a very convenient local environment for doing the work in. It should be more fun and more lucrative to make Shopify related discoveries then other companies. After this initial period we then reduce the payouts somewhere slightly above community standards. Its all just business 101.

Internally we are actually thrilled how the shopify-scripts/mruby program went. Most (all?) of what was found would have been caught by our sandboxing but we don't want to rely on this. As everyone who does security knows - <USER2> of exploits, even if superficially contained, can sometimes combine into "the big one".

<comment><USER4> So I'd be interested to know your thoughts on bug bounties as against "traditional" security reviews.

Have these areas of your application been through external reviews before being opened up to bug bounty or did you decide to start there?

I was thinking that for the amount you've paid out in bounties you could've engaged a reasonable team for several man-months, so was interested in what led you more down the bug bounty line for this.

<comment><USER5> You seem to assume we set out to pay this amount to begin with. Indeed for this amount we could have went other ways, but hindsight is 20/20.

No one expected to get so many valid sumbmissions in such a short time. We set the payout amounts this high as a way to attract talent at the beginning of the program, which worked quite well to bootstrap it.

<comment><USER6> I literally just got off the phone with Hacker One on Friday and they recommend the exact OPPOSITE of what you did. Start with low or no bounty to get the easy stuff off the plate and figure out what class of reports you want -- then ramp up the bounty over time.

Which is what we'll be doing!

</comment></comment></comment></comment><comment><USER7> _we expect most vulnerabilities will no longer be exploitable without additional bugs in the kernel or seccomp itself, and so we are lowering the payout amounts for our program to 10% of previous levels._

I don't quite follow this logic. If bugs are now going to be more difficult to find, one would think they would be more valuable, not less.. and that by lowering the bounties they are lowering the incentive for people to search for them.

<comment><USER8> I suppose because the vulnerabilities would actually be vulnerabilities in someone else's code they don't feel it should come under their umbrella?

<comment><USER9> That's flawed reasoning IMO. Do they expect the underlying porject maintainers to have the same resources they do to compensate third party vulnerability research?

It really should be the other way around, public facing, revenue generating projects should do all they can to subsidise vulnerability research and upstream their findings. The alternative would be to start paying up more for the code they use from third party and what are the odds of that.

<comment><USER10> With those lower 'underlying project' bugs there are multiple actors who can compensate for vulnerability research, so the market rate goes down.

It makes sense to either: lower the payout to reflect market rate or start a seperate scheme for those projects that others can buy into. Unfortunately if you use a seperate scheme you end up paying for bugs that don't affect you.

Personally I'd have split my own payouts into things from my own project (100%) and things from other projects (10%).

The fact they haven't done this suggests to me that they consider the bounty system too expensive - either in payouts or maintenance. By reducing payouts you will likely reduce interest and increase signal to noise at the cost of less signal.

<comment><USER9> or send the signal to other less well intentioned parties who see the value of owning vulns to popular underlying libs

<comment><USER10> I don't know how strong that argument is, yet I suspect not very.

The problem with selling to 'less well intentioned parties' is that they are hard to get a hold of, hard to trust, and time consuming to work with. I very much doubt that many people who sell to them are not already close to them and their ilk. I also see this much like the arms trade, where illegal trading is an intrinsic property of the trader, not a function of the market.

</comment></comment></comment></comment></comment></comment><comment><USER11> As someone who has built a company around working closely with the Shopify platform, I'm very happy Shopify is taking these initiatives.

I like that Shopify isn't your typical Silicon Valley tech company. But coming from a background as a tech and security consultant for Fortune 500 companies, Shopify does feel like I'm back in the tech little leagues sometimes.

And this is an unfair image association problem Shopify has. Their tech is quite amazing and a lot of very brilliant people work there.

It's great to see Xal, the CEO of a publicly traded company with a close to $4bn market cap, this active on HN. I've always considered him one of the most brilliant engineers of our generation ever since the Active Merchant days. To me these programs and the way they are being shared on HN really help bringing his company the credit it deserves.

</comment><comment><USER12> The found vulnerabilities are mostly on mruby itself so it's pretty interesting.

A lot of PoC are very simple:

        a = Decimal.new
        a.initialize a

[https://hackerone.com/reports/185775](https://hackerone.com/reports/185775)

        A ||= break while break

[https://hackerone.com/reports/183356](https://hackerone.com/reports/183356)

        a = Symbol.new
        a.inspect

[https://hackerone.com/reports/185957](https://hackerone.com/reports/185957)

etc.

</comment><comment><USER13> I don't know if it's the right place, but does anyone has feedbacks regarding the Hacker One platform? Especially for small SaaS (between 1-2M ARR)?

<comment><USER14> As someone who has used hackerone on both sides (managing and reporting bugs) I'd suggest starting a private program first. Select a small group of researches known to provide good reports and wait for them to start rolling in. Use this as a pilot, if you see value in what's being reported keep it open.

Keep in mind you're going to see a lot of reports in the beginning, it will level off as you apply fixes. You'll need to prioritize these bug fixes in your organization, if you do not fix them within a time period the researcher has the ability to disclose the bug publicly.

I recommend you review your program guidelines with a lawyer before starting it.

<comment><USER15> +1 to starting a private program first which is recommended by all bounty programs.

If helpful I wrote down my notes about starting a bounty program although my experiences were formed by larger companies [https://medium.com/@collingreene/bug-bounty-5-years- in-c95cd...](https://medium.com/@collingreene/bug-bounty-5-years- in-c95cda604365)

</comment></comment></comment><comment><USER16> Still cheaper than one good security engineer. :)

</comment><comment><USER17> This bug bounty program was limited to MRuby and paid by Shopify. Does anyone know where they use MRuby in their stack?

<comment><USER18> From [1]:

>> The Script Editor app lets you create scripts that are run each time a customer adds items to their cart. Shopify Scripts can have many uses, from discounting products with specific tags to running promotions such as "buy 2, get 1 free". Shopify Scripts are written with a Ruby API that allows a great deal of control and flexibility.

The description on the bug bounty page says those 'Shopify Scripts' are executed in an MRuby environment, which they are trying to keep sandboxed.

[1] [https://help.shopify.com/api/tutorials/shopify- scripts](https://help.shopify.com/api/tutorials/shopify-scripts)

</comment></comment><comment><USER19> Shopify seems to basically have given up on application-level sandboxing, and now relies on process-level sandboxing (e.g. seccomp).

This is probably wise; the track record of in-language sandboxing is pretty bad (see also: Java applets.)

<comment><USER20> I was under the impression that JVM, CLR and probably e.g. V8 are reasonably secure. I'd like to learn more about recent sandbox-escaping vulnerabilities in these runtimes. Got any resources?

<comment><USER21> For JVM, consider this update which happened in 2016:

"Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610)"

[https://access.redhat.com/errata/RHSA-2016:1458](https://access.redhat.com/errata/RHSA-2016:1458)

</comment></comment></comment><comment><USER22> about a year's salary for a security-focused engineer. Did they get more or less bang for their buck? I guess we need to ask haquaman how many hours he spent in collecting that $49k (by my count)

<comment><USER23> I spent 3 days on it and collected $70k. Per hour that's near a top lawyer :P

<comment><USER24> Were you recruited to work on the bounty?

<comment><USER23> no

</comment></comment></comment></comment><comment><USER25> pft, the salary of one engineer & you get pure results from him. Who wouldn't do that?

</comment><comment><USER26> Honestly the highest bounty is $2000 only, seem low for remote code execution.

</comment><comment><USER27> The page won't load for me, it said, because my browser, Opera Mini 4.x, is not supported. "But I'm browsing on a Nokia feature phone," I vehemently object. "No exploits will run. Even ads don't."

</comment><comment><USER28> I'm surprised it's so little. 300k is very little compared to the financial burden that a security breach would bring. Talk to Target and Yahoo about cost. If anything they might start looking into way of increasing it.

<comment><USER29> It's very delicate to talk about financial burden, given the following references:

"Two months after damaging data breach, Target stock has its best day in 5 years" [http://blogs.marketwatch.com/behindthestorefront/2014/02/26/...](http://blogs.marketwatch.com/behindthestorefront/2014/02/26/two- months-after-damaging-data-breach-target-stock-has-its-best-day-in-5-years/)

"Sad reality: It's cheaper to get hacked than build strong IT defenses" [http://www.theregister.co.uk/2016/09/23/if_your_company_has_...](http://www.theregister.co.uk/2016/09/23/if_your_company_has_terrible_it_security_that_could_be_a_rational_business_decision/)

"The Cost of Cyberattacks Is Less than You Might Think" [https://www.schneier.com/blog/archives/2016/09/the_cost_of_c...](https://www.schneier.com/blog/archives/2016/09/the_cost_of_cyb.html)

And my take on this topic

"Is it really cheaper to get hacked?" [https://dadario.com.br/is-it-really- cheaper-to-get-hacked/](https://dadario.com.br/is-it-really-cheaper-to-get- hacked/)

<comment><USER30> So, the best way to monetize a breach is to play with the company's stock while you disclose the breach. Interesting.

<comment><USER4> Yeah that's already a thing [http://www.zdnet.com/article/cybercriminals-turn- talents-to-...](http://www.zdnet.com/article/cybercriminals-turn-talents-to- stock-market-manipulation/)

Also monetizing security vulnerabilities by place bets on stock when disclosing has already happened [http://www.careersinfosecurity.com/st-jude- medical-files-law...](http://www.careersinfosecurity.com/st-jude-medical- files-lawsuit-over-device-security-report-a-9385) . It does carry the risk of a lawsuit however...

</comment></comment></comment></comment><comment><USER31> and about $150k is made of only 3 people being rewarded interestingly enough.

</comment><comment><USER32> "It looks like your JavaScript is disabled. To use Hacker One, enable JavaScript in your browser and refresh this page."

Kinda ironic that a site that is supposedly for hackers wants you to expose yourself to zillion browser vulnerabilities before you can see its content.

<comment><USER33> 'Cos a true hacker would be able to enable JavaScript without exposing himself.

<comment><USER34> How?

<comment><USER35> Up-to-date browser in Virtualbox with uMatrix for manual whitelisting?

To go more tinfoil, a "trash" laptop on its own subnet.

<comment><USER36> Better keep your real laptop at a safe distance unless you want VM escape --> Bluetooth propagation --> pwned.

<comment><USER37> Well, web Bluetooth is a thing now, so no need to escape VM in that scenario

</comment></comment></comment></comment></comment></comment><comment><USER38> What's funny is Facebook -> has a publically faced image server that has NO authentication required to see even private messages. When FB Security was contacted ... they say it was not a "guessable" URL, ergo security through obscurity was their "security method" of choice. This was two days ago.

If anyone wants to test this theory - setup 2 FB accounts, message an image one FB account to the other. Click on the image with the second account (to bring up the lightbox custom thingy they have). Drag that image into notepad (to get the URL)... then try and logout of both accounts, clear your cache, and you'll see the image is COMPLETELY public -> meaning no authentication is required.

They refused to acknowledge this as a "security risk". I laughed, then was really pissed that a PRIVATE image shared between two parties can be viewed w/o authentication above it.

WTF?

<comment><USER39> Hi "FBSecuritySux",

I'm not a member of the Facebook security team, but I work in the industry and your comment frustrates me. I can understand criticizing companies for poor security decisions if they are legitimately bad decisions, but I don't think that's the case here...

I just tested this between two Facebook accounts, and got a URL like this: [https://scontent.fsnc1-1.fna.fbcdn.net/v/t35.0-12/12628848_1...](https://scontent.fsnc1-1.fna.fbcdn.net/v/t35.0-12/12628848_10210262841021024_251749007_o.jpg?oh=6ae8902a3a7ae3a78397cd7fa0864b45&oe=5857E4D3)

Let's imagine, for the sake of argument, that all those numbers in the URL are predictable and 100% the security relies on the "oh" and "oe" parameters. Taking a rather naive approach both of these appear to be exclusively hex strings. Therefor "oh" is 16 bytes and "oe" is 4 bytes making the total 8*(16+4) = 160 bits

In other words, assuming both parameters are truly random, an attacker would have to try (worst-case) this many combinations to view a victim's image: 2,135,987,035,920,910,082,395,021,706,169,552,114,602,704,522,356,652,769,947,041,607,822,219,725,780,640,550,022,962,086,936,576

</comment></comment><comment><USER34> I guess that all the money Shopify makes allows them to afford weak reasoning/engineering.

Giving your users a ruby interpreter inside your infrastructure is a terrible idea. They're just one unreported bug away from disaster!

One could think of a few alternatives, all of them involving decoupling Shopify's servers from users' scripts.

It could be anything from Docker/k8s to AWS lambda to a custom DSL. I'm not saying any option is easy - proper solutions tend to require effort.</comment>


This New Vulnerability: Dowd's Inhuman Flash Exploit - <AUTHOR> http://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/ <comment><USER2> I'm going to guess that this post has limited interest to this audience (please correct me if I'm wrong).

But what may interest you, if you're a dev, is TAOSSA, Mark Dowd, John McDonald and Justin Schuh's awesome Addison-Wesley book on reviewing source code for security problems:

<http://taossa.com>

If you code, and there's just one book you're going to put on your shelf to fill the "security" slot, fuck Applied Cryptography (which is going to _cause_ security problems in your code). This book is about as large, and, in stark contrast to Schneier, flipping to any page of it is probably going to improve the security of your product.

In the very best case with your company, people like Mark Dowd --- or at least people who've memorized his book --- are what you're up against the moment someone decides your security needs to be reviewed (to take credit card numbers, manage personal information, or get deployed at a Fortune 500 client).

Highest possible recommendation.

<comment><USER3> This exploit is nothing short of a work of art; seriously, it's beautiful.

I haven't checked out TAOSSA, but I have to admit I've got a pretty dog-eared copy of Applied Cryptography here on my desk. In my defense, I only have it for light reading over lunch, I wouldn't dare implement anything from it by hand ;)

<comment><USER4> Wait, is AC bad or good?

I can't tell whether the gp means it'll cause problems because the protocols are hard to implement or wrong.

<comment><USER2> AC is bad. If you implement cryptography and you're not depending on it in some way, you're wasting time. If you do depend on it, you have to get it exactly right. Even people who do that for a living don't know exactly what that means.

[http://www.matasano.com/log/487/rsa-signature-forgery- explai...](http://www.matasano.com/log/487/rsa-signature-forgery-explained- with-nate-lawson-part-ii/)

<comment><USER3> I would say AC is good from a theory point of view, but bad as an implementation guide. Kind of in the same way that a Chilton guide will tell you all sorts of things about your car, but you shouldn't try to build a car from scratch based on it.

<comment><USER2> Ferguson and Schneier wrote a followup book, "Practical Cryptography", which addresses the shortcomings of "Applied Cryptography" --- it selects the "best" algorithms and protocols to use, and tries to document the pitfalls of actually implementing them in real software.

I recommend it with reservations. It's an extremely valuable book, especially if you're a security evaluator looking for crypto vulnerabilities. As an implementation guide, it misses glaring faults that real software constantly introduces.

There simply is no by-the-numbers guide to implementing crypto in an application, and doing it wrong is worse than not doing it at all.</comment></comment></comment></comment></comment></comment>


Horizontal History - <AUTHOR> http://waitbutwhy.com/2016/01/horizontal-history.html <comment><USER2> The author's comments on needing to have a better understanding of the state of the world that surrounded any particular person or event rings true to me. It's one of the reasons I enjoyed Jacques Barzun's _From Dawn to Decadence_ , a sprawling historical account of western civilization from 1500~2000. He deliberately de-emphasizes the exact dates of things, aiming more to show the significant events within the surrounding "mood" of the general time and place in which they occurred. Barzun also emphasizes that "a reader of history must be a reader of histories" due to the perspective or bias that any writer of history is bound to impart upon the work, just as the author suggests.

While I found the second chart showing lifespans as vertical bars to be interesting, I think that it doesn't quite do what the author set out to do. I can see that these three or four people were alive at the same time, but it doesn't so much help me to understand how what person A did might have influenced person B to do whatever it was they are remembered for, or even if the influence was the other way round. A might have been a late bloomer and B a prodigy. With lives frequently spanning half a century or more, there's a lot of room for interpretation. I am not complaining: this is an interesting proof of concept. It could be improved, I think, by adding additional markers to the lifelines for each person's achievements, and also perhaps having by bands of color in the background showing large-scale events such as wars, disasters, etc. Of course then you'd get into the mess of sorting out e.g. how much influence a war between England and France had on contemporary events in Germany, possibly necessitating more complications in the visual display.

In fact upon first seeing the lifeline chart, I thought of Barzun's big book and how handy it would be to have an interactive version of the chart where I could click on a lifeline, or a defining moment, and be shown the relevant section(s) of the book, or really any number of books. In that respect it would function as sort of an index for finding specific historical events and understanding their surrounding contexts. If I were a technically-minded historian working today, I'd set my sights on implementing something like this. A visual, clickable exploration of history seems like something lots of people would get into.

<comment><USER3> The idea to make an interactive version is not new and I and most probably several others already had it before reading this article. The technology is all there on the web. Just look at this: [http://evolutionofweb.appspot.com/](http://evolutionofweb.appspot.com/) The issue is there is a huge amount of crisscrossing data that needs to be curated, classified, adapted and maintained. It's a shame Wikipedia is no longer as forward thinking and reputable as they once were. They would have made a great steward of such a project. Of course we can still use the data Wikipedia has but someone still had to maintain the great parallel timeline project.

It's so unfortunate that in the end the downfall of almost all things made by groups of people comes from within those very groups. And unfortunately this phenomenon is probably not going to change very soon.

And speaking of groups. On the same timeline we could plot the lifeline of a lot of other things like organizations, construction projects, movements, etc.. And as you said events would be displayed horizontally intersecting with all those involved.

It is unfortunate that past and current approaches of teaching history at all levels do not make use of such an obvious concept. It's not super hard to figure out that things happen at the same time and influence each other. And it's not like it is impossible to use such representations without computer interactivity. Interactivity just makes it better. All history is thought as a fairy tale and emphasis is placed on knowing the exact date and time of an event instead of knowing how it relates to other contemporary and past events. All of this makes history have appeal limited to people used to thinking sequentially. Current approaches to history are impenetrable for someone who thinks about the big picture first. The common approach to history simply can't see the forest for the trees.

</comment></comment><comment><USER4> Fascinating, it's easy to fall into the trap of thinking some individuals live in separate alternate histories.</comment>


Ask HN: Any method to get HTTPS working for root domain and www on GitHub Pages? - <AUTHOR> I am curious if anyone in the HN community has a workaround for this not really "solved" GitHub Pages issues: https://github.community/t5/GitHub-Pages/Does-GitHub-Pages-Support-HTTPS-for-www-and-subdomains/td-p/7116<p>HTTP based redirection is not supported by my registrar, and would not be preferred to use anyway, and migration due to this issue does not seem ideal. I raised this as a Ask HN as it appears to impact a number of other popular websites, a small sampling is provided below:<p>- https://www.commonmark.org/<p>- https://www.scikit-learn.org/<p>- https://www.pytorch.org/<p>- https://www.selenium.dev/<p>- https://www.rpm.org/<p>- https://www.webassembly.org/<p>- https://www.wkhtmltopdf.org/<p>- https://www.metaflow.org/<p>- https://trailofbits.com/<p>- https://www.microservices.io/<p>- https://www.semver.org/<p>- https://www.vue-chartjs.org/<p>- https://www.flutterowl.com/ <comment><USER2> Maybe this will help: [https://blog.cloudflare.com/secure-and-fast-github- pages-wit...](https://blog.cloudflare.com/secure-and-fast-github-pages-with- cloudflare/amp/)</comment>


Show HN: [Node.js] how I built Pate, my latest open source side project - <AUTHOR> https://firstname.lastname@example.com/introducing-pate-my-latest-open-source-side-project-12da4fccd9fc <comment><USER2> You should mention first the problem you are trying to solve, you only mention that at mid page.

<comment><AUTHOR> Thanks for the suggestion xchip, you're probably right!</comment></comment>


Propagation Delay and Its Relationship to Maximum Cable Length - <AUTHOR> http://www.wildpackets.com/resources/compendium/ethernet/propagation_delay <comment><USER3> > Electrical signals in a copper wire travel at approximately 2/3 the speed of > light.

An interesting fact - in those copper wires (or any type of wires) the electron velocity itself is less than 1 centimeter / second (and often in the mm/s range). Whether it's DC or AC, it does not matter much.

Think of the wire as a tube with a bunch of ping-pong balls inside - <USER2> it up tightly from start to end. If I stick my finger into one end of the tube, a ball will come out at the other end almost instantaneously (regardless of how long the tube is), but the balls themselves only moved a small distance - _and only at the speed/velocity I pushed my finger at_. But the "signal" "traveled" at a much higher velocity.

So in DC - electrons only travel a few centimeters / second (not anywhere near light speed), and in AC - you're pushing/pulling the same electron back and forth for eternity at about the same speed as it travels in DC.

Now it's of course a bit more complicated (the electrons rattle around at much greater speeds, and the mentioned velocity is a net average), and there are some edge cases, but for the most part the above is accurate.

I'm just not 100% sure of the speed of electrons in a superconducting loop (Cooper-pair electrons) - if they are truly relativistic or not.

And if this does not blow your mind, you should not be reading about electricity. PHDs in the electrical field don't even know this stuff.

<http://en.wikipedia.org/wiki/Drift_velocity>

TL;DR; If you raced a snail and an electron in a wire together, the snail would win - <https://www.youtube.com/watch?v=jbi7gJTPSXk>

<comment><USER4> So if my tube of ping-pong balls is infinitely long, am I sending my signal infinitely fast?

<comment><USER5> You're forgetting about propagation of force within the ping-pong ball. It is not immediate.

<comment><USER4> For which (TIL) the speed of propogation is limited by the speed of light - except (maybe) gravity: <http://www.metaresearch.org/cosmology/speed_of_gravity.asp>

</comment></comment></comment></comment><comment><USER6> Cat6 and cat5 are recommended to go no further than 90 meters:

<http://en.wikipedia.org/wiki/Category_6_cable>

<http://en.wikipedia.org/wiki/Category_5_cable>

Links are full duplex nowadays, the bus architecture is long gone and hubs are rare (usually just old), switches are dirt cheap so no reason for hubs.

The limiting factor is simply the ability of the electronics to recover the signal reliably. You can go way beyond the specs if you are willing to accept ever increasing packet losses due to degradation of the signal, one way to improve throughput over such links is by shortening your MTU.

Another simple solution to make longer runs is to use a fibre-optic repeater (for instance this ancient 10 mbit device: [http://www.blackbox.com/resource/files/productdetails/10542....](http://www.blackbox.com/resource/files/productdetails/10542.PDF) but there are tons of others, more modern gear: [http://www.signamax.com/mediaconverters/13-10100basettx- to-1...](http://www.signamax.com/mediaconverters/13-10100basettx-to-100basefx- single-fiber-converters) as an additional advantage, fibre optics don't suffer from electrical interference and act as an optical barrier for electrical signals which is very handy in industrial environments).

Or to forego cabling entirely and to use wireless with directional antennae.

<comment><USER7> > switches are dirt cheap so no reason for hubs

Hubs are nice to packet-capture from a small device without a managed switch in between, so it's a bit of a bummer that they're hard to find these days.

<comment><USER6> Yes, that's a good trick. And splicing the RX pair to two different cards only works in rare cases, usually you have to lock the ports to a certain rate/duplex mode.

<comment><USER8> If you value your time, and hair, the best answer is to just buy a good network tap.

<http://www.networktaps.com/>

</comment></comment></comment></comment><comment><USER9> None of this applies to modern gigabit ethernet installations, which are full- duplex and switched so that collisions don't occur. Maximum cable length is limited by signal degradation, so the limit is soft. With good quality cables you can go a little beyond the rated maximum.

<comment><USER10> Exactly. The switches buffer packets. The article is talking about a CSMA limitation of the old unbuffered hub architecture (and the "real electrical bus" coax networks before that) which have been irrelevant for over a decade now.

And my experience is that you can actually get _well_ beyond the official lengths for most signal types even with comparatively cheap cables as long as you're willing to test and throw out the odd cable or connector. Standards are written with conservatism in mind.

<comment><USER8> > Exactly. The switches buffer packets.

In most cases, you're right. The vast majority of switches use a sore-and- forward design (buffering), but when you get into latency-critical applications, another type of switch design is used, typically called a cross- bar switch.

[http://www.researchgate.net/publication/220055485_A_low- late...](http://www.researchgate.net/publication/220055485_A_low- latency_modular_switch_for_CMP_systems)

<http://www.google.com/patents/US5339396>

I think opinions vary on whether or not crossbar designs "buffer" but it mostly depends on how you define buffering. None the less, the low-latency crossbar designs try to eliminate the latency caused by buffering in the older but more common store-and-forward designs.

<comment><USER10> This is a valid point and I should have been more precise. But AFAICT all those interconnects are single duplex point-to-point links, and thus not subject to the CSMA issues of asymmetric collision detection detailed in the linked article.

</comment></comment></comment></comment><comment><USER11> Cool article. Though it only talks about ancient Ethernet variants. Issues like packet collision don't happen on most networks because we use switches instead of vampire taps and hubs.

Can someone more knowledgeable explain the parts that are still correct?

<comment> X-Istence All of them. Just because Station A and Station B are switched means that we could now say that the Switch is Station C. So lets say Station A starts transmitting at the same time as Station C (our switch is sending a packet from Station B to Station A) we can still get a collision.

We no longer get a collision between the nodes on the switch because of the fact that the switch will buffer packets as necessary before sending them on to their intended target, which reduces the amount of collisions that can/do occur...

<comment><USER12> I thought this stuff was full-duplex now, with each direction using different wires. So there's only ever one device that can transmit on a given set of wires, thus no chance for collisions. Is that not the case?

<comment><USER13> Yes that is true for gigabit. Gigabit ethernet is ethernet in name only. It doesn't resemble the original standard in most meaningful ways. But the name is a brand at this point so whatever the new standard is, it's always called ethernet even if it's completely different electrically. Or even optically in the case of fibre, which is something that was never originally anticipated that it would run over.

<comment><USER14> Backward compatiblity too.

</comment></comment></comment></comment></comment><comment><USER15> Propagation delay is dependent upon a variety of factors and while the numbers the article quotes may be correct for thick-net and thin-net, the cable we use for CATV trunk-line is significantly faster at about 0.85c ([http://www.china- satellite.com/sdp/1385167/4/pd-5853918/8382...](http://www.china- satellite.com/sdp/1385167/4/pd-5853918/8382534-2286595/RG540_QR540_QR540JCA_QR540JCAM109_Trunk_Line_Cable.html)).

Interestingly, the propagation delay through single-mode fiber tends to be significantly lower than through copper (well ... again it depends on the cable), but the 0.66c speed is a pretty good number for fiber.

</comment><comment><USER16> When was this article written? The last time I worked in an office with 10Base2 cabling (aka "thin ethernet", using RG-58 coax about 5mm thick with BNC connectors) was 1995. The last time I saw 10Base5 (aka "thick ethernet", using an extra-stiff variant of RG-8 coax about 10mm thick, in continuous runs with "vampire taps") was sometime in the late 1980s.

And if the maximum cable length were simply proportional to signal propagation speed / bit rate, then why does 10Base2 have a shorter maximum length than 10Base5? They're both carrying 1e6 bits per second. Do signals really travel 3 times faster through fat coax than through thin?

</comment><comment><USER17> Interesting article. A nit that can be picked is that it is not generally true that electrical signals in copper travel slower than c. The reason the signal travels slower than c in an ethernet cable is that the copper is surrounded by dielectric material, and it is the presence of the dielectric that slows down the signal. If the 10BASE5 coax cable was filled with air instead of foam, the signal would travel at c.

</comment><comment><USER18> Very misleading article title. The entire thing is about collisions, which only limit the length between ethernet cards, which is 5 times the length in the title. I suspect the 500m is related to the bandwidth and signal degradation rather than anything in the ethernet protocol.

</comment><comment><USER19> "You may know that the minimum frame size in an Ethernet network is 64 bytes or 512 bits, including the 32 bit CRC. You may also know that the maximum length of an Ethernet cable segment is 500 meters for 10BASE5 thick cabling and 185 meters for 10BASE2 thin cabling. It is, however, a much less well known fact that these two specifications are directly related."

Odd, given that the VERY first thing anybody is taught about CSMA/CD ethernet is how the maximum length of cable and minimum packet size are precisely related. Indeed, it's almost the only thing people are taught about the relationship of those two.

</comment><comment><USER20> > _Since we know that Ethernet operates at 10Mbps or 10,000,000 bits per > second_

I'm trying to figure out if this essay was written in the late 80s or the early 90s.</comment>


Time Series layer on top of FoundationDB with Millions of writes per second - <AUTHOR> https://github.com/richardartoul/tsdb-layer <comment><AUTHOR> There are some great slides: [https://static.sched.com/hosted_files/foundationdbsummit2019...](https://static.sched.com/hosted_files/foundationdbsummit2019/3c/DiamondDB%20-%20FDB%20Summit%20Presentation.pdf)</comment>


U.S. pressed to disclose secret court's order on Yahoo email search - <AUTHOR> http://www.reuters.com/article/us-yahoo-nsa-order-idUSKCN12800D <comment><USER3> > Intelligence officials told Reuters that all Yahoo had to do was modify > existing systems for stopping child pornography from being sent through its > email

It's such a convenient wedge for getting the technical capabilities and laws in place, isn't it?

<comment><USER4> Along with the other three Horsemen of the Infocalypse.

[https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...](https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse)

</comment></comment><comment><USER5> Secret courts, secret processes and secret orders are very problematic. They leave the individual or group with no recourse to the rule of law. Essentially one single order by the FISA court 'can' suspend all your democratic rights. Without recourse. Without limits.

Given the FISA court cannot be challenged and you can't even speak about it, this is similar to the dehumanizing helplessness one would feel in a totalitarian state.

The FISA court is basically a rubber stamp. The hundred percent approval rate puts it in the company of kangaroo courts seen in the most dubious regimes.

We need to hold ourselves accountable to the minimum basic values we loudly professes. Or there will be no credibility to call for springs or draw attention to democratic deficiencies around the world.

There are serious inconsistencies that are now impossible to brush aside. Without serious pushback this destructive pattern of executive behavior is not going to stop.

</comment><comment><USER6> Well this is an interesting detail: _The court-ordered search Yahoo conducted, on the other hand, was done by a module attached to the Linux kernel - <USER2> other words, it was deeply buried near the core of the email server operating system, far below where mail sorting was handled_

In other words, a lot of effort was spent to hide the very existence of the code. Injected into systems in a stage far from the intended scope, and made to persist across upper level application rewrites.

No wonder their security team freaked out when they discovered it.

<comment><USER7> Could putting such a thing in the Linux core not also open vulnerabilities which a Hacker such as the "state sponsored" one could have used to steal yahoo's user data?

</comment></comment><comment><USER8> >secret court directing Yahoo to scan all its users' incoming email...

>it appeared to involve new interpretations of at least two important legal issues.

>order from the Foreign Intelligence Surveillance Court, a secret tribunal...

Very sketchy. Shades of Lavabit / Snowden

</comment><comment><USER9> I am going to bet that it was more than just Yahoo. Google was definitely on it too.

Yahoo is just being forced to reveal now it due to the Verizon deal.

<comment><USER10> Assuming the worst is a self-fulfilling prophecy. It destroys any incentives these companies may have not to cooperate.

<comment> nv-vn They shouldn't need any incentives. They should be led by morally upright people who fight for the right cause and protect their customers.

<comment><USER11> Many of these companies did stand up to the government, but were forced into line through a secret set of courts, laws, and administrative procedures. This leaves aside all the undocumented pressures which the government has applied in order to achieve their desired objectives; we know these sorts of tactics are used because many government officials freely admit that they avoid e-mail (and it's not because they're illiterate). There is only so much that individuals can do to oppose the government, especially when the policies are popular.</comment></comment></comment></comment>


Tell HN: The 2 best things I love about HN - <AUTHOR>

1) No ads 2) The wealth of FILTERED information you get everyday without browsing any other website<p>I used to waste so much time on techcrunch, venturebeat, techmeme, slashdot, google news, mashable, engadget and the likes. But, thanks to HN, not anymore. :) <comment><USER2> I'll chip in with the "2 worst things I hate about HN", since I enjoy being contrary.

1) The groupthink that arises in certain political/scientific/social debates. I find that the nontech debates here are more uniform and less varied than they are on sites with similar quality.

2) While the site's filtration is good, the fact that its only two lenses are "news" and "jobs" makes the community less flexible and, frequently, less engaging.

It's still easily a top three social news site, though, so I'll resume my lurking and quit being a pest.

<comment><USER3> at 5600+ karma, that's some serious lurking you've been doing :)

<comment><USER2> I noprocrasted my account for 4 months. I used to feel more involved in the community than I do now. I'll consider that lurking.

</comment></comment></comment><comment><USER4> I would add

3) generally very thoughtful discussion in the comments.

<comment><USER5> This is the #1 for me. There are other ways to filter content and block ads, but finding quality conversations is difficult.

<comment><USER6> Honestly, if they removed the URLs from the front page and just kept the conversation topics and community, I'd still get 98% of the value from the site.

(Ads are value-neutral for me, incidentally.)

</comment></comment></comment><comment><USER7> 1\. HN is one of the few places where I constantly bump into people who are simultaneously more knowledgeable, more intelligent, and more accomplished than I am. Humbling, challenging, and rewarding.

2\. I love that this is a community where smart people help other smart people navigate life, from deciding what to major in, to picking a database server, to dealing with an unruly roommate.

</comment><comment><USER8> HN loads extremely quickly. I can generally scan through a page of comments quicker than the linked article while their rendering is blocked on 3rd party scripts/ads

<comment><USER9> I find that when I have a crap iPhone connection and I want to surf, I go to HN just b/c I know it will load.

</comment></comment><comment><USER10> For me its:

1) Subject Matter of the articles. for the most part the articles on here are right on target in what I am interested in.I know lately there has been talk of some cruft getting through, but for the most part the quality of articles to make it to front page is high.

2) Community I find that the community here is respectful and the members tend(and their comments) to be quite knowledgeable and highly focused. The community in general is a positive one.

</comment><comment><USER11> News aggregators are useful if they convince me to read something useful that I otherwise wouldn't have seen.

A few seconds before I saw this question, I saw the link to "The Economics of Suicide". Surely a recipe for content-free emoting, that I would usually ignore ... but with 20 up-votes on a Saturday night. And I'm better off for having read it.

I still skim Slashdot, too. That's just a different selection of things I wouldn't have otherwise seen, but sometimes enjoy.

</comment><comment><USER12> A community of doers and thinkers.

</comment><comment><USER13> I'm not even a programmer but I come on here every day because when the submissions are relevant to my interests they're very good quality.

</comment><comment><USER14> For me it's:

1\. I don't have to be in a vacuum anymore. If I read something on the internet and form an opinion about it, I can post it here and see what others think. I can also comment on any discussion, and soon enough I'll probably get feedback. I simply don't have that many people in my life with whom I can have this interaction about things I care about.

2\. I don't have to _be_ alone. I usually work from home alone for long hours. Some days, being one alt-click away from like minded people keeps me going.

</comment><comment><USER15> I like that when I see a comment that I'm tempted to downvote (if I could), several people have already taken care of that for me.

Also, the amount of cross-disciplinary knowledge the community brings to bear on most issues is pleasantly humbling.

</comment><comment><USER16> 1\. Interesting content.

2\. Good quality, helpful, useful comments with very few idiots.

</comment><comment><USER17> I had never even visited techcrunch, venturebeat, mashable or engadget before stumbling upon HN. There are a ton of links to these sites.

But the thoughtful and insightful discussion by like-minded developers is a breath of fresh air.

</comment><comment><USER18> I disagree. Techmeme is better for quick news scans.

And the level of discourse here is better than most places, but the time decay of stories (and comments) leads to quick bursts of discussion near the top, followed by dead silence.

</comment><comment><USER19> 1\. High quality discussions. 2\. Any BS gets called out with relevant evidence

<comment><USER4> _2\. Any BS gets called out with relevant evidence_

There could still be more improvement in this, but the current baseline is not bad.

</comment></comment><comment><USER20> The articles posted here are always interesting and of good quality. The comments are well-mannered without a bunch of idiots ruining the posts (most of the time anyway).

</comment><comment><USER21> 1\. Meeting people! (Whether through the comments here or through #startups)

2\. People help each other! (Ask HN, website feedback, participating in betas, etc)

</comment><comment><USER22> 1\. Ask HN feature. 2\. Comments and discussion.

</comment><comment><USER23> For me, it's definitely rms.

<comment><USER24> Get a room you two :-p

<comment><USER23> Oh can we rms?

</comment></comment></comment><comment><USER25> I love the lack of leftist politics that have taken over reddit.

</comment><comment><USER26> Compared to, for example Programming Reddit, HN has:

1\. Good quality links (less fluff, and good links are often more visible here) 2\. Good quality comments.

</comment><comment><USER24> My favorite is the absence of circlejerk ;)

<comment><USER27> Except for present company, of course.

</comment></comment><comment><USER28> I tend to filter information also using www.postrank.com for high volume sites such as the ones mentioned by OP.

</comment><comment><USER29> 1) Fast turnover of stories 2) the 250ish limit means I can actually run out of reading and get back to working

</comment><comment><USER30>
        * Community
        * Quality of Comments

</comment><comment><USER31> People probably shouldn't be up-voting meta discussions.

</comment><comment><USER32> people in here give motivation start my own startup</comment>


List of Algorithms - <AUTHOR> http://www.scriptol.com/programming/list-algorithms.php

<comment><USER2> <http://www.itl.nist.gov/div897/sqg/dads/>

</comment><comment><USER3> Here [0] is an algorithm for bipartite matching not listed there. Too bad it is not a wiki.

[0] <http://en.wikipedia.org/wiki/Hopcroft–Karp_algorithm>

</comment><comment><USER4> It would make more sense if it was a wiki, so people could link to detailed descriptions/implementations of the algorithms listed. The invitation to email those to the author (at the bottom of the page) is not exactly encouraging.

</comment><comment><USER5> Missing: motion detection

Also missing: any interest in what's missing. Maybe that's a bit harsh, but if it's been thru Reddit already you'd think they would have a way to submit additional requests.</comment>


Ask HN: How and when to do referral marketing for your startup? - <AUTHOR>

With my wedding registry website (GiftyWeddings.com), I've found that word-of-mouth seems to work very well, and it's certainly cost effective (profit/cost tends to ∞). So I'm looking for ways to "promote" word-of-mouth, like referral or affiliate marketing (but not get-rich-quick junk).
I know Dropbox does this quite effectively with their "get an extra 250MB for each friend you sign up" thing. It's a bit harder for Gifty, because I'm not offering something I can just expand by the MB, and I'm not sure I want to go to a premium/fremium model. One way would be to offer say a $5 discount on a couple's registry for every couple they in turn sign up.
Anyway, do you guys have any experience with how best to do referral marketing? Or pointers to good articles on the subject? <comment><USER2> I don't have any sources to cite, but with my graphic design business I give discounts or cash for referrals. Although just telling people doesn't really seem to do the trick. Instead, get them something in their hand that reminds them about it. I like to use something that is akin to a coupon, but really well designed and on heavy card stock. Perhaps even embossed or foil stamped... all depends on what your marketing dollar looks like.

Probably not the end-all solution you're looking for, but a small hint from my experience.

Goodluck!</comment>


This project posts one new startup idea every day for a year - <AUTHOR> https://www.billiondollarstartupideas.com/ <comment><USER2> A service where you agree ahead of time and whenever you need a dental appointment instead of emailing you they just kidnap you with a panel van and you wake up later after the procedure.

Toothly: Anxiety free dentistry.

<comment><USER3> Any services to deal with my anxiety about randomly being kidnapped?

<comment><USER4> Twist: They kidnap you in your sleep with anaesthetic gas.

<comment><USER5> Interesting. So you don't even have to know that you just had surgery. You could just go to sleep as you would normally, wake up, and everything is better. if anything you'll probably think you just had some weird kind of dream because of the anesthesia.

<comment><USER6> This will really mess you up psychologically and question your reality and your agency for a while.

<comment><USER7> Working life already has the same effect on me so no worries :)

</comment></comment></comment></comment></comment></comment><comment><USER8> Some useful reading/viewing on this subject:

Ideas are just multipliers: [https://sivers.org/multiply](https://sivers.org/multiply)

Idea vs Execution: [https://www.quora.com/What-do-you-think-is-more-important- th...](https://www.quora.com/What-do-you-think-is-more-important-the-idea-or- the-execution)

Timing is an important factor: [https://www.youtube.com/watch?v=bNpx7gpSqbY](https://www.youtube.com/watch?v=bNpx7gpSqbY)

</comment><comment><USER9> Like [https://nugget.one/ideas](https://nugget.one/ideas)?

</comment><comment><USER10> Ah! Ideas are cheap. Implementation is hard.

<comment><USER11> This is why patents are stupid.

<comment><USER12> But patents are supposed to cover implementation, are they not? (I know they are completely messed up and don't work properly for that purpose currently)

<comment><USER13> Patents are not required to cover implementation details, and in fact, it is not even required to lay out any detail of the mechanism. As an extreme example of this physicist Leo Szilard was granted a patent on nuclear chain reaction in 1936, three years before it was discovered scientifically. It was sufficient for the British patent office that if such a mechanism existed, it could release large amounts of energy.

This may be an extreme example, but it illustrates that implementation details is not a requirement for a patent. This is also the case for a lot of software patents. They are broad enough to cover nearly anything, but not detailed enough to be useful as a description to build useful technology.

<comment><USER14> In the US, a patent requires enablement (ability to make it). That can be squishy, of course, as it doesn't require a working prototype.

[https://www.upcounsel.com/difference-between-patentable- and-...](https://www.upcounsel.com/difference-between-patentable-and-non- patentable)

</comment></comment></comment></comment></comment><comment><USER15> One new _stupid_ startup idea every day.

</comment><comment><USER16> ice cream trucks but for toilet paper

<comment><USER17> Mobile supermarkets with base requirements (TP, Sanitary Napkins, Water, various Food stuff). Drive around take requests through a perspex wall, stick items in a secure box and push through to outside truck.

This concept has legs if ask you me. Wish i had the capital and time to try it.

<comment><USER18> In my country this is still common in countryside without the secure box. Various "themed" trucks go through small villages and you can hail/stop them to buy stuff. They also each have their theme music so you know which one is it.p

</comment></comment></comment><comment><USER19> Ideas are incredibly cheap. Execution is hard as someone else pointed out. Beyond that, a random AI crapsoup of techonerdmangled words would give a pretty good "billion dollar idea":

AI ML crypto spaceship

Nano modular ML-based DNA aggregator

Crypto but actually is useful

And some of the most important ideas require the most boring execution:

\- safe, clean toilets for the next billion

\- all-display walls, e-paper that can act as lights too

\- instead of self driving cars how about simple government intervention to provide sensors on roads for augmented-driving cars?

\- continuous study of flu via most populated areas to predict flu vaccine 6 months from now (Bedford lab but super charged and automated)

\- and finally, 5$ hospital saline solution

These seem stupid and naive but I believe they are some of the most important "ideas" and again without any execution plans.

<comment><USER20> Curious about the saline solution problem, it appears 0.9% concentration is available for roughly $10/L on internet marketplaces, likely can be manufactured much cheaper, but getting it for that price in a US hospital might be a challenge.

<comment><USER19> My point is the insane supply chain costs that permeate the insurance, hospital and medical manufacturing industry. I used the saline solution as an example based on an LA Times investigation that found out saline solution is charged 1000$+.

Again a very hard problem as it involves innovating across the board in boring ways.

</comment></comment></comment><comment><USER11> It seems that most of these startups are in the space of what I would call low-tech, i.e. smartphone apps and websites.

<comment><USER21> Are you implying anything by "low-tech" or just an observation?

</comment></comment><comment><USER22> I'm not sure I'd call any of these billion dollar ideas, but some of them are interesting nonetheless.

</comment><comment><USER23> Some are really interesting, to be honest.</comment>


Apollo Guidance Computer Restoration [video] - <AUTHOR> https://www.youtube.com/watch?v=2KSahAoOLdU <comment><USER2> It is great to hear that the efforts of the different team members are brought together and to see the progress. Absolutely fascinating how the dedication of a few engineers can bring history to life.

We are [re]living in exciting times!

If you are interested to see more of the groundwork, a few weeks back on the HN front page we had the link to the engineer working on the Rope Memory Modules (effectively the ROM). His channel has the "unboxing" video of the AGC that is currently in the process of being restored: [https://www.youtube.com/watch?v=OkFy30kxfh4](https://www.youtube.com/watch?v=OkFy30kxfh4)

*edit fix typo</comment>


Car CNG conversion licenses cost $10k from the EPA - <AUTHOR> http://gas2.org/2009/07/31/natural-gas-conversions-could-cost-a-couple-hundred/

<comment><USER2> The existence of absurd EPA regulations is not a surprise. However the claim that a car can be converted to CNG for "a few hundred dollars in parts and labor" is unbelievable. You can't just throw a couple of barbeque grill tanks in the trunk. A DOT-approved CNG tank will be roughly $2000 - $3000 all by itself, based on prices at <http://www.cngconversionsonline.com/>

Add in other parts and labor and I'd ballpark it at around $5,000 minimum. And it has to be done properly: you don't want a CNG leak in your garage overnight. Some sort of certification of installers is warranted.

<comment><USER3> It costs "a few hundred dollars in parts and labor" in Moscow, Russia ($400 [Lada] - $1500 [Chevrolet Suburban], Russian, Polish, and Italian parts), based on price lists on the web. Labor is cheaper here, but it takes from 4 (most cases) to 12 (non-standard cases) hours to install.

<comment><USER4> You're also probably ok without an EPA license in Russia or India. The complaint's probably valid in the context where it matters. But either way-- taxing 300% or 3,000%--that's a travesty for an organization that's purportedly dedicated to preserving the environment.

<comment><USER5> New vehicles in India have to confirm to a Euro IV emission standards (equivalent).

GM sells an LPG version of a small city car in India [1]. Just so that you understand the level of market awareness and "capitalism" in play.

[1] [http://indianautosblog.com/2009/06/chevrolet-spark-lpg- launc...](http://indianautosblog.com/2009/06/chevrolet-spark-lpg-launched-in- delhi-price-and-specification)

</comment></comment></comment></comment><comment><USER6> Why would natural gas make less carbon emissions?

<comment><USER7> Short answer: because it has a lower carbon:hydrogen ratio.

NG is mostly methane (minimum 88% if I recall the stickers on the PG&E "pumps"), with 1 carbon and 4 hydrogens. The rest is made up primarily of also fairly short (2-4 carbon) chain hydrocarbons.

Traditional gasoline is heptane (7 carbon) and octane (8 carbon).

Methane's ratio is 0.25.

Heptane's ratio is 0.4375, and octane's is 0.4444. (Longer chains asymptotically approach 0.5).

<comment><USER2> But, you'll burn more methane than gasoline to get the same energy. I wonder how close it ends up in reality.

<comment><USER7> Acutally, it's the other way around.

[http://en.wikipedia.org/wiki/Gasoline_gallon_equivalent#cite...](http://en.wikipedia.org/wiki/Gasoline_gallon_equivalent#cite_note-0)

CNG is 5.660 pounds (2.567kg) per GGE.

<http://en.wikipedia.org/wiki/Gasoline#Density>

Gasoline is 6.073 pounds (2.755kg) per gallon.

I get the same economy (30-33 mpgge) in my Civic GX as in my gasoline Civic.

However, let's compare carbons based on molar mass (16.042 g/mol for methane and 100.21 g/mol for heptane and octane is 114.23g/mol). That's 160 moles of methane per GGE and 27.5 moles of heptane per gallon. That's a ratio of 160:192 of carbons. For octane, that's 24 moles per gallon, about the same ratio. It's not 1:4, granted, but these are just hand-wavey approximations for the gasoline, which has the added complication of ethanol. I'm also assuming _complete_ burning, which is patently false, considering that, before modern emissions controls, it was possible to commit suicide by carbon monoxide poisoning from engine exhaust.

Edit: Molar mass</comment></comment></comment></comment>


Functional CSS – The Good, the Bad, and Some Protips for React.js Users - <AUTHOR> https://github.com/chibicode/react-functional-css-protips <comment><USER2> I expected to hate this but I love it already. I'm not on the all-functional all-the-time bandwagon. I go functional when it suits what I'm building. But working with CSS is broken for many of the reasons that chibicode outlines - semantic css encourages specializes classes that end up duplicating lots of css properties. The functional CSS proposed here obviously isn't a complete solution - although it may be the case that "If you use functional CSS, when you add something new to a page, you'll rarely write any new CSS", you have to pay for it in all of the classes that you write. I've seen really well- structured SASS files that end up keeping duplication and class names to a minimum, but it's hard to do. I'm anxious to try this for myself and see how the tradeoffs play out in a real codebase.

<comment><AUTHOR> Thanks :)</comment></comment>


Ian Knot - <AUTHOR> https://www.fieggen.com/shoelace/ianknot.htm <comment><USER2> Perhaps he is the inventor of this knot in the same way I was the inventor of short division in grade school--I thought I had invented it since no one had taught it to me, but I had just rediscovered an existing technique. Since that was the way my dad learned how to tie his shoes from his father before Ian was born, I think the furthest one could say is Ian is _an_ inventor of this not, not _the_ inventor.

However, this website is really cool, and it does do a much better job of explaining than my frustrated attempts of "you just pull one loop through the other!"

<comment><USER3> It's the Ramanujan Effect.

<comment><USER4> I tried googling "Ramanujan Effect" but nothing turned up. Could you explain what you meant by that?

<comment><USER5> [https://en.wikipedia.org/wiki/Srinivasa_Ramanujan](https://en.wikipedia.org/wiki/Srinivasa_Ramanujan)

"Though he had almost no formal training in pure mathematics, he made substantial contributions to mathematical analysis, number theory, infinite series, and continued fractions, including solutions to mathematical problems considered to be unsolvable. Ramanujan initially developed his own mathematical research in isolation; it was quickly recognized by Indian mathematicians."

</comment></comment></comment></comment><comment><USER6> The secure version of this is much better and the one I use all the time. Doesn't get stuck and is quick to tie and untie.

[https://www.fieggen.com/shoelace/secureknot.htm](https://www.fieggen.com/shoelace/secureknot.htm)

<comment><USER7> Talking about other secure knots wouldn't be complete without mentioning the Granny Knot and what Ian says about the secure knot:

> NOTE: For normal activities, the Ian Knot or other standard knots should be > quite secure. I believe that many people seek more secure knots because they > are, without realizing, tying their shoelaces with an un-balanced "Granny > Knot". Please see my Granny Knot page that discusses this in detail.

<comment><USER8> I think this is right. In ten years of use, the handful of times the plain Ian Knot has come undone on me were from stepping on and end or similar - it's never come undone without some external force, and even then it's usually fine. I just checked and I'm not doing the Granny Knot version.

<comment><USER9> I believe it's impossible to tie a granny knot using the Ian Knot method.

<comment><USER8> It's definitely possible. It depends on which way you do the initial single knot (right over left or left over right), relative to which way you turn the Ian Knot loops (left end towards you or away). The are four possible combinations, two of which produce Granny Knots.

</comment></comment></comment></comment></comment><comment><USER10> Since this is Hacker News I am going to take issue with some technical points. This is not a new knot, it is simply a reef knot with the ends slipped. Generations of sailors know it as a way of reefing (reducing the area of) sails . What this is, is an alleged new method for tying a reef knot with the ends slipped more quickly than the boy scouts 'left over right, right over left' method. I think this is an important distinction.

Actually I love this site! Does one thing, and does it well.

<comment><USER11> Who ever said this was a new knot?

The reef knot (square knot) with both ends slipped is called a bow knot (shoelace knot).

[https://en.wikipedia.org/wiki/Reef_knot](https://en.wikipedia.org/wiki/Reef_knot) [https://en.wikipedia.org/wiki/Shoelace_knot](https://en.wikipedia.org/wiki/Shoelace_knot)

<comment><USER10> > Who ever said this was a new knot?

> I tie my shoelaces with my own "Ian Knot", the World's Fastest Shoelace Knot > (yes – I am the inventor):

It says so in the first line. How can you be the inventor of an existing knot?

</comment></comment></comment><comment><USER12> I learnt this a while ago and haven't stopped using it since. Saves me the trouble of bending over for too long and is a great party-trick.

</comment><comment><USER13> I've always been impressed by the lasting quality of this site. It's extremely simple (the only javascript is for ads), easy to navigate, fast to load and ranks 1st, 2nd, 3rd and 5th in Google for "shoe knot" and "shoelace knot".

<comment><USER14> Yeah, just look at the page source. So clean and readable, no extraneous boilerplate.

</comment></comment><comment><USER15> So, having tried this method in the past, and revisited this again just now, I don't thing it is actually faster. The set up requires each hand to independently form a loop with an opposite twist without the benefit of the other hand to brace the rest of the shoelace against.

The gif of the knot does not show the set up, which is kind of unfair to the standard knot since that part is fundamentally baked-in to the standard knot. I'd love to see a video of the creator doing this from the start, because he probably is pretty good at the set-up which is just as important.

I think part of the reason why I don't find this faster is because I use the more modern style of flat/ovaloid shoelaces. Round shoelaces don't really get "twisted", and linen shoelaces are pliable enough for it to not matter, which means you could roll the laces around in your hand to get them to the starting position for Ian's knot. With the laces in basketball/running shoes, I think you need a bit more dexterity to manipulate the laces to get them to the point where they are 'flat' than could be managed with Ian's knot.

I don't think switching to Ian's knot and round laces would save me much time overall; the reason I like flat athletic laces is because I never have issues with the knot coming undone, loosening, or stretching/tightening. I use round laces on my work boots because flat laces are hard to untie if they get gritty, and I always have to double-knot them or they come undone. Since this is identical to the standard knot, I'm sure that would continue to be a problem, and I think the set-up for the standard knot makes double-knotting easier as well.

As a final note, my best friend ties his dress shoes this way (with the really narrow laces), and it is definitely faster all things equal. I think those narrow laces are probably the best use for this method.

All that being said, I originally found this site while looking for lacing methods, and it's one of my favorite sites on the internet. It's basically everything of what I loved about the "geocities" era of the internet (without the stuff I hated).

<comment><AUTHOR> Interesting!

I've switched to using Ian's knot, and have found it to be both faster to tie and easier to set up. I think once you work out how to 'pick up' the laces in the right way, so that they are already in the correct starting position, it gets a lot faster/simpler to think about.

Of course, I haven't been in your shoes - my laces are all the round type and I haven't tried it with flat ones.

To each their own!

<comment><USER15> I like flat laces a lot because they seem to distribute the force a lot better than round styles. I like my shoes to be fairly minimalist, I don't like overly padded or heavy shoes, and round styles seem to put a lot more pressure on the top of my foot.

The oval style with the sharp edges has a lot of the benefits of the flat style, but is more universally compatible. The flat ones don't always move well in round eyelets, they work better with loops in my experience.

The completely flat style doesn't tie well if one of the laces is twisted though. I think it's a great option for athletic shoes though, where you are more likely to care about a particular level of give, etc, and when you don't want your shoes to become untied. The round style is cheaper, and if you don't notice the difference it's probably a more versatile shoelace.

Plus you can do fancy knots with the round style.

</comment></comment></comment><comment><USER8> I've been using this for years - it's great!

An interesting memory anecdote: within two weeks of switching I had forgotten the method I'd used for the previous 20 years.

</comment><comment><USER16> My name is also Ian and I have invented my own shoe-tying method independently from Ian Fleggen's method. I believe it's faster than the "Ian Knot". Once I come up with a name for it, I will publish it online.

Taking name suggestions...

<comment><USER17> Ianest Knot. The most Ian a knot can be.

</comment></comment><comment><USER18> This is a Reef knot tied using two bights. Nice little trick and a very clear explanation.

We would use a knot similar to this when furling the foresail on schooners, as it easily untied under sail.

If the author wanted a slight improvement in the explanation, mine would make the finger diagrams use a transparency for the thumb and index finger so that the reader could interpret the location of the laces behind the fingers.

</comment><comment><USER19> Hah, I worked in a grocery store part of my time and college and this is very similar to the way I was taught to tie plastic grocery bags shut. Sub the two handles of the bag for these loops, and repeat it a second time after pulling through. Extremely useful for people on bike.

Practically impossible for the knot to come undone and after 5 minutes of practice you can do it in literally 1-2 seconds.

</comment><comment><USER20> Quite a lot of past discussion: [https://hn.algolia.com/?query=fieggen.com%20points%3E3&sort=...](https://hn.algolia.com/?query=fieggen.com%20points%3E3&sort=byDate&dateRange=all&type=story&storyText=false&prefix=false&page=0)

</comment><comment><USER21> Somewhat related: How to tie your shoes TED talk: [https://www.ted.com/talks/terry_moore_how_to_tie_your_shoes#...](https://www.ted.com/talks/terry_moore_how_to_tie_your_shoes#t-159870)

</comment><comment><USER22> Poor Ian, bless 'im.

</comment><comment><USER23> This is cool and I definitely appreciate that this page exists. Cool page!

However, totally absurd—Donald Trump levels of absurd—to say you invented a knot. Not only have mathematicians categorized every possible way to make a knot, but before that hundreds if not thousands of generations of sailors and knitters certainly discovered every kind of knot that could be made. Very strange to think you could have "invented" a knot... borderline disturbing to be honest.</comment>


Make 3D printers using recycled electronic waste - <AUTHOR> https://iafrikan.com/2020/09/03/22-year-olds-high-tech-innovation-project-voted-cameroons-best-for-2020/ <comment><USER2> Couldn't find his; but i found these:

[https://www.instructables.com/id/eWaste-60-3DPrinter/](https://www.instructables.com/id/eWaste-60-3DPrinter/)

[https://github.com/biosafetylvl5/retr3d](https://github.com/biosafetylvl5/retr3d)</comment>


Reminder: Cambridge news.ycombinator.com meetup tonight, 7PM - <AUTHOR>

For those of you who missed the message the first time, this is a second posting.  We're doing a meetup tonight at the 1369 Coffee Shop in Central Square, Cambridge, MA.
Sunday, August 19th at 7 PM
1369 Coffee House in Central Square
757 Massachusetts Ave. Cambridge, MA 02139
A bunch of people have said they are coming, so it should be a good time. <comment><USER2> Guys! We moved! We're now at Andala which you can find here:

286 Franklin St Cambridge, MA 02139</comment>


Alien developers/startupers (without H1B) in SF Bay Area. How many? - <AUTHOR>

I'm not here to complain about US Immigration Laws, they are understandable and it's a business of Americans on what to do with them.<p>But let's get counted you desperate and lonely developers/designers/startupers, who stay here with F1/J1/who-knows-what-else visas and trapped to work online to earn the living. Let's unite, hang out, share information and help each other in order to create something cool. <comment><AUTHOR> A little about myself:

I'm PHP/RoR/Javascript developer, live in SF for 1.5 year under F-1 visa and earn my living working remotely for non-american company based in Europe (no, seriously). Besides this I'm constantly trying to implement my own ideas, create my own apps, but as you understand doing that in complete solitude is not a simpliest task.</comment>


Show HN: Finding puns computationally - <AUTHOR> http://puns.samueltaylor.org/ <comment><USER2> I think I've found a bug: sometimes it does not return puns, but the correct idioms instead. For example, "words":

a man of few words

a picture paints a thousand words

a woman of few words

actions speak louder than words

mark my words

picture paints a thousand words

put words in somebody's mouth

Actions speak louder than words

</comment><comment><USER3> I love this! But if you choose words that commonly appear in idioms, you just get the original idiom back. Example:

cat

>cat got your tongue

>cat nap

>curiosity killed the cat

>fight like cat and dog

>grin like a cheshire cat

>let the cat out of the bag

>no room to swing a cat

>not enough room to swing a cat

>not have a cat in hell's chance

>play cat and mouse

</comment><comment><USER4> > a man's home is his asshole

> don't put all your eggs in one asshole

It checks out.

</comment><comment><USER5> Very cool! How did you build this?

<comment><USER6> I found his source code on GitHub. [0]

From this[1], seems like he's taking the top-10 closest (in terms of Lehvenstein distance) phoneme of input and idioms of English language.

0: [https://github.com/ssaamm/pun-generator](https://github.com/ssaamm/pun- generator)

1: [https://github.com/ssaamm/pun- generator/blob/master/src/app....](https://github.com/ssaamm/pun- generator/blob/master/src/app.py#L105)

<comment><AUTHOR> Nailed it!

I scraped some idioms from the web, and take the 10 with the lowest score relative to the input word.

To score an idiom relative to an input word, I first convert the input word and each word in the idiom to phonemes (using cmudict [0]). I find the minimum Levenshtein distance between the input word's phonemes and the phonemes of a word in the idiom. The score for the idiom is that minimum distance divided by the number of phonemes in the word that had the minimum score.

The idea with dividing it is to give longer words a bit of a boost (though admittedly I didn't test that rigorously).

0: [http://www.speech.cs.cmu.edu/cgi- bin/cmudict](http://www.speech.cs.cmu.edu/cgi-bin/cmudict)

</comment></comment></comment><comment><USER7> >curl your lisp

>program makes perfect

>No puns found :(

</comment><comment><USER8> girls just Java have fun

better the Java you know

Ha ha! :-)

</comment><comment><USER9> to DRINK home the bacon.</comment>


Does open-source undermine the value of individual programmers? - <AUTHOR>

As a group of programmers build open-source products they are spending time on the process but not getting paid, they then create a product, something like Joomla, which then is used by other developers. But as a whole, Joomla makes some jobs easier, but also kills jobs (or hours of work) as it takes less people and work to get a site built.
I know it makes some jobs easier, but more importantly it makes some work free.
How is programming work worth anything if it can be done for free?
What I mean to say is open-source is shooting the industry in the foot. <comment><USER2> I think you're saying roughly this: work is the process of turning time into money, and the open source community saves everyone's time, so less money could be made.

However, I think you might be missing the fact that the time saved from not reinventing the wheel countless times could be used to build better things. In fact, this happens a lot. Numerous companies and careers have been built by virtue of open source tools.

</comment><comment><USER3> And without php which is free, there would be no joomla, and without gcc and linux and freebsd and a ton of other tools there would be no php... and how many people wouldn't have jobs right now?

My entire career has been built around using various open source tools.

Have you consider that without these tools to make X project take Y time that X project might never have been done? If it was a massive undertaking to create a website for Mom's Bakery, how many Mom's Bakeries would have websites?

I would argue that all these tools create more work, more value, not less.

</comment><comment><USER4> Value and worth to some people are defined by things other than money. And this is true outside of programming.</comment>


The Singular Power of Writing - <AUTHOR> https://lareviewofbooks.org/article/the-singular-power-of-writing-a-conversation-with-thomas-chatterton-williams/ <comment><USER2> My maiden name is Irish in origin. At one time, Irish Americans were an othered group. Now, they are just a subset of white.

I have a German immigrant mother with very olive skin. Her skin color is very close to that of some light skinned blacks. But, of course, she's "white" because she's German.

I have been told my father was 1/16th Cherokee.

I tend to not really fit in with white middle class Americans. I never really have. I'm too culturally different from them.

Of course, people of color don't want to claim me as one of theirs. Natives are extremely critical of people like me. I'm not really welcome by them.

I've started checking "decline to answer" the race question when filling out forms. The options they provide just don't seem to fit my reality and there isn't enough space to explain it. If I did, no doubt whoever read it would promptly conclude that I'm white and my discomfort with the question is neurotic and not legitimate.

<comment><USER3> My father's side of the family is Bohemian (western Czech). I was always curious as to why artsy-hippies use 'bohemian' as an adjective.

Come to find out, French aristocratic youth rebelled and started dressing like the colorful, poor Romani (getting the label _haute bohème_ ) and the general stereotype that said poor Eastern Europeans must also obviously be from the nearest "eastern" country.

So, cultural appropriation and misidentification going back to the 19th century (an insult to both the Romani and the Bohemians).

Also strangely, I recall my father's older relatives frequently telling terrible jokes about and referencing others of the same identity as "bohunks" which I didn't discover until a few years ago was a racial slur. In a way, their adoptation of it seems to have been similar to the frequent use of the n-word in black hip-hop, rap and edgier pop culture.

There are similar stories about my mother's side of the family. The world is a strange, complex place, and somehow boiling that family history down to "white" just doesn't do it justice.

<comment><USER2> [https://en.m.wikipedia.org/wiki/African_Americans_and_the_G....](https://en.m.wikipedia.org/wiki/African_Americans_and_the_G.I._Bill)

 _In the New York and northern New Jersey suburbs 67,000 mortgages were insured by the G.I. Bill, but fewer than 100 were taken out by non-whites._

I grew up in Columbus, Georgia in a house purchased using military benefits. My part Cherokee father was extremely white-passing, yet spent 18.5 years of his 26.5 year military career overseas.

He's no longer alive. I can't ask him if he did that to escape racism in America.

What if he hadn't successfully downplayed his part Native heritage? Would I have even grown up in a nice house in the suburbs?

After my father died, I tripped across a photo of a full-blooded Iroquois actor that looked uncannily like my father. I was already not comfortable with our social construct of race. But I just no longer can comfortably answer that question with stating "I'm white."

What makes me white? My skin color? If so, why is my darker skinned mother also white?

My socioeconomic background? I could argue that grows out of my father successfully downplaying his Native heritage. So does that make my _whiteness_ a fiction? Perhaps even a lie?

My father made his own constructs. Which constructs are more "real" or more valid? His? Those of a nebulous racist thing we call society? Where is this thing we call society? Can I go talk to it?

No, society is just a sum total of something that grows out of a group of individuals. Individuals like my father.

My father chose to protect himself and his family. I can't find moral defect in that decision.

But I also find it increasingly offensive to even try to answer a question about my heritage with an answer from a canned list of arbitrary answers rooted in a long history of social BS where none of those answers remotely fits anything I would identify as.

I have long association with American military culture. Military dependent is not an option.

I was born and raised in The Deep South. Southerner is not an option.

I'm part German. German American is not an option.

I'm part Cherokee, but only a very small part. I don't even know what to call that. Mixed race doesn't really seem to fit this case. But why not? I look part Native to my German relatives. How many generations does it take to "erase" my Native blood so it no longer counts?

I'm not interested in trying to officially join the Cherokee Nation. I'm not interested in trying to qualify for scholarship money reserved for Natives. But isn't calling me white just another way of saying "those people" don't count?

If you aren't full-blooded Native, your Native ancestors don't count? Doesn't that further deepen a history of genocide? Many Natives were murdered by European settlers. Do we also need to murder any memory of them? Any trace that survived in mixed bloodlines?

Do we need to deny that "those people" are a part of _us_ people, even if only a small part?

Why?

<comment><USER3> I'm a second generation American, and acknowledge that I am a legacy of my heritage. However, I do not really _define_ myself as such, as I am more than just the sum product of genes.

My brother was in Czechia on a recent business trip, and between his looks and last name, _everyone_ there assumed he was a local... until he opened his mouth, at least.

If I am asked on a form, I'll typically put decline to answer or other.

However, I also acknowledge that how to reconcile the history of your family with your own identity as an individual is a difficult and personal decision... especially when the law is involved, such as / for example around tribal memberships.

</comment></comment></comment></comment><comment><USER4> This author is a voice we really need as a counterpoint to the current train of thought running through American politics. I will definitely check out his books.

As a side-note, I couldn't help but think of Kayne declaring that 'he's not black, he's Kanye' as an attempt to get across what Williams is talking about here. Of course, it tremendously backfired. I'm also reminded of some of Moran Freeman interviews, in which he cooly refuses to be pigeonholed.

<comment><USER5> I think it's hard for people to stomach the notion of deconstructing race when we've designed society in such a way that has hamstringed groups for generations. I'm all for forgetting 'race' as a social construct, but I think there's a few things we'll need to atone for first.

<comment><USER6> The challenge is that race and culture are often tied together. In 1920 New York the Irish and the Italians would have effectively treated each other as different races. As culture homogenized, those 'racial' differences also faded away—now everyone is just European. It's a challenge to maintain your culture within a dominant culture while not suffering socio-economically.

</comment></comment></comment><comment><USER7> This is a fantastic interview.

I was so excited to share this with everyone I know. I think about a great friend with a black father, now deceased. I always imagined what his father he might have related to life during a time when his marriage was illegal. This article really stimulated ideas like the way I imagined it was for him might not at all have been the case, which is wonderful to think about. And how my friend's relatives might have lost so much in their bigotry.

Then, I was left with this harrowing thought: what's the payoff for anyone to give up their identities (including racial identities, but also every other identity that binds us). I mean, it's a wonderful idea and wonderful documented here, but not everyone will move to France and investigate their thoughts. That made me sad. I'm doubtful that most people will read this interview, and doubtful most people that do read it will radically change their belief systems. I must include myself in that assessment to be honest.

</comment><comment><USER8> > I think that you need to have this kind of childlike way of looking at > things, as the writer Albert Murray described, and which you see with > children before they've been conditioned into race-thinking, which is that > the color of your skin is not white. The color of my skin isn't black. Those > colors don't even manifest on human flesh. We don't even describe ourselves > in words that are actually accurate to flesh tones. Any fool can see that > white people are not actually white and black people are not black.

I agree with this. I think calling people 'white' or 'black' is stupid and I don't do it (and not just for this reason). But Williams does use these words to refer to people elsewhere through the interview. I wonder why he does it, after making this explicit point?

<comment><USER9> He calls this out in a later paragraph, mentioning that in the modern discourse it's too difficult to not. "(It's almost impossible to actually have a conversation where you stop using the term "black." So I hope, you know, when I say black and white, I'm not implying that I believe those terms are true. I'm just using it because that's the way we speak about people.)"

<comment><USER8> Thank you for pointing that out. I did read a good part of the interview but obviously missed that bit.

But I disagree with him here (while finding a lot of the rest of what I read insightful). How we speak about people is not fixed and change can come from us choosing to speak differently. Not that I'm suggesting we force others to speak differently, but we can make the change ourselves (which will be heard by others and perhaps picked up).</comment></comment></comment>


VanillaJS Framework Announced - <AUTHOR> http://vanilla-js.com/

<comment><USER2> How is this a fair comparison:

Vanilla JS var s = document.getElementById('thing').style; s.opacity = 1; (function fade(){(s.opacity-=.1)<0?s.display="none":setTimeout(fade,40)})();

jQuery <script src="//ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js"></script> <script> $('#thing').fadeOut(); </script>

</comment><comment><USER3> It took me about five minutes to realize how dumb I was and that this was literally Vanilla JS.

<comment><USER4> Yep, it had me scratching my head.

</comment></comment><comment><USER5> I love this so much. I'd give it a million upvotes if I could.

<comment><USER6> You love extra typing for no reason? I see the point but jQuery is still much more concise.

<comment><USER5> Typing is pretty minimal when you use a good IDE with autocomplete. I never type the word "document" \-- just "d" and then enter. (Note that vanilla JS has great autocomplete support out-of-the-box in many IDEs.)

The vast majority of development time is spent dealing with people, reading code, learning, or maintaining code. Typing is a very small part of it, and I remember seeing a study recently that confirmed it.

If you hate typing that much, just write simple wrappers around vanilla JS, e.g. $.el = function (id) { return document.getElementById(id) };

What's more, when you're writing a complex web app using JS libraries, all of those milliseconds you lose in performance are going to add up (especially on mobile!)

<comment><USER6> Those "simple wrappers" are already provided to me by using jquery, etc. Why would I waste my time writing my own? (I realize a lot more is also provided.)

The getElementById is really the most simplistic example and actually does not bother me. Though just look at all the cruft required to make a AJAX call with "vanilla" JS. It's gross. Use a well known, standard library and abstract it all away.

</comment></comment></comment></comment><comment><USER7> Previous HN thread: [https://news.ycombinator.com/item?id=4435547](https://news.ycombinator.com/item?id=4435547)</comment>


HTTPS Everywhere 3.0 protects 1,500 more sites - <AUTHOR> https://www.eff.org/deeplinks/2012/10/https-everywhere-3-and-a-trillion-web-requests

<comment><USER2> There are more improvements than just "more sites". Here's the changelog <https://www.eff.org/files/Changelog.txt> Some highlights:

      3.0                                         (2012-10-04)
      * Since version 2.x:
        * 1,455 new active rulesets
        * UI improvements:
          - right-click to view ruleset source in the config window
        * Numerous improvements to the SSL Observatory internals, including cached
          submissions on hostile networks, better Tor and Convergence integration,
          and a new setting to control self-signed cert submission
        * New translations: Basque, Czech, Danish, French, Greek, Hungarian,
                            Italian, Korean, Malaysian, Polish, Slovak, Turkish,
                            Traditional Chinese
      * Relative to 3.0development.8:
        * Update the SSL Observatory whitelist of common cert chains
        * Fixes, mostly in the CDN/media playback department:
                 Akamai/CNN, GO.com/ABC, AWS/Amazon Zeitgeist MP3 player,
                 AWS/Spiegel.tv, Technology Review, Cloudfront/Tunein,
                 Akamai/Discovery Channel, Beyond Security, OCaml, Gentoo,
                 Nokia, Widgetbox.com, Squarespace
      /001324.html
        * Disable buggy: Web.de, AJC.com, Feross, Bestofmedia
        * Remove a lot of off-by-default rulesets from the code, since they have
          some costs in terms of startup speed and RAM usage

</comment><comment><USER3> A tip for anyone considering using HTTPS-Everywhere: You should also grab HTTPS Finder[1] to work with it.

HTTPS-Everywhere forces you into a secure connection when you attempt an insecure one (e.g. clicking on <http://en.wikipedia.org> will still make the request under HTTPS) on any domain in its database. You can also add additional rulesets for other domains.

What HTTPS Finder does is send, when you make an HTTP request, an additional request to see if the server will also serve over HTTPS, and it will redirect you there.

If you also have HTTPS-Everywhere, HTTPS Finder gives you the option of adding a ruleset to it for that domain so that you will always make the secure connection first. You can also whitelist the domain from future HTTPS Finder checks if you find that the secure connection serves no-or-different content, or if it otherwise causes errors.

[1] <https://addons.mozilla.org/en-US/firefox/addon/https-finder/>

</comment><comment><USER4> Direct link: [https://www.eff.org/deeplinks/2012/10/https- everywhere-3-and...](https://www.eff.org/deeplinks/2012/10/https- everywhere-3-and-a-trillion-web-requests)

<comment><USER5> Poster is a spambot for neowin; this should be the actual link.

</comment></comment><comment><USER6> You can also just add important domains to Chrome's HSTS list: chrome://net- internals/#hsts</comment>