Ask HN: Does HN not cover breaking news? - <AUTHOR>

There is a current news event I am interested in.
As a discerning consumer of news, I was interested to see what the HN community has to say about the subject.
But, there are zero live posts about the topic.
I know that HN doesn't cover politics...
But, doesn't a news story cease to belong to any one category once it becomes the number one front-page headline across the USA?
Was I wrong to look forward to reading comments from Baltimore hackers this morning? <comment><USER2> From the guideline: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

> _Off-Topic: Most stories about politics, or crime, or sports, unless they > 're evidence of some interesting new phenomenon. Videos of pratfalls or > disasters, or cute animal pictures. If they'd cover it on TV news, it's > probably off-topic._

<comment><USER3> This exact question turned up in reference to the Sandy Hook school shooting. A few of us asked why it was so prominent on HN given then guidelines, and in particular I said:

        Yes, this is important, yes, it's newsworthy.
        No, it's not "Hacker News".  It's all over the
        news, and there's nothing specific about hacking,
        or start-ups.  It's not even of "deep interest"
        in any real sense. It's tragedy, pure and simple,
        and then it becomes politics.[0]

PG replied (in reference to the guidelines you quote) with:

        Note those words most and probably.

Another accused me:

        Try on a little human emotion and sensitivity for
        size: this isn't your site to police.  Even pg has
        pointed out the precision of the wording which you
        seemingly ignored.

I usually stay out of discussions about on-topic/off-topic now. There's nothing to be gained. I just flag things according to my own criteria and move on.

[0] [https://news.ycombinator.com/item?id=4922380](https://news.ycombinator.com/item?id=4922380)

</comment></comment><comment><USER4> Link to HN front page: [https://news.ycombinator.com/item?id=9451652](https://news.ycombinator.com/item?id=9451652).

</comment><comment><USER5> If you think it belongs here, just submit it.

Please consider that things highly specific to a single country or non- technical/non-scientific links may be downvoted.

<comment><USER3> Submissions cannot be down-voted, only flagged.

<comment><USER5> Another name for a similar mechanism.

<comment><USER3> Similar, perhaps, but not identical. For example, on comments, flagging has a much more drastic effect than a simple downvote, so keeping the conceptual difference clear is useful.</comment></comment></comment></comment>


JQuery Mobile Alpha 3 Released - <AUTHOR> http://jquerymobile.com/2011/02/jquery-mobile-alpha-3-released/

<comment><USER2> Wow, this is really coming along nicely guys - well done!

I just tested it on my iphone and it's really looking excellent.

Direct link (to demo) for those that want to test it out on a mobile: <http://jquerymobile.com/demos/1.0a3/>

<comment><USER3> It's better than the last round, but still has a bit of a ways to go on the iphone.

For example, the behavior of clicking one of the slide menus is:

1\. The address bar pops down momentarily while the ajax call is made and then disappears after half a second. 2\. The loading graphic overlay appears and then disappears. 3\. The window pops you back to the top of the original page. 4\. The page slides over, and you're on the new page. 5\. The new page does a quick half second "flash."

It's progress to be sure, but these little kinks are what need to be ironed out before anyone should consider deploying it.

<comment><USER4> I actually just finished a web-based ipad demo for a client, and my choices were jqTouch, JQueryMobile or Sencha.

While I love the html syntax for JqueryMobile (Sencha is a giant Javascript function, which had a steep learning curve at first) I felt that the widgets and display quality of jQueryMobile just didn't match that of Sencha.

Sencha's transitions felt faster, animations were smoother, and form items felt more like native parts than in jQueryMobile.

I eventually went with sencha because it produced a better experience on a tablet, but I think I would definitely like to give jQueryMobile a try on my next smartphone project.

<comment><USER2> Yeah I really hope jquery mobile can match the smoothness and fixed menu support to be on par with Sencha.

That's definitely the main thing keeping me on the Sencha side for now too.

Considering how new this project is still, the progress is very encouraging though.

</comment></comment></comment></comment><comment><USER5> Nice. Can any one please highlight the differences between this and jqtouch?

<comment><USER6> The main difference is in browser support: jQuery Mobile is on its way to supporting Windows Mobile, Opera Mobile, and almost any new mobile browser while jQtouch is only for Webkit. Also, jQuery Mobile works pretty well in Google Chrome from my experience if you're inclined to use a mobile app on the desktop for some reason, while jQtouch doesn't have animations on Google Chrome.

EDIT: And it's officially supported, meaning it's here to stay.

<comment><AUTHOR> In regards to your edit, jQTouch was acquired by Sencha and is now officially supported (and maintained) as well.

<comment><USER4> Was it really? I find that interesting, since jQTouch is much closer to jQuery Mobile in syntax than Sencha (which is a giant Javascript Object)

<comment><USER7> Yes there is a bifurcated development path. I prefer the HTML-friendly approach (JQtouch) as opposed to the monolithic Javascript (Sencha Touch)

</comment></comment></comment></comment></comment><comment><USER8> I was wondering what was going on, since the last missive was targeting a final release in January[1]. I'm excited to see this, and especially excited that we're going to see A-grade support for WinPhone 7 soon. Congrats!

[1] [http://jquerymobile.com/2010/11/jquery-mobile- alpha-2-releas...](http://jquerymobile.com/2010/11/jquery-mobile- alpha-2-released/)

<comment><AUTHOR> I was browsing the support forums and the team seemed to be copping a lot of (not undeserved) flak over their lack of communication to the public. In response to this they have promised to be much more transparent and have also set up a twitter account.

<comment><USER9> Yep, we're very active on our @jquerymobile twitter account since the team gained access to it a week ago. We'll be posting code updates and soliciting feedback so follow us. Sorry for the lack of communication over the past few weeks, we've been heads down getting a3 out.

</comment></comment></comment><comment><USER10> Nice, I love jQuery because it made DOM manipulation a breeze by abstracting everything. But I am getting the feel that jQuery Mobile assumes "what" it is that developers are creating, making it less abstracted and more narrow minded (for instance, that we all want right to left iPod style page navigation). Or perhaps not, I could just be wrong.

<comment><USER11> jQuery Mobile is not a mobile version of jQuery - it's a UI library for mobile devices. A better comparison would be jQuery Mobile to jQuery UI. Both projects depend on jQuery proper, and both provide UI-widgets (they are absolutely "narrower" than jQuery, as you say).

</comment></comment><comment><USER12> Looks nice. The demo runs quite slow on my Galaxy S, though. Should I expect it to be faster at this point?

<comment><USER9> What specifically is slow -- touch events, scrolling, transitions, etc? We're working on bug improvements on all of these items so things will get faster, lighter and more responsive as we go. Oh, and work on more platforms (Nokia, Blackberry 5, Windows Phone 7). Feel free to log issues on the Git tracker.

<comment><USER12> Mostly the animated transitions. I get about 4 frames total for the entire transition. Scrolling is also a little slow for the first few seconds after loading a page, but it quickly reaches normal speed.

I'm not working on any mobile webapp projects right now, but if/when I do I'll be sure to provide more detailed feedback on the issue tracker (if I encounter issues at that time), and otherwise contribute back to the community.

At any rate, keep up the great work! I finally took a detailed look at jQuery UI as a result of seeing this post and there's a very good chance I'll be using it in the semi-near future.

</comment></comment></comment><comment><USER13> it has some bugs... the fixed-position header/footers randomly disappear on my iphone 4 / ios 4.2. I'm sticking to 1.2!

<comment><USER9> They were much buggier in 1.2 so 1.3 is much more reliable but your mileage may vary.

</comment></comment><comment><USER14> demos don't work on wp7 though, page loads and is blank.

<comment><USER9> We're working on debugging WP7 now and will be pushing an update soon to make things work much better. We use media query support to decide who should be enhanced and WP7 doesn't support these so we need to add some code to let them in. We just got our first device last week but things are already looking good.

<comment><USER14> Great to hear that! Reportedly, there is a WP7 update due soon.. I didn't expect this IE in current WP7 to work at all as good as it does (I think it's 7), we'll get IE9 I guess, with new update. Keep up the good work!

</comment></comment></comment><comment><USER15> NEAT!

</comment><comment><USER16> Great work, however it's far short of the quality of Sencha Touch.

I have to wonder what the point of mimicking native UI is.

I've just started learning Obj-C and iPhone dev and getting ones head around basic UI functionality is at most 2-3 days worth of playing around. Is is really worth sacrificing native performance and consistency for such marginal gain?

<comment><USER17> Shocking as it may sound not all mobile devices are iOS, in fact most aren't. jQuery mobile lets you target a huge number of devices. See the supported browsers page for a list:

<http://jquerymobile.com/gbs/>

<comment><USER16> Performance of these types frameworks on anything other than the beefiest mobile hardware is woeful.

I get your point though... 1 click deployment to multiple devices is a great feature.

<comment><USER17> True, performance on older mobile hardware's not great, my old htc hero runs the demos at a pretty glacial pace. But it wasn't so long ago that javascript performance was apparently so poor that web apps would never catch on and remember this is an alpha version so it's going to get quicker.

I do agree native apps are going to be more appropriate in a number of situations though.</comment></comment></comment></comment>


Launch: 37signals Answers - <AUTHOR> http://37signals.com/svn/posts/2122-launch-37signals-answers

<comment><USER2> Rails 3 must really be coming along for them to launch an app with it.

</comment><comment><USER3> The UI looks really good! I think this solves the normal problem with stuff like this.

I have blog comments on the blog on my site, but a very prominent and pretty easy to use Support section. For some reason, people kept using the blog comments as a generic contact form for me to help them with their highly specific problem they're having with the product. I don't use Get Satisfaction or forums for that reason because I don't think many people can really understand anything more complicated than a simple email/contact forum, even when it's made really clear how to use it.

</comment><comment><USER4> Seems like the StackOverflow bug is spreading.

<comment><USER5> or deeper understanding of human psychology and game mechanics are spreading.

</comment></comment><comment><USER6> This is really just a ticketing system in their unfeatured style, given that only 37Signals staff can mark something as "answered", and they appear to do so any time they reply to a question.

<comment><USER7> We mark things as answers when they are answers. Anyone's reply can be marked an answer.

It's mostly been us answering so far (we're in there all the time to keep everything moving smoothly at launch), but over time other people will come in and offer answers as well.

Here's a non-37signls answer, for example: [http://answers.37signals.com/basecamp/132-printing- sections-...](http://answers.37signals.com/basecamp/132-printing-sections-of- the-site)

We expect to see more of these over time. We are also exploring ways to incentivize people to answer each other's question.

<comment><USER6> That wasn't my point -- the impression was that questions get marked as answered as soon as you've read it and either replied or picked an existing answer. While you may be the sheriff, judge, jury, and executioner of your product; you aren't the arbiter of the asker's mind. There's a reason none of the existing systems work this way: not even YA or SO fucked this up when cloning Ask Metafilter.

I checked back and it looks like you've refrained from insta-answering discussion questions where you're having a back-and-forth.

I think a much better model would be to make the answered flag normally asker- only, or do away with it all together.

Instead add a [staff] flag on questions that staff have answered in, and when you think a normal user has already answered the question effectively (with or without approval from the asker), you should explicitly call out their answer as good (which then causes the [staff] flag to be added).

</comment></comment></comment><comment><USER8> And they're nuking the old forum's contents. Not that I care, since I don't use any 37signals products, but this seems to be a typical 37signals move. I suppose migrating or just archiving old content wouldn't have been opinionated enough for them, or fit within a 2 week schedule.

<comment><USER9> What would be the benefit of holding on to the legacy stuff? It's not like they have users on old versions of software.

</comment></comment><comment><USER10> "Get help, share tips & tricks with other Basecamp customers."

Why not "Basecamp users." Sounds nicer, I think.

<comment><USER11> Facebook has users, Basecamp has customers.</comment></comment>


PIK, Guetzli, WebP, JPEG, BGP and FLIF Compared with Butteraugli and Ssimulacra - <AUTHOR> https://encode.ru/threads/2814-Psychovisual-analysis-on-modern-lossy-image-codecs <comment><AUTHOR> PIK won this test. PIK seems to be less than half the file size of everything else on the "red-room.png" test on the same butteraugli scores.</comment>


With $15M, the Riveter plans to open 100 new female-focused co-working spaces - <AUTHOR> https://techcrunch.com/2018/12/11/with-15m-the-riveter-plans-to-open-100-new-female-focused-co-working-spaces/ <comment><USER2> All the coworking spaces I have worked from were about 50/50\. This seems like a non-issue.

Women excel in some areas and men excel in others. Regardless, coworkering is very cooed, in my experience.

I don't get it.

Edit: after rereading the article I conclude it is some kind of hypocritical sexist absurdity. I do get it, but I do not like it.</comment>


Introduction to Concurrent Programming with Stackless Python - <AUTHOR> http://www.grant-olson.net/python/intro-to-stackless-python/browsable-html <comment><AUTHOR> Note that while Stackless Python makes coroutines and similar things easy, it offers more: You can serialize all the runtime elements like the stack trace and that data is platform independent. That gives you very nice possibilities, like moving some thread over to a different machine. Or serialize to disk and resume at some later time - maybe after a reboot or after some edit of the code. That is also great for debugging and inspection.

It makes Python much more dynamic - and somewhat more similar to Smalltalk.

</comment><comment><USER2> This article is relatively old (2006) and pretty outdated. I can't find the link now, but I remember reading that Stackless is no longer recommended, because modern Python can now provide the same functionality (using generators).

If you can stick with regular Python then I highly recommend it; Stackless requires a different Python binary with is a PITA for deployment/production.

<comment><USER3> I understand that generators allow concurrency, but not parallelism (you can't have more than one generator actually running at the same time, on different cores).

If Stackless doesn't support parallelism either (I have no clue), then yeah, it doesn't make much sense to use it.

<comment><USER2> Yep, yep. Stackless doesn't support parallelism either, it only enables cooperative multitasking.

</comment></comment></comment><comment><USER4> > To take advantage of both multi-core machines and distributed programming, > concurrency quickly becomes the de-facto standard way of doing things.

Parallelism is the way to achieve better compute performance. I assume stackless still has a GIL and can only take advantage of one core? Does it provide any inter-process communication that would help with parallelism?

</comment><comment><USER5> Has anyone used Stackless Python in production yet?

<comment><USER6> According to Wikipedia, at least the Eve Online MMO uses it quite heavily, as well as an IronPython Mail client thingy. For whatever that's worth.

<comment><USER7> As a programmer on the EVE team for the last 7 years, I would not recommend it at this point in time. Stackless is a fork of CPython, maintained by a small number of people. I'd rather look at pypy which has stackless support: [http://pypy.org/features.html#stackless](http://pypy.org/features.html#stackless) and is under active development.

Or look at golang which has the same type of primitives(microthreads, channel based communication and scheduling) built in.

<comment><USER8> I've searched extensively for years for something python-based which enables actual multi-core concurrency.. and after spending one week with golang, I strongly prefer go compared to anything I've found with python- multiprocess, stackless, pypy, etc. None of them let you reap the benefits of hardware like coroutines with communication channels in golang.

</comment></comment></comment></comment><comment><USER9> A very nice article and intro to concurrent programming. 10/10 would bang.</comment>


Why did Microsoft create C#? Wasn't Java good enough in the 1990s? - <AUTHOR> https://www.quora.com/Why-did-Microsoft-create-C-Wasnt-Java-good-enough-in-the-1990s/answer/Dan-Shappir-1?share=1 <comment><USER2> As someone who has worked with both Java and C#, I would say while Java might have been "good enough" it's lacking when compared to C# across the board. Microsoft has consistently improved the language ahead of Java, with new technology like generics (or properties, but you could argue about that one). Also, the development environment for C# is much better than whatever you can cobble together for Java.

I think much of the difference comes from the nature of the language designers and the timing of the language's creation. Joy had the handicap of going first, and Java has some choices that reflect that. Hejlsberg got to look at the weakness of Java to make C#. Overall, I think the practical approach to C# makes it a more useful language than Java, where Joy has some definite philosophical baggage he's carrying around that is reflected in Java.

Note we're talking a fairly fine gradation here. If you need to work in either, you're not slumming.

<comment><USER3> I wonder if we are not close to the end of C#'s useful life. It's a great language but it has become so convoluted with dozens of way to do the same thing, largely due to improvement that came along the way. Like methods accepting objects coexisting along methods accepting generics. Old async syntax (callbacks) along task async, like out and ref parameters now that we have valuetuples, etc. I wonder if .net core isn't a missed opportunity to clean up the language.

<comment><USER4> I think C# is lucky in a way. It's getting old and bloated at a moment in history when modern is essentially synonymous with being a convoluted multi- paradigm monster gobbling up features and syntactic sugar at a frantic pace.

Even the Go crowd has made the first step towards quantum computing, leaving behind errno in favor of returning both a possibly invalid return value and an error that can be nil and non-nil at the same time! ;-)

<comment><USER5> that last bit sounds terrifying.

</comment></comment></comment></comment><comment><USER6> Java most definitely was not good enough in the 1990s. It's true that C# 1.0 was very close to a Java clone it still added a couple of very nice improvements such as value types and ref and out parameters making it much easier and cleaner to return multiple values from a method. Features like these didn't add much complexity to the language, and greatly improved the ergonomics. Sun could have (and should have) copied them in Java, and I don't know why they didn't.

<comment><USER7> Java wasn't good enough...but that was not the reason MS created C#. They were very scared of Java at the time, and their attempt to "embrace and extend" failed. So they created their own language.

Out and ref was not a clean way to return multiple values - they are actually a pretty ugly way to return multiple values. (Tuple unpacking is the clean way, but that has only recently been added.) Out and ref was added because C++ API's had call by reference, and MS wanted to make integrating with windows API's easier. I suspect value types (structs) were added for the same reason.

That said, C# _did_ end up a much better language than Java, especially with later improvements like generics and Linq.

<comment><USER8> > They were very scared of Java at the time

This is an understatement, reading some of the antitrust documents you can clearly see that Microsoft was afraid that Java's ability to create rich programs that run regardless of OS would end up making Windows unnecessary since it wouldn't matter what OS you had. They saw Netscape as a distribution vector for Java and the JVM and was an important reason for why they made IE (one could say "and ActiveX" but that was already a thing they had anyway).

And FWIW i think they were partially successful in that their own MS Java did kill Java on the desktop and browser (the startup performance of Sun's runtime was also a factor, but the main thing i always remember developers being concerned around the turn of the millennium was compatibility with the VM that everyone had - the MS Java - both in terms of supported APIs and in terms of runtime performance - MS Java was _way_ slower and contributed extensively to the idea of Java being slow).

Of course they failed to avoid making Windows unnecessary for a large number of applications, but instead of Java it was HTML, CSS and JavaScript. If that is a better alternative... well, i'm sure there are people who prefer it this way.

<comment><USER9> I agree. Those emails/PDFs released in the DOJ case very enlightening and proved a lot of what Charles Ferguson was talking about in his books, "Computer Wars", "High Stakes, No Prisoners".

MSFT was even afraid of AOL, Oracle, and others teaming up to offer a home appliance (eg. a net PC) at low prices and undercutting the PC industry. Of course, those partnerships and alliances never did work out. Sun and Netscape hated each other, for example.

Microsoft was even worried Sony would "take over" the home since game consoles were becoming as powerful as PCs. Flash forward a few years: when I used my brother's PS3 in 2010, I couldn't believe how awful the browser was on such a powerful machine.

Hollywood and media companies were also afraid of Microsoft in the 90s. MSFT was making deals with Dreamworks, NBC (ie MSNBC), and others. It really did seem like MSFT had the cash to takeover the world and charge fees everytime a movie needed to be distributed. At one point, early on, Bill Gates suggested people would pay a nickel or dime to view a website.

Then, in the low 2000s, when .Net came out, there was a slide that compared the PC desktop to the WWW. MSFT wanted to offer APIs/languages/abstraction layers for the WWW that were analogous to the MSFT desktop.

The same paranoia people had of MSFT/AOL/Oracle, continues, but the names have change to different companies.

<comment><USER10> >Sun and Netscape hated each other, for example.

Ain't that the truth! The bitter irony is that a bunch of the Sun-hating Netscape programmers went over to AOL after the acquisition, just to be mis- managed into the ground by a bunch of "Alliance" managers from Sun.

[https://www.cbsnews.com/news/aol-woos-netscape- employees/](https://www.cbsnews.com/news/aol-woos-netscape-employees/)

>Case told the Netscape workers that after the merger is completed next spring, stock options will remain valuable, their sabbatical program will remain in place, and their corporate culture will remain intact.

>"Maybe you joined the company because it was a cool company," he said. "We are not changing any of that. We want to run this as an independent culture."

Pffff!!!

[http://www.zdnet.com/article/a-year-ago-friction-behind- aol-...](http://www.zdnet.com/article/a-year-ago-friction-behind-aol-netscape- sun-deal/)

>Netscape cancelled a project to develop a Java version of Netscape Navigator with Sun Microsystems Inc. because Netscape couldn't afford it, according to Kannegaard. Kannegaard's claims are at odds with the story Netscape told publicly about the reason it killed its so-called Javagator product. "It was explained to me that after Microsoft in their [Netscape's] words undercut their business, they could not afford to continue the project, so they had to reduce their engineering resources and cancel this project," Kannegaard said.

>That is not the story Netscape told the general public. According to a story in ZD Net's sister publication, PCWeek published Feb. 26, 1998, Netscape said it was pulling back on Javagator in hopes of getting help from Network Computer manufacturers such as Sun and Oracle Corp.

Meow!!!

[https://www.cnet.com/news/aol-layoffs-slam-sun-netscape- alli...](https://www.cnet.com/news/aol-layoffs-slam-sun-netscape-alliance/)

>After the layoffs, iPlanet will largely be a Sun satellite. As of last July, only one-third of iPlanet's approximately 3,000 employees were from AOL, Sun Chief Financial Officer Mike Lehman said. Lehman has further said that Sun largely owns iPlanet's intellectual property.

Owch.

<comment><USER9> Thanks for pointing that out.

</comment></comment></comment></comment></comment></comment><comment><USER11> They created Visual J++ because Java scared them and also because Java didn't work very well with Windows. Sun Microsystems sued them and Microsoft had to deprecate Visual J++ and its runtime.

They created C# because they wanted a native language for their .NET runtime that integrated seamlessly with Windows. It was obvious that cross platform runtimes were going to be the future and Microsoft couldn't depend on an outside company to drive the technology platform they would be relying on.

<comment><USER12> IMO, it's pretty straight-forward. They created it because of Java. If Java doesn't exist, C# doesn't exist.

<comment><USER13> They also didn't own or control C++. Ownership is extremely important for market control.

<comment><USER14> Actually they at least control the C++ improvements that they are able to drive through the ANSI C++ work.

Only the companies that are willing to sponsor ANSI C++ work, do have anything to say to what happens to C++, same applies to any other ANSI language, including C.

</comment></comment></comment></comment><comment><USER15> I have never really coded in C# or in the .Net platform, but I remember when it came out.

I always thought that prior to C# 1.0 being released, the Java language was stuck. There was no generics, annotations, enumerations, for/each loops or auto boxing which made programming in Java not only painful but dangerous (especially with the lack of generics and for/each). I personally, never considered anything before Java 1.5 "good enough".

I was always under the impression that these language change were in response to what C# and many of these language concepts were practically copied from C#. Is this actually the case?

<comment><USER10> In the case of generics, C# got them right (but required changes to CLR 2.0) and then Java tried to copy the idea (without requiring any changes to the JVM) but fucked them up. Look up "type erasure": Java's underlying compiled classes weren't actually generic, and generics compiled down to "Object" and casts (which are less efficient, and can be subverted at runtime). Generics were implemented by the Java compiler, not the JVM runtime.

[https://stackoverflow.com/questions/31693/what-are-the- diffe...](https://stackoverflow.com/questions/31693/what-are-the-differences- between-generics-in-c-sharp-and-java-and-templates-i#31866)

[https://stackoverflow.com/questions/355060/c-sharp-vs- java-g...](https://stackoverflow.com/questions/355060/c-sharp-vs-java- generics)

[http://www.jprl.com/Blog/archive/development/2007/Aug-31.htm...](http://www.jprl.com/Blog/archive/development/2007/Aug-31.html)

[http://www.artima.com/intv/generics2.html](http://www.artima.com/intv/generics2.html)

[https://blogs.msdn.microsoft.com/ericlippert/2009/07/30/what...](https://blogs.msdn.microsoft.com/ericlippert/2009/07/30/whats- the-difference-part-one-generics-are-not-templates/)

<comment><USER14> The Pizza compiler had better generics support.

[http://pizzacompiler.sourceforge.net/](http://pizzacompiler.sourceforge.net/)

But then only part of it was taken back into Java.

</comment></comment></comment><comment><USER16> Microsoft created J++ which was Java but with extensions that only worked on Windows. In Visual Studio, these extensions were enabled by default so programmers were unwittingly writing software that only worked in Windows thinking they were writing cross platform Java code. This was a very sneaky move that went totally against Java's _write once, run anywhere_ moto. Microsoft was sued and a judge ruled against them. They were forced to disable the Microsoft only extensions in Visual Studio and warn developers that they were creating Microsoft specific code when the extensions were enabled. Microsoft got mad, went home and broke all their toys. Next day they came back with C#.

[https://www.cnet.com/news/sun-microsoft-settle-java- suit/](https://www.cnet.com/news/sun-microsoft-settle-java-suit/)

<comment><USER17> Java was far less open back then than it is now, and this lawsuit is a good example.. There was even a question whether you could have a clean room JVM implementation at all.

</comment></comment><comment><USER18> Funny thing. After all these year it actually seems like Java now has the upper hand.

It is an open platform. You are just as productive as a developer on Unix and Mac OS X as you are on Windows. The "toolchain" with things like Maven, build and dependency management, is well-defined and not buggled into a big IDE like it is on C#.

Deploying on Unix is a standard thing, not an experimental feature. And finally there is Android.

Sure Java as a langage is more conservative but the differences are not that big. And there are alternatives like Scala or Kotlin for those want and they seem to be a minority.

<comment><USER19> > It is an open platform. You are just as productive as a developer on Unix > and Mac OS X as you are on Windows.

How is that any different from .Net core? Open platform, check (1) productive on those platforms, check (2)

> buggled into a big IDE like it is on C#.

Nope. dotnet cli is fine standalone (3)

> Deploying on Unix is a standard thing, not an experimental feature.

Um, it might be fairly new but I would not call that platform target "experimental" any more. It's in version 2 now

> And finally there is Android.

Yes there is. I know teams that write in C# for Android and iOS. (4)

C# is late to the party in this regard. But what you are saying isn't correct.

1) [https://github.com/dotnet](https://github.com/dotnet)

2) [https://code.visualstudio.com/](https://code.visualstudio.com/)

3) [https://docs.microsoft.com/en- us/dotnet/core/tools/dotnet?ta...](https://docs.microsoft.com/en- us/dotnet/core/tools/dotnet?tabs=netcore2x)

4) [https://www.xamarin.com/](https://www.xamarin.com/)

<comment><USER18> Java is the primary development langauge for Android. You can't really compare that to the stuff you are listing.

Can I run Visual Studio on my macbook? Does any of the companies developing webapps in C# actually deploy on Unix?

MS might aspire to have that broadness of platform but it is not actually there. It is in the Java world.

<comment><USER19> > Can I run Visual Studio on my macbook?

Visual Studio Code, yes. People do that. I see it at my employer.

But ultimately it's not tied to a particular IDE. You could e.g. use JetBrains Rider (1) on your mac. You could use the likes of Sublime text, the command line tools and a plugin (2) if you want.

> Does any of the companies developing webapps in C# actually deploy on Unix?

Some of them do yes, and more of them will. AWS Lambda functions too. (3)

I see both of those (.Net core web apps and lambda functions) at my employer.

> MS might aspire to have that broadness of platform

Correct, this a fairly new aspiration

> but it is not actually there.

You know, it's ok to say "I don't actually know that particular technology very well, I'm not keeping up to date with recent developments in that space." Nobody tracks everything. You don't have to make strong statements about things that you don't know much about.

1) [https://www.jetbrains.com/rider/](https://www.jetbrains.com/rider/)

2) [http://www.omnisharp.net/](http://www.omnisharp.net/)

3) [https://aws.amazon.com/blogs/developer/aws-lambda-net- core-2...](https://aws.amazon.com/blogs/developer/aws-lambda-net- core-2-0-support-released/)

<comment><USER18> Vscode is not vs.

I didn't want to go into a detailed argument. Just look at the broad lines of what happens in practice. On one side you have a diverse environment with different development machines, deployment machines and so on. On the other side you don't have diversity. It is as simple as that.

<comment><USER19> No, VSCode is not VS and that's a good thing, VS is a beast, you called it "a big IDE" and that's true, VS code is much lighter.

But did you miss the _three other_ development options listed for .Net on mac? : Visual Studio For Mac, Jetbrains Rider, and bring your own editor.

> didn't want to go into a detailed argument. It is as simple as that.

Things are usually only simple from a distance. How much time have you spent up close to .Net in the last 2 years?

For my part, I have spend no time close to Java lately, and that is why I don't hold forth strong opinions about Java: because I would be a fount of ignorance. I'd rather listen to those who have more experience with it.

> On the other side you don't have diversity.

That might have been universal a while back, but it really is not any more. Facts have been laid out above and you keep repeating your assertion. It's just prejudice. Is this something that you want to be true?

Look, the .Net ecosystem is changing for very valid reasons, and in a great direction. It has changed a lot at a sustained pace over the last few years, and that will not stop. Some employers and industries have not changed yet, and that's fine, many places are happy in their niche, be it .Net and Windows or Java and Linux. However your universal assertions are outdated, and will be increasingly irrelevant.

</comment></comment></comment></comment></comment></comment><comment><USER17> I was involved in some of the first non-Sun java VM implementations and spent some time at Microsoft. The quick list of major reasons: 1\. competition between Microsoft and non-Microsoft camps 2\. Java was far less open in the 90's than it is now 3\. .Net/C# is a better language and runtime,(e.g. how it deals with native code, designed for JIT compilation from the start, created with multiple languages in mind)

</comment><comment><USER20> Microsoft got sued by sun so they got rid of their VM and made C#. C# copied java, but its evolved and now has a lot of cool features.

<comment><USER14> Java also ended up copying quite a few features of C# back.

\- Boxing

\- annotations

\- StringBuilder

\- LINQ

\- var (coming with 10)

<comment><USER21> How does Java linq look like?

<comment><USER22> IMO it's completely inferior to LINQ in C#. One of the main reasons being that Java still lacks extension methods, so you're stuck with the methods that are provided for you. In C#, if I want a Dedupe in my LINQ method call chain, I can simply implement it myself.

</comment></comment></comment></comment><comment><USER23> C# and Java. From Open Source standpoint and with Android adoption Java was/is ahead. However, things are changing again. Oracle has announced that they will give free support to Java releases only for six months. It makes JVM a risky, unstable and potentially unsafe platform to develop on. On the other hand, MS is putting a lot of effort to make C# open and to make it run on all platforms.

Both the languages and platforms are very good. But right now there is more influential OSS (HBase, Cassandra, Kafka and many others) stuff in Java. However, I wonder with Oracle's new stance, if C# will become the preferred language for Open Source. Or Maybe Go will leave both Java and C# behind.

<comment><USER14> That is not correct, 6 months support is for the releases that aren't LTS. LTS releases are three years.

Without generics, GUI toolkits, good quality SQL drivers from the vendors themselves, enterprise frameworks and the IDE quality of Java and C#, Go will never be an actual threat to them.

Go 2.0 might be, if it ever happens.

<comment><USER23> Yes, I know about LTS releases. But upgrade time from one LTS to another LTS is only 3-4 months. Check [1]. For JDK8 for people using it for commercial purpose, the updates will stop in Jan. 2019 only after 4 months since new JDK 11 LTS release.

According to Wikipedia [2] same period for JDK 7 to JDK 8 was 1 year. Also on the same Wikipedia page, you can see how many bugfixes JDK 8 received in that 1 year.

So JDK8 to JDK 11 release is also going to be a little bit risky as people will need to depend only on 3-4 months stability reports to upgrade their production deployments to JDK 11.

[1] [http://www.oracle.com/technetwork/java/eol-135779.html](http://www.oracle.com/technetwork/java/eol-135779.html)

[2] [https://en.wikipedia.org/wiki/Java_version_history](https://en.wikipedia.org/wiki/Java_version_history)

</comment></comment></comment><comment><USER24> Because they wanted to decide for themselves</comment>


Mining for Malicious Ruby Gems - <AUTHOR> https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems <comment><USER2> > The perfect candidate to succumb to this type of "spray-and-pray" supply > chain attack is a Ruby developer whose environment of choice is a Windows > system that's also periodically being used to make BitCoin transactions. A > rare breed indeed.

Very rare indeed. I suppose every package had their own BTC address. I wonder how much they got away with.

But I thought rubygems does a similarity check for names and reject or flag them for manual verification if the name is too similar to an existing one?

</comment><comment><USER3> I would support a Great Renaming, wherein underscores and dashes are considered equivalent and insignificant:

        action-mailer_cache_delivery
        action-mailer-cache-delivery
        actionmailercachedelivery
        act-ion-ma-iler_c-ache-deli_very

Should resolve to the same entry in RubyGems.

I would also support this usage in `require` lines.

The "experts-exchange" (or "pen-is-mightier") problem is tiny compared to the frustration and security risk of the present policy.

</comment><comment><USER4> Free software projects need to converge on standard platforms and tools. On the modern complex world, it's bad enough that they can't keep with proprietary software features and polish. But they can't keep up with the black hat industry either.</comment>


Apple Uses Bluetooth LE To Enable Apple TV 'Touch To Set Up' Via iOS 7 Devices - <AUTHOR> http://techcrunch.com/2013/09/25/apple-turns-apple-tv-into-an-ibeacon-to-enable-touch-to-set-up-with-ios-7-devices/

<comment><USER2> Direct link instead of AOL's rewriting of AOL's summary of it -

[http://support.apple.com/kb/HT5900](http://support.apple.com/kb/HT5900)

</comment><comment><AUTHOR> I've been wondering recently if iBeacon is the first showing of a 2 year long plan to crush NFC and take over POS payments, or whether Apple released iBeacon just for better Passbook functionality, and then the world anointed it as the NFC killer and all-hail-the-new-king - and now Apple is scrambling to come up with a comprehensive plan to do what people _think_ iBeacon was meant to do.

(They've delayed any detailed specifications for weeks now.)

Doesn't matter to me. _Anything_ that finally gets Bluetooth LE on a roll is fine with me. It has awesome potential.

<comment><USER3> I think iBeacon is Apples response to NFC. NFC was poorly executed from the beginning. Google didn't push it hard, and Samsung implemented it wholeheartedly with gimmicky features like file transfer. No major retailer was ever involved that I or anyone I know care about. The most I saw NFC being used for was Samsung bus stop ads. What Apple has in it's hand and what Google is trying so hard to get is 500 million user accounts with CC information already entered via its app and music stores. The payment information is what the companies have a hard time getting. Wallet and Checkout never blossomed and all those reasons are why NFC is so anemic right now.

Also, NFC technology is a little clunky with 'turning on yet another protocol, setting up incoming connections, "it didn't work try again.", etc, etc'. The iPhone is the phone of the masses because they simplified or removed protocols like removable Li-ion, SD, USB, and NFC. The only protocols that remain are the most branded, and the most functional. (They are still working to perfect Siri :)

Developing well established existing technologies that people and phones are already used to (bluetooth) is key to Apple's strategy. NFC was DOA simply because Samsung has a hard time with implementation [ie: eye tracking, tv voice commands, and hand commands].

<comment><USER4> I don't know how Samsung's NFC implementation works, but the only correct way to use NFC or Bluetooth Low Energy is to exchange a session key, and then use WiFi for the actual data transfer. NFC and Bluetooth LE have way too low a data rate to be useful for anything else. (Well, I guess it's OK for syncing my step count from my FitBit.)

Actually, this makes me wonder why anyone bothered with NFC or Bluetooth LE for file transfer, etc., when WiFi Direct is just as good.

<comment><USER5> Can't Bluetooth LE "upgrade" the connection to full speed?

Also, since I'm asking: Does anyone know if my Bluetooth-LE-supporting HTC One will consume very little battery if Bluetooth is turned on? I have an inkling that it will need to keep advertising Bluetooth proper, so it will use as much battery as Bluetooth always has.

<comment><USER6> No. Bluetooth and Bluetooth LE are distinct, incompatible protocols.

</comment></comment></comment></comment></comment><comment><USER7> Why would actually tapping your phone onto the Apple TV be required? I thought iBeacons had a range of several meters.

<comment><USER8> In article it says you don't have to touch AppleTV. They were able to pair from 8 inch distance.

<comment><USER9> From my perspective, this seems why perhaps iBeacon isn't an NFC killer? NFC seems to have an advantage of requiring contact (baring a few millimetres gap because of device/case) to trigger an action (better for actions that are more 'intentional'?) whereas with iBeacon distance is bit of a woolly concept.

</comment></comment></comment><comment><USER10> I don't think this is "iBeacons". This sounds like the MultipeerConnectivity framework, which uses both WiFi and Bluetooth and is agnostic as to which interface is used.

<comment><AUTHOR> Everything is iBeacons these days.

Doesn't matter that Bluetooth LE has been out since 2010, and was first developed by Nokia in 2006.

I actually don't mind. I've been waiting for years for Bluetooth LE to take off. If this is what it takes, that's fine with me.

</comment></comment><comment><USER11> Can't the same thing be done using regular Bluetooth?

<comment><USER12> The benefit of BT LE is that the pairing process is supposed to take at most 6ms. Thus the requirement for 4S or later iOS devices.

Pretty sweet. I wonder if this was supposed to be part of the new AppleTV reveal in Oct?

<comment><USER13> _is supposed to take at most 6ms. Thus the requirement for 4S or later iOS devices._

I don't follow the causation between the first and second sentences. Are iPhone 4 not fast enough or do they lack the proper BlueTooth technology?

<comment><USER14> The latter. The iPhone 4S was the first model with BTLE hardware.

</comment></comment></comment></comment><comment><USER15> Great, this sounds like Apple is going to compete with NFC.... you know, a real standard. Like FaceTime, oh wait, like iMessage, oh wait, like AirDrop, oh wait.

<comment><USER16> Apple is making a bet on NFC like they did on Blu-Ray. Nothing has proven that NFC is going to change the world one device at a time yet, just ike so many computers still don't come with Blu-Ray drives. Besides, every iPhone and iPad currently for sale support BTLE, whereas there are only a handful of devices that come with an NFC chip. Why wouldn't Apple leverage a technology that all of their current devices support?

<comment><AUTHOR> I agree with most of your argument, but almost every Android phone for the last 3 years has had NFC installed - so I'll bet the installed userbase is actually _more_ than for Apple's Bluetooth LE.

<comment><USER6> And every Android phone has had BLE hardware, but no software because Google dragged their feet until this summer. The install base of BLE is _far_ larger than NFC.</comment></comment></comment></comment>


Ask HN: Any examples of ethical pyramid schemes? - <AUTHOR> To be clear I know pyramid schemes are scams, however some companies use similar tactics to increase user adoption.
For example Uber gives you credit if you get friends to sign up. Many other companies use this tactic too. It seems a product could get explosive growth using a method like a pyramid scheme, but I'm not sure it's ethical...
Are there any other examples of ethical pyramid schemes in business? <comment><USER2> A referral scheme and a pyramid scheme are very different things. A pyramid scheme is where revenues derived from recruiting people into the scheme exceed revenues from sales of the end product. Because people further up the pyramid make commission on the recruiting/sales of those further down, growth requires the perpetuation of fraudulent claims about income potential - selling the hope that the new recruit can reach those upper levels of the pyramid when it is more or less impossible unless you get in early, because people are already occupying the higher levels.

This all applies when the pyramid scheme is zero sum (i.e. the transfer of money up the pyramid). I once had the idea for a company that would do tutoring in a pyramid structure where a tutor would be one level above their tutee in this pyramid and that there would be non zero-sum interactions since the tutor also cements their understanding by trying to teach someone one level below them, with some monetary commission involved too for a tutor's tutee's tutee's tutoring, etc.

That wouldn't be a pyramid scheme by the aforementioned definition though.

You can't really have an ethical pyramid scheme by the definition, I think people just confuse "pyramid-shaped" things with the precise definition of a pyramid scheme.

</comment><comment><USER3> I think the fundamental nature of a pyramid scheme is that the people below finance the people at the top. In the example you used, the people at the bottom are not injured by the people who invited them. It would be different if they had to pay a fee to sign up once invited that went directly to the person who invited them. That's the scenario that sets up the people at the base of the pyramid for fraud. In your example, people aren't injured if they can't find people to recruit.

</comment><comment><USER4> Most jobs are positive pyramid schemes, IMO.</comment>


Patronizing Passwords - <AUTHOR> http://joelcalifa.com/blog/patronizing-passwords/ <comment><USER3> "The point here is that it's my decision. Perhaps, to me, the convenience of a single email/password combination is worth the risk of my accounts being cracked in bulk.

As a user, I have the right to weigh my own pros and cons."

If you bore the full cost of your account being hacked, that might be true. But in practice that's not the case. There are laws and contracts that protect you from the full costs of your being hacked and shifts some of those costs to the proprietor of the website. Even leaving aside those direct financial risks, the proprietor of the website bears customer support costs if your account gets hacked, and quite possibly PR risk too.

I like the Password Security Guide idea though.

</comment><comment><USER4> I have the perfect solution to this, but software systems aren't with me yet. The answer is: a keychain. Not a digital keychain, an actual one. On this I put my "infinity key" \- it's a little USB flash drive with a LUKS-encrypted file system on it that holds a private key. Lots of tech people have something like this. It's great for SSH - I can add my infinity key to any host and be assured that I will always be able to login securely from any machine I want. We're all used to the physical metaphor of keys as security, and needing a physical key to get into things. This is not a huge change for us.

This could easily become the norm, and should. It requires only one key for all of us, it is perfectly secure, doesn't require storing secrets on the remote end, never needs to be changed, can't be forgotten because it doesn't need to be memorized (there is one password for the LUKS encryption). There is no penalty for using the same key in thousands of places.

The problem is, no website or browser supports this kind of authentication, and most people are not savvy enough to build this sort of thing for themselves. These are both problems that should be solved; we desperately need to move the Internet away from passwords, password resets, and so on.

<comment><USER5> You can't really "add" your key to a computer you don't trust, though. At best, it could destroy your USB device; at worst it could copy the contents out once you decrypt them.

This may be better than using one password for everything, but it's certainly not a panacea.

<comment><USER6> Maybe the only answer is to air-gap the two devices and have the user input a secret code shown on the dongle. So you press the button, type the code on the website and log in that way.

Edit: Or maybe have two devices: one dumb flash storage and a device that actually computes your key. You press the "compute my key" button while the storage is connected to the keychain, then disconnect it from the keychain and connect it to the pc. Next time you connect it to the keychain, it's wiped before use and never ever read.

<comment><USER7> The device could instead have a display that displays a password, QR code, one-time-key, etc... and then you would scan it using a webcam or your phone (or type it manually).

<comment><USER8> Maybe like a phone running a TOTP application?

<comment><USER7> I would have more trust in a separate device that has no networking capabilities.

<comment><USER9> What if it's in a "secure element" whose hardware and firmware make it provably incapable of divulging the private key?

<comment><USER7> I don't think that's possible... it reminds me of Apple saying that they can't decrypt your phone, but it is decrypted when you use it and many apps have permissions to transfer basically everything over the network (and Apple has root too).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I switched jobs last month and decided to audit all my personal stuff while the old place was auditing all the work accounts I left behind. We'd been using google/gmail 2 factor authentication.

There's a few layers to it, most everyone has seen. Ok, 1st factor is your password, so you log in with your password.

2nd factor can vary - a list of codes you print and keep in your wallet, or they can send a txt message to your phone. Or you can get an authenticator app, which you configure with some magical seed value, and then you have what's effectively a software RSA token device on your phone.

Even easier? I just found out about these FIDO usb hardware keys. 9 bucks, wait for it in the mail... go to your gmail account settings, click the link, put the hardware key in, press the button... and that's it, from then on you can plug that key into a web browser (chrome, actually) and it will pass the second factor. Anyways, it's been out for a while, but I just found out about it, and it's so easy to do I wanted to jot a note down here.

<comment><USER11> What's the procedure if you break or lose the FIDO hardware key? (Not a rhetorical question; I'd never heard of them before either.)

This is the sort of the thing I always worry about when discussing or considering strengthening security. At some point the risk of accidentally locking yourself out outweighs the risk of someone else getting in. Particularly so for something like gmail, where there's no customer service as a last resort.

<comment><USER12> I'm not 100% certain, but when I setup 2FA for many services they give you ~10 single use emergency codes that you can use to get into the system in the event that your second factor is unavailable for whatever reason (phone stolen, you are out of the country, fido broke, etc.)

</comment></comment></comment><comment><USER13> I work at Okta([https://www.okta.com/](https://www.okta.com/)), a SSO product among other things, and we deal with this all the time. We use a variety of techniques to help secure the user's identity and access to various applications.

1\. Use the SAML protocol to log in to apps as opposed to passwords. (See [https://en.wikipedia.org/wiki/Security_Assertion_Markup_Lang...](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) for more)

2\. Use MFA as much as possible. Our product works with a variety of MFA options, including hard tokens, such as Yubikey, and more software based ones, like our own MFA app that pushes a notificication for MFA.

3\. Generate random passwords for other applications that can be rotated frequently and easily.

There's a lot more we do underneath the covers and other ways of improving passwords and logins, such as adaptive MFA (prompt MFA if the login passes some threshold of suspiciousness)and no password login (simply use the multifactor token as the primary factor)

</comment><comment><USER14> I hate the recommendation of 2FA as the solution. I find 2FA more patronizing than anything else.

I use a password manager (1Password) and have a unique, secure password generated for every site. If someone gets access to my passwords, that means they've compromised my 1Password keychain which is game over anyways. I'm not interested in any protection mechanisms for such an unlikely scenario. So I end up storing the 2FA keys inside of 1Password as well—bringing it back down to 1 factor, but adding annoyance and hassle.

Don't make assumptions about how your users secure themselves.

<comment><USER15> My biggest question with this is, what if I ever have to login using a computer or tablet that is not mine? How does 1Password deal with that case?

<comment><USER14> 1\. I have my keychain on my iPhone, so I can always look up the password there.

2\. 1Password lets you publish an encrypted HTML viewer which you can share via Dropbox, so I can retrieve passwords online if need be (just need to remember my Dropbox and 1Password passwords).

</comment></comment></comment><comment><USER16> I completely agree with the article. From what we can tell password strength meters mostly work, or at least work "well enough." Some users attempt to game the system and in doing so wind up with marginally more secure passwords.

We also found 2F easier to implement than even we expected. Google Authenticator uses something called "Time-based One-time Password Algorithm" or TOTP for short. Even ignoring all the open source code and libraries, it actually isn't really at all complicated to do yourself. The hardest part is generating the QR codes for Google Authenticator (which, yes, we did utilise a library for). Even the storage requirements are low.

Our current passwords rules are:

\- Minimum 6 characters

\- Maximum 256 characters (for DDoS protection reasons, long passwords cause a high CPU load on our micro-instances)

\- We technically allow a "weak" password but bring up a pop-up (strongly discourage it).

\- We do have password expiration (90 days) and history (3x) due to unavoidable organisational requirements

But overall we're pretty liberal. You can use sentence based passwords and typically they're marked as "secure" in the traffic light score system.

> Forget about the now famous XKCD strip that proves a long lowercase password > is more secure than a short dollar-sign-riddled password.

Technically what it proves is that you can replace one character in a complex password with one word in a sentence based password and get similar (or better) levels of security, even if the attacker knows you utilise sentence based passwords.

For example, a En-US keyboard has approx. 100 characters on it. A child's dictionary has about 10,000 words in it. But in reality less than 1/2 of those keys are ever typed, and less than 1/16 of those words regularly used (plus you have predictable words like "The" "A" "I" "And" etc which have less security value).

So a good rule of thumb is: If you move from random character passwords to sentence based passwords, keep the letters in the former the same as the words in the latter (e.g. 6x characters = 6x words, 8x characters = 8x words, etc).

This gives you the best chance of remaining either as secure or MORE secure while moving to lower case sentence based passwords.

<comment><USER17> Just curious, but long passwords shouldn't in any way affect CPU load. After the first hash (of thousands?), it's just hashing a hash, which is always the same length unrelated to the original password length.

Even though I can't think of a legitimate use for > 256 character passwords.

<comment><USER18> > After the first hash, it's just hashing a hash

The recommended password hashing functions (PBKDF2, bcrypt, scrypt) actually use the provided password in each iterated round of the algorithm. The DoS vector Someon1234 mentioned is real and has previously affected Django[0] (and, I believe, others). In order to prevent it, you should either limit the maximum password length (256 characters seems sensible, as does Django's choice of 4096) or hash the password (to a known length) before passing it to the KDF.

[0] [http://arstechnica.com/security/2013/09/long-passwords- are-g...](http://arstechnica.com/security/2013/09/long-passwords-are-good-but- too-much-length-can-be-bad-for-security/)

</comment></comment></comment><comment><USER19> I really like the idea behind passwordless [1], where users never use a password but just confirm they are who they say they are.

I always remember Tom Scott saying "Don't store passwords yourself if you can all avoid it" [2] and how you should leverage google, facebook and other 3rd party authentication methods as a way to add a layer of security and remove one way to compromise your user data.

[1] [https://passwordless.net/about](https://passwordless.net/about)

[2] [https://www.youtube.com/watch?v=8ZtInClXe1Q](https://www.youtube.com/watch?v=8ZtInClXe1Q)

<comment><USER20> A disadvantage is the media break while using passwordless.

Some folks i met strongly believe that using a different medium while interacting with a site distracts new users, by this lowering the sign-up rate. I have no data on that but it sounded at least plausible.

If you believe in this, it would depend on your target group how you should handle passwords (or the lack of).

<comment><USER19> I think your argument would also valid for 2FA approach, which is is widely encouraged regardless. Sign-up rate would drop drastically for a majority of common users if a good UX is not into play while developing the system workflow.

But I want also say that for a great variety of solutions having 2FA or passwordless as default is valid, Slack for example has an option of demanding 2FA for all team members, which a lot of people would agree is a good thing.

The "Password Security Guide" section at the article is a good example of educating people how insecure storing password, and you could do the same thing showing/enabling passwordless as a clear and easy alternative to migrate to.

<comment><USER21> But most sites let you "trust this device" once you've done 2FA - <USER2> doesn't have that option from what I can tell. Also, 2FA is an extra, optional layer for most users. They can choose if they want the extra hassle in exchange for security. Passwordless gives you no such option, you have to switch apps, period.

</comment></comment></comment></comment><comment><USER22> I'm actually thinking something completely opposite; do we really need to have users input their own password? Why not just generate one for them? Users are notoriously bad at creating passwords (on average), and generating one for them would allow us to throw away all that complex password rule dancing.

For the people that are already using password managers it would be fairly minor change in workflow when creating accounts (which is relatively rare occasion anyways), and for the rest it would be massive improvement in security.

<comment><USER23> In my naive thinking, I'd let my computer and the server manage passwords independent of me. Let them share some secret; then my machine creates a 1024-bit challenge and get a response from the server. Why involve me at all? I'm terrible at managing large random things.

<comment><USER3> If you always used one computer that would be fine. But if you create your account on your home computer and then want to use it on your work computer, your ipad, your android phone, and occasionally at your brother's house then we need some way of authenticating you instead of your computer. And even if you don't want to log on from any of those places, eventually you are going to get a new computer.

<comment><USER23> And how does that differ from a huge, unrememberable password?

</comment></comment></comment></comment><comment><USER24> Does anyone really believe the world needs yet another article bemoaning the common and unpopular practice of imposing arbitrary requirements on passwords?

I'd much sooner read a piece discussing the reasons developers so often make this design choice. Is it a thoughtless formula, a common misconception about how brute-force attacks are conducted, or something else?

I'm far from an expert on the subject, but as an aside, I'd like to point out that the XKCD comic on the topic seems inconsistent with what I know about how brute-force attacks are usually conducted. To my knowledge, these are usually dictionary-based attacks, which would significantly decrease the "search space" to discover even a long, lower-case sentence. Thus a password with random characters and shorter length might be more secure in practice than a longer password composed of English words.

Edit:

I've been informed that my layman's speculation on the comic was mostly wrong. As I said below, "sorry to be on the other side of the 'infuriating argument with someone who doesn't know information theory or security.'"

<comment><USER25> > To my knowledge, these are usually dictionary-based attacks, which would > significantly decrease the "search space" to discover even a long, lower- > case sentence.

The xkcd comic assumes a dictionary-based attack. It points out that choosing 4 words at random from the 2048 most common words provides more entropy than choosing one word at random from the most common 65536 words and performing some letter substitutions on it. In both cases, it is assumed the attacker knows the formula used to create the password.

If your formula for creating a password is "Choose a printable ASCII character at random, then repeat", you only need a password that is 7 characters long to beat the "4 random common words" formula (95^7 > 2048^4). But the percentage of people who construct passwords by choosing random printable characters rounds to zero.

<comment><USER24> I appreciate the clarification. Sorry to be on the other side of the "infuriating argument with someone who doesn't know information theory and security."

<comment><USER25> Not at all, I know only a tiny amount about this field myself.

</comment></comment></comment></comment><comment><USER26> This is exactly what happened to me on MULTIPLE occasions with multiple websites. Right down to the special characters table flipping.

But the best one yet was my car insurance (have since switched to another one). I logged in maybe once or twice a year and that thing was asking for a PIN. Turns out this was not actually a number they were asking for. When clicking through their password reset forms I found out that they were actually asking for a password (with multiple rules in place to make it more secure). Gaaahhh.

Ok, sorry for rambling…

</comment><comment><USER27> "It's time to use the password reset link again, which at this point is basically your login button."

This actually is not a bad idea. For rarely used sites I might as well just make something up that is impossible to guess and that I will never remember, and then just use the reset link every time.

<comment><USER28> I did something like this with [http://nightchamber.com](http://nightchamber.com), where your 'login' is just a unique URL. It's a fun idea, but it only works when the stakes are low (which they are for nightchamber, it's not like there's anything useful in the account anyway). I sure as hell wouldn't want paypal or amazon using that kind of scheme though.

</comment></comment><comment><USER29> On one side I understand the need for good passwords given how bad websites are at keeping their clients data private, but fundamentally the problem is rather that websites are leaking data, not that passwords are too weak.

How do we solve that problem?

<comment><USER30> > How do we solve that problem?

You don't solve it, but you mitigate it.

1\. Decentralize authentication and get rid of passwords. Persona/BrowserID had the exact right idea in mind and .. well, whatever, it's gone now, and we're all pissed off; plenty was said about it. We need the concept back and we need it to be popular.

2\. Stop gathering so much data. Stop keeping it for so long. If your client's data is sensitive, ask yourself - and your client - whether you should really be keeping it and how long should you be keeping it for. You're not Google, Facebook or anything close to them - the odds are you will _not_ be able to do anything with "big data". Either make the data public in the first place (if it's appropriate for it to be public), or wipe it out if you don't need it.

3\. Start treating security malpractice in large companies as seriously as we treat Food & Health standards. Leaking hundreds of thousands of passwords because you hashed them with md5 no salt is _criminal_.

4\. Build a better framework for users to learn the basics of security. How it works, why it matters; the fundamentals necessary to figure things out on your own. Make them understand what they're giving up if they are not treating this seriously. Education, education, education.

</comment></comment><comment><USER31> Reminded me of this video: [https://www.youtube.com/watch?v=luv_bWmb9lE](https://www.youtube.com/watch?v=luv_bWmb9lE)

</comment><comment><USER32> There's no way I would give away my phone number to any random website. Thus, I would never use two-factor authorisation that involves my phone, unless it's a bank or something. Most of "social" accounts aren't all that important anyway.

<comment><USER33> 2FA doesn't mean phone number. There's also HOTP and TOTP, dongles, bio, etc.

</comment></comment><comment><USER34> There's a RFC for everything else... why not have one for password requirements?

[https://en.wikipedia.org/wiki/Request_for_Comments](https://en.wikipedia.org/wiki/Request_for_Comments)

</comment><comment><USER35> Nothing about password, but the nav banner show/hide on scroll for the page is delightful (and should be adopted by all sites post-haste IMO).

</comment><comment><USER36> 1password... last pass... is the only way to survive... Now how soon can we completely abolish passwords?

</comment><comment><USER37> No love for spaces in passwords? i.e. spacebar presses

</comment><comment><USER38> This exactly is why I use LastPass

<comment><USER39> Ditto, but I still get annoyed at having to re-generate a password half a dozen times to fit whatever opinionated rules a particular site comes up with.

</comment></comment><comment><USER40> > The Attorney General of Texas Child Support website

It would not surprise me at all if this password hell was intentional.</comment>


Company Announces First SEC-Compliant Public American Ethereum ICO - <AUTHOR> https://medium.com/@BlockMason/three-weeks-ago-the-ethereum-community-was-rocked-by-an-unexpected-report-the-sec-had-finally-90814e8ca4d <comment><USER2> This is Fake News, as an honest reading of the SEC press release shows. There is _no such thing_ as an "SEC-compliant ICO"; the SEC has made no such endorsement.

The SEC press release simply says that ICO instruments _may be securities_ and therefore _subject to the full gamut of SEC regulation_.

</comment><comment><USER3> Direct link to legal opinion: [https://blockmason.io/Ethereum_Opinion_2017-08-14.pdf](https://blockmason.io/Ethereum_Opinion_2017-08-14.pdf)

<comment><USER2> A _memo_ published by a law office is _not_ a "legal opinion" in the normal vernacular.

</comment></comment><comment><USER4> Why haven't other companies been able to get lawyers to issue similar opinions?</comment>


New spongelike structure converts solar energy into steam - <AUTHOR> http://newsoffice.mit.edu/2014/new-spongelike-structure-converts-solar-energy-into-steam-0721

<comment><USER2> Isn't limescale going to make this unusable quickly? Perhaps those structures will need to be moved through acid baths periodically and automatically. What about dirt? I guess that's the joys of research when you've got a practical usage in mind--all of the issues that lie ahead.

</comment><comment><USER3> Link to paper: [http://www.nature.com/ncomms/2014/140721/ncomms5449/full/nco...](http://www.nature.com/ncomms/2014/140721/ncomms5449/full/ncomms5449.html)

</comment><comment><USER4> 85% efficiency - wow!

<comment><USER5> Once you run it through some kind of thermodynamic cycle to turn steam into electricity, the efficiency will drop.

There's a limit to how efficient those processes are. For the kinds of temperatures we can easily handle with the technology we have, it's not so rosy.

Steam plants are between 30% and 60% efficient depending on how fancy (and thus expensive to build) they are.

[http://en.wikipedia.org/wiki/Thermal_efficiency](http://en.wikipedia.org/wiki/Thermal_efficiency)

So if you figure the steam plant might be 45% efficient and the steam production is 85% efficient you end up with 0.45 * 0.85 = 38.5% total efficiency.

Better than off-the-shelf PV panels available today. But this method requires solar concentration by a factor of 10x which will definitely add cost. If it's better that PV at that point would remain to be seen.

<comment><USER6> Though you don't necessarily need to convert it to electricity, and can use the steam for something else, like desalination of sea water.

<comment><USER7> Nothing lasts in sea water. Least of all sponges. I doubt that's a practical application.

<comment><USER8> Just wash it off.

<comment><USER7> Incidently, detergent is one of those things that won't work well in seawater. Plus seawater is corrosive. So even if you do manage to clean things, they're not as reusable as they otherwise would be.

</comment></comment></comment></comment></comment></comment><comment><USER9> I wonder how their new type of graphite sponge would work in a battery.</comment>


RFC2468: I remember Jon Postel, by Vint Cerf - <AUTHOR> http://tools.ietf.org/html/rfc2468

<comment><USER2> I never knew him personally, but I definitely felt the loss.

I happened upon the Internet in the late 80s, a wide-eyed college freshman, and the early RFCs taught me a lot about systems design and protocol design.

More than that, they taught me to see the Internet as an endlessly collaborative process. There was no central king-like authority. We were all in it together, figuring it out as we went. We still are.

For that, I owe Jon Postel a debt of gratitude. I always will.

</comment><comment><USER3> Thank you for making this post, Luyt. It is a good thing to be reminded of those who did so much to make the present day what it is for us.

</comment><comment><USER4> Folks, these are the shoulders we are all standing on. Let's try not to mess it up too badly.

</comment><comment><USER5> "Jonathan B. Postel, our Internet Assigned Numbers Authority, friend, engineer, confidant, leader, icon, and now, first of the giants to depart from our midst."</comment>


Programma 101, the first commercial "desktop computer" - <AUTHOR> https://en.wikipedia.org/wiki/Programma_101 <comment><USER2> It's terrible that modern Italians no longer understand that our "design" culture can be applied to computers as much it is applied to shoes, food, clothes. It's the same process as the Programma 101 shows, and the engineering background is still here.

<comment><USER3> The real problems start with production costs. See how overpriced the locally assembled Arduino boards are, compared to their chinese clones.

</comment></comment><comment><USER4> "It is usually called a printing programmable calculator or desktop calculator [...] in order to be able to overcome the fears of computers."

We still do the same, but now we call it a smartphone.

<comment><USER5> Interestingly, Nintendo did similar things for US launch: called theirs an "Entertainment System" and designed it to have a technically not necessary loading mechanism similar to a VCR, to dissociate it from the game consoles of the day.

<comment><USER6> And cancelled the AVS [https://www.google.com/search?q=nintendo+avs](https://www.google.com/search?q=nintendo+avs) project because of that too. So stylish but so not the Nintendo history got to remember.

</comment></comment></comment><comment><USER6> It's astonishing to find Olivetti's products in the 60s. They had the aesthetic appeal Apple put into their lines decades later, and seemed like good engineering underneath the style too.

Also, they advertised the same value, making the work easier, leaner, but with fancy desks geometry, cute drawers and typewriters.

Progress never change.

ps: I read in a book that Olivetti's effort to get into the digital computers market died because of a bad bet from their latest owner (De Benedetti failed attempt at taking over [https://en.wikipedia.org/wiki/Soci%C3%A9t%C3%A9_G%C3%A9n%C3%...](https://en.wikipedia.org/wiki/Soci%C3%A9t%C3%A9_G%C3%A9n%C3%A9rale_de_Belgique) in 1980).

<comment><USER7> Sadly De Benedetti is still around after a whole life of bad industrial/fiscal/political behaviours, he faced law so many times i can't even remember

<comment><USER6> Ah, I thought Alain Minc was the bad influence in his choices ...

</comment></comment></comment><comment><USER8> As someone who had the awesome pleasure of a Uncle who started in System Admin in the 1960s and a dad who bought a Sol 20 in 1976 I have to say it doesn't seem very computery. I loved programming that Sol 20 in basic and spend hours fixing it or customizing the programs. Heck a count of 1 to 1,000,000 took over 2 days to finish.</comment>