Ask HN: Method to slowly improve decision making skills? - <AUTHOR> Success or lack thereof boils down to one's ability to make good and decisive decisions. Example: Even being consistent at something (learning, planning, thinking before you speak) requires making good decisions consistently. I realize this is my main battle, above and beyond everything else. I just hope I can retrain my decision making skills. Curious to hear from others about experiences, thoughts, and recommendations. <comment><USER2> David Goldsmith has an excellent outline for decision making he calls Cyclonic Thinking, pulling together thoughts from everywhere-- from forecasting activities, competitive intelligence, other leaders/colleagues, etc... to come up with the best path for reaching your Desired Outcome > [http://www.goodreads.com/book/show/13236274-paid-to- think](http://www.goodreads.com/book/show/13236274-paid-to-think)</comment>


Inheritance versus Composition - <AUTHOR> https://lwn.net/SubscriberLink/787800/b7f5351b3a41421a/ <comment><USER2> One of the most memorable eye-opening moments in my (admittedly fractured) education was when when my software engineering professor listed the 3 fundamental tenets of OO—inheritance, encapsulation, and polymorphism—and then asked us which one was optional.

Ever since then I've been on an anti-inheritance kick, although for the last several years it's polymorphed into an anti-OO kick.

Anyway, I suspect most readers here have heard the idea that inheritance should be used in limited circumstances (or not at all), but I wonder what proportion of college students get that message today.

<comment><USER3> With all this angst against OOP, what other alternatives should a programmer consider or what patterns of hierarchical logic do people suggest?

<comment><USER4> Hierarchy - a single ontology - is one of the problems with OO. Ontologies - note the plural - are useful, but choosing just one ontology privileges some axis of abstraction over others, but there are different lenses you can put on things that may make you want to classify by different criteria.

For example, you might have a bunch of things, some of which: (a) can be rendered in some display - could be console, HTML, print output, screen, don't care; (b) can be serialized to a variety of media; (c) have some common configuration, that interacts with some configuration management system; etc.

If you try and shoe-horn these commonalities into a hierarchy, you end up with classes that advertise being able to do too much and need to have "not implemented" error conditions, breaking the Liskov substitution principle.

Interfaces are a way of breaking out. They're additive, rather than hierarchical, from the implementing class perspective.

The other big problem (a bigger problem IMO) with inheritance is coupling. I don't think there's any closer coupling between two pieces of code in an OOP system than inheritance. Changes in a base class can radically alter behaviour in all descendants. Depending on the implementation of overriding, descendant behaviour can be accidentally hijacked with no compile time or run time warning merely by updating a dependency. The API by which base class and descendant class interact is bidirectional, with the flavours of both library (you call them) and framework (we'll call you), and intermediate internal state when e.g. overridden protected methods are being called is usually sorely undocumented and liable to change.

<comment><USER5> > Interfaces are a way of breaking out. They're additive, rather than > hierarchical, from the implementing class perspective.

Java (and .Net by copying) choose to make interfaces additive and superclasses combinatorial. It's a design decision and in no way intrinsic. Other languages have different choices.

<comment><USER4> Oh, I'm aware. However additive superclasses are much much worse for OOP, there's good reason languages beyond C++ haven't walked the same road.

</comment></comment></comment></comment></comment><comment><USER6> In this issue, proper understanding is muddled by "OOP" languages that have a static type system which uses inheritance as a gatekeeper to polymorphism.

So that is to say, if you want to dynamically substitute objects of class D1 and D2 in the same places in the program, these classes have to inherit some base B. Then D1 and D2 objects can work in places that require a B. For this reason, sometimes the B is a dummy that contains no implementation at all. In recognition of such dummy bases, some languages have "interfaces" and "interface inheritance" to formalize the concept.

In true OOP, there is no such requirement for D1 and D2 to be a new kind of B. Objects are substitutable into a situation if they simply respond to all the required methods. Inheritance is then used optionally just as a trick for implementation reuse. That is to say, we not only want D1 and D2 to be substitutable, but since they are similar, we would like to have a large fraction of their code in common, not to mention the instance data which that code refers to.

The problem is that inheritance is like a software fork. There is this basic implementation of something B, and then these derivations D1 and D2 are like branches: they use the B code, but they replace some of it with their own versions of functions. Those functions initially correctly mimic what their counterparts in B are doing. But if B is subsequently maintained, that can fall apart. B functions can be altered, while their counterparts in D1 and D2 remain the same, not incorporating the new logic. This kind of inheritance situation works best when it's all maintained by one developer, or team, as a cohesive whole. Or else, the base has to be very well designed for inheritance and maintained very carefully.

Inheritance has issues that interact with mutability. The circle-ellipse problem goes away if objects are immutable. In the Common Lisp object system there is an analogy there in that numbers of type _rational_ are subclassed by inheritance into _ratio_ and _integer_. An _integer_ isn't a new kind of _rational_ ; it's a restricted kidn of one, just like a circle is a restricted ellipse. Since we cannot mutate an _integer_ (it is what it is), inheritance models things just fine here; it is quite suitable for partitioning a mathematical set. In terms of substitutability, it is perefect: certainly wherever rationals are allowed, we should be able to use an integer or a ratio, just like where ellipses are allowed, we should be able to use a circle. If we ask an integer what its denominator is, we get 1.

<comment><USER7> >In this issue, proper understanding is muddled by "OOP" languages that have a static type system which uses inheritance as a gatekeeper to polymorphism.

I am trying to think of a commonly used language that exclusively uses inheritance to implement polymorphism. (Unless you consider Java's interfaces to be inheritance when they are the language's alternative to using inheritance.)

<comment><USER8> > _(Unless you consider Java's interfaces to be inheritance when they are the > language's alternative to using inheritance.)_

Having come to Java from C++, I always considered Java's interfaces to be a syntactic sugar on top of inheritance. In C++, there is (or was, back then) no meaningful difference between "interface" inheritance and "class inheritance" \- and why would there be, if it boils down to stringing up vtables together?

</comment></comment></comment><comment><USER9> _There are, of course, disadvantages to composition. It requires more code than inheritance, as we saw, Ortiz said. It is often more difficult to read the code using composition than it is to read code using inheritance._

I think this is the main disadvantage, at least in languages like C++ and Java; if you want to be dogmatic about the OOP-ism of encapsulation and that stuff, all those "methods that just call another method on the composed sub- object" create lots of bloat that a compiler may or may not be smart enough to inline, but a human certainly would have to deal with --- and that adds overhead when debugging and otherwise maintaining the code. Speaking as someone who really hates such "useless" code, composition (especially sometimes of the nested variety) can get annoying really really quickly ---needing to "thread the call" to the right place through many composed objects just feels more like busywork than accomplishing anything functionally useful. If you inherit, you automatically get the union of the methods (and only when there's name collisions do you need to disambiguate), but inherit too deeply or widely and it gets more difficult to find where the code is.

Of course, none of this is relevant at all to the code I normally write using C, where there is no inheritance and everything is composition, and not being an "OOP purist", I'm perfectly happy with BAR_dosomething(&foo.bar);

<comment><USER7> >needing to "thread the call" to the right place through many composed objects just feels more like busywork than accomplishing anything functionally useful

Doing this is a pretty strong code smell. If you have chains of object references that need to know about the internal structure of other objects, perhaps think about the Law of Demeter? [https://en.m.wikipedia.org/wiki/Law_of_Demeter](https://en.m.wikipedia.org/wiki/Law_of_Demeter)

<comment><USER9> That's exactly the problem with being dogmatic about OO --- even the page you linked to mentions it:

 _Although the LoD increases the adaptiveness of a software system, it may result in having to write many wrapper methods to propagate calls to components; in some cases, this can add noticeable time and space overhead_

Suppose foo() inside class X needs an extra parameter or similar, but that parameter actually needs to come from A which contains an instance of B which contains a C which contains a ... ... which contains the X. Instead of changing only foo() and the b.c....foo() in A, being dogmatic means having to change all the do-nothing wrapper methods on that call chain.

If anything, I'd say _wrappers_ are the real code smell. You can probably tell I'm not a fan of OO; I've encountered the aforementioned situation countless times, where the real purposeful change takes a tiny fraction of the time compared to going through all that other do-nothing code and changing it too. The mind-numbing depth of indirection and wasteful bureaucracy is excruciating.

<comment><USER10> Can you give a brief example of the situation you are describing? Or a link to an article on this?

I am really interested in improving my coding using functional programming, composition, etc... but so far, I haven't been able to understand the benefits in my current circumstances. (I've done a lot of reading already) I am hoping I will run into one, so I can see clearly why it's worth the effort to implement. (ie, implement something new when upgrading/replacing some old OOP code...)

</comment></comment></comment></comment><comment><USER11> Eiffel's take on inheritance might be an answer to its 'perils': [https://www.eiffel.com/values/design-by- contract/introductio...](https://www.eiffel.com/values/design-by- contract/introduction/)

Here's the crucial part: in Eiffel, methods can have preconditions and postconditions, and overridden methods in subclasses must _honour_ those conditions in specific ways:

> The principle of subcontracting follows from these observations: a redefined > version of r may keep or weaken the precondition; it may keep or strengthen > the postcondition. Strengthening the precondition, or weakening the > postcondition, would be a case of "dishonest subcontracting" and could lead > to disaster. The Eiffel language rules for assertion redefinition support > the principle of subcontracting.

In a sense, languages which support inheritance might not actually be doing it correctly if they don't support these rules of 'subcontracting'.

</comment><comment><USER12> It would be nice if languages provided mechanisms to support composition without the bureaucracy.

Why should we write a ton of boilerplate just to forward a message to a contained object? Why can't we just have:

        type MyType {
            member containedObject SomeOtherType
            forwardTo(containedObject) MethodA, MethodB as SomeOtherName, MethodC
            method SomeNewMethod() {some implementation}
        }

Then the compiler can optimize the path to call the delegated object directly rather than through a secondary call via this object, since it knows what our intent is.

<comment><USER13> Perl 6 does, with a "handles" trait:

       class MyType {
           has SomeOtherType $.containedObject handles ('MethodA', MethodB => 'SomeOtherName', 'MethodC');
       }

Very useful when you need it.

[https://docs.perl6.org/language/typesystem#trait_handles](https://docs.perl6.org/language/typesystem#trait_handles)

<comment><USER14> Similar in perl5 with Moose or Moo

      package MyClass;

      use Moo;

      has member => (
        is => 'rw',
        handles => [qw[
          methodA
          methodB
        ]]
      );

</comment></comment></comment><comment><USER15> Inheritance drives me nuts. I'm trying to read through a class and keep it all in my head, then I see a call that isn't defined, so I have to look at the base class. Now I have two classes I'm trying to keep in my head. But oh wait, it inherits from something else. Then I finally find the implementation and ive forgotten the context it was getting invoked in. I'd much rather just have an explicit import providing code reuse.

<comment><USER16> An IDE would help with this, at least for a strongly typed language ('go to definition'). For something like Perl, good luck!

My other complaint is when the base class is updated independently of the child class. Suddenly your code is breaking because a new field is being set in the original function but not your override. For that reason I tend to inherit to extend only, as much as possible. I prefer to write a wrapper if it's a neater solution.

<comment><USER17> Definitely need an IDE for inheritance and OO heavy projects. It's not an apple and oranges thing, it's required.

</comment></comment></comment><comment><USER18> Aaron Patterson (aka tenderlove), Ruby and Ruby on Rails contributor, has a good post titled "YAGNI methods are killing me" where he points out the problems when inheriting from builtin classes such as String or Hash.

[https://tenderlovemaking.com/2014/06/02/yagni-methods-are- ki...](https://tenderlovemaking.com/2014/06/02/yagni-methods-are-killing- me.html)

<comment><USER19> Side note: I always feel pretty weirded out visiting a website called tenderlovemaking.com. It feels gross and creepy and not something I want when I'm doing my professional job in a professional environment.

Is it just me, or does anyone else feel like this tenderlove/tenderlovemaking thing is a bit uncomfortable-making and maybe not ok?

<comment><USER20> It's not just you. I also think the domain name is in poor taste.

<comment><USER21> It sorta suits the Ruby 'aesthetic', perhaps, but considering Ruby/Rails' current age and image, it makes me think of the Buscemi meme ([https://i.kym- cdn.com/entries/icons/original/000/018/666/fel...](https://i.kym- cdn.com/entries/icons/original/000/018/666/fellowkids.jpg)).

I say that with a lot of affection for Ruby though!

</comment></comment></comment></comment><comment><USER22> Nice write-up! Coincidentally, I wrote on the same topic, also in python just a few days ago [1]

I came to largely the same conclusions, but instead of forwardable, I wrote a new library called superdelegate that is, IMO, more explicit [2]

1: [https://brianschiller.com/blog/2019/05/03/two-sorted- lists](https://brianschiller.com/blog/2019/05/03/two-sorted-lists) 2: [https://github.com/bgschiller/superdelegate](https://github.com/bgschiller/superdelegate)

<comment><USER23> Alternately, if you want to just delegate _everything_ , you can subclass wrapt.ObjectProxy [https://wrapt.readthedocs.io/en/latest/wrappers.html#object-...](https://wrapt.readthedocs.io/en/latest/wrappers.html#object- proxy)

Python is scary sometimes. If it looks like a duck and quacks like a duck and isinstance(duck), it might be an alien masquerading as a duck using metaclasses to accomplish these feats. But with this craziness comes the ability to make a transparent runtime proxy to just about anything in Python, and do so recursively e.g. to track all uses of an object hierarchy.

<comment><USER22> I think I'm confused. If you want to delegate _everything_, why not just actually use inheritance? Or even the object itself. What's an example of when you would want an ObjectProxy?

Definitely agree about metaclass magic being a blessing and a curse. That superdelegate library was fun to write and uses a metaclass to make the API pleasant.

<comment><USER23> If you don't know what you're going to need to wrap (heck, it might be something with methods implemented with native code), but you want to override or intercept a certain subset of calls, then composition/delegation is really the only thing you can do. It's significantly more stable than trying to find the class of an arbitrary object at runtime, create a subclass of it, and try to copy the state of the original object.

For instance, I've seen instrumentation libraries monkey-patch database cursors with wrappers around those cursors, so the library can detect usage of the cursor without changing its behavior.

Django itself has a LazyObject class, which operates similarly to an ObjectProxy but only evaluates its wrapped initializer when one of its properties is accessed: [https://docs.djangoproject.com/en/2.2/_modules/django/utils/...](https://docs.djangoproject.com/en/2.2/_modules/django/utils/functional/)

And I'm using wrapt in a project (which I hope to open source) where, by recursively wrapping the return value of every __getitem__ and __getattr__ with a properly-bookkept proxy object, you can see what subgraph of a complicated object hierarchy was actually used by a function call (say, the rendering of a Django or Jinja template). Possibilities of such a transformation are endless!

</comment></comment></comment></comment><comment><USER24> What advantages do proponents of inheritance say that it brings to the table? As far as I can tell, the code reuse aspect can be replaced by composition, substitutability can be replaced by subtyping, and encapsulation can be replaced by immutability and functional purity.

On the other hand, the problem that I see with inheritance is that it ties code reuse and subtyping together. I don't see any reason why the two should necessarily be related.

<comment><USER25> The mental model of inheritance is easy to grasp. I think inheritance has its place as long as things don't get too crazy. For 90% of projects out there, inheritance is a simple model to understand and can be used just fine. It's when "architects" get overzealous and try to force everything into a hierarchy where things get bad.

</comment></comment><comment><USER26> This is missing the biggest difference between the two, at least according to me.

In composition (and its on-steroid cousin, delegation), the component/delegate can't "call back" into the aggregating object.

Of course, this additional power can be misused, but it's what should inform the choice between inheritance and composition. Use the least powerful thing that will work — so composition if you don't need to call back into the aggregating object.

<comment><USER27> Thanks for pointing this out.

I can't think offhand of an example to illustrate when you would like this "call back" functionality in a way that you can't anticipate when you design the component object. Do you have a killer-app for inheritance?

<comment><USER26> Any time the component needs to call a method or access data from the aggregate. The kind of thing that happens all the time but the pattern is abstract so there's no killer example.

e.g. the component manages some kind of list, and the content of this list has to be kept in sync with some field in the aggregate.

No example is going to be perfect, because if you have _full_ control over both classes, well then you can always change their interface in a way that it isn't required anymore. One need to consider the reason the thing should be a component in the first place (maybe the pattern is reused in multiple places) and other external and/or historical constraints on the code.

</comment></comment></comment><comment><USER28> Go makes composition less powerful than it could be by slicing structs, which means a lot of hoop jumping to get template methods (where blanks are filled in downstream).

I've been playing around with first class environments [0] lately in g-fu [1], which allow convenient and flexible composition of data and behavior using only what was already there.

I have a feeling Lua might be playing similar tricks with its tables, but I lack enough experience to judge.

[0] [https://github.com/codr7/g-fu/blob/master/v1/lib/eos.gf](https://github.com/codr7/g-fu/blob/master/v1/lib/eos.gf)

[1] [https://github.com/codr7/g-fu](https://github.com/codr7/g-fu)

<comment><USER29> >slicing structs

Can you explain what this means? Still learning Go. Google didn't help.

<comment><USER28> I'll try :)

The issue is that you can't interface methods from pointers to a contained struct, since it has no idea where it is or how it got there. Instead a pointer to the full struct needs to be threaded all the way down to where the overridden function is called.

I sort of understand why, but this is a major missing piece that makes it very frustrating to add anything but trivial default implementations to interfaces in Go from my experience.

</comment></comment></comment><comment><USER30> This talk from PyCon 2013 covers much of the same ground: "The End Of Object Inheritance & The Beginning Of A New Modularity"

[https://www.youtube.com/watch?v=3MNVP9-hglc](https://www.youtube.com/watch?v=3MNVP9-hglc)

</comment><comment><USER31> Modern programming languages like Rust avoid classic inheritance:

[https://doc.rust-lang.org/book/ch17-01-what-is-oo.html](https://doc.rust- lang.org/book/ch17-01-what-is-oo.html)

</comment><comment><USER32> One article that helped me to understand the OO inheritance problems understand much better is this one:

[https://www.sicpers.info/2018/03/why-inheritance-never- made-...](https://www.sicpers.info/2018/03/why-inheritance-never-made-any- sense/)

It argues that there are three different kinds of inheritance and in OO you often mix them up into one hierachy - which may work in some situations, but in some it just can't. Personally, I've experienced this kind of conflict often enough.

</comment><comment><USER33> Java esque OO is often tauted as a way to reuse code, but incredibly does the opposite by dictating a tree design and then actively disallowing reuse between arbitrary leaves of the tree

I think the worse part is this plague has descended into other languages, if you want different behaviour for different things (but common in someway) just accept a function into your function & invoke it, tada more efficient dependency injection

</comment><comment><USER34> I find that in a lot of critiques of programming methods, the proposed solutions often contain the implicit assumption that the 'code' is a small to medium codebase with a single developer.

If a sole developer is the only one working on it, of course any approach can contain the complexity.

But, if in the language you are using, the alternative to inheritance is composition via code duplication, then I think that's even worse than inheritance, especially once the code is unleashed on a whole team of maintenance developers.

Who says all that duplicated code will be left in its pristine state, and used only for it's intended 'compositional' purpose? People might start hanging special logic in there or whatever...

Generally, for projects with large teams like this, the less code the better, because that means there's less code for them to screw up.¹

If that means using inheritance for reuse a bit even if it's not 'pure' OO or whatever, I'd chose that over duplicating code all over the place.

1: I know Java isn't fashionable, but for many reasons, it's perfect for this kind of project.

</comment><comment><USER35> Fun way of describing inheritance :D

"You wanted a banana but what you got was a gorilla holding the banana and the entire jungle." -Joe Armstrong

</comment><comment><USER36> Composition also facilitates utilizing (GOF) design patterns. They can make code much cleaner and reusable when used properly and sparingly.

</comment><comment><USER37> I guess I'm old school but I have had huge success with OOP and the long lived design patterns.

Patterns like adapter, bridge, and strategy are emensly useful in archetecting software that will last more then the next iteration or 6 months.

Perhaps I havent seen the right resources but so far function programming seem weak to me compared to oop which has things like domain driven design, and a very long list of battle tested design patterns.

</comment><comment><USER38> I'm partial to Eric Elliott's take[1] which highlights the brittle rigidity of _classical_ inheritance in particular (vs eg prototypal inheritance). "OO" is often conflated with class-based inheritance per se.

[https://link.medium.com/k0YynV2rxW](https://link.medium.com/k0YynV2rxW)

</comment><comment><USER39> Grpc-Java makes staying away from inheritance incredibly difficult (since they dont present an interface to the service methods you want to call). This makes adapters, decorators, and other useful patterns difficult to employ without the rigamarole of defining the interface yourself and duplicating the delegation.

</comment><comment><USER40> I feel many people are overlooking the most important bit:

> He ended with a Spanish question that was evidently made popular in a US > advertisement: "¿Por qué no los dos?", which means "Why not both?". > Inheritance and composition are both useful tools; developers should > understand when to use each.

<comment><USER20> When should you use inheritance. I can think of one use where it's acceptable and not dangerous. Implementing base class methods that are stateless helpers for sub classes.

But I'm not sure that inheritance is the best way to solve it. You would probably want to use interfaces and static methods instead. Basically I literally can't think of a case that isn't better solved by another way.

Some languages may not give you those other options, in which case, by all means use inheritance. Just make sure you are careful not to shoot yourself in the foot while doing so.

</comment></comment><comment><USER41> The main problem that inheritance introduces -- is irrelevant references to methods and fields.

If I want to see what code is using a method I am interested in, Visual Studio shows me all related code. But if other developers overrode that method in their own classes, then in addition to seeing ~5 references I like to see, I have to sift through ~50 other references that are irrelevant to my investigation.

So 5 minutes investigation turns into 55 minutes investigation. As you can see, that "references spam" can easily slow down research and development 10x or more.

</comment><comment><USER42> This is amusing. Earlier today I was reading through Sonya Keene's book on CLOS, and wondering why OOP had to be hierarchical rather than compositional, and wondered if there had been any work done in this space.

</comment><comment><USER29> Been hacking on a side project in Go, after coming from a career of nearly exclusively using OO languages, with a little bit of functional here and there. And of course enjoying all of the new functional features that nearly every big language has been racing to implement these days.

At first there I had some quirks, along the lines of "how do I get thing X from A to B", or "these things are similar how do I share code between them".

Everytime this happened I couldn't help but go through a process of solving the problem in OO and then unwrapping it into a non-OO solution. Which doesn't always turn out well.

Eventually, once I became comfortable with Go, I got to the point where I just code things in the most obvious way possible. This struct has these fields. This function takes x and produces y. I dont try to take a big picture view of the software as a whole, Im just solving a bunch of small localized problems one after the other. Then I refactor periodically to get rid of anything completely stupid, and make sure the big picture looks ok. The name of the language is quite fitting, you just go.

Whereas in OO, for me at least, it feels like im constantly bouncing all around the abstraction layers of your program. Any change I make here in class X could affect these other classes. Class A is dependent on Y, but so is class B. How do I share it between them? Maybe dependency injection? Subclasses? Do I refactor to an abstract class? Wait, should it be an abstract class or an interface, what's the difference again? Is this generic enough? I only need to use this in this one place, but I'll make it generic because "best practices". What if I might need this other subclass eventually but it's not on the spec right now?

I'm obviously exaggerating, but I think most of us have been there. I find I often end up in a competition against myself about being more clever or more reusable with my OO code.

Our job is already hard enough when you have to decide and reason about algorithms, data structures, concurrency etc. The extra layer of code patterns usually just obscures things.

I'm not a complete hater though. Using a well designed OO library can be an absolute delight (PyTorch being a great example). But OO is the kind of thing were its not just garbage in garbage out. The garbage multiplies and creates even more garbage.

</comment><comment><USER43> "You wanted a banana but what you got was a gorilla holding the banana and the entire jungle."

Aren't mixins a way of avoiding this problem while using inheritance?

<comment><USER44> Some languages don't support multiple inheritance so mixins aren't an option.

<comment><USER5> And then we get programmers that only know those languages claiming that inheritance if bad because the only language they know only supports an useless simulacra of it.

</comment></comment></comment><comment><USER45> I wonder why so many books and articles like this one are written as though the approach they're championing is the only right approach, or always the right approach for every situation. There's never any consideration like, "in the following examples, this might be a good tactic..."

Looking at the subject for this post:

Inheritance is a good, straightforward approach when you have multiple related classes which share a lot of code but don't interact directly with other unrelated classes:

        class document
        {
            public function title ()
            {
            }

            public function get_plain_text ()
            {
            }
        }

        class word_document extends document
        {
            public function get_plain_text ()
            {
            }
        }

In a document management application, you might need to represent lots of different kinds of document formats, each with their own specializations, but also with a lot of common attributes too. These document classes might not need to interact directly with a database or a network socket, so a straightforward and traditional class hierarchy would be the natural choice here.

But then let's say you wanted to build an abstract data pipe. A data pipe needs to talk to lots of different things; maybe it's a plain old network socket, maybe it's a database engine, maybe it's an API. Here, you get no advantages from using inheritance, because although each data pipe is trying to mimic the behaviors of any other data pipe, under the hood their code is completely dissimilar. You'd end up having to rewrite so much of the functionality that there'd be nothing really for a base class to actually do.

This is where composability and interfaces are the right approach:

        class phabricator_datapipe implements datapipe
        {
            private $_api_client;

            public function __construct ($api_client)
            {
                $this->_api_client = $api_client;
            }

            public function search ($parameters)
            {
                //  Build a search query out of $parameters specific to
                //  this API, then:
                $this->_api_client->search(...);
            }
        }

Each datapipe class strictly follows a common interface structure. Dependency injection is used during instantiation to compose the runtime object, so the responsibilities in the datapipe class are limited to translating the application's business needs into the specific structures required by the API, while the API class takes care of authentication and error handling.

There is room for both of these approaches in the same application, because they solve entirely different problems. The inheritance of the documents classes solves the problem of dealing with similar-but-different units of data in a maintainable, extensible way. The composable interface of the datapipe classes solves the problem of interacting with completely different external components in similar ways.

This likewise is where the post falls over, IMO. It presents an argument for composition, but is too lazy to provide any of the context that really makes composition look like the right answer. Whether a Car object should be modeled as a child of a Vehicle base class, or whether it should be more of a standalone class with other objects injected into it, depends entirely on whether the application just wants to say:

        Vehicle->GetTimeToDestination(...)

or whether the application instead needs to:

        Vehicle->StartYourEngine(...)

(Aside: I think a major failing of posts and books on programming is using contrived, made-up examples, especially when talking about abstractions like object-oriented programming. Those don't help anybody understand the advantages and disadvantages of different approaches. I'm using some examples from applications I've written.)

<comment><USER46> Inheritance usually looks more natural when it comes to toy examples.

It the real world, a few edge cases can break down an elegant inheritance hierarchy and composition is often the better solution.

</comment></comment><comment><USER47> article with better code, comparing languages and more substance: [http://radar.oreilly.com/2014/01/horizontal-reuse-an- alterna...](http://radar.oreilly.com/2014/01/horizontal-reuse-an-alternative- to-inheritance.html)

</comment><comment><USER48> Problems caused by inheritance is not one people maintaining legacy vb6 software have to worry about.

But in the day the main reason VB6 was called a toy language was because it wasn't fully OO, it lacked inheritance.

And in his 1999 book Francesco Balena showed how this handicap could be worked around, using delegation.

</comment><comment><USER49> Isn't it dependancy injection rather than composition? I'd think JS old time "inheritance" where methods are being copied from class to class is composition.

</comment><comment><USER50> Python, in a sense forces inheritance, because with composition there are too many dots (i.e. objects get too nested)

</comment><comment><USER51> prefer composition for code reuse and inheritance for polymorphism</comment>


Ads work by cultural imprinting, not emotional inception - <AUTHOR> http://www.meltingasphalt.com/ads-dont-work-that-way/ <comment><USER2> There's an excellent book called Rational Ritual[1][2][3] which develops this idea much more fully. The thesis is that common knowledge (I know something, _and I know everyone else knows it too_ ) is very powerful and rationally drives people's behavior.

One of the arguments in the book revolves around the absurd pricing of advertising during big public events like the Super Bowl. If advertisers weren't concerned about the common knowledge aspect of their messages, they would air their ads when the cost per viewer is lowest. And you do see this with non-social goods, which tend to be advertised during off hours. But companies producing social goods like beer pay much more per viewer for prime- time and Super Bowl slots in order to get their product into the cultural zeitgeist. If you see something in a Super Bowl ad, you know most other people have seen it too.

[1] [http://press.princeton.edu/titles/9998.html](http://press.princeton.edu/titles/9998.html)

[2] PDF of the original 2001 manuscript: [http://www.sscnet.ucla.edu/polisci/cpworkshop/papers/Chwe1.p...](http://www.sscnet.ucla.edu/polisci/cpworkshop/papers/Chwe1.pdf)

[3] [http://www.amazon.com/Rational-Ritual-Culture- Coordination-K...](http://www.amazon.com/Rational-Ritual-Culture-Coordination- Knowledge/dp/0691114714)

<comment><USER3> I would imagine the cost per viewer for a Super Bowl commercial isn't that high. Super Bowl commercials are expensive because there are so many viewers. In addition to the extra press surrounding them.

<comment><USER2> Super Bowl ads cost about the same per viewer as prime-time TV slots ($35 per thousand in 2014). Both cost about four times as much per viewer as daytime TV.

Primetime: [http://www.tvb.org/trends/4718/4715](http://www.tvb.org/trends/4718/4715)

Daytime: [http://www.tvb.org/trends/4718/4710](http://www.tvb.org/trends/4718/4710)

<comment><USER4> With daytime TV you can only reach consumers that are watching TV during the daytime though. That's a lot of potential customers that will never, ever see any of your ads.

</comment></comment></comment></comment><comment><USER5> I agree that the primary mechanism of ads is to affect the "landscape of cultural meanings" so that a product is associated with a broader meaning or image, but I don't think this is so different from the Mad Men philosophy, or that making purchasing decisions to feed your external image is so much more rational, and more relevant, than feeding your self-image.

Maybe _you_ choose your household cleaners just to impress your guests. You wear Axe Body Spray because of what it communicates about you ("Hey girl, I'm wearing Axe Body Spray right now"). I don't need bystanders while I drink Corona in order to feel like I'm the kind of guy who'd rather be chilling on a beach far from the daily grind. I'm making a statement to myself about the kind of person I am, one who endorses those values or that fantasy.

There's got to be a way to take the bystander out of the equation. If we want to maintain the idea that we are all rational thinkers -- only "culture" is irrational, or _other_ people's subconsciouses! -- how about: the advertiser is selling us a bit of meaning, thereby increasing the value of the product. Meaning is hard to obtain, and making purchasing decisions based on advertisements is one way for rational individuals to obtain this scarce resource.

</comment><comment><USER6> A comment to the author of the article:

I don't agree with your point about non-immunity. Cultural imprinting works because it leverages the desire that humans have to portray a certain image or belong to a certain group.

As rational humans, we can eliminate the pull of such ads by building our own understanding about the group the ad is appealing to, and how that ad appeals to the group. Equipped with this understanding, we can find far more effective ways than drinking Corona to portray the image of being chill and relaxed.

Alternatively, we can reconsider our willingness to be included in that group. Once we realize the only thing binding Corona drinkers together is their collective vision of some beach, we might realize that there's more interesting people to drink with.

<comment><USER7> From the article:

>>>> The problem is that there's no escape, no immunity, from this kind of ad. Once we see it — and know that all our peers have seen it too — it's in our rational self-interest to buy the advertised product.

No it's not. That's where non-immunity falls down. For one thing, peer pressure is still only one factor in choosing a product, and we can still use our rational brains to weigh it against other factors. It only adds to the information at our disposal, but doesn't necessarily outweigh other information.

We might decide that tasty beer is more important than personal image, or that the social impact of our beer choice is either negligible or not worth paying extra for.

</comment></comment><comment><USER8> Maybe I'm just less aware of what other people do than others, but I find this fundamentally unconvincing (the argument that this explains most of what's usually considered emotional inception, not the existence of the phenomenon in some cases).

> Beer, soft drinks, gum, every kind of food (think backyard barbecues). > Restaurants, coffee shops, airlines. Cars, computers, clothing. Music, > movies, and TV shows (think about the watercooler at work). Even household > products send cultural signals, insofar as they'll be noticed when you > invite friends over to your home. Any product enjoyed or discussed in the > presence of your peers is ripe for cultural imprinting.

Your choice of coffee shop or fast food communicates something to your peers _if_ you're seen there, which, as far as I know, is often fairly uncommon, depending on your situation. It's nice to be culturally aware, but that doesn't constrain your consumption of music, movies, and TV too much (especially music) unless you watch very little. Nobody notices what brand of sneakers you're wearing... at least, I rarely even look down that far, and I can't believe other people are that different. Household products? Maybe once in a year.

Nor do I find all of the anecdotes convincing.

Bed sheets - sheets themselves may not be the hottest product category, but I've seen many mattress and mattress store commercials. Tempur-pedic, Sleepy's (I have heard that jingle so many times I doubt I will ever forget it), etc.

Gas stations - don't advertise because usually you don't have multiple stations right next to each other. Since the service is a commodity, everyone goes to the closest station.

Why not two-faced - because it's easier to remember something if it's clear, well-defined, and repeated often, and that includes unconscious associations. No need to bring in cultural factors.

<comment><USER9> Gas stations do advertise. Fill in the blank '___ with Techron'. You also see a list of gas stations at an interstate exit sign. [http://www.kentucky.com/2011/09/05/1869947/ads-at- interstate...](http://www.kentucky.com/2011/09/05/1869947/ads-at-interstate- exits-mean-revenue.html) (third immage bottom right.)

Anyway, there are lot's of forms of advertizing. From informative "talk to your doctor about ED" to simply memorable. [https://www.youtube.com/watch?v=pVcbasIb8lQ](https://www.youtube.com/watch?v=pVcbasIb8lQ)

However, the cultural inception idea is not about some sort of Pavlovian response. You don't actually get to taste what's for sale in a supermarket, so it's an abstract choice. And with little to no information to work off of you make a split second decision after split second decision which is draining. In that situation simple familiarity is worth a lot. Similarly, your not actually going to test drive every car in your price range on the market.

That said, signaling is a big part of advertising. If nobody knows you just spent 20k on a watch it's harder to justify the purchase.

<comment><USER10> > Anyway, there are lot's of forms of advertizing.

I think this article is specifically referring to branding advertising as opposed to educational, informative, direct response, etc...

re: watch purchases, those that spend 20k on watches are usually people who can appreciate the amazing craftsmanship, mechanics, and art form behind it. Here is a mindblowing video of a Corum Golden Bridge being made. [https://www.youtube.com/watch?v=NOdmoGoh3ck](https://www.youtube.com/watch?v=NOdmoGoh3ck)

I am not discounting the status symbol of owning a $20k watch...but I could just as easily impress lots of people with a TAG watch for 1/10th the price. or a Patek Phillipe for half the price.

<comment><USER9> I agree mechanical watches are fun.

However, for comparison Intel is manufacturing at 14 nm which means their features size is ~30 atoms wide. Or ~1 million times more precise than those watches and few people care. High end watches became a status symbol in the 16th century and technology has simply progressed to the point where there low tech by comparison.

Anyway, people who buy 20k watches are generally the kind of people that can afford to buy them. It's simply not a major purchase to most of them.

<comment><USER10> Its not about the tech perspective of the mechanics, its about the fact that a human being crafted by hand this amazing mechanical watch. Personally, I am blown away that its even humanly possible to craft watches like this Golden Bridge by hand. Its like wearing an original picasso on your wrist.

There are plenty of people that can afford to purchase them that don't as well. I think you need a deep appreciation for the art to be comfortable dropping $20k on a watch even if its a drop in the bucket for you.

</comment></comment></comment></comment></comment><comment><USER11> Oh man. That's a doozy. Well, uh.

>We may not conform to a model of perfect economic behavior, but neither are we puppets at the mercy of every Tom, Dick, and Harry with a billboard. We aren't that easily manipulated.

Yeah. Yeah we are.

It looks like the author of this is just some random engineer without a lot of backround in marketing or persuasion psychology. That's a shame because he's clearly interested in it and it's a really cool field. Like the author, I'm not going to cite specific sources in this comment, but anything in it is probably covered in Cialdini's _Influence_ (a _fantastic_ starting point for persuasion psychology) or Gass & Seiter's _Persuasion_ (which is not as easy to read as Influence but is a better textbook).

First off, advertisements definitely do work via simple association. Humans use liking as a heuristic for virtually all decisions (we decide in favor of things we like), so increasing liking increases purchases fairly reliably. A warmth appeal like a Coke ad with smiling faces _will_ reliably create an association between Coke and positive emotions just because that's how humans are wired. If you activate two concepts together, you link them. This is just how humans work and is the basis of most of cognitive psychology. Many, many things make sense once you start to see things in terms of co-activation and priming.

The author calls this emotional inception, but that's sort of... not a real term, so I'll just call it association, which is the actual term. You do associate Coke with positivity after seeing it often enough. That's the basis on which observational learning works, and observational learning is pretty obviously a thing. If you don't believe me on that you can pretty simply replicate some Banderas experiments with a 6 year old if you happen to have one lying around.

The current cognitive model of persuasion closest to the truth (IMHO) is Kruglanski's Unimodel. But it's too complicated to explain here and the older models will work, so I'll use an older model here for the purposes of explanation. Older persuasion models posited that there were two _routes_ to compliance: the central route, through the target's careful, rational consideration of options, and the peripheral route, through cognitively quick decisions made mostly on factors that are heuristic. This is a natural way of viewing things in a System 1/System 2 algorithms vs. heuristics world (for more on this see Kahneman's Thinking Fast and Slow).

Humans almost never spend enough time on a decision for it to be considered rational in any way. Humans are wired with a fairly small amount of heuristics and we use those for literally everything. Liking, availability, and conformity are all we can muster in most cases. The author dislikes this, but doesn't offer any reason why it isn't true, and doesn't present any science as to why it isn't true, so... sorry man, but you might just have to accept humans aren't rational. I know it might be difficult to be a libertarian after that, but I'm sure you'll deal.

Because of this, virtually all advertising is targeted at the peripheral route. _All_ of the mechanisms the author discusses are peripheral cues: Associational priming to create liking, mere exposure effects, appeals to authority (sorry, saying 4/5 doctors recommend X is not a rational cue to buy X), brand image, resource expenditure (as if people who buy more expensive engagement rings are less likely to cheat -- I'd bet money the opposite is true!), and finally, what the author calls cultural imprinting, but is actually something like a mix of self-image manipuulation. Because of the mechanisms used for observational and social learning, images that don't actually give us food can create these cognitive links that later do cause us to buy products.

When you see the Corona add, you notice a few things. The first is probably the attractive person of the gender you're attracted to. The advertisers nicely put two of them there, so you could be anything but asexual and have something to salivate over. You notice the open space and clear skies, and the beach, something you probably have a positive association with already with lots of nice sensory cues. Very last, you'd notice the text, which you have to manually process, and you'd notice that it says "Find your beach", which implies that drinking Corona will make you feel similar to these things. The ad has communicated that Corona will make you attractive, calm, and relaxed, which are all nice things on their own. The ad also does, as the author points out, establish another association on the meta-level, between people who drink Corona and people who have these qualities. This isn't terribly different from any of the other aspects of the ad, though, and it's certainly not a different mechanism. Ultimately it all comes down to making associations.

I really hope the author and other interested people get into the actual science behind persuasion. It's a really fun field and it's very rewarding.

<comment><USER12> > It looks like the author of this is just some random engineer without a lot > of backround in marketing or persuasion psychology. That's a shame because > he's clearly interested in it.

Little parenthesis: if you're interested in a subject, make the effort to read about it from well established sources (very often, books). The author of the posted article relies on sources like LifeHacker and pop psychology journalism to build his knowledge and make his claims, but those are clearly shallow, insufficient, and inaccurate.

I feel like this is a problem that the internet has created- it makes it possible to feel knowledgeable in certain topics after reading a lot of informal web pages on a given topic, but very often that content is far from being authoritative. Reading less blogs/pop journalism/etc. and more books from established academics is one of the most beneficial moves you can do for the depth and accuracy of your various bodies of knowledge.

<comment><USER13> That sounds nice, but in practice it's extremely difficult because academics have very little incentive to make their rigorous research discoverable, much less accessible, to laymen. I agree that arm-chair theorizing is almost always a waste of time, but a layman probably contributes more by trying to bring his own particular expertise (software engineering or whatever) to bear on the problem -- on the off chance that he makes a novel insight -- than by sinking himself in the literature.

<comment><USER11> Influence is maybe a hundred pages, very accessible, and written by one of the foremost persuasion researchers out there.

You're just justifying laziness. Software engineering does not, in fact, qualify you to comment on human minds, which are very different from software. Presumably you wouldn't accept design advice from a doctor because of some claimed way to bring medical practices to bear on software engineering.

<comment><USER13> I don't do software, I'm an academic. At least in my subfield, I have a pretty good idea how many unnecessary barriers stand between laymen and the expert wisdom, and how how often experts use their expertise as a way to dismiss outside views without consideration. That's true even though, at the same time, most outside views are a waste of time (as I mentioned).

He's writing a blog post, and you don't need to be qualified to do that.

"Influence" is a fine book and I encourage everyone to read it _including the OP_. But that does't mean OP did something wrong, or was lazy, by using his finite amount of time to write up his thought.

</comment></comment></comment></comment></comment><comment><USER14> This argument is spot on but we resist it because we think we are above culture, too smart for it, that we can reduce everything to science, analysis, and engineering. The opposite is true. Culture is everything. Your brain does not receive ads in a kind of tabula rasa clean room environment. Thanks for articulating this!

</comment><comment><USER15> "So if a theory (like emotional inception) says that something as flat and passive as an ad can have such a strong effect on our behavior, we should hold that theory to a pretty high burden of proof."

When I was adolescent I went to a(my first) music concert, it was an incredible experience, I even met my first girlfriend there. I was surprised that it was Coca Cola everywhere.

For me this was freedom(from my home environment), adventure, joy, friendship, and even sex.

Way more than pixels on the screen.

Today is not Coca Cola. I do B.A.S.E jumping, love going downhill with my bike and when I go to see or meet the Gods of the trail or Skydiving doing incredible things(them,not me) I see REDBULL EVERYWHERE in the events they participate.

Pixels on the screen are probably not that good, but they affect millions at the same time.

Lots of people watch porn, even when it is just "pixels on the screen".

A significant part of the advertising industry do not use pixels at all, they use text, they are called "copywriters" and what they do is tell stories.

</comment><comment><USER16> Complete nonsense. Do you really believe that comms majors are being tought cultural inception in undergrad? The Corona ad, like all ads, is a response ne to a brief that is designed to address a business objective. In this case get people to drink Corona not just in the Summer. Hence find your own beach even if you live in Minnesota in the Winter and would normally reach for a winter beer. We don't sit around at agencies with our clients discussing the best way to mind fuck the public. Ads are tested on awareness, purchase intent, brand association and message association. Creatives reach for the stars. Clients and strategists pull them back to earth. Depending on the people involved. Some ads are great. Some suck. Case closed. - Ad Agency Guy (BTW none of us watch Mad Men)

<comment><USER17> How they're made doesn't explain why they work or not. But having said that if that ad was run in the winter it could be interpreted in a very different way to if it was a summer campaign.

</comment></comment><comment><USER18> Lots of theory here but surely there's some solid science that can address these ideas?

<comment><USER6> It's quite simple to suggest an experiment to prove the article's point (which I find very convincing).

Look at an ad for a product you own (e.g. iPhone) that you perceive as conveying some form of emotion. Now, go use that product.

Do you feel the emotion portrayed in the ad?

To make this more scientific, expand the above test to a few hundred people. Query their emotional state with a survey (or possibly by facial expressions, if that's considered an accurate means of evaluating emotional response). Do this for a number of products, ensuring that boring products (e.g. household cleaning products) are included to rule out emotion generated from the intrinsic properties of the product. Then check for the existence/non- existence of a correlation between the emotion felt and the emotion portrayed.

<comment><USER19> That experiment would not accurately test the emotional inception theory. The theory states that given ads associating a product with a positive emotion, people will eventually feel that emotion when they _see_ the product in the store, and be compelled to buy it. Your experiment tests whether people feel that emotion when they _use_ the advertised product after having bought it. You might assume that these answers would match, but that is a dangerous and unnecessary assumption.

I have an idea for a more accurate experiment. Survey a number of people about what brands of some product they buy, if any. The product should be something that does not currently have many ads for it (like bedsheets), so that cultural imprinting is not a factor. Then send them a weekly email newsletter on some random topic. Each newsletter would also contains ads for a certain brand of that product.

The people would be split into two groups. For half of them, the ad for the product tries to associate the brand with a positive image. For the other half, the ad tries to associate the brand with a neutral image, while otherwise keeping the text the same. This splitting into groups ensures that "honest signaling" is not a confounding factor.

To ensure that the participant opens the newsletter and sees the ads, participants would be asked to search each newsletter for a piece of information and reply to the email with that information.

After three months of the newsletters, participants would be surveyed again about what brands of the product they buy, if any. If emotional imprinting theory is accurate, the participants who were shown the positive images should have increased their purchasing of that brand of product more than the neutral-image participants increased their purchasing.

</comment></comment></comment><comment><USER20> All oversimplified models are naive nonsense, especially those which were developed to contradict another oversimplified models.

It is the same flaw as to say 'clouds cannot be of this or that particular shape, they are always of this or that'.

There are too many 'variables' in what we could call the [naive] psychology of a mind or so called Froidian psychology. Any undergraduate cognitivist would tell.

It is not the naive this-OR-that 'logic' according which mental processes work. It is this-AND-that logic.

BTW the author probably should study Wikipedia article about Narcissistic Personality Disorder, which is, of course, yet another oversimplified model.)

</comment><comment><USER10> This article Is based on an incorrect assumption of the utility and function of branding ads. they don't change perception...they don't make a new impression...they support a pre existing perception and reinforce it.

Brand perceptions and this cultural imprinting he refers to are driven by word of mouth, media coverage, and third party validation... Once we have a perception- ads reminds us of it.

Yes, ego and peer pressure are strong emotional drivers of purchase behavior but so are dozens of other emotions we satisfy with various purchases.

</comment><comment><USER21> I've heard of this idea before under the term "Lifestyle Advertising". You don't sell the product, you sell a "culture" that "exists", with your product being a means to signal "membership" in that "culture".

Things to Google:

\- LessWrong "Applause Lights" \- Burning Man Ten Principles (specifically, Decommodification, Radical Self-Expression, and Participation)

PS - I really like the point about "you need to know that everyone else knows what this means..." \- that's a good point!

</comment><comment><USER22> > It suggests that human preferences can be changed with nothing more than a > few arbitrary images.

"You're never alone with a Strand" seems like a reasonable counter.

> Q: Have you ever seen an ad for bed sheets? Can you even name a brand of bed > sheet? If ads work by emotional inception, wouldn't you expect to have seen > at least a few ads trying to incept you with the idea that Brand X bed > sheets are going to brighten your day?

Yes, I do see ads for bed sheets and for bed sheet makers. The author is just looking in the wrong places.

</comment><comment><USER23> The Ehrenberg Bass Institute has quantitative marketing/advertising/brand results going back to the 50s. If you're interested in the math, I recommend checking out How Brands Grow by EBI director, Byron Sharp.

[1] [http://www.marketingscience.info](http://www.marketingscience.info)

[2] [http://www.amazon.com/How-Brands-Grow-What- Marketers/dp/0195...](http://www.amazon.com/How-Brands-Grow-What- Marketers/dp/0195573560)

</comment><comment><USER24> >> Q: Have you ever seen an ad for bed sheets? Can you even name a brand of bed sheet? If ads work by emotional inception, wouldn't you expect to have seen at least a few ads trying to incept you with the idea that Brand X bed sheets are going to brighten your day? [2]

By the same theory we should rarely ever see ads for mattresses too, since their "consumption is purely obscure". And yet, I'm bombarded by ads for mattresses everywhere.

</comment><comment><USER25> I've seen a lot of ads, for example, for household cleaning products (dishwashers, detergents, sponges, soaps, etc.) which are not social at all - they actually even more a-social than bedsheets, your house guests may happen to notice your bedsheets but would rarely know which soap you use to wash your dishes or windows. So while it sounds very persuasive for some products, one may easily poke holes in the concept applied universally.

<comment><USER26> As the author mentioned at the beginning of the article, ads for household cleaning products work by making promises (if you use X toothpaste, your breath will smell fresher for 24 hours), instead of creating cultural signals (Beyonce drinks Pepsi).

<comment><USER27> Well there is an element of cultural signaling going on. Washing up liquid like 'Fairy' in the UK usually feature an attractive mother in a middle class white household dealing with the state of their children's (usually boys) clothes after they've come home from soccer practise or school or what have you. The ad isn't saying Beyonce endorses the product, but it is saying that yes! you too can be like this supermom and effortlessly and jovially clean your kid's clothes for school tomorrow, so you look like a neglectful parent thanks to Fairy. Trust Fairy. Live Fairy. Fairy is love. Fairy is life.

</comment></comment></comment><comment><USER28> I don't buy it. This advertisement, especially the unreleased version narated by Steve Jobs, gives me goosebumps every time I watch it: [http://m.youtube.com/watch?v=Rzu6zeLSWq8](http://m.youtube.com/watch?v=Rzu6zeLSWq8)

I had such a strong emotional response to it that I remember watching it for the first time vividly from when I was little.

</comment><comment><USER29> I would love to read this article in a shorter, more concice format. From the paragraphs I read the author spends most of his time trying to describe the common (mis)conceptions held by a layman in advertising by giving numerous citations and examples, which is weird and repetitive when his argument is that we already know and hold the assumptions.

</comment><comment><USER30> "You could swap in a Budweiser or Heineken and no information would be lost."

Corona is a lighter beer, which is what you want on a hot beach where you're sweating and thirsty.

Yahoo Answers: Corona - 4.6% Heineken - 5.4% Budweiser - 5.0%

</comment><comment><USER31> The abundance of laundry detergent, mop, swiffer, and other home cleaning ads seems like a counterexample to the points about bed sheets and gas stations. Toilet paper ads are another counterexample.

</comment><comment><USER32> Imho a good ad, and more broadly a good brand, both has a cultural imprint piece and a "emotional inception" piece.

Think of Chick Fil A. They've taken a strong stand on same sex marriage. They've made a cultural imprint on you in that you either support or don't support that lifestyle. So far so good right?

However, you also feel something about that. You're either happy or upset about their brand. So not only are you associating that brand with your lifestyle, you're also having a feeling about that brand.

</comment><comment><USER33> thinking fast and slow is the book for you. nobel prize winner gives the skinny... and yeah, there's actual experiments that show merely familiarity breeds positive responses. NB there's a bit of commentary going on at the moment about the reproducibility of the experiments in this field</comment>


Show HN: Midnight – Affordable managed Ghost blog hosting with zero setup - <AUTHOR> https://getmidnight.com <comment><AUTHOR> Ghost is a superb platform for creating a blog and indeed a complete online publication. The only problem is its complicated to install and setup correctly for those for are not developers, and it doesn't run on traditional web hosting. Like Wordpress, the creators of Ghost offer their own hosting for Ghost however it isn't the most affordable service. Enter Midnight.</comment>


The problem of sleeping without sleeping - <AUTHOR> https://books.google.com/books?id=8xAAWySuWckC&pg=PA36&lpg=PA36&dq=salvador+dali+slumber+with+a+key&source=bl&ots=ZA99dL59SS&sig=FbjpX8QoQVobfd5dn22c5hRuyvo&hl=en&ei=jMDITe37Deby0gHP3uzmBw&sa=X&oi=book_result&ct=result&resnum=4&ved=0CCsQ6AEwAw#v=onepage&q&f=false <comment><USER2> I am a borderline narcoleptic. I can basically will myself to pass the narcolepsy test, and so I've had the diagnosis overturned. As a result of this, I have some experience with sleep studies and I received some information from doctors about sleep. This information should cause one to be a bit skeptical about the sort of "sleep hacks" that come up often on HN.

The test for narcolepsy I took consists for lying in bed the morning-after of the overnight part of the sleep test, and falling asleep 4 times. If you can fall asleep 4 times, and if you go too quickly into REM sleep every single time, then you are a narcoleptic. Narcoleptics can fall asleep very easily and tend to go very quickly into REM, but they do not go very easily into the deepest stage of sleep, which is the stage _the brain uses to rid itself of certain materials._ So narcoleptics have a bit of a problem. Often, we can get what many would call a "decent" span of sleep. However, we may only spend a couple of minutes in the deepest stage of sleep, where we might really want more.

I own a Zeo sleep monitor, and the data that I got out of it corroborated what the sleep studies indicated: I get only a fraction as much of the deepest stage of sleep, compared to the average for my age.

So here's the problem: These "sleep hacks" that allow you to enter into REM sleep very quickly for "power naps" may be harmful to you in the long term. You may well never enter the deepest levels of sleep that serves important physiological functions for your brain.

</comment><comment><USER3> Barbara Oakley talks about this in her talk at Google, "Learning How to Learn".

[https://www.youtube.com/watch?v=vd2dtkMINIw&feature=youtu.be...](https://www.youtube.com/watch?v=vd2dtkMINIw&feature=youtu.be&t=13m32s)

She says Edison did the same thing too, but had a handful of ball bearings instead of a key.

<comment><USER4> She also has a coursera course (that I'm going through right now) - [https://www.coursera.org/learn/learning-how-to- learn](https://www.coursera.org/learn/learning-how-to-learn)

<comment><USER5> How do you like that course? I was thinking about taking it.

<comment><USER6> This course is great, everyone how wants to improve his learnings techniques should do this course.

<comment><USER7> Indeed, this course was great. It's pretty much a summary of the state of the art of learning science.

</comment></comment></comment></comment></comment><comment><USER8> As so often with Dali - /not sure if serious or trolling

<comment><USER9> Same. If I'd read this with no context whatsoever, I'd have guessed it was written by Italo Calvino and was entirely tongue in cheek.

</comment></comment><comment><USER10> I've always been jealous of people who are able to take power naps. I can't do it, unless I've done something exceptionally exhausting or I barely slept the night before. I end up closing my eyes waiting to fall asleep, and then nothing happens.

<comment><USER11> Try meditation. I guess you are not supposed to fall asleep while meditating, but the breathing exercises I learnt from meditating always helped me fall asleep.

<comment><USER12> If the breathing exercises help you fall asleep and you want to fall asleep, then as far as anyone is concerned, it's working as intended. ;)

Now if you were falling asleep while trying to meditate then you might not be sleeping enough in general.

</comment></comment></comment><comment><USER13> I'm not usually one to complain about this… but wow, this site is incredibly hard to read on mobile, at least on an iPhone. Zooming out is disabled, too.

<comment><USER14> You probably didn't notice this on mobile, but this is google books. The poorly rendered text is due to it being an actual scan of some book. What exactly is being linked to here is unclear though. The passage isn't too concrete on getting a point across...

<comment><USER15> The short and sweet version (and heavily paraphrased) version is:

If you're tired in the afternoon, you only need a literal moment of sleep to feel revived. You can do this by sitting in a chair, holding something in your hand (a key, in this book), palm down, with something beneath it on the floor (a plate, in this book) that will create some sound when hit. The instant you fall asleep, you drop the item onto the the thing on the floor, it wakes you up, you feel energized.

<comment><USER16> thank you for that concise explanation. i love Dali's flowery language but its awful for actually getting a point across.

</comment></comment></comment></comment><comment><USER17> Wow, Google Books is awful on iPad. Completely unusable.

<comment><USER18> No worries, it's also awful in a browser.

</comment></comment><comment><USER11> I imagine you could also construct an electric buzzer with a spring loaded switch you hold in your hand.

<comment><USER19> I imagine there are all manner of over-engineered solutions to this problem.</comment></comment>


Ask HN: Is it bad to entertain an idea that has already been tried? - <AUTHOR>

I'm playing with an idea in my head that would be very fun to implement, but the idea is not particularly original and although I haven't checked out how many sites have done the same thing already, it feels a lot like the idea is not worth implementing except for fun.<p>So, I'd like to ask you whether it's a waste of time to entertain ideas that have already been tried (successfully or not)? <comment><USER2> Probably everything anyone on HN has thought on has been at least tried, in some cases successfully.

That doesn't mean you can't do it better.

</comment><comment><USER3> A bad idea? I would say its quite the opposite. Just look at it this way--your market research is essentially done for you.

If there are existing businesses with the same idea, who are their customers? What iterations did they go through to reach product/market fit? _How are they vulnerable?_

If there's currently no one profiting from this idea...well, why the hell isn't there? Did someone raise some cash, get a bunch of press, but ultimately fail to execute? Awesome, you now know what _not_ to do.

The general idea behind all of this is that you need not worry too much about the competition at this point. Learn from it, sure. But please don't let it discourage you from even trying. Good luck!

</comment><comment><USER4> Its all in the implementation, not the idea. Its certainly worth giving it a shot if you can identify flaws in the original implementation.

Even if its only for fun, do it. I'll be incredibly surprised if you learn nothing from it, even if it fails.

</comment><comment><USER5> Lots of innovative projects failed because they hit too early, when the market or the technology weren't ready yet. There were dozens of sites like Groupon back in 2000. Tablet computing has been around for 30 years, and it almost hit the mainstream with Palm, only to languish again, until Steve Jobs decided it was time to tackle it.

Besides, there aren't crowded markets. There are just markets you haven't segmented enough yet. <http://www.ericsink.com/laws/Law_02.html>

</comment><comment><USER6> Here's a list of some ideas that were entertained despite already existing, and ended up wildly successful. Any of them sound familiar?

\- Google ("Nah, who needs another search engine")

\- Facebook (MySpace)

\- Zappos (selling shoes, idea copied from a guy in 800BC)

In an exerpt from Felix Dennis' book 'How to Get Rich', he describes how ideas can't be patented, it's the execution behind it that matters.

Personally, none of my ideas are original. My only hope is to execute existing ideas better.

</comment><comment><USER7> Does it solve a problem for you? Is it a subset of something bigger you will face eventually anyway? Is it fun, actually?

Yes, if yes to any of the above. And regardless, implementing something that's been done already gives a huge advantage over the edge-of-existence startups-- because you begin with at least two data points. What worked or failed before, and your own project state.

May learn more about the existing thing, and almost certainly have a clearer picture of your own relative progress.

</comment><comment><USER8> A couple more successful examples: tumblr and posterous. Built by newcomers to the blogging crowd, brought nothing new except for a better implementation. Meanwhile vox.com from Six Apart shut down. There are also a ton of social book reading sites. Goodreads is growing the fastest, even though it launched considerably later than LibraryThing (which was the first major one). Shelfari was acquired by Amazon.

</comment><comment><USER9> If you think the existing solutions suck and you know why they suck and you know how to build something better, by all means go for it.

If you don't really think they suck, or you don't really have an idea about why they suck, or don't really know how to make a better alternative, maybe you should reconsider ..

<comment><USER7> I wouldn't want to go chasing rockets.

</comment></comment><comment><USER10> I love building stuff. Its one of those guilty pleasures that consume my weekends. The truth about fun projects is that you can waste your life away working on them. I would recommend that you really think about this idea more. Maybe you could see yourself doing this for much longer than a weekend? Why not?

</comment><comment><USER11> Why do you care to judge an abstraction of another abstraction? How about judging the idea itself?

</comment><comment><USER12> If it took you time to find the other sites but you know how to market it, then I'd say it's not bad, go for it :)

</comment><comment><USER13> Pardon the short answer, but simply:

No, its not bad at all. A. google B. Facebook

</comment><comment><USER14> No. Anything can always be improved upon.

</comment><comment><USER15> You'll never know until you try it...</comment>


Ask HN: Did anybody bootstrap a successful business by hiring a freelancer? - <AUTHOR> How would you rate your experience? <comment><USER2> I have hired a lot of freelancers over the years and I run a successful bootstrapped business. I don't outsource core activities, just smallish things that we don't have skills in house to do. Overall it is hit and miss, but my advice for what it is worth.

1\. Only hire individuals. Never hire a team.

2\. Watch out for individuals who are secretly fronting a team.

3\. Make sure that you have a keyword in your project description that has to be mentioned in the bid by the freelancer. This will allow you to weed out 95% of freelancers who bid without reading.

4\. Chat to the freelancer about the project first and if possible hire them for a small private project to scope out the details.

5\. Despite all these steps expect only 50% of freelancers to workout. Either hire two at once or schedule enough time to do it sequencially.

<comment><USER3> As someone who works on a freelance team, why do you only hire individuals?

<comment><USER2> A few of reasons

1\. It is very hard to pin down who is responsible for anything.

2\. You end up explaining everything twice - once to your front wo/man contact and then again to the clueless intern who is tasked with implementing what you want.

3\. It is near impossible to determine the competency of the person who will be doing the work in advance. The front person is usually quite good, but the person who actually does the work is often not. You can't work that out until you are well into the project.

Teams on average are probably better than individuals, but from a project management perspective they are a pain to deal with.

<comment><USER3> Here are my personal anecdotes:

>1\. It is very hard to pin down who is responsible for anything.

Fair for some situations but my team and I use git and share the repo with our clients so they can see who is committing code.

>2\. You end up explaining everything twice - once to your front wo/man contact and then again to the clueless intern who is tasked with implementing what you want.

My team and I always make sure we are in the same email thread with the client.

>3\. It is near impossible to determine the competency of the person who will be doing the work in advance. The front person is usually quite good, but the person who actually does the work is often not. You can't work that out until you are well into the project.

I've had situations were my entire team has interviewed separately but I can see how this is unfeasible for some teams especially past a certain size.

<comment><USER2> I am sure there are good teams (and you sound like you are part of one), it is just really hard to work out who is a good team and who is not until you are well into the project.

I think if you had a really large project then a team would be a good idea especially if you require skills in a lot of different areas, but in my case all my projects have been smallish and focused.

I have worked with some amazing freelancers over the years who can do things in days that would have taken me months.

</comment></comment></comment></comment></comment><comment><USER4> I helped someone non-technical hire a competent freelancer. works just fine.

the problem is usually in the skill of the freelancer, not the fact that freelancers dont work period.

if you need a website and a stripe integration, then thats all you need. you dont need someone "oh my god fully committed to the business".

</comment><comment><USER5> I'm bootstrapping a couple of side-projects by training up an intern, and starting in January I will be paying him a monthly retainer against hours worked. The coming tasks will include:

\- Stripe payment integration \- Marketing automation

This has been a great experience for both of us, and we will be self- publishing a PDF book on this process.

</comment><comment><USER6> I basically built MyAppTemplates.com off of Elance. IMO the key thing was in working with freelancers who 1. Were very responsive by email and 2. Didn't need a lot of explaining in order to 'get it'.

This apart from the obvious requisite skills necessary to do whatever the job was ofcourse.

</comment><comment><USER7> We've been bootstrapping (successfully) for a few years now and so far almost every instance of using a freelancer failed (some more miserable than other) and cost us money and time.

We're in a unique situation where we outsourced for lack of time and not skill, which is a double edged sword...

My two cents - if you can do it then do it. If you can't, and can't learn fast enough, then try to freelance it.</comment>


Everything I Forget About Git - <AUTHOR> http://dshimy.github.com/blog/2013/04/04/everything-i-forget-about-git/

<comment><USER2> Thanks, lots of greats tips.</comment>


Timing attack against HSTS to sniff browser history in Chrome and Firefox - <AUTHOR> https://zyan.scripts.mit.edu/sniffly/ <comment><USER3> Mitigation, get your site added to the HSTS Preload list.

Most of the advanced webappsec security features leak information. CSP, HPKP, HSTS, etc, which was all 100% known.

This talk is excellent because it puts together the attacks into real PoCs, real attacks, and great information on how it all works. These attacks in the talk are quality too, instead of being 'mostly' theoretical.

This wasn't really documented all in one place, or as high quality in the past. Way to go @bcrypt. High quality work.

<comment><USER4> Can anyone who runs a high trafficked site and isn't on the HSTS preload list explain why not? I am genuinely interested.

<comment><USER3> There's a lot of pressure to turn the includeSubdomains flag on, with the new Google Submission Process (submit a form to hstspreload.appspot.com).

Not all businesses are in a situation where they can just turn on HTTPS across all subdomains. I'm sure agl will make exceptions if you reach out and are a high traffic site.

</comment></comment></comment><comment><USER5> Probably a good idea to edit the title to indicate that this is an example attack site as well, not my favorite thing in general to land on without warning.

No js seems to mean no worries though.

<comment><USER6> The results never leave your browser, though, so there's not much to worry about.

<comment><USER7> The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation, since you don't have a copy of the JS code that was sent to hobs' browser.

<comment><USER6> Actually I can. The author of this code is a friend of mine who works with the EFF, and the idea that she's secretly sending malicious scripts to some people but not others from her MIT web hosting space under her own name is simply not plausible.

<comment><USER8> Unless, she's already compromised your browser and the two previous comments are in fact placed by her!

In all seriousness, I appreciate the added context your (particularly this last clarifying comment) add to the discussion.

</comment></comment></comment></comment></comment><comment><USER9> The site attacks seems to fail in Tor Browser. It returns a list of sites that have nothing to do with my browser history. Probably because Tor Browser reduces the time precision.[1]

It seems like it would be nice to require some sort of user privilege escalation like accessing location, or webcam to access high precision timing. This would close off a huge class of time related side channels.

[1][https://trac.torproject.org/projects/tor/ticket/1517](https://trac.torproject.org/projects/tor/ticket/1517)

<comment><USER10> Tor Browser restricts js timing precision to 100 milliseconds, which makes this way harder. HTTPS Everywhere also creates a lot of false positives, although those can be subtracted out.

See discussion at [https://trac.torproject.org/projects/tor/ticket/17423](https://trac.torproject.org/projects/tor/ticket/17423)

</comment></comment><comment><USER11> I hit the page from Chrome 45.0.2454.101 and it literally did not get a single site that I regularly visit. It did make a hit on Reddit, I guess, but I have only visited the site two or three times, and you could probably say that about 2/3 of the population.

<comment><USER10> interesting, are you using any browser addons? please file a bug at [https://github.com/diracdeltas/sniffly](https://github.com/diracdeltas/sniffly), thanks

<comment><USER12> Same here. Most sites are those that I visited shortly a long time ago.

<comment><USER13> Same here. The only addon I use is uBlock origin. I also had to activate javascript on the page which I normally don't.

</comment></comment></comment></comment><comment><USER14> The root problem seems to be that the web security model is broken because you can get onload AND onerror callbacks from img coming from 3rd party sources regardless of CORS.

You are not allowed to read the content of those resources for security reasons, and the fact that you can detect whether they have been loaded seems just as broken (although obviously this usually only has privacy impact, while reading the contents easily allows impersonating the user or stealing secrets).

This attack abuses this by using HTTP URLs and causing HTTPS to trigger onerror by using a content security policy that disallow HTTPS, which allows to measure timing of the HTTP->HTTPS redirection, which is instantaneous if the site had already been visited due to HSTS caching.

So I think two changes are needed:

1\. The browser should never fire onerror on non-CORS-allowed 3rd party resources, but instead fire onload even if an error happens

2\. The onload event should ideally be triggered 1 second after the resource has been seen regardless of whether it has been loaded or not. If that breaks too many websites, the timing granularity should be rounded to the greatest period possible.

There is also the problem of lots websites having CORS policies that allow * , so should probably also fix browsers to not allow sites to have CORS * policies, at least for this purpose.

Alternatively, it might be possible to load those resources normally, but effectively consider them to be a "3rd party origin from 1st party origin" that is different from "3rd party origin" and from other 1st party origins for all caching purposes.

However, this seems risky because if the 3rd party site manages to somehow fingerprint the user (e.g. because the IP address is whitelisted) then that information is potentially leaked to the 1st party site. For example, it would be possible to detect whether your IP is whitelisted by a domain that otherwise returns errors to everyone.

<comment><USER15> You still can insert external image into a page and poll its size either directly or detect it via layout changes.

Maybe the root problem lies in HSTS and browsers using HTTP by default (because that is why we need HSTS)?

<comment><USER14> Indeed, should disallow that as well, e.g. give such external images and videos an intrinsic size of 1/3 the browser window size regardless of their actual size.

And disallow (non-CORS-allowed) cross-domain JavaScript and CSS.

<comment><USER15> It would be easier to disallow http-only CSP though.

<comment><USER16> this sounds like a good idea. I do have to wonder if you use CSP & https for your own site (because what site deploys CSP without deploying https first?), what sort of http-only directives would even be legal (i.e could successfully load content) under mixed-content rules.

But I don't think this solves the whole problem, as the time to "redirect + load https image" v. "HSTS redirect + load https image" is probably significant enough of a difference to timing attack. In which case you just need to time the onload of an image (or similar resource).

<comment><USER15> CSP can be useful on HTTP-only sites to prevent and log XSS attacks (e.g. somebody trying to insert a script on a page via vulnerable server script). That is SCP primary purpose IIRC.

</comment></comment></comment></comment></comment></comment><comment><USER17> Having disabled NoScript, Privacy Badger, HTTPS Everywhere, and AdBlock Pro, it can tell I've been to npmjs.com. I'm not immediately worried.

Maybe too obvious to point out, but as far as I can tell, it looks for entries in the browser cache, rather than looking at the history per-se. If you have the browser cache empty when you close the browser (gotta watch those evercookies!), that's also not an issue.

<comment><USER10> sort of. the hsts cache gets cleared when a private browsing session is closed or when you clear it manually in browser settings. it takes a long time (up to a year) to expire on its own.

</comment></comment><comment><USER18> This approach is rather interesting. But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?

<comment><USER19> This used to be possible, but browsers put into place various mitigations: restricting which properties a :visited selector can affect, always computing both the visited and non-visited style to avoid timing attacks, etc. [http://dbaron.org/mozilla/visited-privacy](http://dbaron.org/mozilla/visited- privacy) has a writeup describing the issues and the solutions that were adopted.

</comment></comment><comment><USER20> One nice thing is that it is quite inaccurate, I've visited a large number of the sites it tells me I haven't.

<comment><USER21> It's accurate depending on what you're looking for. Saying you didn't visit a site means you either did, or did not, but saying you did visit a site means you 100% did for sure. In the case of a negative the results are meaningless, but in the case of a positive they are accurate. Similar to a bloom filter

<comment><USER22> I've just checked my history and the sites I thought I have not visited do not show (2/14). Maybe 85%?

<comment><USER10> Yeah, I think the accuracy so far has been like 75-80% among my friends (once httpseverywhere is disabled). PS: you can check whether sites are in your HSTS cache in chrome at chrome://net-internals#hsts

</comment></comment></comment></comment><comment><USER23> I think many popular sites will be a false positive because some browsers ship with a list of HSTS domains.. visiting them in HTTP first wouldn't happen. [https://code.google.com/p/chromium/codesearch#chromium/src/n...](https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json)

<comment><USER24> Preloaded HSTS entries are filtered out [https://github.com/diracdeltas/sniffly/blob/c645af76cb53a21a...](https://github.com/diracdeltas/sniffly/blob/c645af76cb53a21a8eba449d766d25da18d3db54/util/process.py#L65)

</comment></comment><comment><USER25> Strange. I disabled "scripts from 3rd party sites" and "frames from 3rd party sites" by default in ublock origin and this site successfully loads 329 external JS ressources from other sites (none are manually enabled). Does anyone have the same problem? Is this a bug of ublock origin or expected behaviour?

<comment><USER26> It loads images, not JS, if I understand correctly.

<comment><USER25> Ah, thanks! That why these external ressources are shown but not blocked. Interesting attack vector!

</comment></comment></comment><comment><USER27> A slide discussing HSTS+CSP attack (this one) and also HPKP attack: [https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf](https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf)

</comment><comment><USER28> This was wildly inaccurate for me. I think it was wrong far more than it was right.

</comment><comment><USER29> The core issue is the same that leads to cross domain search timing attacks [1] (which can be prevented with CSRF tokens)

With timing HTTP->HTTPS redirections maybe the issue is not that the response can be timed but that HTTP exists in the first place? There are other similar timing attacks that can easily be used to identify if a user is logged in to a specific website [2].

[1] [https://news.ycombinator.com/item?id=10211306](https://news.ycombinator.com/item?id=10211306) [2] [http://crypto.stanford.edu/~dabo/papers/webtiming.pdf](http://crypto.stanford.edu/~dabo/papers/webtiming.pdf)

</comment><comment><USER30> Completely inaccurate for me.

</comment><comment><USER16> Hm, tried this on my Android phone first and it didn't seem accurate - <USER2> have found 1 or 2 sites I actually visited, a few I wasn't sure of, and would randomly change between reloads. Seems to work much better on desktop Chrome (win 7). Wonder why there's a discrepancy.

</comment><comment><USER31> I'm using Chrome 46.0.2490.80 without HTTPS Everywhere and it couldn't find any site I visited (tells me I visited none). I tried to visit a few and restart the test, it didn't found anything either

Edit : retried in Firefox 41.0.2, it's giving accurate results

</comment><comment><USER32> How much of this is accurate, and how much of this is simply the top XXX sites that people visit?

<comment><USER10> I pulled the list of domains out of the Alexa Top 1M plus some domains that my friends run. But I'm not biasing results towards showing up as visited by popularity or anything like that.

I didn't set up analytics to figure out how accurate results are for the average person; having manually checked with a few people's browsers, I'd say the accuracy rate is ~75%.

<comment><USER33> At a glance, looks about 75% accurate for me. But what really freaked me out is that it correctly flagged a financial institution (not a major one) where I have an account yet feel pretty sure I haven't visited the website in months.

<comment><USER10> Yeah, part of the nice/scary thing about HSTS is that it is a highly persistent cache. The browser is reluctant to clear it because it's a security feature. So HSTS pins can be stored for up to a year in FF/Chrome, even if you are deleting cookies regularly.

</comment></comment></comment></comment><comment><USER34> Thankfully, this particular attack does not work with a running µmatrix. I do see a bunch of image requests to all these domains, but it shows that I haven't visited any (except for the ones that are blocked completely by hosts files, amusingly enough).

<comment><USER10> adblocked domains are indistinguishable from hsts blocked domains in terms of timing. so they show up as false positives. a clever attacker could subtract them out though.

</comment></comment><comment><USER35> I was skeptical at first, then I visited some of the sites it said I had not visited. A second round caught them, eep! A little machine learning could probably make this much more accurate, the PoC is clear.

</comment><comment><USER36> Are timing attacks over the internet affected by buffer bloat?

Not a single positive even though I have visited a number of the sites on the list. There's even tabs open for Reddit right now.

</comment><comment><USER37> this worked on an older version of chrome for me, but not the recent ones -- the sites listed were incorrect.

additionally, some alternative browsers based on chromium also gave inaccurate results when used on ipad and android.

this is strictly based on my exp w/ my own machines. im a security researcher so maybe my machines exhibit more unconventional settings / environments that are atypical of the avg user.

will try again later on a different machine. this is interesting stuff,good work.

</comment><comment><USER38> Security features (like any software features in general) are additional vulnerability vectors prone to implementation flaws.

</comment><comment><USER39> Tried with Firefox for Android 41 and it is quite accurate.

Note: in China, so sometimes HTTPS actually fails to establish

</comment><comment><USER40> Doesn't seem to be working in Safari on Mac. I'm getting over 650 CSP errors in my console.

</comment><comment><USER41> I'm using HTTPS Everyhwere, and it couldn't get a single website correct.

<comment><USER6> Yes, HTTPS Everywhere blocks this particular attack, hence why the top bar says to disable it.

(Incidentally, the author of this attack is also one of the authors of HTTPS Everywhere.)

</comment></comment><comment><USER42> Does not seem to work without Javascript enabled.

</comment><comment><USER43> A different version of this would of been to mess around with the :visited css selector since it's assuming a list of domains that you probably visit

<comment><AUTHOR> This has mostly been fixed.

See [http://dbaron.org/mozilla/visited- privacy](http://dbaron.org/mozilla/visited-privacy) and [https://blog.mozilla.org/security/2010/03/31/plugging-the- cs...](https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history- leak/)

<comment><USER44> Yes. If you're using a browser version that's been updated past 2010-2011, this will no longer work.

<comment><USER45> Yes, and if you're running an older browser, then the webserver can provide arbitrary code that just reads the history directly. :)

</comment></comment></comment></comment><comment><USER46> Wow. Our corporate proxy isn't going to like that many requests that quickly from one box. I wonder if they can add a landing page.

<comment><USER47> Yan has hit the HN homepage before, so hopefully it can weather this storm too.

<comment><USER48> I believe voltagex_ meant outgoing requests from his/her location.

</comment></comment></comment><comment><USER49> Sites you probably haven't visited: "myspace.com" < pffft. That's too easy.

</comment><comment><USER50> Luckily I have taken out entire classes of attacks against the browser (this one included) using simple, baseline configs that harden the browser. I am unsure how many people take these measures and I don't know the stats for how many people are hardening their browser in some way, but I suspect large swathes of web users are at risk here.

Since this is Hackernews, my efforts to educate the masses on weaponized browser attacks like this would be futile, and I am sure many have configured their browser in some rudimentary way to merry away the assholes.

There is a certain sigh of relief and 'ha catch me if you can' that coats me when I see PoCs like this rendered obsolete and inert.</comment>