U.S. developing sanctions against China over cyberthefts - <AUTHOR> https://www.washingtonpost.com/world/national-security/administration-developing-sanctions-against-china-over-cyberespionage/2015/08/30/9b2910aa-480b-11e5-8ab4-c73967a143d3_story.html <comment><USER2> > "The indictments were a strong move," said Rob Knake, a former White House > cyber official

Yeah, you sure showed those peksy Chinese! "Shut it all down boys, the US has issued indictments against 5 of us. Better stop this hacking nonsense, things are getting serious".

<comment><USER3> Owning homes, educating one's children, and stashing ill-gotten money overseas is de rigueur for hypocritical PRC chieftains.

Those five indictments were perhaps a way of gently signalling to the higher- ups, who do have exposure to the legal machinery of the USA and its allies, that the golden parachutes they've painstakingly created for themselves outside of China could easily be taken from them.

</comment></comment><comment><USER4> Looking forward to see who sanctions who.

</comment><comment><USER5> The wheels turn slowly. Amazing that it's taken this long.

<comment><USER6> The US has been involved in some similar activity, so it will be interesting to see if anything actually comes of this.

[http://www.forbes.com/sites/kenrapoza/2013/06/22/u-s- hacked-...](http://www.forbes.com/sites/kenrapoza/2013/06/22/u-s-hacked-china- universities-mobile-phones-snowden-tells-china-press/)

</comment></comment><comment><USER7> This is utter bullshit. This looks like a whitehouse leaked story that is speaking directly to the Chinese saying:

"we could sanction you, and you're economy is pretty shit right now so rein your people in and stop promoting IP theft. Also, with that $180B[0] reduction in your position in t-bonds a few weeks ago, the tables are turning back in our favor"

Look at this quote from the article:

>The sanctions would be a second major shot at China on the issue. In May 2014, the Obama administration secured indictments on economic spying charges against five Chinese military members for hacking into the computer systems of major U.S. steel and other firms.

> The indictments were a strong move, said Rob Knake, a former White House > cyber official.

Well, five people isn't that many but it was a show of strength, a strong move if you will, and a definitive stance against the hackers. This all but proves the US is serious about standing up to China.

From the NYT article about that incident:

The move by the Justice Department was almost certainly symbolic since there is virtually no chance that the Chinese would turn over the five People's Liberation Army members named in the indictment.[1]

Ahh, got it political posturing via the American media doing some public scolding and little else.

EDIT: This is probably the most infuriating part though, snuck in right at the end:

>The sanctions would not be imposed in retaliation for China's hacks of the Office of Personnel Management databases, which compromised the personal and financial data of more than 22 million current and former government employees and family members. The data heists, which took place last year but were discovered this year, were judged as having been carried out for traditional intelligence purposes — not to benefit Chinese industry.

So, the message we seem to be sending is steal 7% of OUR ENTIRE COUNTRIES PERSONAL DATA, no biggie. Hurt a few companies steel and energy competitive advantage and we will threaten you, then ultimately back down. Why? Because publicly we want to reaffirm our commitment to valuing companies much higher than our own citizens.

[0][http://www.bloomberg.com/news/articles/2015-08-09/china- slas...](http://www.bloomberg.com/news/articles/2015-08-09/china-slashes-u-s- debt-stake-by-180-billion-and-bonds-shrug)

[1][http://www.nytimes.com/2014/05/20/us/us-to-charge-chinese- wo...](http://www.nytimes.com/2014/05/20/us/us-to-charge-chinese-workers-with- cyberspying.html?_r=0)

</comment><comment><USER8> Pot meet kettle.

<comment><USER9> Can you sight your sources?

<comment><USER4> There's tons of better sources, but this can give you an idea:

"NSA 'engaged in industrial espionage' \- Snowden"

[http://www.bbc.com/news/25907502](http://www.bbc.com/news/25907502)

<comment><USER7> While I think it is possible that the US is engaged in economic spying for profit, there isn't as much info about them providing data to companies directly for profit, and certainly not in that link. Industrial spying is a power grab more than an economic one. Your article noted Siemens as a spying target. Here is a a possible reason for industrial spying:

> Stuxnet functions by targeting machines using the Microsoft Windows > operating system and networks, then seeking out Siemens Step7 software.[0]

[0][https://en.wikipedia.org/wiki/Stuxnet](https://en.wikipedia.org/wiki/Stuxnet)

</comment></comment></comment></comment><comment><USER10> I doubt it will come to fruition.

Where do I start.

1\. Sanctions are only effective if a lot of other countries also do it. Who would be willing to follow suit because of a cyber skirmish that doesn't involve them? Traditionally the Europeans would follow suit with this type of thing. But hell, Russia is taking land in their backyard and the Europeans can't even come to a consensus on that. Snow balls chance they form a unified opinion on China. Furthermore they are tired of following America in its quixotic foreign adventures. How about Australia? Nope. Their economy nowadays is shipping mineral wealth to China. Anything short of the PLAN maneuvering towards Sydney would make them think about sanctions. By the same reasoning, discount any country that appears darkly colored on this map: [http://imgur.com/msbZwo6](http://imgur.com/msbZwo6)

2\. Is America's geopolitical enemy China or Russia? Because right now they are getting quite close with each-other. Russia's economy would be even more fucked without China buying its gas, and China needs resources like I need adderall (hint: a lot). If you try to isolate and contain both at once, you'll just end up with a regional power bloc that parallels or even surpasses US hegemony.

3\. Right now the Chinese economic slowdown has caused ripples in the world economies. Even though the Chinese stock market is relatively contained, the mere fear that the Chinese engine is stalling has caused a small panic around the world. Are we really so confident in our post-2008 recovery to just yolo it and inform investors that we will be kicking China while its down? This is like pointing a gun at your foot hoping to blow that hang-nail straight off.

4\. China isn't some two-bit country. It will look like America is trying to use diplomatic and military clout in lieu of actual competitive advantage to maintain global dominance.

I'd like to imagine that Obama is smart enough not to actually do this (or only have a hopelessly watered down version). Here is my pet theory: Donald goddamn Trump. This upcoming election year the crotchety-old-man demographic has gone mainstream. Trump has bought China (and Mexico and a few other things) to the forefront. If status-quo candidate Clinton is to have a chance, the status-quo needs to look anti-China. Obama can help with that by throwing some hot air around and making some empty threats at China. Its ok, the Chinese understand that election year rhetoric means nothing. Maybe while Xi is dining at 1600 next week, Obama will tell him all of this explicitly.

If you really wanted to f over the Chinese and start a new cold war, start by undermining their canal plans to circumvent the straight of Malaca, promote regime change / instability in Pakistan (see: maritime silk road) and a few other countries (the other silk road project), conclude the Iran deal for good measure, finance Japanese political groups that want to amend away the passive part of their constitution, Strengthen ties with that other billion-people country in the region (India), and use Turkey to keep on doing what their doing with the Uigers. Warning: about half of this may result in another 9/11 at some point.

</comment><comment><USER11> Good Good Let the Hate flow through !

A cyber-security cold war would be the best thing to happen to the CS industry and a lot better than real wars.

<comment><USER12> > and a lot better than real wars

Instead of people dying, everyone just loses all their credit and savings. That is until someone shuts down a dam and opens all the flood gates, or shuts off the power grid to a city, shut down airport flight tracking (or make planes show up where they are not), etc.

Cyber war seems almost scarier than a "real" war - because it almost exclusively targets civilians instead of combatants.

<comment><USER13> It depends how you look at it. If what you listed is possible to do, then it's possible to do right now - no war is needed. If people really expect such actions, then security will finally stop being an afterthought.

Credit cards and savings are already being stolen. Industrial controls are not yet taken over, (ignoring one-offs like stux) but they're definitely not controlled very well (have a look at the project which scanned the internet for exposed VNC). While flight tracking is isolated, false flight plans already stopped take-offs for some time.

Sure, governments can go much further than anyone has so far. But if we start to really think about it and protect systems for that possibility - great!

</comment></comment></comment><comment><USER14> isn't the us government hacking all the time too?

<comment><USER15> While true as an abstract point, is there any evidence that US government shares (on a large scale) intel or stolen IP with commercial firms? I mean it's one thing if a high-ranking official would say to a CEO 'we found out company XYZ is bidding x million dollars against you'; but it's another to systematically feed design documents, customer records etc. into firms and keep that under wraps. Occam's Razor says that at some point, someone would have spilled the beans - long before Snowden.

<comment><USER16> Do you think that the US government won't share with industry if another country is leading in research and development?

<comment><USER15> That's not my question. My question is, if it would happen at a detailed scale (i.e., anything more than can be communicated in ad-hoc conversations), how likely is it that this could be kept under wraps?

My point being, of course, that I think that's highly unlikely, given how apparently even a US president can't stop the world from finding out that he fingerbanged a single intern. Therefore, the most logical conclusion would be that it doesn't happen. To all those saying it does: why isn't there proof of it? (please no 'the landing on the moon didn't happen' tinfoil hattery)</comment></comment></comment></comment>


Ask HN: Now that so many of you are off GoDaddy, where'd you guys go? - <AUTHOR>

See topic <comment><USER2> I've had good luck with nearlyfreespeech.net for a while now (pre go-daddy exodus).

The only reason I had a domain @go daddy is that nfs doesn't do the .me tld. That domain is being moved to namecheap.

</comment><comment><USER3> namecheap, but .name and .ws can't goto namecheap. Decided to not renew those anyway. Only thing left is a ssl cert for a client. Will wait that one til expire.

</comment><comment><USER4> I went with name.com.</comment>


So you'd like to... become a mathematical finance quant starting from scratch - <AUTHOR> http://www.amazon.com/gp/richpub/syltguides/fullview/RDXHW9HPBHCOT/ref=cm_syt_fvlm_f_1_rlrsrs0

<comment><USER2> In passing it looks like a nice reading list. What motivated you to study this topic and are there any achievements resulting from this regimen that you could share?

</comment><comment><USER3> WTF? An amazon ad?!?!?</comment>


Show HN: Browse and take photos/videos at the same time - <AUTHOR> https://github.com/kmdarshan/safecam

<comment><AUTHOR> I open sourced the code so that, it will be helpful to others if they need this.</comment>


Tavis Ormandy finds another major hole in Lastpass - <AUTHOR> https://twitter.com/taviso/status/845717082717114368 <comment><USER2> Ok this is the last straw for me. I'm finally done with Lastpass.

Can anyone who uses Keepass with desktop and iPhone please explain their setup? I'm finally going to make the switch, but I'm not sure what the best options are for smart phone use.

<comment><USER3> I self-host an instance of Nextcloud and sync my KeePass DB between devices with their desktop/mobile syncing applications. You could do the same with Dropbox/Google Drive/et al.

It's pretty effortless.

<comment><USER2> Assuming you have an iPhone, which iPhone app do you use?

<comment><USER3> Hey, sorry for the late reply. i do not have an iPhone, but a quick glance at the iOS app store shows that Nextcloud have an official app there.

</comment></comment></comment></comment><comment><USER4> I feel like just having a browser extension is a major security hole for any password manager. Yes it's more usable and prevents domain spoofing, but it makes the attack surface huge.

Whereas to exploit a desktop app that doesn't interface with the browser (written in a decent way), you'd need code execution already.

Thoughts?

<comment><USER5> I think it depends on the extension. For example browserpass [0] can be only invoked on button press in browser's Chrome (not via scripts on page) and while it runs native app via Native Messaging it just uses JSONs to communicate.

[0]: [https://github.com/dannyvankooten/browserpass](https://github.com/dannyvankooten/browserpass)

</comment></comment><comment><AUTHOR> From down thread: "@moeadham It will take a long time to fix this properly, it's a major architectural problem. They have 90 days, no need to scramble!"

</comment><comment><USER6> Does Tavis get any overtime for finding a bug on Saturday?</comment>


MackerNews: The Hacker News Client for Mac - <AUTHOR> https://itunes.apple.com/us/app/mackernews-hacker-news-client/id946730699?mt=12

<comment><USER2> Lost in Translation: "Macker" in german means "Dumb Bro", which would be quite the opposite of a HackerNewsClient… ;)</comment>


Quantum interference of currents in an atomtronic SQUID - <AUTHOR> https://www.nature.com/articles/s41467-020-17185-6 <comment><USER2> SQUIDs are really fascinating to me so this article is right up my alley. My colleagues and I, are developing a fully automated, wide imaging area, scanning SQUID microscope for superconducting circuit imaging, evaluation, etc. In this application, a SQUID is used as a micro-magnetometer. An array of SQUIDs are also used as a low-noise current-to-voltage transimpedance amplifier. Good times...

</comment><comment><USER3> " The stored data are fed in through a modified series of microsurgical contraautism prostheses.' I reeled off a numb version of my standard sales pitch. 'Client's code is stored in a special chip; barring Squids, which we in the trade don't like to talk about, there's no way to recover your phrase. Can't drug it out, cut it out, torture it. I don't know it, never did.'

'Squids? Crawly things with arms?' We emerged into a deserted street market. Shadowy figures watched us from across a makeshift square littered with fish heads and rotting fruit. 'Superconducting quantum interfence detectors. Used them in the war to find submarines, suss out enemy cyber systems.'

'Yeah? Navy stuff? From the war? Squid'll read that chip of yours?' She'd stopped walking, and I felt her eyes on me behind those twin mirrors."

</comment><comment><USER4> May I dissect you for the search?</comment>


Show HN: Malcheck, a tool to test memory allocation failure handling - <AUTHOR>

Here it is: https://github.com/andrewrk/malcheck
I posted the idea for this this morning[1] and got no responses but I decided to make a proof of concept anyway :-).
One problem that has presented itself is that "memory leak" is kind of a subjective concept. It's really common to allocate memory and never free it, because the memory need not be freed until the application shuts down. valgrind has all kinds of voodoo to differentiate between memory intentionally never freed and accidental memory leaks. So you end up in common situations where the number of allocations is thousands more than the number of deallocations, and there's still no leak.
So this can still help check the allocation failure handling code, but I don't think it's going to be able to find memory leaks since there would be too many false positives.
[1]: https://news.ycombinator.com/item?id=9977032 <comment><USER2> Stories without URLs get penalized, so you'd be better off posting this as a link to your project, then adding the text as a first comment in the thread.

<comment><AUTHOR> Thanks for the tip. I'll take that into account next time.</comment></comment>


Gather Is a Video App That Wants to Replace Your Boring Text Replies - <AUTHOR> http://techcrunch.com/2015/05/20/whenpoopemojiswontdo/

<comment><USER2> This is a comment that wants to replace empty space on your screen with itself.

<comment><AUTHOR> Ummm.. ok.... a comment with inner drive? :)</comment></comment>


Ask HN: Best way to collect event data coming from different sources? - <AUTHOR> I'm building a predictive analytics SaaS tool. I need to collect a massive amount of data coming from my own customers. Do you have some good advice or know any useful API product to seamlessly collect event data? <comment><USER2> Why not have a s3 bucket for the events to be uploaded to?

<comment><AUTHOR> I will train the model using historical data. It'll process real-time data and then compute the prediction.

I'm on the lookout for an easy way to collect real-time data without managing an ad-hoc infrastructure.</comment></comment>


The Sad State of Web Development - <AUTHOR> https://medium.com/@wob/the-sad-state-of-web-development-1603a861d29f <comment><USER2> This article mostly seems to be saying "my problems don't require your solutions". So don't use them. We all know jQuery still works.

A more charitable reading would be "don't use complex tools to solve simple problems". That's a fine piece of advice when your problems are simple. Simple problems rarely stay that way. Most of these articles lamenting the state of front end development make a similar concession:

 _If I see a section on my app that is really hard to with Pjax /Turbolinks and jQuery, I'll bring in a library/framework like Vue.js, React, Angular. All good choices for doing really complex forms(although I find Angular to be the best at this), with a ton of conditional validation. You know what though, these are the outliers in my experience, not the norm._

Sure, adding a form to your front page can be done with a couple lines of vanilla javascript. But you suffer the cost of a framework or library at the start of a project because it pays dividends at the end of a project. When you have to filter a list of ten thousand items as the user types, you'll probably wish you could use virtual DOM diffing. When you have to step through a series of ten asynchronous requests before updating a view, you'll probably wish you could use async/await. When your site takes five seconds to load over 3G because of your single monolithic codebase, you'll probably wish you could tree-shake your dependencies. The tools mocked by the author have real uses, he just refuses to see them.

<comment><USER3> What is tree shake your dependencies?

<comment><USER2> Something like [http://rollupjs.org](http://rollupjs.org) which statically analyzes your ES6 dependency graph and creates a bundle with only the parts you need. The author included an image that rips at ES6 syntax, including the new import statements. A tool like Rollup couldn't work with dynamic exports like `module.exports = foobar`.

</comment></comment></comment><comment><USER4> While I'm not a huge fan of the tone, I do agree with a few points. The ES6/ES7 syntax is freaking awful... I still write almost all of my JavaScript code in ES5 because I don't really want to have to deal with all of the magical stuff Babel/Traceur/TypeScript/whatever is doing behind the scenes.

That being said, it's not all bad. System.js/JSPM has improved my front-end workflow quite a bit and the SPAs I've made with the new workflow have been both stable, compatible and fast (very few end user complaints, lots of praise, quick development). So while some things have become convoluted, not everything is dire.

</comment><comment><USER5> This makes me so glad I don't work on anything near web development. You know there about two dozen other major areas in software if you ever want to something different. Just saying. On the other hand, the labor shortage in the other areas is so much more pronounced thanks to the popularity of the web (and mobile) that I really should be more thankful for it.

<comment><USER6> What are these 2 dozen other areas? I'm genuinely curious.

<comment><USER5> Think about all the different computers connected together it took to get this web page to your eyes. All those network nodes, routers, the billing for your ISP, the CDN, all the security related, etc. How did those things even come into existence? Think of the tools the humans used to work on those things. Think of the energy it takes to run all those systems. Think of the entire fuel supply chain, power generation, transmission and distribution. All that takes millions of computers. Think of transportation, defense, biotech, astronomy, music, film, games, litigation support, to education. Computers run everything. "Basic" agriculture and land management is even wholly revolutionized by software. The world is a big place. Applied computing is unfathomably far reaching. Further, applied computing relies on development tools, operating systems, microprocessor design, fabrication advancements. Don't settle for a career in something that you find boring.

</comment></comment></comment><comment><USER7> Outside of Reagent for clojurescript, I'm not that interested in using React. It does seem like a step back in readability and 9 times out of 10 you don't need to use virtual dom because you know exactly what is changing and where.

With clojurescript it was a no brainer since the effort to make it reactive was functionally 0 compared to default hiccup data structures.

</comment><comment><USER8> Most of the things he whines about apply to all dynamic languages, since you can't catch API drift bugs except at runtime.

<comment><USER9> Have you worked extensively in Javascript and other dynamic languages? In my experience, Javascript is at least 10x worse on nearly every major point he raises than anything else I've seen. The library creators don't have a fucking clue what they're doing, and blindly cargo-cult what the rest of the community is doing (example: micro-libraries). This happens a bit in ruby, but NOTHING on the scale that it happens in javascript.</comment></comment>


Startup Sues a Domain Name Owner to Grab a 16-Year-Old URL - <AUTHOR> http://techcrunch.com/2015/07/03/startup-sues-a-domain-name-owner-to-grab-a-16-year-old-url/ <comment><USER2> It doesn't look like he was CyberSquatting to me. I hope it resolves in his favor. If the person bringing the suit should win it would set a bad precedent for all Internet business.

<comment><USER3> The key take away is the part of the plaintiff's filing that seems to want to redefine 'register' to include 'renew'.

<comment><USER4> Which is going to look ridiculous as soon as it hits court, because there's clear precedent for the standard meaning - sixteen years of it.

Team Harsh are probably hoping for an internet-ignorant judge. I wouldn't want to bet on their likely success with that gambit.

<comment><USER5> That's going to be an interesting conversation.

"Mr.Mehta when was your business started?"

"2003".

"And when was the domain in question registered."

".... uh, 1999".

"Are you sure you want to proceed?".

</comment></comment></comment></comment><comment><USER6> _The unfortunate thing about the case is that both parties are Internet natives and, Mehta especially, part of the startup ecosystem._

What the fuck does this mean?

<comment><USER7> They were born in Internet and have since relocated elsewhere but still journey back to Internet from time to time.

<comment><USER8> Internet is also home to a thriving ecosystem where mystical creatures called "startups" frolic freely in the forests.

</comment></comment></comment><comment><USER9> The guy's name is Harsh, what other actions would you expect from him?

But seriously, looking at the doc and not mentioned in the article. Harsh apparently tried to negotiate, failed, then tried to "transfer" the domain. When Kneen called him out on this, Harsh suggested it was someone else, and that he wouldn't have done this since he found a suitable alternative.

So I'm pretty sure Harsh was being purposely manipulative in that situation. None of this makes any sense and is a waste of resources so I hope Harsh loses badly.

<comment><USER10> Isn't Harsh just a mildly-common Indian name like Richard?

<comment><USER11> Probably Harshil is. Harsh must be the shortened version.

</comment></comment></comment><comment><USER12> Won't Web searches about WorkBetter always point to news about this case now? Sort of bad PR even before the new company gets started.

An 'out of court' settlement would be better perhaps for both parties.

<comment><USER13> Since WorkBetter is a co-working space, I'm guessing that their target market is, largely, folks like many of us on HN: those in the tech industry who work remotely. These are the same people who are going to Google the company to gather as much info about it as possible and then be turned off or put off by the fact that they'd sue someone over a domain name dispute. Some people wouldn't care, obviously, but I wouldn't want to be a customer of an organization that filed such frivolous lawsuits just because they didn't get their way.

A dismissal of the suit, initiated by the Plaintiff, would be in the best interest of both parties, in my opinion.

<comment><USER12> Such an outcome would be much cheaper as well.

Not quite a co-working space but the place below has sprung up in Birmingham as part of a much larger organisation (or franchise)

[http://birmingham.impacthub.net/what-is-impact- hub/](http://birmingham.impacthub.net/what-is-impact-hub/)

</comment></comment></comment><comment><USER14> I think many of us have been looking for an available domain for a site and found all of them registered years before and parked since then.

The normal way to proceed is look for another name and try again. Mehta is doing it wrong.

However I don't like the general idea of squatting, also on domains. I'd be happy if there was an easy way to prevent it. Somebody suggested incremental renewal fees for unused domains, but how to tell if a domain is unused? It won't be difficult to automate some "working" site for parked domains (think of those blogs that are populated with content automatically scraped from real sites.) Other ideas?

<comment><USER15> Why does it need to be prevented exactly? Why is the internet different than anything other situation where people see an opportunity to make money and take advantage of that opportunity? Like buying real estate or wine, or art and so on?

It is trivial anyway to "use" a domain name. Are you further suggesting that someone who is legitimately "using" a domain name (and who is going to decide what use is anyway) then can't sell that domain name? And does that mean they can't sell the business that is attached to that domain name? Or you are going to have some tribunal that looks into the facts of every single case and decides 'ok this is a "real" business the domain can be sold, "no this isn't sorry"'?

<comment><USER16> Because, it favours those who have more money. People who can afford a few dollars/pounds, mostly from the western countries, can keep domains booked for years. Others in the developing or under-developed world don't have that luxury... but the internet is a more global/democratic place... or should be.

<comment><USER15> You haven't really said why that should matter though. There are other alternatives and essentially many things in the world favor "those who have more money", right?

</comment></comment></comment></comment><comment><USER17> This article isn't very good. The first twitter embed is out of context. Had me quite confused.

Anyway, the $500 offer is pretty insulting for this "premium" domain name. No wonder it didn't get sold.

<comment><USER18> The legal fees will be way more than that. They probably figured since he was out of the country they would get a default judgement. There's a new business model for you. go around filing lawsuits in different jurisdictions and get default judgements. Then go to the domain provider and get it swithced.

</comment></comment><comment><USER19> I thought that when this happens that you just go register workbetter.ly or something. Isn't that the way of the web?

<comment><USER20> Exactly. And then when your company starts to do better, you throw $xx,xxx at the owner of the .com version and getdropbox.com becomes dropbox.com.

<comment><USER21> sometimes money is not enough, see steam.com

<comment><USER22> How odd. I'm sure they could get a small fortune for that name.

</comment></comment></comment></comment><comment><USER23> I've also been sitting on a bunch of domainnames; all with the interest of "maybe some day" projects. One can hardly call that cybersquatting. It is, however very frustrating these days, .com is still king and for example I had whole dictionaries running for my keyword*.com -- and surprisingly enough, even the most insane combinations were taken. Ofcourse, selling a premium domain once in a while for 15k, makes it possible to hog 100's of other domains. Regardless of this frustrating setup, as it is now, I still prefer it over some kind of regulated way where people can just steal away your side- project's old domainname, just because they trademarked it. It's the wild west, yes for sure, but often, still it's better then an over-regulated state.

<comment><USER15> Don't be so down on what you do. It's not hogging and it's not cybersquatting. This whole concept of it being wrong to register domains was back in the mid 90's when there was no cost and people would register names with clear trademark rights (like panavision.com) with the sole idea of selling it to only one person. The trademark owner. Not the same as what you and many others are doing.

Let's say a name that you would one day sell for $15k was registered by a flower shop that used it for business. In that case if someone else came along and wanted that name they would very well have to pay more than 15k for it and might not be able to purchase it at all.

<comment><USER23> right but also, one thing to remember is, an old domainname; depends on the extension, but some of them were not cheap as in these days. maybe it was my inexperience, but I have some domains I paid 50$ for back in the days/year. so, in 10 years time you get to the point of: should I let it go, or am I already too deep in? But letting it go for $100, well, just would be a big loss. In that regard, letting it go for say 100-200, for an old domain, is just breaking even or even making a loss. though it's likely not to be perceived like that. some of us are just too deep in, and just would like to break even..

<comment><USER15> Whether you should keep or let go totally depends on the domain name and what your money situation is, not what you paid in the past that money is gone. If you care to disclose the domain I can render an opinion on what I would do based on my knowledge and experience.

</comment></comment></comment></comment><comment><USER24> This is same argument that real estate sharks use to use eminent domain and alleged blight to bully property owners.

<comment><USER17> Can you elaborate? I'm having trouble making the connection from domain names to real estate.

<comment><USER25> He has a domain (land) that the startup (property developer) wants but refuses to sell. He's trying to use domain squatting laws (eminent domain laws) to force an ownership transfer.

<comment><USER17> But isn't eminent domain only available to the government?

<comment><USER25> Yes, but local governments are regularly in bed with big money interests which would include land developers. So, the land developer gets the local government in his pocket and convinces them to use eminent domain to make a project happen that will bring lots of tax revenue to the government.

</comment></comment></comment></comment></comment><comment><USER26> I remember here some nasty comments about the previous owner of the dropbox.com domain (similar situation of an old unused domain), calling him squatter etc when Dropbox finally acquired it.

<comment><USER27> OK.. let's check that. here's the HN post for it: [https://news.ycombinator.com/item?id=880522](https://news.ycombinator.com/item?id=880522)

Let's look at some of the comments:

\- _Finally, I don 't think this owner, nor Justintv.com, are cybersquatters since they owned their domains since the 90's._

\- _I agree with you, but in this case the original owner wasn 't a squatter._

\- _note that I don 't like squatters either, but who can tell that he wasn't legitimate when he registered it first?_

\- _Not to mention that he registered it in the 90 's! How does that possibly count as squatting?_

Nope.. not really seeing any "nasty comments"

</comment></comment><comment><USER28> I have sympathy for Kneen, but do we really, as a society, benefit from people that buy useful domains and then sit on them for 16 years while doing nothing with them?

<comment><USER29> The bigger question is whether anyone has the authority to take it away from him.

<comment><USER30> Trademark law probably says yes.

<comment><USER31> Except in this case the domain was registered 16 years ago.

You can't just see a domain you like, go register a trademark for it and demand they give it to you. Atleast not for .com.

<comment><USER30> That is actually how trademark already works, if you have enough money. E.g. well funded brands like Coke, Google, Facebook, can easily use trademark to retroactively remove rights to a name from anyone who wasn't actively using it for some non-squatting purpose - within certain trademark and legal scopes.

Doesn't matter if someone simply owned property with that name prior to the trademark. The test is more complex than that.

<comment><USER31> I am not sure if UK or US law will apply but in Commonwealth countries there is a clause in trademark law called Prior Use.

Basically if you are using an unregistered-trademark which is then later registered you are not considered to be infriging if you have been using this trademark before the trademark was registered.

Cyber squatting laws specifically call out that you need to have obtained the name with ill intent (i.e with intent to ransom it to an already registed trademark holder).

So no, that is not how trademark works, atleast in the codes of law I am familiar with.

<comment><USER30> Really helpful. Best comment of the year.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> My company has 41 telecommuting employees out of NYC. I've sent the article to everyone in management, and I'll make sure we never use their services. If you disagree with the tactics of this company, tell everyone not to use their service. Email the company.

</comment><comment><USER33> Oddly, I can't determine what location this is for. The workbetter.us domain redirects to a Squarespace landing page that has no real info (who, where, etc.). It seems they are mostly doing business as OfficeLinks (NYC and Chicago) and own the .com for that domain outright, so why do they have to go after this guy?

</comment><comment><USER34> I doubt Kneen will lose, my old startup PAID for a domain that was the legal name of another company held by a reseller, we didn't even file a counterclaim and they lost the dispute resolution process essentially because they were the low bidder.

(We both had trademarks in respective countries)

</comment><comment><USER35> Why go to court? Why not use the fees you'd pay for a trial to either put in a much higher offer for the domain, or to pay a marketing company to rebrand your company as something where the domain name is available?

Regardless of the outcome, the only winner will be the lawyers.

</comment><comment><USER36> Looks EXACTLY like cybersquatting to me. You have to learn to read behind the lines here. I've had to deal with these people before, they are infuriating. Heres the facts that suck

\- Has the domain for 16 years, doing nothing with it. \- Strings a long a deal for purchase because it doesn't meet his demands. \- Continues to fight extremely hard to do nothing with said domain.

I find it convenient the author never mention why the guy backed out of the deal, probably because his demand was $50k+ and completely unreasonable.

<comment><USER13> I haven't checked to see if there's an MX (or other) RRs for that zone, but just because there isn't a web page (or something more than a "parking" page) doesn't mean he's "doing nothing with it".

</comment></comment><comment><USER37> Purchasing domain names is the most frustrating experience. Why there is no transparent market is beyond me. Mehta's tactics are clearly abusive, but if someone was holding onto a domain name for 16 years and not doing anything with it is more infuriating to me. There really needs to be a use it or lose it policy.

<comment><USER38> What other property rights should be under your "use it or lose it proposal"? Land? Housing?

<comment><USER39> We indeed do that with land and housing, aka real estate: [https://en.wikipedia.org/wiki/Adverse_possession](https://en.wikipedia.org/wiki/Adverse_possession)

But the Internet landscape is very different and less finite in nature.

<comment><USER40> (Keeping in mind that laws vary in different nations/states...) Adverse possession laws usually only apply if a squatter takes possession of a property without official title and uses that property for a length of time without being challenged. The principle of adverse possession might apply if Mehta had somehow hijacked the domain records and used the domain for a number of years without Kneen noticing and acting to retake control. Even then, adverse possession does not apply if the squatter used illegal means to obtain or keep control of the property (i.e., a domain hijacking).

But adverse possession does not simply allow one entity to come in, declare the owning entity to not be using a property, and assume legal control. As a land-owning entity, I am not required to "use" my land, and as long as I kick squatters out in a reasonable amount of time, adverse possession does not affect me.

</comment></comment></comment></comment><comment><USER30> Forcing squatters to have to file a trademark to retain their squatted domains would improve the squatting situation 10000x.

Clearly the current Workbetter.com owner is squatting the name.

<comment><USER41> It's only squatting if someone already owned the trademark. That clearly was't the case 16 years ago.

A startup tried to buy a domain and failed. So instead of moving on, they decided to sue. Sounds like a winning plan to me.

<comment><USER30> It's squatting because:

Workbetter.com

Try going to the domain.

</comment></comment></comment><comment><USER16> The article sets a slight bias in favour of Kneen already. So, many people might sympathise with him more. But who knows what negotiation talks actually happened?! The tone, the mood..

The coming generations should have a better chance at finding domain names I feel. So I personally would side with the one trying to acquire the domain name for his/her registered company.

<comment><USER42> Uh, no, it doesn't.

Just because you happen to wish the world and the law worked differently doesn't make the article biased.

<comment><USER16> I'm not wishing that the law works differently. I'm presenting an opinion. The court will decide based on the law. May the right one win.

<comment><USER43> Just read the latest news on domainnamewire.com that the workbetter.com lawsuit has been dismissed.</comment></comment></comment></comment>


Inside insides (MRI of various foods) - <AUTHOR> http://insideinsides.blogspot.com/ <comment><USER2> MRI is very useful to look inside things you _can't_ cut open, like, say, the head of a living human being. If you think this is spectacular, you should try spending more time in the kitchen. You'll see color too!

<comment><USER3> My thoughts too: they're not showing me much I don't already know from having cut up the various fruits in question. I'd rather see stuff I can't open up easily.

</comment></comment><comment><USER4> This could greatly benefit the TWINKIE project.

<http://www.twinkiesproject.com>

</comment><comment><USER5> The watermelon reminds my of a julia fractal.

</comment><comment><USER6> Interesting. I'd like to see more of the 3D composites, they're kinda cool.

Someone should do marshmallow peeps to go with peep research: <http://www.peepresearch.org/>

</comment><comment><USER7> It's interesting of course and looks cute, but why would anyone do this?

<comment><USER8> If I worked within fifty feet of an NMR machine I would do nothing but this, right up until they fired me.

<comment><USER9> Why should getting fired stop you?

</comment></comment></comment><comment><USER10> No pomegranate? Artichoke is awesome though.</comment>


SOLID Is OOP for Dummies - <AUTHOR> http://www.yegor256.com/2017/03/28/solid.html <comment><USER2> What a condescending, shallow view.

> The point being these principles are nothing but an explanation of "cohesion > and coupling" for dummies in a very primitive, ambiguous, and marketable > way. Dummies will buy books, seminars, and trainings, but won't really be > able to understand the logic behind them

And then he goes and does the same thing:

[http://www.yegor256.com/about-me.html](http://www.yegor256.com/about-me.html)

<comment><AUTHOR> The testimonials are the best:

[http://www.yegor256.com/testimonials.html](http://www.yegor256.com/testimonials.html)</comment></comment>


Facebook test adds Wikipedia information to search results - <AUTHOR> https://www.engadget.com/facebook-test-adds-wikipedia-search-results-010434896.html <comment><AUTHOR> This could be a good way for FB to back into the search engine market.</comment>


Lack of Oxford Comma Could Cost Maine Company Millions in Overtime Dispute - <AUTHOR> https://www.nytimes.com/2017/03/16/us/oxford-comma-lawsuit.html <comment><USER2> The title of this HN post, like nearly every headline I've seen for this lawsuit, is misleading. The headlines makes it seem as if the company forgot an Oxford comma and is now losing millions as a result of having made a typographical error.

This is not the case. There is a statute that does not have a comma where one might be, and the litigants fought over whether the lack of a comma toward the end of a list ought to be read in light of the Oxford comma convention or not.

And it's actually more complicated, as the last item in the list is (potentially) compound, which makes it difficult to tell whether the "and" is to be attached to the final element alone, or to be a binding of the final element and previous elements.

Not that this its uncommon for articles to have misleading headlines, but I've been surprised at the extent to which nearly every article (save this one [1], by the ever-precise law professors at the Volokh Conspiracy) have misrepresented the case (or misunderstood it?) to make it seem like a company's typo led to a million dollar loss.

1: [https://www.washingtonpost.com/news/volokh- conspiracy/wp/201...](https://www.washingtonpost.com/news/volokh- conspiracy/wp/2017/03/15/a-b-or-c-vs-a-b-or-c-the-serial-comma-and-the-law/)

<comment><USER3> Why on earth not to use programming language like constructs to write legal documents.

No compiler or anyone who can read code ever had any ambiguity reading simple code.

let overtime_allowed = true unless (action in [canning, processing, preserving, freezing, drying, marketing, storing, packing_for (shipment or distribution)] of [Agricultural produce, Meat and fish products, Perishable foods])

<comment><USER4> There's an argument to be made that it already is. It's called lawyerese (or just L), its programmers are highly regulated and highly paid.

What happened here is what happens when someone with insufficient skill tries to write an L program. The language has no such thing as linting or syntax checking, so while a faulty program will always run, it will return with unexpected or absurd results. L failures tend to make C's nasal demons look positively friendly by comparison.

There's no formal spec, it's literally centuries of ad-hoc patches and fixes and revisions piled onto one another.

<comment><USER5> > What happened here is what happens when someone with insufficient skill > tries to write an L program. The language has no such thing as linting or > syntax checking, so while a faulty program will always run, it will return > with unexpected or absurd results. L failures tend to make C's nasal demons > look positively friendly by comparison.

Worse than that, legal "code" has thousands of frequently used implementations (judges) and millions of one-time-use implementations (jurors), all of which may interpret it differently, both from each other and even from their own past versions. So if you thought writing JavaScript was bad because you have to deal with a half-dozen browser implementations and quirks...

<comment><USER6> Jurors don't interpret law and judges have a well-organised system for exception handling.

The legal system is massively reliable. By the time something reaches an appeal court, you're already into 5th 9 territory. You can live an entire life under it, moving through it, completely surrounded by it, and never have to see it or think about it.

<comment><USER5> > Jurors don't interpret law

They can and do. Quoting the Oregon constitution:

"In all criminal cases whatever, the jury shall have the right to determine the law, and the facts under the direction of the Court as to the law, and the right of new trial, as in civil cases."

Similar measures exist in other legal jurisdictions, though it isn't universal.

> judges have a well-organised system for exception handling

I didn't suggest they don't; I suggested that two different judges can interpret the law differently.

<comment><USER6> > _under the direction of the Court as to the law_

The point here is that jurors decide on facts _according to law_ , as instructed by a judge[0]. The judge is also asked during trial to consider legal questions -- not the jurors.

> _I suggested that two different judges can interpret the law differently._

I suggested that is why there is a hierarchy of courts, with the hardest and most important ones being delegated upwards via the process of appeal.

I am, of course, not a lawyer and this isn't legal advice. I did enjoy my time in law school though. The main thing I learned is that the law is a language that resembles but is not common English. Phrases like the one you quoted have to be read in the larger context of case law and statute law.

[0] [http://www.americanbar.org/groups/public_education/resources...](http://www.americanbar.org/groups/public_education/resources/law_related_education_network/how_courts_work/juryinstruct.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Alternate headline: workers to receive appropriate compensation following accurate interpretation of state law.

<comment><USER8> I have never fully understood the insistence that employers should be allowed to demand unpaid work from their employees.

Surely if your business is only viable with coerced labour then it isn't a viable business?

Or maybe if you need employees help to run it without pay them then they can be given a share of the business so they can benefit from the future returns that their efforts provide?

<comment><USER9> No one is demanding unpaid work. The question is whether they are owed 1.5x their salary or just their salary.

Overtime rules say that if you work overtime (and the definition of overtime varies by state), they have to pay you 1.5x your salary. In this case, they were only paying their regular salary.

No one was working for free.

<comment><USER8> Ah, gotcha. For some reason I always associated overtime with "unpaid". Probably because when I was a kid and had crappy jobs there would always be stuff that would need to be done at the start and end of every shift that outside my regular hours and therefore unpaid. I wasn't savvy enough to ask for pay, or to tell them where to stick it.

 _edit_ concrete example: Blockbuster Video. Shop closed at 11, the time I stopped getting paid. At that point I had to lock up and do accounts stuff, clean, and general admin (plugging the CC machine into the phone line so it could phone home and get lists of updated cards to watch for) etc. Would usually take about half an hour ISTR.

<comment><USER10> GameStop is a company that had similar tactics. Had to close the registers, process and late trade-ins, and close/clean the store. Then they trusted me to take thousands of dollars to the bank and drop it in the slot. But all of it was unpaid.

<comment><USER11> Was it GameStop, or the store manager? I'd bet money the GameStop corporate HR people would have fired the guy on the spot if they heard about something like that. My own retail experience (big box office supply store) was so metrics driven I can absolutely imagine a scenario where the store manager tries to illegally cut work hours to make his store's numbers look better.

</comment></comment></comment></comment></comment></comment><comment><USER12> I don't think I've ever heard an impassioned argument against the Oxford Comma. I mean, I have no problem with it, but there seems to be a belief that this is a less filling/tastes great holy war, but really, omitting the serial comma is fairly archaic at this point. At least in my experience. Sometimes lists need one, sometimes they don't. At this point in the evolution of our written language that should be a fairly unambiguous proposition.

<comment><USER13> "omitting the serial comma is fairly archaic at this point"

Wish that were true! But many news organization style guides condemn the Oxford comma, with sometimes disastrous results:

[http://www.chronicle.com/blogs/linguafranca/2016/12/06/for-w...](http://www.chronicle.com/blogs/linguafranca/2016/12/06/for- want-of-an-oxford-comma/)

<comment><USER14> Is there _any_ good argument for eschewing the extra comma when it clearly disambiguates the meaning of the sentence?

I can't think of one, but I also find it (slightly) difficult to believe that anyone smart enough to write an article would insist on ambiguity for no good reason...

EDIT: to disambiguate my own comment: with 'when' I meant 'in cases where leaving out the comma causes ambiguity'. Personally I try to prioritize clarity so sometimes I will use an extra comma, and sometimes I won't.

<comment><USER15> It can create ambiguity as well as remove it, depending on which terms can be appositives to other terms. Classic example:

"To my parents, Ayn Rand and God." (ambiguous without the comma)

"To my mother, Ayn Rand, and God." (ambiguous with the comma)

<comment><USER16> Not a native speaker, but if Ayn Rand is your mother I'd blame the first comma for the ambiguity.

"To my mother Ayn Rand, and God."

<comment><USER17> But that's just grammatically wrong, in English.

Appositive clauses require a comma. Forgetting God, you can just look at the sentence "To my mother, Ayn Rand." We put a comma there because the object of the sentence is "mother," and then we're clarifying who "mother" is. We'd only omit the comma if "Mother Ayn Rand" were a noun phrase all by itself, like "Father John."

Similarly: "This is to my arch-nemesis, Ayn Rand, who always doubted me." The commas are necessary there for the same reason.

(How did Ayn Rand enter this discussion..?)

</comment></comment></comment></comment></comment></comment><comment><USER18> The law in question excluded "canning, processing, preserving, freezing, drying, marketing, storing, packing for shipment or distribution of" agricultural products from the requirement for 1.5x overtime pay.

In a sane world where everyone used the Oxford comma, that sentence would be clear and the last item in the sequence would be "packing (for shipment or distribution)" and the drivers would be entitled to their overtime pay. But the Maine Legislature's drafting manual recommends omitting the Oxford comma so the above sentence is ambiguous. And it's really ambiguous because either meaning could really be what the Legislature intended.

<comment><USER19> The way I read it, the intended meaning is as if the comma was right after shipment. A list like that requires a conjunction before the last element. "Or" serves that function. If "or" was merely internal to the final item, it would be grammatically incorrect.

Here is the full context, with the only grammatically correct place to put the comma:

 _The canning, processing, preserving, freezing, drying, marketing, storing, packing for shipment[,] or distribution of:_

 _(1) Agricultural produce;_

 _(2) Meat and fish products; and_

 _(3) Perishable foods._

edit: fixed formatting

<comment><USER20> I also read it the way you do. But interestingly, there is what appears to be an Oxford _semicolon_ between items (2) and (3). The inclusion of an Oxford delimiter in one list and its exclusion in another list would seem inconsistent. If anything, the second list is the one that does not need the extra punctuation because the items of that second list are also delimited by newlines and the enumeration. Very weird indeed.

</comment></comment></comment><comment><USER21> My question is, what makes the canning industry so unique and special that it's deserving of exemptions from fair pay?

<comment><USER22> Not even that -- the fact that legislators actually wrote this as a law is interesting. There is likely a historical reason or something unique about that industry that prompted this.

<comment><USER23> Probable historical reason: the industry had money and therefore political power, and its workers were poor immigrants therefore without political power.

</comment></comment></comment><comment><USER24> It is perfectly clear here that "distribution" is a separate list element, set off by the final disjunction "or":

 _The canning, processing, preserving, freezing, drying, marketing, storing, packing for shipment or distribution of:_

The pattern being: _A, B, C, D or E_.

This does not change even if we add a spurious comma after D:

 _A, B, C, D, or E_.

D and E are still separately listed items.

Quite simply, _D or E_ cannot be a single list item without being preceded by some conjunction.

If the intended meaning were "packing (for shipment or distribution)" to the exclusion of "distribution", then the conjunction "and" or "or" would be required before that entire phrase:

 _A, B, C, D or E for X or Y._

Here the entire phrase _E for X or Y_ (such as _packing for shipment or distribution_ ) is now the last list item (and, again, that is clear whether or not we add a spurious comma after D).

The "or" in (for shipment or distribution) belongs to this inner phrase and therefore cannot serve as the delimiting conjunction of the last list item; another delimiter is required.

Thus, the insertion of the comma makes no difference. The alternative interpretation is hard to justify, because it is based on the claim that a meaning-altering conjunction is missing, even though the existing text happens to be grammatical.

</comment><comment><USER25> In almost every case I see people arguing for an Oxford comma I see a sentence that should be broken up or restructured to make it less ambiguous. A sentence where not noticing a comma can drastically alter it's meaning (especially when it's a losing battle to make everyone understand the Oxford comma) is not a good sentence.

<comment><USER26> Give an example that doesn't use parentheses or a bulleted list.

It seems clear to me that if you are listing multiple items in a sentence, a comma should separate every item in the list.

Alternatively, we could use the semi-colon for lists. This is what I do sometimes at work, especially when the items in the list may contain commas.

<comment><USER27> >Give an example that doesn't use parentheses or a bulleted list.

Why the arbitrary restriction on bulleted lists? Situations like this seem ideally suited for a simple list.

<comment><USER26> Because prose doesn't use bulleted lists.

<comment><USER27> The law in question has a numbered list.

</comment></comment></comment></comment></comment><comment><USER28> Avoiding the Oxford comma is the JavaScript automatic semicolon insertion of English grammar.

Each has odd exceptions that have to be thought about, and each is polarizing.

In both cases I really wonder: why the insistence on adding to cognitive load?

</comment><comment><USER29> "I'd like to thank my parents, Ayn Rand and God."

<comment><USER30> Now, if you make it singular, it's the _presence_ of an Oxford comma that makes it ambiguous:

"I'd like to thank my mother, Ayn Rand, and God"

Whereas

"I'd like to thank my mother, Ayn Rand and God"

As long as English uses commas for both apposition and list separation, there will always be ambiguity no matter which comma convention is used.

<comment><USER31> Why do you have that first comma.

"I'd like to thank my mother Ayn Rand, and God" is clearer.

<comment><USER32> Yes, but how do you handle the case where your mother is not Ayn Rand and you want to thank three individuals?

<comment><USER33> "I'd like to thank my mother, to thank Ayn Rand, and to thank God."

<comment><USER34> Following the conventions of programming languages with mandatory bounds checking (and thus have to keep track of the array size at all times):

"I'd like to thank three people: my mother, Ayn Rand, and God."

</comment></comment></comment></comment></comment></comment><comment><USER35> There should be an "or" before the word "packing" if "packing for shipment or distribution" is a single phrase (rather than two alternatives). The Oxford Comma debate is a sideshow. It's all about where you find the "or", which indicates the last choice.

</comment><comment><USER36> Original Source: [https://www.nytimes.com/2017/03/16/us/oxford-comma- lawsuit.h...](https://www.nytimes.com/2017/03/16/us/oxford-comma- lawsuit.html?_r=0)

</comment><comment><USER37> The canning, processing, preserving, freezing, drying, marketing, storing, packing for shipment or distribution of...

More telling is the difference between the verbs ending in "ing" and those not.

canning, processing, preserving, freezing, drying, marketing, storing, and packing are the actions.

shipment and distribution relate to packing.

If distribution was supposed to be a separate activity, they would have used "distributing of" instead of "distribution of".

</comment><comment><USER38> It's kind of amazing that we even write laws this way anymore. There isn't much to gain from freely allowing legislators to use the English language to dictate our system of rules. I'm sure there are much clearer templates that everyone should follow.

<comment><USER39> Yes, law should be written like code. A "tree of nested assertions" or whatever you call it.

Law is code. The hardware is masses of people.

</comment></comment><comment><USER40> Couldn't they just have looked up the intended meaning of the law? I mean laws or not made by just writing down the law in its final form, there are designs, discussions, and drafts. Wouldn't it be likely that there are documents showing the intended meaning more clearly, for example by listing the exceptions as bullet points? In my opinion that would provide a way better argument to settle the issue one way or another than appealing to grammar rules and style guides.

</comment><comment><USER41> Ignoring the comma issue, it still seems poorly worded.

"The canning, processing, preserving, freezing, drying, marketing, storing, packing for shipment or distribution of:"

Lets group related activities based on what workers might be doing/where they might be doing it.

If the law intended to exclude truck drivers from overtime, our groups could be:

\- Canning, Processing, Preserving, Freezing, Drying (processing facility?)

\- Marketing (?)

\- Storing, Packing for Shipment (Warehouse)

\- Distribution (On the road)

Why is one sentence trying to define rules for all those groups?

<comment><USER42> I think there is a legal principle that takes all enumerations as closed sets.

You may enumerate a set as an example of a class. You might say, "animals, such as lions, tigers and bears." If you wrote that as legalese, only lions, tigers, and bears would be considered "animals" for the purpose of the chapter.

Legalese has to be really specific with respect to lists, otherwise clever lawyers can argue their way around the holes in whatever manner best benefits their client. If you're going to specify _any_ sub-activity of the industry in question, you have to specify _all_ of them that you with to include for the purposes of the law.

I would say that distribution includes shipment, so "packing for shipment or distribution" is unnecessarily redundant. As such, I would prefer the interpretation of "packing for shipment, or distribution". Just as you wouldn't say "lions, tigers, tigers, and bears" you would never say "shipment or distribution" as its own clause. Distribution is shipment.

So to make it unambiguous, you could use stricter redundancy aversion: "packing for shipment or shipment".

</comment></comment><comment><USER30> The case was decided on equity, not grammar. What the comma style did was give the company a specious argument to make.

<comment><USER23> IANAL, but if this verdict were based on equity it would have helped out everybody on cannery row, not just the drivers.

<comment><USER30> Well, "equity"

</comment></comment></comment><comment><USER43> Perhaps they should adopt programming language like syntax for laws. eg You will be jailed for [kill, hurt, steal].

<comment><USER44> Define 'kill'. What about self-defense, soldier in time of war, accidental, negligence? You're going to need an overly large switch statement to decide, and that's just one crime.

<comment><USER45> If laws were codified in a machine-friendly format, automatic code analysis could alert lawmakers and the public to ambiguity, conflicts, redundancy, unused code, opportunities for optimization and verbosity.

</comment></comment></comment><comment><USER46> JFK and Stalin are still the best proponents for using the Oxford comma: [http://www.verbicidemagazine.com/wp- content/uploads/2011/09/...](http://www.verbicidemagazine.com/wp- content/uploads/2011/09/Oxford-Comma.jpg)

</comment><comment><USER47> There are two types of people this world: those who use oxford commas, those who don't and those who should.

</comment><comment><USER48> This should totally be a case study in grammar lessons. This comma could cost you millions kids, pay attention!

<comment><USER49> This comma could cost you millions kids. Pay attention! FTFY

<comment><USER50> Well if we're gonna be pedantic let's not forget the vocative comma:

"This comma could cost you millions, kids." :-)

<comment><USER49> I stand corrected.

</comment></comment></comment></comment><comment><USER51> [https://www.firstthings.com/blogs/firstthoughts/2011/11/roge...](https://www.firstthings.com/blogs/firstthoughts/2011/11/roger- casement-the-gay-irish-humanitarian-who-was-hanged-on-a-comma)

</comment><comment><USER52> Instead of discussing a grammar issue, why not go back to the intent of the law and apply it as... intended? What were the lawmakers thinking when they wrote that law? Are they still around? Are there any notes or recorded sessions discussing this?

<comment><USER53> Do we expect the truckers to do said research in order to know how to interpret the law? Of course not. The whole point is that the law should be explicit and unambiguous as written.

<comment><USER40> It would be sufficient if the court does it.

</comment></comment></comment><comment><USER54> I wonder how Maine is able to exempt works from overtime, wouldn't that contradict federal overtime laws?

[https://www.dol.gov/whd/overtime_pay.htm](https://www.dol.gov/whd/overtime_pay.htm)

<comment><USER55> The federal law has lots of exemptions that apply to various hourly workers.

<comment><USER54> Oh, I thought the only exemption was for the usual adminstrative/white collar type work:

[https://www.dol.gov/whd/overtime/final2016/SmallBusinessGuid...](https://www.dol.gov/whd/overtime/final2016/SmallBusinessGuide.pdf)

</comment></comment></comment><comment><USER56> The article asks:

> Does the law intend to exempt the distribution of the three categories that > follow, or does it mean to exempt packing for the shipping or distribution > of them?

I'd say it does both. It exempts workers who package for shipment AND workers who distribute.

Discuss... :-)

<comment><USER22> Are shipment and distribution fundamentally different? Seem like synonyms to me and thus the lack of comma ought not matter because: "package for shipment -- or distribution." I guess my question is how packing would be materially different for shipment or distribution.

Since it seems analogous, a reasonably intelligent person could assume that the sentence could read, "packing for shipment or shipment" that implies that shipment is a separate activity while packing for shipment is another activity. -- since shipping is really a subset of distribution actions.

My question is why they sued -- clarity should have been sought before engaging in the work. It wasn't like these guys were unaware of the law. They chose to read it in the most advantageous way rather than obtaining clarity before working.

<comment><USER44> What person goes and reads all applicable laws before taking a job? You've got federal/state/local laws to sift through.

And who's to say that a company can't hire lawyers to comb through old laws looking for loopholes to screw over workers?

</comment></comment></comment><comment><USER57> As a freelance writer, this is sort of cool to me.

"The pen is mightier than the sword" and all that. A little comma -- or lack thereof -- moves millions of dollars in one direction or the other.

Food for thought.

</comment><comment><USER58> They could have done so much more with that first sentence. Example: "An appeals court ruling on Monday was a victory for truck drivers, punctuation pedants and nazis"

</comment><comment><USER59> Of possible relevance: _The New York Times_ , per its internal style guide, eschews the Oxford Comma.

I smell a possible revolt on the part of Mr. Victor.

</comment><comment><USER60> Meanwhile a complete jerk move did cost Maine university employees thousands of dollars in unpaid wages over the course of a decade.

</comment><comment><USER61> Why is everyone discussing the grammar and no one questioning why laws have such silly exceptions? Why should there be an exception for the packaging of perishable goods? It is not like the goods cannot be packaged if the workers are paid extra for working over-time. And it is not like a well planned logistics chain should necessarilly be forced to have workers working overtime. So really, this exception is just a gift to a specific industry.

</comment><comment><USER62> The longstanding question posed by Vampire Weekend has finally been answered: Oakhurst Dairy cares.

</comment><comment> d--b Or: why AI is a long way to understand natural languages.

</comment><comment><USER63> The sheer amount of misused punctuation in this comments section seems to indicate a systematic problem.

<comment><USER64> I believe you mean systemic.

<comment><USER65> Muphry's Law.

</comment></comment></comment><comment><USER66> Also posted to HN as: [https://news.ycombinator.com/item?id=13886467](https://news.ycombinator.com/item?id=13886467) [https://news.ycombinator.com/item?id=13879156](https://news.ycombinator.com/item?id=13879156)

For me the lesson here is "use unambigious language" rather than "{always|never} use an Oxford comma".

The 29-page decision shows that the "Oxford comma" is only part of the court's interpretation of the law, and shows that the court examined several paths to reach an interpretation.

[http://cases.justia.com/federal/appellate- courts/ca1/16-1901...](http://cases.justia.com/federal/appellate- courts/ca1/16-1901/16-1901-2017-03-13.pdf?ts=1489437006)</comment>


Facebook reportedly suspends share trading ahead of IPO - <AUTHOR> http://latimesblogs.latimes.com/technology/2012/01/facebook-reportedly-freezes-share-selling-ahead-of-ipo.html <comment><USER2> If FB has 500 million users and is "valued at" $100 billion, they're planning to get $200 out of you. I feel like they're leaving money on the table. Surely my privacy, conversations, connections etc. are worth more than that over the years I will use the service? Why don't they give the option of being the customer? They'd give me all the stats and data that they would give to advertisers. Even if they only charge $2/month to work for me instead of working for advertisers, it would take 8.5 years to make more than $200 from me.

(Well, if they plan to expand their userbase to say 1 billion, then you're only worth $100. But still.)</comment>


SF financier developing new business model for journalism - <AUTHOR> http://www.trulytimes.com/business-news/warren-hellman-to-unveil-new-journalism-model/36353/

<comment><AUTHOR> I really should have left link to original bizjournals article. Sorry, here it is:

[http://www.bizjournals.com/sanfrancisco/stories/2009/05/04/d...](http://www.bizjournals.com/sanfrancisco/stories/2009/05/04/daily93.html?t=printable)

I suppose that's the place to monitor to see if/when he releases some specifics. Of course if he really plans to invest/transform the SF Chronicle on- and/or off-line he'll probably keeps his cards as close to his chest as a new Apple product until he's secured a deal.

</comment><comment><USER2> They are trying to figure out how to save the San Francisco Chronicle. If they succeed, maybe that'sthe new business model. Short on specifics.</comment>


Pike Programming Language (2014) - <AUTHOR> http://www.drdobbs.com/open-source/pike-programming-language/240168647

<comment><USER2> Pike is one of my favorite languages, but I've hardly used it. It's dear to me to me for purely sentimental reasons. As the article briefly mentions, Pike is the spiritual successor to LPC, a pretty unique language from the late 80s/early 90s used to extend LPMUDs and write areas, items, mobs, etc. I'd dabbled in programming before, but LPC was the first language I used to write real code shipped to production on a MUD called Aldebaran [1], with a user base in the hundreds (felt huge at the time :-)), circa 2001.

I remember very quickly losing interest in playing Aldebaran when I saw how the so-called "wizards" (programmers) could manipulate the world around them with code [2]. I decided almost right away that I would play exactly enough to fulfill the bare minimum requirements to apply to become a wizard and harass the administrators until they let me have a trial run. A few weeks later, the admins relented, and I haven't stopped coding since.

[1]: [http://aldebaran.mud.de/](http://aldebaran.mud.de/)

[2]: Looking back, Aldebaran to the wizard was an almost Emacs-like interactive environment. You could create and manipulate items on the fly by cloning a blueprint and, using a special wizard's staff, evaluate code directly on that item without changing any files. And like Emacs, the text editor it came with (an ed clone) was terrible :-)

<comment><USER3> > used to extend LPMUDs

It would be probably better to say it was used to implement LPMUDs (still is, BTW). Driver without a mudlib - written in LPC - was not very useful at all.

> special wizard's staff

A driver of the MUD I worked on had a special set of objects used for introspection/reflection: you could inspect object state, set it's attributes and evaluate arbitrary code "inside the object". These were invoked as normal global commands IIRC. Now I wish we had it coded as a wizard's staff, too :)

> almost Emacs-like interactive environment

Also similar to image-based Smalltalk or Lisp. It's a pity that it wasn't used to build a Smalltalk-like graphic environment, but in its text form this environment was awesome, too.

> the text editor it came with (an ed clone) was terrible

OMG, please don't remind me of this. I had to learn ed, because on our MUD we had no FTP access for some time and it was a tragic experience. I was only able to live with it thanks to MUSHClient, which did a great job at handling large amount of text and I mostly just copied the code to notepad and then pasted it back after modification. But, on the flip side, I could never understand why people don't like Vi - it's so much better than ed! ;)

</comment></comment><comment><USER4> For a very short while it looked like Pike could take a seat among the othe "P" languages (Perl, Python, PHP), but that was _quite_ a while ago. And mostly because it was bundled with the Roxen web server. IIRC its claim to fame was easy headline font->image rendering…

fugaces labuntur anni, indeed.

</comment><comment><USER5> Oh gosh, I remember checking out Pike a longgg time a go! Totally forgot about it since them.

Checking it again today makes me realize how neat it is, the union types (now in typescript as well) are awesome.

</comment><comment><USER6> Reminds me of Javascript, but with better performance and without some of the Javascript oddities.

<comment><USER3> > Reminds me of Javascript

How exactly? Pike is no closer to JavaScript than to Python for example. Out of languages I know I think only Boo looks a bit similar - Pike is it's own thing, it's design is based on earlier LPC language, which IIRC existed years before JavaScript, Python, Ruby and PHP.

BTW, LPC was fun to work with, too: prototype-based OO, mix of static and dynamic typing similar to that of Dylan, shadowing (a bit like mixins, but not quite) and inherent _liveness_ of the system (as proposed by Self and Smalltalk, just using text UI instead of GUI) made it very exciting language for the me back then: a fledgeling C++ programmer. IIRC it was byte-compiled, too. LPC suffered because it was too closely tied to the idea of a MUD (there were other commercial applications of it, though) and I think Pike tried to fix this. But in the process Pike made the MUD-creators community less interested in it, which drastically reduced its initial user base.</comment></comment>


Software That Fixes Itself - <AUTHOR> http://www.technologyreview.com/computing/23821/page1/

<comment><USER2> It makes me wonder if the software can generally "understand" something is wrong, or if it just has a bunch of modules that look for various exploits (say a buffer overflow attack, a XSS attack).

If it's the latter, it just seems like a version of lint that runs on the binary and produces patches on the fly. Granted, that's still a big achievement, but it still relies on people for "unknown" attacks.

</comment><comment><USER3> Just don't make it _too_ smart, or it'll eventually learn that it doesn't need to listen to its imperfect human masters...</comment>


Goggle, Facebook, Microsoft Recuited the First anti-NSA lobbyist  - <AUTHOR> http://www.cybernewsalerts.com/2014/02/goggle-facebook-microsoft-recuited.html

<comment><USER2> Probably should be Google in the title?</comment>


The iPad Mini Will Mean The Death of eInk - <AUTHOR> http://mikecanex.wordpress.com/2012/05/26/the-ipad-mini-will-mean-the-death-of-eink/

<comment><USER3> Mike, you are wrong because your argument includes a false implied premise. Let's agree that you are not a high volume reader and that most people are not high volume readers.

But lets debate whether the smaller number of high volume readers will abandon the Kindle eInk tablet for a back-lit multi-use tablet.

My household has a Kindle, and also has the Kindle application installed on a laptop, desktop, iPhone and Android phone. I am a high volume reader and prefer the 6-inch Kindle eInk model over any of these alternative platforms because of the physical comfort of holding the device, and ease of reading eInk. The device is lighter because the eInk uses much less power than an LCD or other backlit display. The Kindle is purpose built for reading having convenient click buttons for page turning that are part of the frame - <USER2> than tapping. The iPad mini will not be a purpose built ebook reader and will be inferior to the Kindle eInk tablet for the purpose of reading books. High volume readers, who know the important features, will choose the Kindle or similar eInk reader.

Amazon gives its readers a choice now with the Kindle Fire, which is not eInk, and the eInk Kindle models. The latter continue to sell well.</comment>


Show HN: My new online course walks you through creating an entire Laravel app - <AUTHOR> https://app.yourfirst.io/courses/your-first-web-app

<comment><USER2> This is actually pretty amazing, you deserve more upvotes, but that's none of my business :)</comment>


Apple's store comes back online with a dizzying array of nothing new…yet - <AUTHOR> http://venturebeat.com/2008/07/08/apples-store-comes-back-online-with-a-dizzying-array-of-nothing-newyet/ <comment><USER2> I am waiting for a new Mac Book.</comment>


Seaside – Developing Sophisticated Web Applications in Smalltalk - <AUTHOR> http://seaside.st/ <comment><USER2> Ooh, this brings back memories. Continuation-based web frameworks were my original gateway drug to "exotic" programming techniques. Dabble DB was the poster child of Seaside, but didn't get much traction and was acqui-hired by Twitter, whereupon Avi Bryant moved on to other pastures. The other high profile examples of continuation-based web development were Paul Graham's Viaweb (which was acquired by Yahoo and rewritten with more traditional techniques) and Hacker News (which had usability problems due to continuations and mostly phased them out). The verdict of history is clear: continuation- based web development is a sexy but ultimately misguided idea.

<comment><USER3> Great comment, but I don't think I agree with your conclusion. HN still has closure-style handlers [1] all through the code—60 or so as of the latest commit. We phased out the ones that were being invoked millions of times, but I'd emphasize that our reason for doing this was implementation-driven, i.e. accidental rather than essential. (This, by the way, is true of many alleged "verdicts of history" in programming. Those who care about good ideas should treat such arguments as guilty until proven innocent, lest we all get sucked completely into popular practice.)

Writing the code to phase out those handlers was a deep lesson for me, because the new code came out more verbose and harder to follow. One rarely gets to do an apples-to-apples comparison of programming techniques on a production system, and somewhat to my surprise the experience convinced me (I was agnostic to begin with) that the closure approach is superior.

There are at least four reasons: (1) the closure has immediate access to all the state that existed when the request was previously processed; (2) the closure is nested inside the code that creates it, so everything you need to understand a full request cycle is in one place; (3) much boilerplate is eliminated, making the code easier to read and write—it can be explicitly at the problem level; (4) security is less of a worry when the client only has to pass back a token instead of all the original parameters to the request, the latter being safely packed away in the closure. That last advantage, i.e. reduced attack surface, was particularly surprising.

Learning this the hard way, by dismantling those advantages and replacing them with manual code in selected cases, taught me something else about this design: it's more than just a clever device. It's really a triumph of two of the greatest programming ideas: first-class functions—more specifically, what used to be called upward funargs [2] back when people were arguing about whether they were a good idea—and lexical scoping. The combination of those two abstractions is what allows this model to shuffle off most of the gruntwork instead of making you, in pg's memorable phrase, a human compiler.

The fact that the design eventually hit scalability problems at millions of users is also a vindication of it, in the sense that it enabled pg to write HN more quickly and safely in the first place. We could selectively deal with the scalability problems later, and have done so. That has worked fine as an engineering tradeoff, but IMO a better solution will come from new implementation ideas that allow another couple orders of magnitude of closures to be kept without slowing down the rest of the system. If we get there, I will take pleasure in rolling all that manual code back into the original design.

1\. They're closures, not continuations, which for HN is fine.

2\. Meaning the ability to return a function from a function, and thus keep it around indefinitely, as opposed to passing a function to another function as a parameter (downward funargs).

<comment><USER2> Yeah, all fair points.

Client-side AJAX apps also allow you to keep state from one request to the next, instead of tossing it back and forth over the net. You can use closures on buttons and everything. In some ways it's even more natural than keeping state on the server, because the client knows exactly how long the page stays open. And it doesn't break when you have lots of users, because they keep the state instead of you. I guess that's part of the reason why AJAX got so popular :-)

That said, if I were building a site like HN, I wouldn't use any of that stuff. I'd go with a bog standard request-response model. There's just not that much state to be preserved. Except maybe draft comments, but these should go in browser storage anyway.

<comment><USER3> Re Ajax, yes, but there's plenty of state that you can't send to the client. For HN, an example would be the list of known spam sites.

> _There 's just not that much state to be preserved_

Are you sure? From my perspective there's enough to make the complexity difference in the two models significant.

<comment><USER2> No, I'm not sure. But from a quick look, it seems like most GET handlers on HN take at most two parameters, except for "flag" which takes three. The POST handlers take more, but that's stuff that needs to be sent to the user anyway, because the user is editing it.

Out of the stuff that I did see, the "goto" parameter is the most obvious candidate for the closure treatment. It's also the most obvious candidate for the AJAX treatment, if you add in-place editing like on Reddit, which would be a better UI in my opinion.

Sorry if that sounds arrogant! Of course there could be a lot of functionality that I've missed.

</comment></comment></comment></comment></comment><comment><USER4> Developing webapps in Seaside is a lot of fun. The ability that Smalltalk gives to you in terms of having a live coding environment, coupled with being able to debug and modify Seaside code in the browser while in development mode, is really powerful. When I first started learning how to program, learning Pharo and Seaside was of tremendous help in understanding how things work. After having used components to build webapps in Seaside, I was simultaneously amused and saddened when I saw it hailed as the next big thing years after Seaside had already done it (disclaimer: I've probably now opened myself up to someone telling me that it was done before Seaside did it!)

The free "Dynamic Web Development with Seaside" book guides you through creating an ajax webapp, but the last time I checked the chapters on persistence were kind of weak. That being said, for toy webapps it's sufficient to just save the state of the Seaside image, with a singleton as your "database".

<comment><USER5> Indeed, the big plus is really that when an error happens, you can save the state and open a debugger right where the problem happened resume execution. This was a big help when I'd get home at night, I would check if there were errors during the day and would fix them right in the debugger.

</comment></comment><comment><USER6> Seems to me that the Nagare framework is the closest match in Python.

<comment><USER7> Yes, it's explicitly said in the docs that it's based/inspired by Seaside[1]. But note that - last time I checked - Nagare requires Stackless Python and not the standard interpreter. That's because Stackless lets you serialize tasklets and stack frames, which is impossible in normal Python without a custom C extension. It also lacked many useful features, like any kind of authentication handling (but, being WSGI compliant, you probably can plug some middleware to handle this).

[1] [http://www.nagare.org/trac/wiki/NagareFeatures](http://www.nagare.org/trac/wiki/NagareFeatures)

</comment></comment><comment><USER8> This approach to webdev (continuations) could be so cool. I just wish there was a framework on the level of django/rails so that I could feel comfortable using it for a large product.

<comment><USER9> The Lift web framework in Scala is somehow similar in that aspect. It has been used on multiple bigger sites like foursquare. I really like the approach compared to MVC.

<comment><USER10> Racket does stateful and stateless servers, and the continuations are either stored on the server or the client per which type you choose to implement [1].

      [1]  https://docs.racket-lang.org/web-server/

</comment></comment></comment><comment><USER11> Can I ask: assuming that Smalltalk and Seaside are the bee's knees, who are your customers? Who do you sell Seaside solutions to?

I'm not a Smalltalk developer; I ask this as someone who finds himself missing Objective-C's dynamism when programming C# or Java, so I'm sympathetic to the advantages of Smalltalk. But customers know .NET and Java. That's not a hard sell.

<comment><USER5> Personally I still have a seaside application, I sell the service so clients get a user account on the web application that I host myself. I wouldn't attempt selling the application as something a client would continue developing on.

</comment></comment><comment><USER12> I wrote a Monopoly Clone in Seaside for University. The framework was really intuitive, but the documentation could use some work.

</comment><comment><USER13> Not responsive :(

<comment><USER12> Well, it's as responsive as design it to be. The framework only gives you the building blocks(tags), you can still use bootstrap or your own responsive design with it

<comment><USER14> Smalltalk is the most lively environment you can have. Pure OO with direct feedback. Not the usual dead code in files with long cycles as in more mainstream technologies

There is a bootstrap package for Seaside, check out the demo page at: [http://pharo.pharocloud.com](http://pharo.pharocloud.com)

It is true that meanwhile single page applications have hit the client web space - but you can address them easily with the Seaside-REST package (for instance sending JSON to clients side AngularJS). If you need a framework with less footprint check out "Teapot" which you can easily run on Pharo ([http://www.pharo.org](http://www.pharo.org)).

</comment></comment></comment><comment><USER15> Irrelevant funny comment, but everytime I read Smalltalk I imagine this scenario:

Jim: Yo bob!, how's it going man?

Bob: Not so much, what's going on your side?

Jim: Nah, not so much, how's your family?

Bob: They're fine, how's your wife?

Jim: All is good man, all is good...

Bob: ....

Jim:.....

Bob: Hey we should make a webapp together!

Jim: That would be totally rad !..

Jim: .. I've even heard there's a sophisticated webapp framework for people having a smalltalk like us!

Bob: Whoa that's cool !, let's get on it man!

Jim: Smashing!!, But what kind of app should we work on?!

Bob: I don't know let's just download it and make something simple

Jim: Darn, it's only made for sophisticated webapps, says so on their website:(

Bob: Naaah, life sucks man, lets wait till they support simple stuff in the future

Jim: Sure thing, let's take it in our next smalltalk, gotta run now I have a scrum!

Bob: Ok, I'll get my coffee and leave before no one notices I don't even work here!

Jim: K man, cya!</comment>


Ask HN: Best banks for startups/corps, by their web interfaces - <AUTHOR>

Hi folks,
How do my fellow starters feel about various bank web sites/interfaces, for corporate use?  I spend (let's say) 95% of my banking relationship online, and unless I'm missing it, few bank critiques focus on these tools -- and therefore they tend to be anemic.  My principle cares: it should be a) efficient and pleasant to perform routine activity, and b) possible and pleasant to (outside one's accounting system) do forensics and some of level of slice/dicing on activity.
I have some experience with three:
- Citibank (3 of 10) - a thinly veneered mainframe throwback, with a terrible contact system.  Not happy.	 Has taken many	years to expose	basic functions, like wire transfers or eftps payments.
- Chase (6 of 10) - not bad, functional, decent design, still some areas without online hooks.
- Bank of America (8 of 10??) - clean design, good contact system, multi-pay screens are solid with some payment history context for each recipient,
not much experience beyond that.
Areas of interest:
- day-in / day-out check-writing and reconciliation
- federal tax payments
- employee direct deposits
- import/export for data tools / software
- multi-account	management / money sloshing/transfers
- etc <comment><USER2> You guys aren't going to like this, because they are out of reach unless you're Canadian, but both TD Bank and Coast Capital Savings (my credit union) have great web interfaces.

Take a look: <http://www.coastcapitalsavings.com> Demo: [https://www.coastcapitalsavings.com/Online_Banking/Online_Ba...](https://www.coastcapitalsavings.com/Online_Banking/Online_Banking_Help/Online_Banking_Demo/?mdi- campaign=DemoPortlet)

</comment><comment><USER3> Banknorth used to mention on their web site that they were rated the #1 bank web site.</comment>


Ask HN: Information Security document for an enterprise contract - <AUTHOR> We're in the process negotiating a contract with an enterprise client for a SaaS solution they are looking to implement into their existing technology.<p>They asked for a document outlining information security. Is there a specific format for completing one of those? Has anyone done one before? <comment><USER2> See if they have a standard questionnaire. If not, propose the BITS AUP SIG (Google it) or the Vendor Security Alliance questionnaire (again, Google it). — VendorTrust.IO</comment>


Ask HN: Review my mini-app. Easily validate all the (X)HTML pages in a website. - <AUTHOR> http://aarongough.com/easy_web_qa

<comment><USER2> INPUT: <http://google.com/>

Fatal error: Out of memory (allocated 47710208) (tried to allocate 35 bytes) in /home/aarongou/public_html/easy_web_qa/simple_html_dom.php on line 760

SUGGESTION: Sane-itize input.

<comment><USER3> SUGGESTION: Have a limit on how far down (and across) you'll recurse

I got the same error when trying CNN.com

<comment><AUTHOR> There actually is a limit of 100 pages per submission, however it is obviously not storing the data for those 100 pages too well.

Looks like tomorrow is de-bugging day!

I wrote this app over the course of a day a couple of months ago and it's been languishing on my server since then. At the moment it's written in PHP and is not exactly what you'd call 'well tested'.

I'm considering migrating it to Rails (or Camping). Any suggestions for mini- frameworks (like Camping) suitable for a single-page app would be welcomed!

<comment><USER4> Very cool tool. Useful too. =]

Framework isn't the issue in this case, it just looks like you're loading all 100 pages into memory at one time? Or keeping the previous pages in memory as you go "deeper" into the hierarchy.

I recommend you just keep a few pages in memory at any given time, keeping a simple list of the URLs scraped out of that HTML. If you're using PHP remember to unset() the variables storing the HTML and so on.

I haven't used PHP in a long time and of course I'm just speculating based on the error message, so slight disclaimer there.

<comment><AUTHOR> I also meant to say: re: "Framework isn't the issue in this case" I agree. It is possible to turn out nice code in PHP and write fast, reliable apps. That being said Rails has me addicted to the idea of unit tests within easy reach. I'm not exactly a massive fan of any of the unit testing systems that I have seen for PHP and that is my main reason for wanting to switch away in this case...

I use PHP all the time, I am just a little dissatisfied with it in light of the alternatives that are out there.

</comment></comment></comment></comment></comment><comment><AUTHOR> I wrote this app to streamline the process of checking medium/large website for (X)HTML compliance... I basically want to get it out there so that other web designers/developers don't have to go through the pain of checking everything manually!

Let me know if you have any suggestions for improvements or find any bugs.

</comment><comment><USER5> Is it really that different to the results with <http://www.htmlhelp.com/tools/validator/> ? You're dragging in W3C results too it seems.

I find that once I have the site chrome (structural features) valid then I don't really care too much about small errors that don't impact the appearance. When you've got code dragged in, with javascript calls, that doesn't validate anyway (Google, etc.) ...

These things always give millions of entity errors (other people dictate the URLs used) perhaps an intial view that just says which errors are on a page (broad categories) - entity errors, failed to close a tab, incorrect attributes, etc.. with drill down to the error details.

These details in the summary would be good too, as would the number of clean pages.

I don't like the dark theme.

<comment><AUTHOR> The reason that both validators are consulted is because they can pick-up different errors. The WDG validator is _much_ more reliable when it comes to finding unicode issues and that has saved my ass at least once.

Your other thoughts are things I'll keep an eye on when I do the re-write.

-A

</comment></comment><comment><USER6> Useful tool. While waiting for results, a progress bar would definitely be more useful in terms of feedback than the spinning logo.

<comment><AUTHOR> Noted! It may not be feasible for the first stage of the process though as the system does not actually know how many URLs are in the site.

I'll definitely have a look into that though.

<comment><USER2> You might want to look at doing this in several passes:

\- Build a site-map, like parsers build a syntax tree.

\- Follow that to validate one page at a time.

<comment><AUTHOR> That is certainly a valid way of doing it and is the methodology that I have used in several search-engine projects in the past (like this: <http://intrasitesearchsupport.com/>)

However in this case I am offloading the work of building the site-map to the WDG Validation service as I didn't want to have to obtain new servers to provide a free service. This means that I don't get the site-map until the WDG results come back...

</comment></comment></comment></comment><comment><USER7> Curious: Why would people use this instead of the W3 validator?

And for your fix list:

it's entirety -> its entirety.

<comment><AUTHOR> Difficulty with the W3C validator is actually why I designed this. Their validator doesn't allow you to check all of a site in one go. You have to go through page by page. Even on a relatively small site that can take a lot of time!

</comment></comment><comment><USER8> An extremely useful tool. Thank you so much.

<comment><AUTHOR> No, thank-you! I just hope that it saves some developers from unnecessary pain!</comment></comment>