Eliminating Errors with Little Languages - <AUTHOR> http://www.modernperlbooks.com/mt/2010/07/eliminating-errors-with-little-languages.html <comment><USER2> Giving parsers and lexers to the average man, or removing the need for them altogether, will be the thing that pushes the bar forward next. I don't know if Perl 6 is going to be the medium for this change, but it might be.

Arguably, lisp _should_ have given us a world filled with little languages, but it hasn't taken hold. People like syntax, and people like compile time checks.

I have yet to dig into the Perl 6 features that make this possible, but having a low-barrier-to-entry way to create DSLs that are compile-time checked and usable opens the door to something big. Domain experts who are not programmers may finally have a lever in the process stronger than the "spec" and weaker than the code. Give them a DSL, with a good compiler, and let them wreak havoc.

The big question here I still have is: text? Perl 6 gives us little languages, but they are still shackled by ASCII-based notation. Solve that problem, and you've got something big.

<comment><USER3> This is an idea that was pioneered by Smalltalk, where you don't need files to organize your code. But I don't see why it can't be used in other languages, such as Java, using a class-based editor (instead of a file-based one).

<comment><USER4> Fundamentally, the problem comes down to the other 90% of the toolstack. Even if you get people to use your language, are you really going to get them to change their source code control, _every_ person's text editor, build system, scripts that run over the code, the external localization service, the third party code escrow service, automated performance and security assessment tools, etc.? Anything that is more than a toy project has real requirements, often with tools that are outside of the control of any one vendor or even the company -- they are sometimes requirements of the industry.

This code-stored-not-as-text-thing came up so often (it was a recurring Serious Question about once a year while I worked on Visual Studio) that it was simply referred to as the Emacs/grep barrier. Any tool solution that prevents the use of Emacs and grep out of box is just dead unless you have a from-scratch codebase and team.

The old Smalltalk hands (some of whom worked on original Smalltalk systems) also like to relate the biggest single issue they had. At one point, they needed to reconstruct the basis library for a new implementation... but there was no code. How do you do a review of a system where the code was (in this case) completely gone, as it had long since become something interpretable as a jump point in a heap image but not as code? (Punchline: they rewrote most of it from scratch, recreating decades-old bugs)

<comment><USER5> Was this before the concept of "filing out"?

</comment></comment></comment></comment><comment><USER6> Why not take the SQLAlchemy approach with its lower-level expression language? Avoid string parsing, implementing specific dialects of SQL, etc.

I love perl, but why strings? Writing SQL is not that fun. The cognitive leaps one has to make is annoying. Why not write queries in natural perl statements and translate them to SQL?

That being said though, modernperl++ and yay for perl 6. :) </fanboyism>

<comment><USER7> _Why not take the SQLAlchemy approach with its lower-level expression language?_

You can indeed do that. I prefer SQL to ORM; de gustibus non est disputandum.

 _I love perl, but why strings?_

Even structured data, such as a nested data structure serialized to JSON, is a string until you parse it. I don't understand the question.

</comment></comment><comment><USER8> I have a much simpler idea that does not provide so much functionality but it prevents sql injections.

We should have datatype for SQL, and special literal for it. Functions that execute queries should take only parameters of type SQL (never strings). There should be almost no way to construct SQL from string. There should be 'formatting' operator that allows you to put values in SQL and it should do default escaping on them.

As for XSS attack I'd suggest HTML datatype with its own literals. Output functions should only accept HTML (not strings). Similarly there should be almost no way to convert string (or any value) to HTML without escaping it.

<comment><USER7> That's essentially the same idea. See also "working with Unicode strings in different encodings" or "working with values of different (but compatible units)".

</comment></comment><comment><USER9> I can't help but think the specific problem mentioned has a specific solution.

It's only three letters: ORM.

<comment><USER7> For some purposes, ORM works fine. I find ORM frustrating and unpleasant far more than I find it useful.

<comment><USER10> That. And the fact that ORM usually don't allow to structure your database precisely the way you want, in the good ol' fashioned way.</comment></comment></comment>


Ask HN: Wireless at Conferences: Problems, Solutions? - <AUTHOR>

I am interested in building an application for conferences which requires real time collaboration.  The problem is conference wifi can be incredibly spotty, which means the application's usefulness is potentially nil depending on the quality of the conference wifi.<p>I am not a wireless engineer, but am trying to understand the problems that typically occur with conference wifi, and hopefully some potential solutions.  Do any businesses out there work specifically to provide reliable wifi for conferences?  When are we going to see three to five-hundred people be able to connect reliably to conference wifi without any hiccups? <comment><USER2> <http://www.tummy.com/Community/Articles/pycon2010-network/> peaked at ~600 people.</comment>


Phonebloks - <AUTHOR> https://www.youtube.com/watch?v=oDAw7vW7H0c

<comment><USER2> Had me right up until "phone companies work together to make the best phones in the world".

Still want to see a prototype though.</comment>


Ask HN: What should an ideal, all-new OS look like? - <AUTHOR> What would an all-new, best-we-can-do-today OS  look like, if we hit restart and didn't have to worry about backwards compatibility to any significant degree? (Yes, I agree that's an extreme hypothetical!)
Would it be all THAT different?
In other words, would such a "best of show" OS (one that's within our technical reach, right now) look much like the incumbents? Would it be more serviceable, do more, or just be somewhat faster, smaller and more reliable? How much easier could it make life for programmers, if at all? Security? Future-proofing? How much economic value could doing such a thing actually add even if you could ignore legacy? (I know, not enough to actually dump legacy, but how much? Enough to make you pay 20% more for a computer, if that were the price you had to pay? 10%?)
Speaking of future-proofing, how likely are AI advances (deep learning) to heavily profit from such a rethink?
I'm hoping to avoid any discussion of why companies haven't done this and almost certainly won't: because I think we all know why such a project might not be profitable or very practical. I still use Qwerty, after all.
I love Rust, but since existing OSes can be rewritten in Rust and that may very well happen, if only a bit at a time; I don't see Rust as a decider, here. Of course, we want Rust, we just don't have to restart to get it.
This query was sparked a bit by this quote from romaniv: "One would think that in 2017 we would be using an OS that takes the best ideas from Xerox Park/Star, Oberon and Cloud 9. At least on new devices (like tablets) which don't have to keep backward compatibility." https://news.ycombinator.com/item?id=15704806 <comment><AUTHOR> Re Fuchsia: Google is restarting in one sense, replacing the Linux kernel in Android it would seem, partly in Rust. But they can't really restart, since they can't stray too far from their libraries and huge app pile. Is that something that eats at those programmers, or is it really not a big deal to forgo pure freedom to invent, since we've gotten it mostly right by now, anyway?

My strong impression of Redox was that it sticks very close to Unix principles (and libraries) and was not a clean restart. But I may very well not understand all that one can do if you are writing in Rust from the start.

</comment><comment><USER2> There's a group of people writing a full, all-new OS from scratch in Rust called Redox[0] and Google is also working on a new mobile OS called Fuchsia[1].

[0]: [https://github.com/redox-os/redox](https://github.com/redox-os/redox) [1]: [https://github.com/fuchsia-mirror](https://github.com/fuchsia-mirror)

<comment><AUTHOR> My apologies, matteing! I posted then heavily edited the above OP query, then added my comment on Fuchsia - before looking for comments and reading yours. Plus now I've edited the Fuchsia comment, too. So your reply may seem to others to ignore what I wrote - but that's not true, you were replying to a much simpler query. It was I who ignored (missed) your reply while busily typing. Next time I'll polish first, then publish (I hope.)</comment></comment>


About the security content of iOS 10.3 - <AUTHOR> https://support.apple.com/en-us/HT207617 <comment><USER2> To me this is quite depressing. The sure amount of bounds errors and whatnot in things like font handling, audio, images, etc mean that evil websites/email/etc have a strong chance of owning your device for years to come.

Highlights the value of languages like Swift or Rust that build in bounds checking into the language itself, preventing such attacks (as long as you don't call any explicitly unsafe bits). I do wonder if Apple is considering re-writing any of these core services in a safer language.

<comment><USER3> And it is not an unknown thing, for decades!

"A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to--they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980 language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law."

\-- C. A. R. Hoare, Turing award lecture in 1981, [http://cacm.acm.org/magazines/1981/2/10949-the-emperors- old-...](http://cacm.acm.org/magazines/1981/2/10949-the-emperors-old- clothes/pdf)

> I do wonder if Apple is considering re-writing any of these core services in > a safer language.

Apple already uses C++ for device drivers, which allows for more safety oriented programming as straight C.

In any case, even if it isn't fully ready today, they view Swift as a C and Objective-C replacement in the long term.

"Fast. Swift is intended as a replacement for C-based languages (C, C++, and Objective-C). " \-- [https://swift.org/about/](https://swift.org/about/)

"Swift is a successor to both the C and Objective-C languages." \-- [https://developer.apple.com/swift/](https://developer.apple.com/swift/)

The dock and launchd in Sierra were rewritten in Swift.

<comment><USER4> > Apple already uses C++ for device drivers, which allows for more safety > oriented programming as straight C

Just to qualify that a bit, IOKit uses a restricted form of C++ based on Embedded C++

[https://en.wikipedia.org/wiki/Embedded_C%2B%2B](https://en.wikipedia.org/wiki/Embedded_C%2B%2B)

[https://developer.apple.com/library/content/documentation/De...](https://developer.apple.com/library/content/documentation/DeviceDrivers/Conceptual/WritingDeviceDriver/CPluPlusRuntime/CPlusPlusRuntime.html)

<comment><USER3> It still is C++ and way safer than plain C, assuming devs care to use RAII, reference parameters, string and array wrappers with bounds checking, enums.

</comment></comment></comment></comment><comment><USER5> It's written that they updated LibreSSL to version 1.17.0 (in the part HTTPProtocol) but the first version of LibreSSL is 2.0 and the last is 2.5.2 ([https://www.libressl.org/releases.html](https://www.libressl.org/releases.html)).

How did they do ?

<comment><USER6> They are referring to nghttp2's version .

</comment></comment><comment><USER7> The takeaway here is that if you have a device that's so old it's not supported for iOS 10 updates, it's a doorstop.

<comment><USER8> iOS 10 supports the iPhone 5 which was released September 21, 2012 or about 4 1/2 years ago. If you're getting 4.5 years out of your iPhone, that's great. Unnecessary but great.

<comment><USER7> Isn't the more relevant date when they ceased sale of the iPhone 4S, which was September 2014 (2½ years ago)?

<comment><USER9> No, because if you bought a 4S at that point you knew you were buying a 3 year old device.

<comment><USER10> I expect support periods for my device to start when I bought it from the manufacturer, not when it happened to first go into production.

</comment></comment></comment></comment></comment><comment><USER11> Jesus, this reeks of a big company throwing programmers at a problem until it goes away. Myriad memory corruption issues all solved with input validation. Surely there has to be some kind of process improvements they could implement, at the very least fuzzing and valgrind (or similar). How do you not read this and want to rethink your strategy.

</comment><comment><USER12> This is pretty terrifying. So many "arbitrary code execution with root privileges" exploits! They may be fixed, but how many more are still only known to malicious third parties?

And without even needing to install anything! "Processing maliciously crafted web content may lead to arbitrary code execution."

<comment><USER13> I can't recall so many (80?) security fixes in a recent iOS update. A malicious font, audio file, image file or website can cause arbitrary execution?! When a file parser or Safari is vulnerable, why doesn't the iOS sandbox block device/root modifications?

What happens if your device is already infected? Does the update process replace all OS files or could an infected device still contain malware after upgrade to 10.3?

Are there tools or apps that can report system level logs, e.g. could iOS 10.3 detect and report if known-malicious files are present on a device?

<comment><USER14> The sandbox does block such modification, but a useful exploit would combine the arbitrary code execution vulnerability with a sandbox escape, using e.g. some arbitrary read/write vulnerability in the kernel or similar.

<comment><USER13> In that case, would the list of iOS 10.3 security fixes mention at least one sandbox escape or kernel vulnerability? Since it does not, can we assume that most (all?) of the listed "arbitrary code executions" would be isolated by the iOS application sandbox?

Or should we assume that competent attackers are hoarding sandbox escapes and thus most app vulnerabilities can be escalated to device compromise?

<comment><USER15> No, you can't make any such assumptions from the text of the update. But you can probably assume there's localhost sandbox escape (or kernel RCE) available to serious attackers.

</comment></comment></comment></comment></comment><comment><USER16> I wasn't aware that Carbon was there in iOS.

I imagine none of the GUI stuff, but drivers and other C stuff

<comment><USER17> Well looking at the bug it seems like it at least is used to support loading old TrueType fonts...

</comment></comment><comment><USER18> It's extremely impressive how many of these bugs were found by Google's Project Zero team.</comment>


Debian 9 Stretch released - <AUTHOR> https://www.debian.org/News/2017/20170617.en.html <comment><AUTHOR> oh, looks like I missed the news yesterday: [https://news.ycombinator.com/item?id=14578807](https://news.ycombinator.com/item?id=14578807)</comment>


WLW: America's 500,000 watt radio station (2015) - <AUTHOR> https://www.neh.gov/humanities/2015/mayjune/feature/in-the-1930s-radio-station-wlw-in-ohio-was-americas-one-and-only-sup <comment><USER2> > People living near the transmitter site often got better reception than they > wanted; some lights would not turn off until WLW engineers helped rewire > houses. Gutters rattled loose from buildings. A neon hotel sign near the > transmitter never went dark. Farmers reported hearing WLW through their > barbed-wire fences.

That is pretty amazing. I wonder if there were any health impacts from that level of ambient power just buzzing through the air. Still, quite a feat of engineering to think about.

I also took some interesting lessons from the story as an entrepreneur. Crosley's obsession with radio reminds me of my own obsessive periods with a particular technology. Then he took his existing business knowledge and manufacturing skills (and capital...) and acted on it. Such a great little story of being in the right place, at the right time, and having the right obsessions.

<comment><USER3> _That is pretty amazing. I wonder if there were any health impacts from that level of ambient power just buzzing through the air. Still, quite a feat of engineering to think about._

It's very common, and becoming more common.

WLW was a special case because it put out so much power it affected homes a fair distance away. But even stations as low as 1,000 watts have to deal with this today.

I worked at close to a dozen different AM stations in a previous life. It's very common for AM transmission towers to be located in flat, moist areas. I'm not an electrical engineer, but from what I remember, flat is preferred so the groundwave signal travels farther, and marshy for electrical reasons.

The problem is that when vast majority of AM stations were built, they transmitters were in the middle of nowhere. Since then, the suburbs have surrounded these facilities with homes, sometimes building houses right up to the property line, and people get interference in their electronics. And they're not happy about it. If they're close enough, everything with a speaker in the house only broadcasts that nearby station. Radios, TV's, even things that don't have "speakers," but are able to pick up the radio waves and resonate.

It's like when people build a house next to an airport, and then complain about all the damn airplane noise.

For reasons I don't understand from an electrical standpoint, it was particularly bad at one 1,000-watt station where I worked in the mid-90's. The General Manager's attitude was along the lines of, "Why would you move next door to a radio station? Didn't you notice the 300-foot-tall red-and-white tower with all the blinking lights out front?" Of course, that's a wholly unsatisfying answer to a new homeowner.

Since I left radio, I've read that there are a number of AM stations that have gone off the air simply because of the angry neighbors. They get the local politicians to pass zoning regulations that end up forcing the AM stations to move their towers, but the stations have nowhere else to go for three reasons: First, because they have to be located within a certain area to fulfill the coverage requirements of their license; second, depending on the station's transmitting characteristics, they may need a pretty large piece of land for multiple towers; and third, because AM radio doesn't make a lot of money, they may not be able to afford new land. So for some, they just go dark.

<comment><USER4> >It's like when people build a house next to an airport, and then complain about all the damn airplane noise.

Not really. Buying near an airport requires explicit acknowledgement that you're doing it and that's why homeowners don't really have a leg to stand on when they complain to their local government. IIRC last time I looked at a home near a bunch of transmitters, there was no such disclosure required.

<comment><USER5> Oh, people complain about airport noise all the time. You even hear about it in the news: so-and-so investigating 10,000 complaints about noise. Interestingly (though in retrospect unsurprisingly), the vast majority of complaints come from a very small handful of squeaky wheels. For example, of 8,760 complaints about DCA, 1 home was responsible for 78% of them! Source: [https://www.mercatus.org/system/files/dourado-airport- noise-...](https://www.mercatus.org/system/files/dourado-airport-noise- mop-v1.pdf)

Disclaimers notwithstanding, noise abatement requirements continue to become stricter and stricter across the U.S.

</comment></comment></comment></comment><comment><USER6> I'm from Cincinnati, and growing up my dad and grandfather would tell us how you could pick up WLW across the country on a good day. In the 90s we took a vacation to the Rockies, and were able to pick up WLW a few times, even though the power had been reduced by then. I can get it regularly and clearly in Chicago as well. That's the cool thing about AM radio; since it is transmitted at a lower frequency, it can travel longer distances, and even reflect off the atmosphere in the right conditions.

<comment><USER7> AM broadcast travels a long way not because it tends to reflect off the atmosphere (skywave propagation), but because it tends to hug the earth (groundwave propagation).

<comment><USER7> Too late to edit: I was confused... groundwave during the day, skywave at night.

</comment></comment></comment><comment><USER8> Was randomly recommended a video on YouTube a few weeks ago which was a recording of a tour of the WLW broadcast transmitter facility. You get to see the high power equipment in detail accompanied by lots of history about the facility. Was a fun watch.

[https://www.youtube.com/watch?v=CbHjcwIoTiY](https://www.youtube.com/watch?v=CbHjcwIoTiY)

</comment><comment><USER9> _The station's once groundbreaking transmitter is long retired but preserved, on-site, beside its modern counterpart._

I wonder if they ever offer tours. It would be neat to see some of this history the next time I'm passing through the Cincinnati area. On a related note, it looks like there's a "National Voice of America Museum of Broadcasting" just down the street from the WLW site.

<comment><USER10> Here is a tour on YouTube [https://youtu.be/CbHjcwIoTiY](https://youtu.be/CbHjcwIoTiY)

<comment><USER11> 100 KW tubes, those are monsters. Watercooling?

<comment><USER12> Yes. There's a pond on the site that was used for cooling the tubes.

</comment></comment></comment></comment><comment><USER13> _> enough power to supply a town of one hundred thousand coursed through an 831-foot tower_

That would mean 5W per inhabitant. In 2020, this would barely be enough to charge a phone, and in 1934 that would have been a light bulb per 20 citizens.

<comment><USER14> The power input to the transmitter is much larger than the power coming out of it. All those tubes generates a lot of heat.

<comment><USER13> So let's say this is 10% efficient, that means 50W per citizen. Clearly, there is something I'm not getting. Do power companies really budget 50W per user? I mean it's possible but that seems very low to me.

<comment><USER15> In 1934, electricity use was limited, and still fairly novel in many places. Utterly unavailable in much of the rural US (look into the rural electrical cooperatives).

Principle household uses would have been lighting and refrigeration, possibly a few clocks, a radio, and perhaps appliances.

Averaged over a day, draw per person could well have been only a few tens of watts. 50W per person for a household of four would be about 150 kWh per month, which sounds roughly reasonable.

The 2018 US average was 914 kWh/mo:

[https://www.eia.gov/tools/faqs/faq.php?id=97&t=3](https://www.eia.gov/tools/faqs/faq.php?id=97&t=3)

In 1930, direct electrical use was only 1% of total household energy consumption. Coal was 69%, fuelwood still 23%. Expressed as kWh/mo (the source below has graphs giving nationwide trillions of BTU/yr electrical equivalent) the number looks closer to 80 kWh/mo, or 110 watt constant, about 28 watt/person assuming a family of four.

[https://aceee.org/files/proceedings/1992/data/papers/SS92_Pa...](https://aceee.org/files/proceedings/1992/data/papers/SS92_Panel10_Paper17.pdf)

</comment></comment></comment></comment><comment><USER16> _Of course, for most broadcasters and regulators debating these broad delivery systems, "listeners" meant Americans who were white and middle or working class. Programming reinforced presumed middle class values. While some local stations offered programming targeted to ethnic groups, occupations, and even political beliefs, black Americans and other minority groups were largely left out of national radio, except as caricatures—usually played by white people—in comedy programs._

Why is this paragraph in the article? Do we have to make everything a wokeness contest? The article is about engineering, and this paragraph is a non sequitur plopped in the middle of it for no reason.

<comment><USER17> This is a history article, not an engineering article. It's published on the Magazine for the National Endowment of the Humanities. The article spends time discussing the perceived cultural potential of radio, as below:

"Since radio's beginnings in the early 1920s, industry and government leaders promoted it as the great homogenizer, a cultural uplift project that could, among other things, help modernize and acculturate rural areas."

The paragraph you take such objection to follows that statement, and is entirely relevant in the context of the article.

</comment></comment><comment><USER18> Current most powerful is 2000 kW in France. How these modern ones are different from old times.

[https://en.wikipedia.org/wiki/Roumoules_radio_transmitter](https://en.wikipedia.org/wiki/Roumoules_radio_transmitter) "..The longwave transmitter at Roumoules, which was inaugurated in 1974, transmits at 216 kHz (until 1988: 218 kHz) with a transmission power of 1400 kW (until 1976: 2000 kW)...."

</comment><comment><USER19> Grew up listening to the Reds on WLW - it's current slogan is "The Big One" and it used to call itself "The Nation's Station".

</comment><comment><USER20> I go camping once a year at the base of a 1.2 Mega Watt transmitter (It is a Navy Camping ground). Not AM, and at a Very Low Frequency, but still impressive! So far, I have not noticed any ill effects. Fingers crossed.

[https://en.wikipedia.org/wiki/Jim_Creek_Naval_Radio_Station](https://en.wikipedia.org/wiki/Jim_Creek_Naval_Radio_Station)

</comment><comment><USER21> For those of you too young to remember the Crosley automobile:

[http://www.classic-car-history.com/crosley-cars.htm](http://www.classic-car- history.com/crosley-cars.htm)

I remember in the sixties and seventies people dropping a small block V-8 into them to use as dragsters.

<comment><USER15> I came across a Crosley Shelvador, mentioned in the article, the first refrigerator with built-in shelves, apparently.

Built in the 1950s, by the early 1990s, the unit was 1) still functioning, 2) in absolutely beautiful condition, and 3) as or more efficient than modern "energy-efficient" refrigerators.

</comment></comment><comment><USER22> Home of the Reds. Been listening to it my whole life.

<comment><USER19> The last couple seasons were difficult for me to listen to Marty calling games because I thought he came across as very negative and embittered, but then his final season (this last season) was so much fun as he seemed to be enjoying it again even though it wasn't a good season for the team. I listened to games a lot more throughout the last season and then listened to parts or all of his last 20 or so games and it was so much fun. Really glad we still have the Cowboy. Baseball is such a great sport for the radio if you have good announcers.

</comment></comment><comment><USER23> I drive past this transmitter every day on my way to work, passing through Mason. Several times my son has asked what would happen if someone snapped on the support cables.

<comment><USER12> I grew up in western Ohio listening to WLW, and to this day, when I drive down I-75 and pass the Mason exit I say (to myself, or whoever is in the car w/ me) "Home of the transmitter" (as was the wont of 700 WLW personality Bill Cunningham to say any time Mason was mentioned on-air).

</comment></comment><comment><USER24> Related from 2016: [https://news.ycombinator.com/item?id=11095038](https://news.ycombinator.com/item?id=11095038)

</comment><comment><USER25> On a related note, here are actual recordings from WLW on the day of John F. Kennedy's assassination.

[https://www.youtube.com/watch?v=J75BAx4W3Zo&list=PL0O5WNzrZq...](https://www.youtube.com/watch?v=J75BAx4W3Zo&list=PL0O5WNzrZqINoVDIEsnoZvorXVcc8MRSF)

</comment><comment><USER26> A tour of the WLW faclility: [https://www.youtube.com/watch?time_continue=3&v=CbHjcwIoTiY&...](https://www.youtube.com/watch?time_continue=3&v=CbHjcwIoTiY&feature=emb_logo)

</comment><comment><USER27> For point of reference, the max power allowed in the US is 50kW

<comment><USER28> I don't believe this is correct; when I look up the details of transmitters, they're often 100kW+, e.g., [https://fccdata.org/?lang=en&facid=62331](https://fccdata.org/?lang=en&facid=62331) for an arbitrary example in Montana

<comment><USER29> Different power levels for different frequencies/services. Your arbitrary example is an FM station broadcasting at 94.5 MHz. AM broadcast stations are limited to 50KW. The FCC regulates ERP based on a number of factors including minimizing interference with other frequencies and a frequency's propagation characteristics. For example, UHF TV full-power transmitters power limit is one megawatt.

</comment></comment></comment><comment><USER30> Can't remember ever closing an article I was interested in reading simply because I had difficulty processing the font. The narrow font face on the white background just makes it unbearable to look at, it's so narrow. It actually hurts my brain after a while.

</comment><comment><USER31> for national security it would be best to shut this puppy down because it is broadcasting our position to extraterresterial civilizations, not all of whom may be friendly.

<comment><USER32> At AM radio frequencies, most of the radio waves are reflected back to earth or absorbed in the ionosphere. Same concept as how amateur radio HF/MF propagation allows individuals to communicate with people around the world, past the horizon. (The 160m ham band nearly backs right up to the top end of the AM radio band.) You can even sometimes hear your own echo, apparently, as the signals travel the entire way around the earth, although I've yet to experience this. (Recent Extra class licensed ham radio operator here. 73.)

Higher frequencies, on the other hand, are not reflected back by the ionosphere and go straight out into space. That's why you typically use VHF frequencies (30-300 MHz) for things like EME "earth-moon-earth" or "moonbounce" communication, or communication via satellite. So if your concern is about radio waves making our planet a beacon for aliens, you should be more concerned about FM radio towers than AM ones.

<comment><USER31> that is a good point, i always forget about the ionospheric plasma. however, there is going to be some amount of outbound re-radiation from the plasma. the sound quality by the time you get to alpha centauri is going to lousy but any alien civ capable of coming over here and sucking up our precious atmosphere is probably going to have good enough spectroscopy and computing to reconstruct our morning zoo broadcasts and judge that we are not worthy to have nitrogen.</comment></comment></comment>


Ask HN: please review Wordics, a word cloud widget - <AUTHOR> http://wordics.lemmatica.com/

<comment><USER2> The feature where you display a word cloud over a link seems slow enough that users might find it annoying to watch it load.

Some word clouds are made of clickable tags. When users try to click, but cannot, they may not like your clouds as much.

<comment><AUTHOR> Thanks for the feedback. The performance of the popups is several times better now.

Clicking the word clouds might highlight all its occurrences on the page, I think this helps understanding. Maybe we'll implement it in this way.

</comment></comment><comment><USER3> Too many words on a white background floated left. Due to lack of design I did not stay on site and try to understand it's concept.

I suggest working on your design and offering a sentence or two description of your concept.

good luck!</comment>


Profile Engine, the Facebook crawler hated by people who want to be forgotten - <AUTHOR> http://qz.com/279940/meet-profile-engine-the-spammy-facebook-crawler-hated-by-people-who-want-to-be-forgotten/ <comment><USER2> I have an easily searchable name. I tried Profile Engine with my name and the information that came up was totally inaccurate (list of friends contains no one I'm familiar with, list of interests are all things I'm not interested in besides "reading"). Is this more accurate if I sign up for an account or something?</comment>


Open letter from a Texas county judge about his Covid mask order - <AUTHOR> https://kfdm.com/news/local/judge-branick-writes-letter-to-citizens-explaining-mask-order <comment><USER2> > When did it happen that we all became so focused on our rights and not our > obligations to our fellow man and woman?

When our society abandoned values in favor of individuals simply valuing themselves. Our world and the incentive and reward systems we have in place have made us selfish loners.

Roger Scruton argues something similar but from an art / aesthetics perspective in Why Beauty Matters: [https://www.youtube.com/watch?v=bHw4MMEnmpc](https://www.youtube.com/watch?v=bHw4MMEnmpc)

Sadly the only link I can find is with Portuguese subtitles, so hope you don't mind

</comment><comment><USER3> The entire point of civil society is to allow people to exist with one another. Let's say, for the sake of argument, that wearing a yellow shirt in public instantly kills 5% of the population. I think that anyone would agree that it would be a good law to make it illegal for someone to wear yellow shirts. In fact we would probably make it just as illegal as pointing a gun at someone and shooting them in cold blood. Because, well, that's what you would be doing wearing a yellow shirt (except even more people would die from the shirt).

So if society's main goal is to make it so that we can live peacefully amongst each other. Then by golly we should have the ability to make it illegal to walk around with a yellow shirt on. In fact it would be so insane to put on a yellow shirt we should have no fear in telling cops (the ones that survive the yellow shirt murderer) to arrest, incarcerate for life said person.

Now, I get that society is hard to change. In this so called Yellow Shirt Means Death world, the meaning and outcome of wearing a yellow shirt has existed forever. So it would be ingrained in everyone. Yellow shirts = fucking bad news.

So let's alter this and present a challenge: Yellow shirts didn't start causing this problem until March of 2020. And to make it even stranger, the death happens 30 days after being in the presence of a yellow shirt. But still 5% die. And now you have all sorts of wacko people that don't fucking care and put on yellow shirts anyway.

Some percentage of society has never seen one of these people die, so they don't believe the yellow shirt causes it. Some of them wearing yellow shirts may have killed people but the person that died 30 days later so it has no effect on them. They don't even know they killed someone.

Anyway, if you didn't read between the lines, I'm saying arrest and jail those that don't wear a mask - because at this point, everyone knows what happens.

<comment><USER4> Your premise is flawed. Yellow shirts don't kill people. Not wearing a mask does not kill people. Letting a TSA officer fondle your groin doesn't save people's lives. It's all security theater.

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

<comment><USER3> We also have a society that requires clothing. And that doesn't even KILL people. Yet we handcuff -> jail nudists anyway. One major exception is pretty much 97% of the state of Oregon, where that is 100% legal.

</comment></comment></comment><comment><USER5> For many outside of it, even from 'cousin colonies' (I'm in Australia) there is much about the USA that is simply bewildering.

I can recommend Kurt Andersen's book 'Fantasyland', published around the time of Trump's ascension, to help you make some small sense of it all.

He writes persuasively, and describes a history full of (perceived) persecution and exceptionalism-inspiring events that, almost ineluctably, led them here.

"America was the dreamworld creation of fantasists, some religious and some out to get rich quick, all with a freakish appetite for the amazing. Beyond our passionate beliefs in various kinds of magic and destiny, our particular religious DNA, supercharged, was the source of other defining American habits of mind as well, such as the craving for the mysterious to be literal, and the hair-trigger sensitivity to persecution by elites. In addition to being the first designed-built Protestant nation, America was also the first designed- built Enlightenment nation. The two fed each other—and sometimes became toxic in combination."

[0] [https://www.kurtandersen.com/fantasyland](https://www.kurtandersen.com/fantasyland)

<comment><AUTHOR> Hell, I voted for Trump and agree with a lot of his policies (if not his tweets)... and even I find the anti-mask brigade totally baffling.

</comment></comment><comment><USER6> Lawyers are good at writing.

<comment><USER7> Not all judges are lawyers. Most are, but in the US it is not always a prerequisite.

</comment></comment><comment><USER8> Haven't we established that ~1/3 of covid cases are asymptomatic and that overall mortality rate is likely <1%? If so, why are we continuing the mask charade?

<comment><USER9> Because when the cost is essentially zero it's okay to be a little overzealous with our prevention efforts.

And your numbers are still very much up for debate. Some localities are already above 1% without having infected the entire population.

<comment><USER8> > Because when the cost is essentially zero it's okay to be a little > overzealous with our prevention efforts.

We can impose all sort of inconveniences on society in the name of saving lives. Why not just wear masks 24/7/365 since it's "free"? Think of all the public health issues that would solve.

I for one am sick of having foggy glasses any time I'm inside a store.

<comment><USER9> What is your threshold of acceptable mortality before you will accept nonzero inconvenience?

<comment><USER8> 1% mortality rate is my threshold. Anything less isn't worth halting society over. To be clear, I think people that are sick should wear masks no matter what. That's just common courtesy for people around you.

<comment><AUTHOR> We were talking about masks, not halting society.

</comment></comment></comment></comment></comment></comment><comment><USER10> Historically speaking perceived government overreach is followed by backlash of some sort. In life, we're all playing the long game. I question the wisdom of some of the health orders in the long run.

</comment><comment><USER7> Interesting. There are cases where witnesses have been specifically banned from using masks to hide themselves. Americans have a right to see the face of their accuser, and to have the jury see it too. I'm all for covid masks but let us not allow this to become an excuse for an evil witness to hide thier face.

<comment><USER11> > Americans have a right to see the face of their accuser, and to have the > jury see it too.

Americans have the right to _face their accuser in court_ not to literally see the face of their accuser in its entirety.

If the latter were an actual thing, all plaintiffs would be required to go into court clean-shaven, so as not to obscure their face with a beard.

<comment><USER7> No. I meant literal. This issue come up when a witness wants to appear by phone. There is a cultural assumption that by looking someone in the eye we can tell if they are lying. So phone is not good enough. It has to be phone+video. It has also been an issue where witnesses, mostly women, want to were veils while on the stand.

This principal hasn't gotten to scotus, but is well recognized.

And procedures for child witnesses appearing outside the courtroom. A speaker on the stand is not good enough. Someone, at least the lawyers, has to see the witness. That has gone to a few higher courts.

And special agents who don't want to reveal thier identities.. and and and. There isn't much new when it comes to witnesses.

<comment><USER11> > There is a cultural assumption that by looking someone in the eye we can > tell if they are lying. So phone is not good enough. It has to be > phone+video.

I only had to Google for a minute to find plenty of instances where courts will allow testimony over the phone (no video) and even by letter, and nowhere did I see "cultural assumptions" like determining truth by being able to look into someone's eyes mentioned as relevant.

Show me actual case law to the contrary or I'm calling BS on your claims.

<comment><USER7> [https://attorneyatlawmagazine.com/telephonic-testimony- when-...](https://attorneyatlawmagazine.com/telephonic-testimony-when-is-it- allowed)

Too many little rules and exemptions to cite any one case. Look to the rules in each jurisdiction.

>> The Tennessee Supreme Court has addressed the reasons why live, in-person testimony is more desirable than remote testimony. Kelly v. Kelly, 445 SW3d 685 (2014) explains this preference: "(1) It assists the trier of fact in evaluating the witness' credibility by allowing his or her demeanor to be observed firsthand; (2) It helps establish the identity of the witness; (3) It impresses upon the witness the seriousness of the occasion; (4) It assures that the witness is not being coerced during testimony; (5) It assures that the witness is not referring to documents improperly; and (6) _In cases where required, it provides for the right of confrontation of witnesses._

Note: in SOME cases in-person testimony is REQUIRED. That means in those cases remote testimony is disallowed.

<comment><USER11> One court considering in person testimony to be _more desirable_ is not in any way equivalent to a decision that doing otherwise is a violation of anyone's rights. You haven't proven that a right exists, nor does the article defend that claim. You've proven that it's an administrative matter that different jurisdictions handle differently depending on circumstances, but _still perfectly legal._

Certainly you haven't proven your original assertion that wearing a mask according to COVID-19 guidelines is a violation of Americans' Sixth Amendment rights (the "right to face their accuser") because that argument depends on a blatant misinterpretation of what the wording of that Amendment means.</comment></comment></comment></comment></comment></comment>


How a name can undermine your product - <AUTHOR> https://www.intentapp.com/blog/naming-cost/ <comment><USER2> very true and yet duckduckgo somehow insist on keeping their awful clumsy name</comment>


Australia gets its own Y Combinator-type fund - <AUTHOR> http://delimiter.com.au/2010/08/19/australia-gets-its-own-y-combinator-type-fund/

<comment><USER2> I'm incredibly excited about this as a uni student in Sydney. I'm hopeful that by the time I graduate that the concept of the Silicon Beach will take off.

The University of Sydney have recently introduced a course focusing on Tech Venture Creation[1] and most of the people on that page are involved somehow (including Ryan from Omnisio, Bart from Tjoos and our lecturer Bill Bartee), so this isn't the only new action on the Sydney startup front.

[1] - Tech Venture Creation course - <http://techventurecreation.wordpress.com/>

<comment><USER3> Hmm I am in Sydney university too but I haven't heard about that course... It should be promoted more! But then again, looking it up it only has 40 free spaces. :(

As students I don't think there is much benefit in "getting funded", especially for those still living at home, and probably not even for a year after graduation. (I'm guessing I could live that long in my parent's house before they start charging rent.)

You could even get a deferred student loan of $500 to $20,000 from NAB, with no repayments for up to 5 years * . (with a steep 15% interest)

If you aren't unlucky you'd also be receiving student payments from centre link also.

IMHO, university students don't need much funding from investors. The banks are willing to lend you money as long as they think you're will be able to get a 9 to 5 job when you graduate. Your parents can also provide you with free accommodation and dinners. I think it's a good idea to take advantage of this while we're still students. The only reason you'd apply for seed funding is the mentoring that you will get.

* certain conditions apply.

<comment><USER4> the interest is lower than that, but you have to pay back a loan.

you don't need to pay back funding.

</comment></comment></comment><comment><USER5> Direct link to the Startmate website - <http://www.startmate.com.au/>

I love this (and have heard it before, around HN a lot actually): "The biggest risk in a startup is not whether someone will steal your idea or if you can build a product but rather that no one will care."

</comment><comment><USER6> One thing that would be really good to see come out of this IMHO is a better profile for tech startups in Aus. The more open this can be around tech scene, gotchas and contacts focussed on Australia the better. Most information and discussion I've seen tends to be US based not surprisingly; This doesn't always translate well, particularly around company structure, equity, tax etc. You know, all the small stuff that can kill you.

Looking forward to see what develops.

<comment><USER7> We fully intend to be very open about the way we do business and bring a local angle on the type of great stuff folks like venturehacks have done in the US.

Also, for Aussie startups if there are issues around company formation and things like migrating an Australian company to a Delaware C-Corp etc we can share, we will.

<comment><USER6> That sounds great. As a tech founder that's the thing I'm working through. There's a few good sources but very little that says, for tech with std tech structures you probably want to do it this way.

</comment></comment></comment><comment><USER8> "The biggest risk in a startup is not whether someone will steal your idea or if you can build a product but rather that no one will care"

a lot of people will obsess over NDA's and the like, thinking that people will care SO much as to steal their idea. when in reality what's quoted above is so true, the greatest risk being that people won't actually care enough about the product.

<comment><USER9> Derek Sivers writes a good essay on the value of ideas is the execution you put into them <http://sivers.org/multiply>

</comment></comment><comment><USER10> The critical success factor for YCombinator is, without a doubt, Paul Graham.

Do they have a Paul Graham?

<comment><USER11> This has been the basis of my skepticism over such a concept.

But I think they're going about it the right way. They know they can't build it around a single figurehead, so they've pulled together a diverse team of mentors, with some big names among them, particularly the Atlassians for current-era track record.

The idea seems to be to build a pathway into Silicon Valley for young founders who don't know what steps to take to get there.

I could certainly have used this a few years ago.

</comment></comment><comment><USER12> This is great to see. There are some pretty good people involved with the program too, which gives me hope that companies going though this will actually get something useful from it.

</comment><comment><USER13> Kudos to the aussies for having something similar to YC. The mentorship from TWENTY (woah!) successful founders, the $25.000 (aus?) sound amazing.

What I find it really sad that even in this decade the best way for a web startup to get attention is to go to the Valley. If the web is global shouldn't the support networks be global too?

In the case of my country (Chile) it is very difficult to make your own web startup. Seed investment is centralized in a goverment organization that only cares about patents and how many millions of dollars you are going to make in the first years. Another problem with seed investment around here is that you must spend the money in very specific things like getting incorporated (which is expensive) and build a business plan $$, not getting the work done. It you aren't sure how you are going to monetize your app in a way that is going to give you massive profits, don't bother trying to get an investor (unless you have rich relatives).

Is Australia similar to my country in that innovating on the web is very difficult from a support ecosystem perspective?

<comment><USER7> To be clear, we wanted to setup the program with a complete handle on reality and to be supportive of many different options on financing - bootstrap or institutional - and where they are based - Sydney or the Valley or in the many cases currently a grey area of being in both.

The two weeks in the Valley at the end of the program is to connect with the Aussie community that is just starting to establish itself, to introduce the startups we are working with to the most useful people we can and then to hold a demo day for early stage investors as well. Plus it's hard not to get drunk on the inspiration of meeting other great startups.

</comment></comment><comment><USER14> Demo day in SF will be helpful, and as for experience, the Atlassian founders are involved. I've seen other attempts to do this, usually by cities/states, that capture only the superficial form of YC.

I'm going to be in Sydney on 6 & 7 Sept.--any startup folks in Sydney available & willing to meet up and tell me about starting a company in Australia?

<comment><USER15> You can work from our office. Email me

mick pollenizer com

</comment></comment><comment><USER16> I went to a Startup Camp run by Bart Jellema a couple of years ago and was quite impressed by his skills especially on the networking/organisational side of things. This is promising as much of what makes ycombinator great is the exposure and contacts being involved creates.

Looking forward to seeing the first batch come through!

</comment><comment><USER17> There is also [http://www.pollenizer.com/pollenizer-investing-in-web- startu...](http://www.pollenizer.com/pollenizer-investing-in-web-startups/) (Sydney based, AFAIK) - they are nice folk too.

Great to see !

<comment><USER5> It looks like Mick Liubinskas (Co-Founder of Pollenizer) is one of the Startmate 'mentors', whatever contribution that means.

<comment><USER15> Thanks guys, yes, Pollenizer is one of the teams behind this.

Looking forward to the first crop coming through.

<comment><USER15> Brief statement by Pollenizer on this;

<http://bit.ly/d2HeQB>

<comment><USER18> [http://www.pollenizer.com/startmate-seed-tech-startup- invest...](http://www.pollenizer.com/startmate-seed-tech-startup-investment- program/)

</comment></comment></comment></comment></comment><comment><USER19> Wow, Ryan Junee used to tutor me in first year computer science back at Sydney University... he's come quite a way since then it seems! :)

I hope it works out well for them, Australia needs something like that -- I have more a few friends who have left Australia to pursue cutting edge jobs in tech.

<comment><USER20> no it was all downhill after teaching first year cs really :)

<comment><USER21> you did a CS degree mate? who knew? :)

</comment></comment></comment><comment><USER22> Great initiative and a fantastic list of mentors. Well done for putting this together.

Also like the idea of the Tech Venture Creation course at Syd Uni. I'd like to see every uni in Australia have something similar running, then we'd be sure to get some real hits emerging.

</comment><comment><USER23> This is wonderful stuff, great work guys.

Whether it works perfectly from the get-go is immaterial, StartMate, like their fundees, can launch and then iterate.

Excited to see the first round come through.

</comment><comment><USER24> Wow, this is awesome. Anyone know any startup mentors based in Brisbane? I run (very) small consulting company and I'd like to move into software.

</comment><comment><USER25> This is fantastic! I can't wait to apply with my Sydney-based startup.

<comment><USER26> Me too! Very excited about this one! \--Trindaz on Fedang

</comment></comment><comment><USER27> This is awesome, look forward to seeing the first batch.</comment>


The United States Radio Spectrum Graph [pdf] - <AUTHOR> http://www.ntia.doc.gov/files/ntia/publications/2003-allochrt.pdf

<comment><USER2> Updated version from 2011 Aug:

[http://www.ntia.doc.gov/files/ntia/publications/spectrum_wal...](http://www.ntia.doc.gov/files/ntia/publications/spectrum_wall_chart_aug2011.pdf)

</comment><comment><USER3> Ofcom in the UK has an interactive spectrum map:

[http://www.ofcom.org.uk/static/spectrum/map.html](http://www.ofcom.org.uk/static/spectrum/map.html)</comment>


Patterns: A Second-Order Tool at Best - <AUTHOR> http://parand.com/say/index.php/2005/07/18/i-hate-patterns/

<comment><USER2> Yes. Yes. Patterns are an educational tool. Read the book(s) then put them away. Adhering to patterns because they are SUPERIOR leads to code bloat and unwieldy design. The article has a case where EJBs were used when a simple servlet would have sufficed. My rant-topic-of-the-day is using beans where a hash would do.

From a comment by Russ Olsen, "People who write this stuff just seem to miss that the size of the infrastructure needs to be in proportion to the size of the actual work being done. If the infrastructure is four times the size of the code that actually does something, then you can rewrite the real code 4 times for the price of the infrastructure."

<comment><USER3> Indeed. Patterns are what you use when there is no cleaner option for the situation.

Recently I've been writing some code which is surprisingly amenable to a cut+paste approach: A tool which automatically generates level layouts for a game. At first I endeavored towards a data-driven approach to customizing each type of level I wanted to make, but soon I decided, "There are only six types of levels. Each one has different requirements and they get maintained in isolation. There is no point in trying to reconcile all of them at once."

And so I went ahead with a strategy of reuse for the most common elements - low-level generation strategies - and made big switch statements for the remainder. It works, I get the job done, and there's almost never anything surprising. The only time something did surprise me was when I accidentally pasted the same code twice in different places and threw the results askew in a non-obvious way. That flags some need to slim down bloated methods, but even as-is, it still feels pretty slim at ~2500 lines.</comment></comment>


Google aims to unify its workplace tools and messaging apps into one service - <AUTHOR> https://www.theverge.com/2020/1/28/21112596/google-messaging-communications-app-hangouts-chat-meet-g-suite <comment><USER2> Too bad they can't unify their consumer messaging apps.

They had a great opportunity to do that with Hangouts, but then they torpedoed it with Allo, Duo, RCS, etc.

<comment><USER3> I am still absolutely confused as what to use. I am still using hangouts, even though I was told it was shutting down twice now. Never was the 'replacement', if there even is one, suggested. Needless to say I will not be using google services for any important communication moving forward.</comment></comment>


$1,000 For the Cheapest Surface? - <AUTHOR> http://thenextweb.com/microsoft/2012/07/25/1000-for-the-cheapest-surface-this-latest-rumor-has-microsoft-fanboys-feeling-downcast/

<comment><USER2> I seriously hope people aren't so dense that they convert directly from one European currency to USD. That'd be the dumbest writing in tech I've seen in recent memory.

There's this thing called VAT, along with other factors - it might cost Apple some extra money that European consumers are covered by a two-year warranty for free.

As a decent trick, try to find a product in the Swedish Apple store (<http://store.apple.com/se>) close to those figures and see what the equivalent is in your own Apple store.

With a customized iPad, this makes the lowest device cost around $775. Not a very attractive price at that, for what it's worth.

        From a PR perspective, Microsoft needs to clear the air,
        and start talking numbers.

Translation: "Microsoft need to reach out and do our work for us."

What an awful article.

Also: 32GB and 64GB? That can't be right. Especially with all the space Windows 8 must occupy.

</comment><comment><USER3> No way... this must be a mistake. A 64GB Pro tablet for $1,800? Not even possibly close to realistic.</comment>


Ask YC: Hecl language syntax? - <AUTHOR> http://journal.dedasys.com/articles/2008/08/12/hecl-syntax-a-survey

<comment><AUTHOR> I don't buy the "syntax doesn't matter" argument, but am a bit frustrated by just how much it does matter to some people. What do you guys think?

<comment><USER2> I'm not part of the "syntax doesn't matter" camp either. Since Hecl (I think) is partly intended to use for coding directly from phones with crappy screens/keyboards, for me at least, syntax would be especially important there. Not so much that it would be familiar, but that it would be as concise as possible.

<comment><AUTHOR> Currently, coding directly from phones is not a big use of the language - it's just too painful on all but a few.</comment></comment></comment>


React v0.4 released - <AUTHOR> http://facebook.github.io/react/blog/2013/07/17/react-v0-4-0.html

<comment><AUTHOR> I'm really excited about this release; I've contributed a couple of significant pieces of code to it and as you can see in the changelog, there are quite a few framework improvements in this release.

If you're interested, I wrote up a post about my first experiences (first Reactions?) about a month ago:

[http://benalpert.com/2013/06/09/using-react-to-speed-up- khan...](http://benalpert.com/2013/06/09/using-react-to-speed-up-khan- academy.html)

React is awesome. :) Proud to be a contributor.

<comment><USER2> Can you briefly explain what actually is React? I read the first blog post by the Facebook team and then the website but still couldn't figure out what's the purpose/use cases.

<comment><AUTHOR> With Backbone views (for example), it's usually cumbersome to update certain pieces of a view to make sure they stay in sync with your underlying model data.

You can just reset the HTML from scratch using something like a Handlebars template (or even just building the HTML by hand), but if you have a large DOM tree, that's slow because the browser needs to recreate all the nodes. Alternatively, you can look up each piece of the UI using jQuery and update it by hand (like $(".points").text(newPoints)), but that's cumbersome because you now have to define what the UI looks like in two places (once in the initial render, once in the update function) where they can get out of sync.

React lets you define interfaces declaratively (as if you were just recreating all the HTML each time) but uses a fast internal representation of the DOM that it diffs against the previous copy so that it knows exactly when and how to modify the DOM, keeping things fast.

</comment></comment></comment><comment><USER3> I have a very DOM-heavy admin built in both jQuery, React, and Angular that uses the Django-style multi-select boxes (left panel has available options, right panel has selected options).

Toggling options is instant in jQuery (explicit DOM manipulation)' ~50ms delayed in React (Fake DOM diff calculation), and Angular is ~500ms (dirty- check and re-render).

Anyway, I find it interesting how it goes to show that different tools work best for different jobs. React seems to strike a nice balance between JavaScript and Angular Directives that makes complex, dynamic templating much easier.

<comment><USER4> Eric,

Are you using the prod version of React? The dev version includes helpful debugging checks that consume a lot of CPU - (But don't worry, it will never show up in production builds).

I really like how you described React as "striking a balance". Here's how I think about that balance:

1\. CPU time in React is an investment: What I've seen with large apps with complex css rules, is that the cost of performing even one additional style recalculation can cost upwards of 50ms - 75ms. If React invests an additional 10ms to find the absolute minimum number of DOM mutations and avoids even just one unnecessary style recalc, then we appreciate a great return on that investment.

2\. If we run into a case where we're not seeing an outstanding return on that investment, we just use React's supported optimization hooks (shouldComponentUpdate).

3\. React's API is unique in that it encourages optimizing for performance, but optimizing at the later stages of development, as opposed to the beginning stages. It's nice to develop rapidly and not let performance concerns interfere with the creative development process, while at the same time knowing that there is always a way to speed up the bottlenecks using the optimization hooks (if needed at all).

</comment></comment><comment><USER5> I get a JS error when I go to the page.

Uncaught Error: Invariant Violation - react.min.js:20

Google Chrome

<comment><USER6> Thanks, we're fixing that.

</comment></comment><comment><USER7> Is React compatible with Web Components (shadow dom and custom elements)?

<comment><AUTHOR> Yup! Here's a post showing an example of how to do it:

[http://blog.vjeux.com/2013/javascript/custom-components- reac...](http://blog.vjeux.com/2013/javascript/custom-components-react-x- tags.html)</comment></comment>


Google Casts a Big Shadow on Smaller Web Sites - <AUTHOR> http://www.nytimes.com/2012/11/04/technology/google-casts-a-big-shadow-on-smaller-web-sites.html?pagewanted=all <comment><USER2> The problem is that Google competes with businesses that once thrived on its platform. It's similar to when Microsoft decided to bundle IE into Windows. Google now bundles comparison shopping and local business reviews into search.

If they go too far in this direction it will probably hurt them. Users don't want a search engine that puts its own, lesser quality, sites at the top.

It'd be amazing if Google spun off Google Search as its own company. The business is so narrow and successful that it could probably survive for 50 years without any fundamental change. Instead, it's being distorted and weighed down by a sprawling organization that's desperate to create new businesses, and compromising the search product to do so.

<comment><USER3> Maybe you can help me understand this analogy a little better. You say that it's similar to when Microsoft decided to bundle IE into Windows, but the comparison isn't totally obvious to me at first blush.

Microsoft went to great (and often illegal?) lengths to prevent customers from considering or being able to make use of alternatives. Consumers had a great deal of lock in -- a user of a Windows computer often had software that would only be compatible with a new computer that also ran Windows, for instance. And Microsoft was able to use that leverage to acquire and keep users of its browser software.

Google doesn't seem to be following that pattern, as far as I can see. Users can (and do) make use of Google services from non-Google platforms. Google makes its products available to people using browsers other than Chrome, phones other than Android, etc. Performing a Google search requires no account.

I use Google for a lot of services, and I certainly don't want a lesser quality site at the top of my search results. I haven't seen that, either. I _have_ seen Google augment its already stellar services with new features that enhance my experience, and I ignore those things that haven't. If I ever find myself unable to ignore or disable things, I'll probably switch to another search engine. Which I'm free to do, since my use of the internet isn't controlled by Google!

You make some assertions that I'm just not seeing the evidence for, but I'd like to hear more about them. It seems uncontroversial that users don't want lesser quality search results. Where is the evidence that they are seeing them? And if they are, why aren't they switching to a different search engine? Why should Google have to separate their "core" search business from their other ventures right at a time when the expanded product (things like Google Now) is proving just how revolutionary a next-generation, personalized, multi- source search agent can be?

<comment><USER2> The thing that's similar to what Microsoft did with IE is that Google is leveraging its monopoly position to compete in new businesses.

Search "headphones" on Google and you'll see the massive ad spot taken up by Google Shopping. They've done similar things with the way they integrate Google Local/Zagat into local business searches.

That's the equivalent of the kind of deep integration Microsoft did with IE. IE wasn't just another application in Windows, it was built-in and inseparable. The same is true of Google's products, they're automatically highlighted, and at the top of, every relevant query.

It seems pretty obviously anti-competitive to me. I think their only defense is that they claim not to be a monopoly, but no one who's on the receiving end of Google traffic can agree with that claim.

I actually think they should spin off Google Search for their own sake. To maintain the integrity and long-term quality of the product.

<comment><USER4> > Search "headphones" on Google and you'll see the massive ad spot taken up by > Google Shopping

What's wrong with that? If I'm searching for headphones, why would I want to be taken to another search engine that indexes headphones? I want to be see the best prices and be taken directly to the websites that actually sell headphones.

There's nothing inherently _wrong_ with a monopoly. If you think Google is a monopoly, it's only because they provide the best results. Switching to a different search engine is _so unbelievably easy_ , I don't see how you could ever claim Google's monopoly is harmful to consumers.

<comment><USER5> There's nothing wrong with it, other than that fact that you have no choice in that case but to take Google's word for it on the lowest price. Maybe there are other sites out there that do a better job finding low price headphones but you'll never see them in the search because Google prefers its own sub- standard offering instead.

<comment><USER6> There aren't. I reckon that's probably why Google offered Google Shopping in the first place - all the other price comparison sites I've tried sucked, and it's hard to come up with a suitable incentive not to suck given the SEO techniques they use.

<comment><USER5> That might be true, but it doesn't mean there won't ever be...

<comment><USER7> That line of thinking can turn any organization into an orwellian entity.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> What's the complaint here? Google makes changes that sometimes negatively impact someone's business?

As long as Google's algorithm is trending in the correct direction (that is towards better quality results) then these complaints are just growing pains and I don't see much of a problem.

Some startups are criticised for simply being features of a chosen platform. Once they get big enough, the platform in control will simply add the feature and eliminate the startup. I'm unfamiliar with Nextag but it looks like a price comparison site and you could perhaps argue that price comparison is simply a missing feature of Google.

<comment><USER9> >What's the complaint here? Google makes changes that sometimes negatively impact someone's business?

As far as I can tell, it's largely a bunch of spammers trying to attack Google for downranking their spam.

The argument is that Google competes with them and so shouldn't be allowed to use its dominance to favor its own service. But it's pure nonsense. These companies aren't valid search results. They only ever got into the results through SEO, and then they wail when the algorithm improves to kick them out. Someone who searches for "kitchen table" is looking for a website selling or providing information about kitchen tables, not a search engine that allows them to search for websites selling or providing information about kitchen tables. The user is already _on_ a search engine -- other search engines are not relevant search results unless the search term is in the nature of "XYZ search engine."

What the complainers are doing is the equivalent of going into the largest chain of retail stores and putting boxes on the shelves labeled with a brand that the major retailer doesn't carry, which don't actually contain any product but instead contain a map to other stores that carry the brand the retailer doesn't. And then complaining when the retailer doesn't allow the spam products to remain on their shelves, and claiming it's an antitrust violation because the retailer has the most market share and it sells its own competing brands of products.

Naturally that doesn't convince judges or sell newspapers, so the spammers scour the world for instances of algorithmic imperfection that give a bad ranking to someone _else_ , who unlike the spammers didn't actually deserve it, and then play ominous music as they reveal the shocking fact that some Google engineer's 20% project or some little-known subsidiary responsible for 0.00043% of corporate revenue arguably competes with the disadvantaged website in some fashion.

<comment><USER10> As HN favorite duckduckgo shows, sometimes the best result a search engine can provide is in fact another search engine. But not always, and not forever.

</comment></comment></comment><comment><USER11> _"We try very hard to make sure we communicate with Webmasters," Mr. Cutts says. For instance, he says, he reassured Gawker Media that it would remain in search results after Hurricane Sandy caused it to crash._

This somewhat perfectly summarizes the genius solution Google found to customer service. Google is very keen to react with a personal face to high profile cases while at the same time squeezing all the thousands of faceless small businesses in similar situations into Adwords.

<comment><USER8> How is Google squeezing small businesses?

<comment><USER12> Basically, the volatility of their algorithm and the opaqueness of it means that any small business that is getting >80% Google-referred traffic is in for a tough time if they're marked as bad. And mistakes happen. Say:

* A canonical tag that shows up due to a bug. Dead.

* Industry terms that appear duplicative to the NLP parser. Dead.

* Too-diverse content. Lower rankings, but functionally dead.

There's tons more, but I'm not a practitioner of SEO.

<comment><USER13> This smells like bullshit to me. Google's search results are generally _extremely_ good from the "customer's" point of view.

People whining about how they're hurt by losing search position inevitably turn out to be spammers or other lowlife that have been trying to use "SEO" or some other shady practice to artificially inflate their search position.

So yeah, Google is bad for con-men. Darn.

<comment><USER14> I've been spending time in Black Hat internet marketing forums (out of curiosity). They hate Google. Google is consistently making their search engine better for the user and worse for spammers.

</comment></comment></comment></comment></comment><comment><USER15> I think the most serious concern is how Google promotes its own offerings above more popular competitors in the search results section. For example, do a search for "finance" and Google Finance is shown above Yahoo! finance, even though Yahoo! finance is better by most measures, and far more popular (see [http://www.businessinsider.com/google-finance-yahoo- finance-...](http://www.businessinsider.com/google-finance-yahoo- finance-2012-8) )

If you rely on Google to drive traffic, but also compete with Google, that puts you in a difficult spot.

Consumers ought to be annoyed too. Google has historically does a good job distinguishing between links that are artificially promoted (ads) and algorithmic rankings. But Google is artificially promoting their own offerings and presenting them as if they're a result of the algorithm.

This seems like a bad strategy. It has the potential to shake user confidence in Google's impartiality and link quality, annoy site maintainers, and drive away advertisers.

<comment><USER16> I'm not convinced that Google moves it's own results up as part of the organic search results. Bing puts Google Finance first before Yahoo Finance as well. Regardless of it's popularity, its position may simply because of other signals in the ranking algorithm.

<comment><USER15> Google freely admits to putting their own links first. Here's what Marissa Mayer said in 2007:

 _We didn't actually have Google Finance until about a year ago. Up until then we were ordering the links based on various published metrics... We had the five top finance sites in their order of their popularity listed there. So we rolled out Google Finance, we put the Google link first._

(You can watch it at <http://www.youtube.com/watch?v=LT1UFZSbcxE> \- that quote starts at 44:50.)

Your observation regarding Bing is quite interesting. Your theory may very well be right, but there's a hilarious alternative:

It's known that Microsoft uses Google's rankings (see [http://googleblog.blogspot.com/2011/02/microsofts-bing- uses-...](http://googleblog.blogspot.com/2011/02/microsofts-bing-uses-google- search.html) ). This would then propagate onto Yahoo, which uses Bing's engine, which means that Yahoo is told their own site is less popular. But Yahoo puts their site first, which may mean they're artificially boosting its ranking, under the guidance of you know who!

So 2012 Marissa Mayer may be artificially boosting Yahoo's rank to defeat 2007's Marissa Mayer's artificial boost of Google's rank. Ha!

<comment><USER17> Mayer's answer actually starts at 44:34 and gives the proper context: she's talking about the order of links in the OneBox (the area at the top that shows the current stock price and a plot), not the order of links in the main results. Danny Sullivan wrote a long post about this:

[http://searchengineland.com/dear-congress-its-not-ok-not- to-...](http://searchengineland.com/dear-congress-its-not-ok-not-to-know-how- search-engines-work-either-105265)

</comment></comment></comment></comment><comment><USER18> The problem: "Nextag's response? It doubled its spending on Google paid search advertising in the last five months."

Google knows this and they have an incentive to move "commercial" sites towards AdWords and move "informational" sites higher in the organic results. The benefit is engineers can claim they are providing a better end user search experience while AdWords can make even more money.

The bigger problem is that the top 10 on a search string can be very arbitrary. What should be the top ten for the search term "shoes"? Wikipedia? Zappos? Local shoe stores? A blog about shoes? Are the top 10 the top 10 because they should be there or simply because Google put them there?

Nextag is an example of a company built on a platform (Google organic search results) that is somewhat hostile to Nextag's business. It's similar to the whole Twitter client app situation. Nextag needs Google, but Google doesn't need Nextag. It's an unequal partnership of sorts and Google doesn't care of Nextag exists.

It's too bad, but that is the nature of Google's platform.

</comment><comment><USER19> I can sympathize with Nextag on the topic of Google entering their market and _possibly_ being a little less than objective regarding their own product (Benjamin Edelman has written about this several times: <http://www.benedelman.org/>).

On the other hand, getting 60% traffic from Google is very unhealthy (18 mil. of 30 mil. monthly users?) and doesn't make Nextag look like a site people stick to because of its quality. None of the sites I visit daily (directly) has anywhere near that much search traffic (according to Alexa), so perhaps Nextag hits are perceived by searchers as "generic", interchangeable results that happen to rank well on Google and they don't care much whether the hits are from Nextag, Google Shopping or any other e-commerce site.

</comment><comment><USER20> If these kind of sites stop clogging up my search results then I'm all for it, good job Google!

</comment><comment><USER21> Wow - when will this guy stop? This isn't new. Every few months, Jeff Katz goes on a Google rant. And it's getting old.

From 2011. [http://online.wsj.com/article/SB1000142405311190337400457658...](http://online.wsj.com/article/SB10001424053111903374004576583092262671326.html?mod=WSJ_hp_LEFTTopStories) [http://techcrunch.com/2012/06/08/nextag-ceo-google-is-a- mono...](http://techcrunch.com/2012/06/08/nextag-ceo-google-is-a-monopoly- google-youve-got-plenty-of-choice/)

Having worked in-house for several large online retailers as well as a handful of independent clients on the side, the comparison shopping engine industry was my obsession for several years. CSEs can make you money, but it doesn't take long to figure out all CSEs do is play a game of "sell traffic to retailers for cheaper than they can buy it themselves." After 12 months of CSEs, it was obvious that being a "CSE expert" wasn't a good career path for me.

Arguably, Nextag's four competitors are Google Shopping, Pricegrabber, Shopzilla, and Shopping.com. Google Shopping was free to list your products for the longest time (until earlier this year), which provided for a much better user experience. Between 2008 and 2010, Google Shopping's marketshare kept eating away at these other CSEs. It was clear their product was better on all fronts.

I think it should also be noted that in 2005, Shopzilla was acquired by Scripps for $525M. Scripps sold Shopzilla to a private equity company for $165M last year. Pricegrabber was bought in 2005 as well - $485M price tag. They just got dumped for ~$80M.

Most CSEs were founded in the 90s; you could argue that their models haven't changed since. It's not working anymore. Take it with a grain of salt, but peek at Google trends and Nextag's Alexa site info:

<http://www.alexa.com/siteinfo/nextag.com> <http://www.google.com/trends/explore#q=nextag>

Nextag's services are becoming obsolete. I find it concerning that their response is to "double its spending on Google paid search advertising in the last five months". I guarantee you they're seeing the same kind of traffic patterns in Bing as well.

Nextag is just a whole bunch of click arbitrage silliness. Don't drink the kool-aid.

</comment><comment><USER22> I do wonder sometimes if google's own site would pass its site quality guidelines. Like duplicated content; the same content appearing on multiple pages, all pages should be linked from somewhere on the site or a site map, substantial original content.

I think it fails on all three of these, so in some sense it is anti- competitive to block other sites that fail these measures whilst it doesn't hold itself up to those same standards.

<comment><USER10> Example of a bad google page that ranks high in search?

</comment></comment><comment><USER23> Hmm I wonder if Nextag's traffic is being affected not by Google's algorithm changing to hurt them personally, but rather to include more localized results.

Example: Whenever I want to do comparison shopping I would type in "{{product name}} price canada". A few years ago Nextag would always come up first and I would click on it, only to be frustrated by the fact that the retailers listed were all American. Now not too long ago more and more of these services cropped up that offered Canadian listings (shopbot.ca, canoe.ca, and now even Canada Post has their own website that does the same thing). Now imagine this happening country by country all over the world and it's not inconceivable that Nextag's traffic would be shrinking. Also I've just realized that Nextag also has a .ca destination but for some reason I've NEVER seen it come up in my results.

</comment><comment><USER24> The entire premise of this article seems bogus to me.

"Google casts a big shadow on smaller web sites."

That title implies that Google is specifically targeting smaller web sites which isn't the case.

The problem seems to be that some shady small business did some shady stuff, got caught and got mad about it.

Google didn't go and replace them with walmart, they probably replaced them in the results with a similar sized company. Someone lost and someone won – that's it.

I'm the first to say Google should step up it's customer service, but it's disingenuous to act like Google is proactively seeking out small businesses who never did anything wrong in favor of big massive conglomerations.

</comment><comment><USER25> Our web app has recently been hit by a Google algorithm change. Search traffic has fallen off a cliff. If it continues, it could be a threat to our business.

We have never done any underhand SEO. We haven't done any SEO at all. People love the app but now, alas, they can't find it.

Ironically, just before we fell out of the search rankings, a Google developer evangelist got in touch to say how much they liked our app and that Google would like to partner with our app on an upcoming initiative.

If there are any Google engineers here who would like to help, I'd be most appreciative.

<comment><USER10> Do some white hat SEO.

Google.com/webmaster

</comment></comment><comment><USER26> It's tough to find any wrong doing by Google in an article like this. It's pure speculation. Many of their tools, step on other sites toes. Hipmunk and kayak recently had to deal with <https://www.google.com/flights/>.

When searching for goods such as "macbook pro" you'll notice sponsored links with prices that Google "may be compensated from". That type of stuff seems unfair to me.

I won't say Google is playing unfair as of late, but they are certainly more than just displaying results these days.

</comment><comment><USER27> Well, if you are not satisfied with google you can always use bing and yahoo. I do suggest you search for the same thing on each service to see the differences in your rankings.

One thing I did not see mentioned was the new google rollout on adwords and merchant center (google base feed). Google use to allow free submissions of products into the shopping segment, but now all of your product submissions must be linked to an adwords account by which google adwords can charge you. It steps directly on nextags formula.

</comment><comment><USER28> I work for a company that relied primarily on Google for it's source of revenue. About a year ago our traffic dramatically dropped because of a change in Google's algorithm. We always had plans to diversify our business but we never did. At the time it hit us hard, but we were able refocused our business. As a consequence our business is far healthier than it was in the past. Google is only a fraction of our traffic generation strategy, essentially we have a sustainable business model now.

</comment><comment><USER29> It seems like NexTag, and maybe other sites, are complaining that they are getting less free traffic from google. Why do they think they are entitled to have as much free traffic as ever?

Towards the end, they say they are on their way to stop living in "Google's world" and the revised plan gives them "a shot at being a very healthy company," less dependent on Google. Well, great! So if they are able to do that, why involve regulators? They should have done that before!

</comment><comment><USER24> I'm really amazed (and impressed) at how many mentions & links Vote-USA got throughout that article. Seemed like an inordinate amount for the number of times it was mentioned.

Also, I get the whole "we got deindexed" from Google, but duplicate content is not necessarily a new thing. If you got penalized for it, so did a bunch of other people. You shouldn't act like it's a surprise and whine about it. Just fix it and move on.

<comment><USER10> (Obligatory <http://paulgraham.com/submarine.html> link)

</comment></comment><comment><USER30> > The government's scrutiny of Google is the most exhaustive investigation of > a major corporation since the pursuit of Microsoft in the late 1990s.

I can't help to notice that apparently in the last 15 years or so, a significant government interest was only focused on high-tech companies. Looks like more "traditional" branches of economy and companies working therein are generally behaving fine...

Companies like Lehman Brothers, for example.

</comment><comment><USER31> Google Search is becoming more like adwords. They just removed a site I manage because it doesn't meet the Google quality guidelines easyfastcheaponlinetrafficeschool.com. When they remove your site its like disappearing from the internet... I had to switch the site to a new domain and the loss in sales has been about $70,000+ so far not to mention spending more on adwords.

<comment><USER10> Pretty sure Google's long published webmaster guide discouraged that domain name years ago.

</comment></comment><comment><USER32> Some sites go down in rankings, but other (hopefully) more useful sites go up in rankings.

Also if your company is impacted negatively by this, you should attempt to focus more on social network effects to reduce reliance on Google. For example, integration from Facebook and Twitter opens up more channels for users to visit your site through.

<comment><USER33> my 5 year old website has dropped traffic 3X suddenly, I was shocked, who to blame now, Google? [https://dl.dropbox.com/u/45940875/google-negatively- affects-...](https://dl.dropbox.com/u/45940875/google-negatively-affects-my- traffic.jpg)

</comment></comment><comment><USER34> Dont want to see Google monopolize the search engine market in future, and it is the reason why sometimes i will use bing.com. Actually it is not bad.

</comment><comment><USER35> The folks at Nextag (which by the way sells product listings without disclosing them and then complains about google: [http://searchengineland.com/given-nextags-lack-of- transparen...](http://searchengineland.com/given-nextags-lack-of-transparency- its-wsj-opinion-piece-asking-for-google-transparency-isnt-wise-124045)) are telling the same sob story to every reporter who would listen. Their complaint is that they keep getting less _free_ traffic from Google as if they are somehow entitled to it, they insist that they are living in a "Google world" and then go on to contradict that by saying that they are diversifying.

It's frustrating that the reporters are trying to cast doubt over every instance of a website getting demoted in rank as if the web is static and Google's code base is unchanging, and they don't even give much consideration to inevitable errors in large and complicated systems. They offer no proof just speculations and innuendo.

But what I find to be most frustrating is that this article shares the same blind insistence with Google's opponents that search engines must only rank blue links, and only links to other websites, which is not only an ati- innovation stance but also an unintuitive one. As IBM's Watson and to a lesser extent Siri has shown, search interface is about immediate answers, and the ultimate answer to these accusations still stands: if you don't like Google's results use another service, if you can't reach a certain website via Google you can go directly to their website or get their smartphone app or follow them on Twitter or Facebook or bloody Instagram.

It is also worth mentioning that the NYT ran editorials urging the government to investigate Google, and I think a disclaimer mentioning that ought to have preceded the article: <http://www.nytimes.com/2010/07/15/opinion/15thu3.html>

<comment><USER36> _If you don't like Google's results use another service._

Sure, but Google has two kinds of customers: searchers _and_ websites.

Maybe you believe websites shouldn't hide from Google because it makes no strategic sense. Twitter and Facebook don't let Google index their content. Why would they let Google front-run ads on their content? It's not a catchall rule, to hide with robots.txt.

Maybe websites should just pay up: they should auction for higher results, if their business depends on search placement. But that's misunderstanding Google's role.

Google isn't a salesperson. It's more like a _road_. Both bring business to your door (literally), but the latter gets used by everyone for everything. And it turns out it doesn't matter how you pave the road (roads have been public since the Egyptian times, yet road-building technology has changed dramatically) or whatever.

To Nextag, Google is a utility. It is only by tradition that some monopolists become utilities and others do not. How do you regulate Google for what it is: a public utility?

<comment><USER37> No, google has one customer: advertisers. Searchers don't directly make Google any money, advertisers do. Google is not a public utility, it's the most successful online advertising machine ever.

<comment><USER24> Google has 2 customers: Searchers AND customers.

Google has to get searchers to sell to advertisers. That said, the generic 'websites' mentioned above are not Google customers. Google does not "owe" them anything – they owe the searchers the best results and the advertisers clicks at a certain cost. The only thing those other websites do with their free listings are attract eyeballs to Google's engine.

<comment><USER37> No, a searcher is not a customer, a searcher is the PRODUCT. Google is the marketplace, their customers (advertisers) are buying the product (traffic) via ad spend.

The entire reason Google improves the search engine is to keep you coming back so they can learn more about you to make their advertising even better. You, as a user of Google, are their product. They are selling YOU to advertisers.

Google is a company, not a utility, not a public service. They are in the business of profit.

<comment><USER38> The economics of this all are quite interesting: <http://en.wikipedia.org/wiki/Two-sided_market>

However, cheap polemics (like being very adamant about who gets to be the customer) help nobody. Two-sided markets can push prices for one side of the market below zero, that's just an inherent property of those markets. That does not mean the one side is the product.

Google has to provide value to you, otherwise they couldn't make money. If they screw you they screw themselves.

Now, this doesn't mean that Google can do no evil, but it does mean that you can't just assume by default that the relationship between users and Google is an exploitative one.

(And two-sided markets are nothing new. Google has essentially the same business model as the free magazine that informs me about cultural events in my hometown. Because of their very well targeted ads – local restaurants, businesses, etc., often pointing to current events – they can offer that magazine for free. That doesn't mean I'm the product.)

</comment></comment></comment></comment></comment></comment><comment><USER39> The question is, is google the web? why do we rely so much on google ? because we became lazy ... because browsers like firefox promoted google search heavily , until it becomes obsolete as a browser itself because of chrome , because all these comparison sites built their businesses on google search engine, and now google has his own shopping search engine , they became obsolete , and the list goes on and on... our businesses rely too much on google, until google take us out of business...

<comment><USER13> > _why do we rely so much on google ? because we became lazy_

Because google delivers amazingly good results.

[Oh, and FF certainly isn't "obsolete because of chrome." Both are fine browsers, and the competition has proved beneficial to both of them.]

<comment><USER40> Furthermore, judging by this graph

[http://en.wikipedia.org/w/index.php?title=File:Usage_share_o...](http://en.wikipedia.org/w/index.php?title=File:Usage_share_of_web_browsers_\(Source_StatCounter\).svg&page=1)

it seems that Chrome's rise in popularity correlates with IE's decline.

<comment><USER10> Recent reports show IE gaining and FF dropping.</comment></comment></comment></comment>


Demo – Login Without Password - <AUTHOR> https://webauthn.org/ <comment><USER2> FF 52.8 ESR not supported, at least not with my addons in this little VM.

</comment><comment><USER3> Also not supported on iOS.</comment>


Simply Secure PHP Cryptography - <AUTHOR> https://paragonie.com/blog/2017/07/it-turns-out-2017-is-year-simply-secure-php-cryptography <comment><USER2> _1\. Clean up old tutorials, forum posts, and blogs._

This! I'm still seeing code snippets on StackOverflow that use hashing for password storage and queries without prepared statements.

I think at the moment that is still a weak spot of PHP.

Edit: my mistake. I was refering to weak hashes like md5 and sha1 or 'home brew' hashing.

<comment><USER3> > use hashing for password storage

As opposed to...?

<comment><USER4> PHP has had a _dedicated_ password hashing function since version 5.5: it's password_hash().

But at least, if you want to roll your own password hashing, do it right: use hmac, salting, stretching and a decent hash function - or use bcrypt/scrypt and save yourself a few headaches.

<comment><USER3> I'm well aware of that. The original comment suggested that password hashing is bad, I was trying to identify what the poster thought should be used instead.

<comment><USER5> Evergreen: [https://codahale.com/how-to-safely-store-a- password/](https://codahale.com/how-to-safely-store-a-password/)

</comment></comment></comment></comment></comment><comment><USER6> I'm frequently amazed by how much Scott has single-handedly accomplished in bringing modern security practices to PHP. Huge props!

<comment><USER7> While I don't want to downplay his role in mobilizing the community, it's hardly single-handed. Implementing ext/sodium was a group effort by dozens of developers, reviewers, and testers.

<comment><AUTHOR> > it's hardly single-handed

I can't emphasize this enough.

Libsodium was Frank Denis's project, which was spawned by NaCl by cryptographers Dan Bernstein, Tanja Lange, and Peter Schwabe.

The participants who voted on the RFC, for the most part, were involved in the technical discussions over the past two years since I first mentioned the notion of doing so (before the PHP 7.0 release).

Similarly, there were 13 people who contributed to the libsodium-php repository (ext/libsodium in PECL). Every single one of them had to consent to relicensing the extension to easily get merged into PHP, and we all did.

I often joke that I'm the worst C developer in all of infosec, but there's some truth to that when it comes to modifying the PHP core.

My main role in the ext/sodium project was saying, "We should do this," and somehow getting people to listen.

</comment></comment></comment><comment><USER8> If you can't wait until PHP 7.2 is available, version 2.0 of the standalone extension was released on PECL: [http://pecl.php.net/package/libsodium](http://pecl.php.net/package/libsodium)

It's identical to what was merged to PHP 7.2 (actually a bit better since some pull requests haven't been merged to php-src yet).

</comment><comment><USER9> Until then php composer.phar require defuse/php-encryption

</comment><comment><USER10> I'm not entirely sure I believe that. I saw a Paragonie project that was posted a while back, supposedly a "secure by default" CMS. I looked at the code and saw it was an hard to audit mess that decided to implement everything itself. It's own ORM, own router, own MVC framework. I spent an hour and found numerous issues[1] in the code.

I don't believe re-implementing the wheel like that is a 'modern security practice'. I asked why they did that instead of using robust, well tested and well supported libraries and did not get a satisfactory answer.

While it's not the author's project (I think?) he is still part of the company, and I'd hope such a security-focused organization wouldn't have done something like that.

1\. [https://paragonie.com/project/airship](https://paragonie.com/project/airship)

2\. [https://news.ycombinator.com/item?id=13905055](https://news.ycombinator.com/item?id=13905055)

<comment><AUTHOR> This is off topic and reads a bit like a personal attack, but if you want to have a level-headed discussion about Airship's design and implementation, [https://github.com/paragonie/airship/issues](https://github.com/paragonie/airship/issues)

A lot has changed since you last looked at it, and a lot will change before the v2.0.0 rewrite is complete.

<comment><USER10> I'm sorry that you read it as a personal attack, I did not mean for it to read that way. I was merely pointing out something that I consider to be designed contrary to security best practices in response to a comment about security best practices.

I'm glad to hear things have changed in the code however, and wish you the best with the rewrite.

<comment><USER11> You replied to a comment praising Scott for improving PHP security by saying "I'm not sure I believe that", and then ambiguously attacked his code. Who are you trying to kid?

I don't much care one way or the other about whether it's OK to try to take people down a peg, but I do care very much when people do that and then try to get away with pretending that's not what they're doing.

</comment></comment></comment></comment><comment><USER12> Adding secure crypto to PHP is like putting a Schlage lock on a pup tent.</comment>


New Drug Attacks Fat, Helps Obese Monkeys Slim Down - <AUTHOR> http://abcnews.go.com/Health/drug-attacks-fat-helps-obese-monkeys-slim/story?id=14915646#.TrsEsENT-rs <comment><USER2> This could be great if it doesn't have significant side effects for humans. I won't hold my breath.</comment>