Dark Patterns - <AUTHOR> https://www.darkpatterns.org/ <comment><USER2> 8 months ago:

[https://news.ycombinator.com/item?id=18722952](https://news.ycombinator.com/item?id=18722952)

Also:

[https://news.ycombinator.com/item?id=13116703](https://news.ycombinator.com/item?id=13116703) (3 years ago)

[https://news.ycombinator.com/item?id=6301378](https://news.ycombinator.com/item?id=6301378) (6 years ago)

[https://news.ycombinator.com/item?id=5347543](https://news.ycombinator.com/item?id=5347543) (6 years ago)

[https://news.ycombinator.com/item?id=4002625](https://news.ycombinator.com/item?id=4002625) (7 years ago)

</comment><comment><USER3> One thing I don't understand is why we are calling these patterns _dark_ rather than _manipulative_, or even just calling it straight up manipulation?

I feel like manipulation has a clear meaning for a lot of people, which I would define as attempts at making you do things against your best interest. This definitely applies to booking.com's multiple practices of creating artificial urgency, various website's "opt-in" to their tracker cookie policy, etc. I don't believe it "weakens" the meaning of manipulation as a term. The appropriate red flags should be raised when hearing about it.

To me, the term "dark pattern" itself seems like a dark pattern, intended to obfuscate what is really meant to those unfamiliar with internet lingo. But, at least the dot org -is-was still available.

<comment><USER4> It's probably called dark because the user is often 'left in the dark'[0] about how to use the interface

[0] [https://idioms.thefreedictionary.com/left+in+the+dark](https://idioms.thefreedictionary.com/left+in+the+dark)

</comment></comment><comment><USER5> It's missing the one that I hate the most: the way Booking.com and similar sites create a fake sense of urgency.

"9 people are actively looking at this hotel right now!"

Yeah, right.

<comment><USER6> Many years ago, I reviewed the code at Booking.com that implemented this (in the version thar existed at the time, there's many more variants of it today) and it had a clear enough definition and was roughly what you'd expect it to be if you tried to design/implement it faithfully but without crazy out-there amounts of work: "number of detected-as-not-a-bot page views for this hotel (page) within the last X minutes" where X was, if I recall correctly, "a few" as in single digit. It was done by consuming a near-real time steam of logs, such that the X minutes above wouldn't be massively biased by the processing delay. I'm certain this was reimplemented at least once since because that wouldn't scale any more to their volume today.

Also, this functionality has received significant amount of scrutiny from some regulators, so last I looked, there was a mouse over that gave the actual definition.

That being said, in no way am I trying to convince anyone that it's not a "dark pattern" or that you have to think it's a good idea on any way. Just looking to preempt some comment that claims Booking.com is actively lying about this. They weren't ~5-6 years ago when I read the implementation and I don't they could've started doing that systematically since then due to regulatory attention.

<comment><USER7> I don't know, still, most people's "psychological setup" isn't wired to handle this kind of manipulation on a frequent basis, _even if_ "designed/implemented it faithfully".

It would just make the web a little more serene place if the said websites did away with these kind of pernicious practices which only induce stress and agony.

<comment><USER6> I'm with you. Weirdly, even though I certainly have an above average understanding of these tactics, they almost certainly still have a minor effect on me anyway.

What I was trying to do was to preempt the allegations that Booking is lying to its users. None of the allegations I'd seen while I was there actually checked out on that front. I, like most others, severely disliked the urgency messaging, but as is with ethics discussions, it was never clear cut. I did not perceive that there was a widespread culture of trying to trick users into purchasing something they didn't want. For most of my tenure, I managed the infrastructure department, not product, so was a bit removed. Experimentation infrastructure fell into my scope, though. We invested significant effort into both education and countermeasures for things like p-hacking.

</comment></comment></comment></comment><comment><USER8> The video is a good example of why Linkedin's popularity is completely baffling for me — if a company has intentionally and malignantly mishandled your information in such a way a number of times, why would anyone want to hand over even more information? People you connect to, who you know, etc. It just blows my mind. Luckily I've had no problems with boycotting them, but I guess it might be hard in some industries?

<comment><USER9> I see it like this: yes, it's a poor website which comes down to semi- legitimised spam.

However, recruiters already were semi-legitimised spam, and they like LinkedIn because it's easier/more signal vs noise for them. Employees like it enough not to quit if there's a potential new job. Signal vs noise is not much different from dealing with job hunting/recruiters outside of LinkedIn. Network effects take care of the rest.

</comment></comment><comment><USER10> I've been trying to cancel my New York Times crosswords subscription for days. You cannot do it on the account management page, instead they force you to talk with their support.

Their recommendation is to use the chat support but whenever I try it says: "All of our advocates are currently occupied. Please try again soon or call us now." I also tried to do it in email, of course no response for 2 days now. I'm not from the US so I don't want to call them on the phone...

Unbelievable that such a big name as NYT does this with their customers, this is disgusting and I can't believe this is not against the law.

<comment><USER11> Some credit card companies will handle this kind of thing for you. Just tell them you've tried to cancel your subscription and explain the situation.

</comment></comment><comment><USER12> The king of dark patterns: [https://www.viagogo.com](https://www.viagogo.com) (try with any listed event)

(edit: they recently got banned from AdWords IIRC)

<comment><USER13> That company is basically built on deception.

</comment></comment><comment><USER14> I still remember one of the first businesses I did a contract for in the early 2000s wanted a hit counter on the bottom of their page.

So I put one in but they wanted it to start at 10,000 instead of 0 to give a false sense that the site was popular. This stuff has been going on for decades.

<comment><USER15> thousands of years

<comment><USER14> Yeah absolutely. The diamond industry is a good pre-internet example.

</comment></comment></comment><comment><USER16> Another pattern:

When companies slow down their web experience and push their mobile apps, where users cannot block tracking or ads as easily.

<comment><USER17> I think Reddit does this...

The mobile site is absolute garbage.

</comment></comment><comment><USER18> There's one more: Suggesting that you lose benefits in a subscription business right away, when in reality, they run until the "contract" ends. Culprit: Amazon Prime. I just checked and they're still doing it (on Amazon.de).

If you try to cancel your Prime Membership, they make it sound as if you lose all benefits right away, even though I pre-paid for the entire year and my membership will end with the billing period and not before.

<comment><USER19> If you want to get really evil, combine this with "you need to tell us you want to cancel in advance or we'll charge you a termination fee". People will put it off thinking they will lose the benefits, then find themselves on the line for a fee because they didn't do it earlier (often giving up and continuing instead).

<comment><USER20> My old ISP had me mail them a copy of my new lease to prove that they could no longer service my area (let alone my state) to avoid a termination fee. Shit is byzantine.

</comment></comment></comment><comment><USER21> And the "growth hackers" that came to prominence a few years ago that masterminded these dark patterns are now all VCs.

<comment><USER22> Haha. This is true. I personally know a few.

</comment></comment><comment><USER14> What about ecommerce sites where they pop up a little notification where it's like "Cathy from Ohio just bought ..." and then it links you to the item.

Or even worse, you have XYZ in your cart and then suddenly as you browse you get all of these notifications that the world is buying that same item so you better checkout soon before you miss out.

You see this a lot on Shopify stores. Here's one app for it: [https://apps.shopify.com/mps-sales- notification](https://apps.shopify.com/mps-sales-notification)

I never used it but I wonder how many of those are fake notifications in general.

</comment><comment><USER4> Some services like Amazon make it outrageously difficult to leave their service. You have to contact support and the link is buried really deep in their site, you have to jump through serious hoops to leave their service.

There's a great site called Just Delete Me[0] that lists all the services where leaving / deleting your account is hard and the user is subjected to dark patterns.

[0] [https://backgroundchecks.org/justdeleteme/](https://backgroundchecks.org/justdeleteme/)

<comment><USER23> Kind of funny to see that Hacker News gets worst ranking there :-)

</comment></comment><comment><USER24> I'd add unnecessarily asking for a mobile phone number for the stated purpose of two factory authentication and then using that for privacy mining ala Facebook[1].

[1][https://metro.co.uk/2019/03/04/facebook-lets-people-find- pro...](https://metro.co.uk/2019/03/04/facebook-lets-people-find-profile- using-security-phone-number-2-8800876/)

</comment><comment><USER25> GMail seems to have opened a vector to amplify dark patterns by placing action buttons on messages. My least favorite is the LinkedIn accept invitation button, which I've clicked now several times by accident because I've spent years using GMail without it taking actions like opening GitHub PRs and accepting LinkedIn invites.

I can't find a way to disable this feature. Does anybody know how?

<comment><USER26> Not sure this is a GMail feature. This would technically be possible with any HTML link styled like a button.

<comment><USER25> It's built into the inbox view, so GMail is extracting the action from the message content and placing a button on the row element. Sorry if that wasn't clear from my initial post.

</comment></comment></comment><comment><USER27> A dark pattern I submitted but was never accepted is clicking unsubscribe in an email and getting redirected to a page that asks you to check the boxes that you would like to _not_ unsubscribe from, or to remain subscribed to, when I expect simply to be unsubscribed from the offending mailing list.

</comment><comment><USER28> Roach Motel is a great name, but surely it should be called Hotel California?

<comment><USER29> Well, a Roach Motel [0] is also something that is easy to get into but hard to get out of, but the name does imply that you are a roach for getting into it...

[0] [https://en.wikipedia.org/wiki/Roach_Motel](https://en.wikipedia.org/wiki/Roach_Motel)

</comment></comment><comment><USER13> Please call it asshole design.</comment>


Ask HN: What do you wish monit/cacti/nagios/zabbix/etc would do? - <AUTHOR>

My co-workers and I have been writing some software to monitor the activity and health of our servers at work. We found that many of the available solutions were either painful to deal with and setup or expensive. We were hoping to find some sort of agent-based hosted solution similar to most of the current web analytics services. We couldn't find one we liked so we're creating one. We're at the point where we're just pre-processing the incoming data that we're tracking.<p>What type of info and data do you all think we could all use for server analytics/metrics? <comment><USER2> I've thought about creating this about 5 times; the existing services really haven't gotten it quite right, IMO. For me, exactly what metrics to measure are not as important as the poor correlation tools. The usual suspects are fine for 'easy' and the non-usual suspects will always require custom scripts.

More important for me is letting go of 'server stats'. The existing tools you mention are stuck in pre-cloud days, assuming that I care about a graph for a particular server as opposed to the average/95th %tile/99 %tile across a group of servers filling a role.

The best solution I've found is OpenTSDB, which lets me tag any data point, which lets me tag web server CPU use metrics as 'web' and not worry about when machines go up and down when I'm looking at web server CPU use. But OpenTSDB is a pain to setup and if someone jazzed up the graphs and made it a service, I'd buy it.

<comment><AUTHOR> Correlation is also why we started this. A little story: we were using Cacti on a cluster of ours. I was showing a friend of mine the graphs, only because I was explaining our infrastructure setup. I noticed one had unusually high CPU load. The server with the high load was one of our SQL database servers. I SSHd into it and sure enough it was MySQL causing the load. But ... why? So, after so log file browsing, we found that our site was being scraped by some bots, and the particular page being scraped was doing a sorted query on a small range of data, which was causing the entire table to be sorted then scanned, which was causing high CPU usage, we thought. So, the correlation there between high CPU usage and the cause was less direct, and a simple graph was only enough to alert me of the fact that there was a problem on that machine. Plus, I wasnt even alerted - I stumbled upon it.

So, this is something we're aiming to fix.

<comment><USER2> If you can correlate semantically-parsed log data with time series to automatically understand that particular problem, you're solving problems harder than server monitoring and applying them to server monitoring, IMO :) Not that there's anything wrong with that!

</comment></comment></comment><comment><USER3> I feel that Nagios style system monitoring is done. Writing Nagios plugins is fairly easy, and tools like Opsview give an API for adding servers. Monitoring disk space, memory, CPU, processes, etc works great in any of the above tools.

The problem with them is reporting data tends to be in RRD silos and doesn't work well at the application layer.

I store metric data in Graphite from my application. If there is something I want to monitor for performance purposes in my application, I put markers around it and this information goes into Graphite. This can be graphed, or CSV data can be pulled.

I want a tool that can monitor values stored in Graphite and notify me if something is out of range. I've been thinking about building a Nagios plugin that does that, I just haven't gotten around to it yet.

</comment><comment><USER4> An absolutely necessary feature for me is auto-discovery. Zabbix really has this down with recent versions. If your system has comparable templating/groups and the ability to autodiscover in IP ranges you'd be +1 on most solutions. If you then added better dashboards (ala Zenoss?) and the ability to acknowledge events from emails etc then you'd really have something I'd try out.

Here's the bar for me: If I spend a few solid days on zabbix per "server class" (ie: mysql, web server, etc) I can have everything I need automatically monitored with zero effort for me going forward (to ~1000 servers). That said, acknowledgement of alerts, etc is a huge pain in zabbix.

<comment><AUTHOR> Alerts, in various forms, are definitely one of our top priorities. That was the spark that ignited our project. So, we're focused on making those as intuitive as possible.

As for auto discovery, we have a rudimentary form of this in place. Spreading of the software agent is manual, but its as easy as running it on a new server to get it up and running. The data reporting and metrics all begin automatically.

</comment></comment><comment><AUTHOR> Just looking for some feedback on the initial concept. Thanks.

</comment><comment><USER5> Scout is actually pretty good, not sure if you saw it or not.

<comment><AUTHOR> I hadn't seen Scout, yet. That's good to see a similar service. Having not seen them until now, I can say that we had planned to provide slightly more for less than they do, in terms of data logging and analytics. It's neat to see them, because the things we have come up with are closely in line to them except that I think we genuinely can compete.

<comment><USER2> I looked into purchasing this exact kind of service a few months ago. I admit that it was tough to find them--they are often not on the front page of google --but there were 3 or 4 players in addition to varying installable tools (sorry, names now forgotten). None really seemed to be what I want, and they were not particularly cheap. I didn't buy any, which is a customer looking to buy in the space and not finding a solution, so by all means give it a go. But you're missing some homework if you had not yet found Scout, which is front and center in this space. One of them even had a whizbang way to edit and test your little agent plugins in the browser in ruby (was that scout?) You have some mature competition here you should consider.

<comment><AUTHOR> Thanks for the response. We really started custom building our own tool, in house, to do exactly what we wanted. We manage about 150 physical servers, so we can't benefit from the underlying hypervisor info that some VM platforms provide. We have been writing our own, and subsequently feel like we could offer this at a very affordable price. We hadn't seen Scout, mostly because we just dove right into making our own tool. We're now doing some research and are finding that we're right on track in terms of being in line with functionality that others provide - like Scout. We're not tied to Ruby, though. I don't even know if our Linux servers come with Ruby - never used it. Admittedly, ours is a little less mature, which is not a bad thing since we are so new, but we're going to continue following our gut on this and just make it as useful of a tool as possible.

<comment><USER2> None of the players are tied to Ruby, but the agents are often written in it (not ideal, as the usual 35MB memory footprint adds up over many servers).

In any event, don't take my call for research as a call not to join the party. The fact that you haven't heard of them means that none of them have quite solved the product/market fit stage and made it to ubiquity. Being intimidated or imitating them would not be the way to go, but knowing about them would probably be useful, and they have some good ideas.

(alternately, it means that most people prefer to do this in-house, and there's just not a market there. But I don't believe that, this is such boring stuff that happens on every project...)

anyways, good night and good luck</comment></comment></comment></comment></comment>


Updating the Git protocol for SHA-256 - <AUTHOR> https://lwn.net/SubscriberLink/823352/ea717c1e49390505/ <comment><USER2> One of the comments mentioned that there was a suggestion (presumably rejected) to "rotate" the first character of the hex string for the SHA256 hashes by 16 characters, so 0 becomes g, 1 becomes h, etc. (that way the SHA256 hashes would be unambiguously not SHA1 hashes, even when abbreviated).

This made me think... why are we using long, unwieldy base-16 hex strings at all? Why not use an alphabetic (non-numeric) base-46 string: 20 lowercase letters ([g-z]), 26 capital letters ([A-Z])? Then the new SHA256 hash strings end up being _shorter_ than the old SHA1 strings, and there is no overlap with the [0-9a-f] range of the base-16 strings.

If you wanted to even it out to 64 characters, you could create a "modified base-64" that doesn't use [0-9a-f] and instead uses more special characters (though for convenience you'd want to choose characters that are shell-safe and possibly even URL-safe, which might make this not work). Alternatively you could use a subset for a base-32 representation.

The downside -- perhaps a significant one? -- is that you can't use standard tools like `sha256sum` or the representation conversion functions into the stdlib of many languages to generate these hashes; it would require custom code. Not sure if that's a concern, though.

<comment><USER3> > This made me think... why are we using long, unwieldy base-16 hex strings at > all? Why not use an alphabetic (non-numeric) base-46 string: 20 lowercase > letters ([g-z]), 26 capital letters ([A-Z])? Then the new SHA256 hash > strings end up being shorter than the old SHA1 strings, and there is no > overlap with the [0-9a-f] range of the base-16 strings.

Are you sure? SHA1 hashes are 40 hex digits, and SHA256 hashes are 64 hex digits. But in base 46, 2^256-1 = 3ZS4A7V5Ki0LWg1f3Of06YNfgQXCA2P0Q6RACKhEIWQXe07, which is 47 base-46 digits long, so still longer than SHA1. (This is not your base 46, since it's using 0..9, A..Z, a..j.)

      import gmpy2
      gmpy2.digits(2**256-1, 46)
        -> '3ZS4A7V5Ki0LWg1f3Of06YNfgQXCA2P0Q6RACKhEIWQXe07'
      gmpy2.digits(gmpy2.mpz('f'*64, 16), 46) #same, but more clearly the "maximum" hash

edit: more code to try kelnos's proposed digits:

      gmpy_digits = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
      new_digits = 'ghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
      ''.join(new_digits[gmpy_digits.index(d)] for d in gmpy2.digits(gmpy2.mpz('f'*64, 16), 46))
        -> 'jPIkqnLlAYgBMWhVjEVgmODVWGNsqiFgGmHqsAXuyMGNUgn'

I think hex strings are probably still better, as there's less ambiguity, and 47 characters isn't much shorter than 64 for practical purposes.

<comment><USER4> One of the mistakes Git made was that the hashes don't describe what algorithm was used to generate them. That makes backward compatibility and incremental upgrades harder. MultiHash is a solution for such issues: [https://github.com/multiformats/multihash](https://github.com/multiformats/multihash)

<comment><USER5> You don't need a specialised solution for this, just prefix the v1 of your hashing algorithm with some constant and then you can easily extend it.

</comment></comment></comment></comment><comment><AUTHOR> This article by John Coggeshall is an example of great technical writing. I look forward to reading more of his work.

The more I learn about Git, the more it blows my mind. Torvalds must have designed Git in his head during the time he was using BitKeeper. When he decided to implement Git, he went to work and in a few weeks he had it working well enough to use for Linux kernel source control. Torvalds is either a genius or merely a superstar computer scientist and software engineer. Choose any two.

<comment><USER6> I'm almost certain if it weren't Torvalds, it would be someone else who creates something like Git. He just had the need and skills to create it. Like Bill Gates he was just a competent person, at the right place and time.

<comment><USER7> > I'm almost certain if it weren't Torvalds, it would be someone else who > creates something like Git. He just had the need and skills to create it. > Like Bill Gates he was just a competent person, at the right place and time.

I think it's fair to point out that Torvalds didn't come up with Git on his own - he was influenced by a good amount of prior art, not the least of which was Bitkeeper.

However, I think calling him a "competent person, at the right place and time" undersells him to a substantial degree.

1\. He's a world class software developer.

2\. He's a world class tech lead (There are certainly criticisms about his communication style, which I don't think are unfair. Here, I am judging him by the artifacts created under his leadership).

3\. He was the write lock for an extremely large distributed team for more than a decade.

It is not surprising to me that the 2nd most famous distributed source control tool - Mercurial - was also initially created by a Linux kernel developer.

<comment><USER8> > It is not surprising to me that the 2nd most famous distributed source > control tool - Mercurial - was also initially created by a Linux kernel > developer.

Because Linux was in a crisis and hot off an excellent experience w bitkeeper? Or something more profound?

<comment><USER7> > Because Linux was in a crisis and hot off an excellent experience w > bitkeeper? Or something more profound?

I'm sure the crisis was part of it.

But also, the way Linux development is organized is very weird compared to how code is developed in most places. "Distributed" is not quite right, but it's the best word I've got. A source control tool like Perforce just wouldn't fit linux development very well, whereas large companies at the time were perfectly happy with it.

<comment><USER9> "Decentralized"?

I agree with you that Linux development is weird compared to most places. Most places have a designated central repo that acts as the source of truth, whereas the Linux developers don't really have this.

This is possibly an unpopular opinion, but I think that when there is an official main repo, git is far more complicated than it needs to be. It's confusing to a lot of developers because of all this unnecessary complexity. Most teams could probably be served better by a simpler system.

<comment><USER10> I share this opinion as well. For centralized-repo style, which is what most teams need, the Git model has three problems:

\- It is hard to use. There's a reason most teams have a single or two Git "experts" to help everyone else resolve repository / merge / pull / whatever problems that happen regularly. The onboarding experience for developers unfamilir with Git is very bad, and many of them end up never able to use it. If you have non-developers (e.g. artists), it is even worse.

\- Binary files. Yes, there is Git LFS, but there are many small integration problems when you try to use it, and the simple fact that Git needs something special to manage binary files is a problem. And no, storing binary files outside the repository is NOT a good solution. In games for example, the binary files and the engine usually evole together and if you want to checkout an old version, the code and the assets need to stay in sync. You want to version the game, not just the engine.

\- Partial (subtree) clones and permissions. There's a reason monorepos are popular: they're much simpler to manage. Unfortunaly, because Git barely does partial clones and cannot manage permissions (inside a repository) at all, monorepos are much more limited than in SVN or P4. That's why many projects end up divided in multiple repos, but this brings all sorts of problems and a large administrative overhead for all developers.

<comment><USER11> Give bitkeeper a try, it's now FOSS

-Simple clean interface

-You can work the linux way or with a central-repo-style

-Binary Asset Manager build in

-Nested (submodules done right)

<comment><USER10> Interesting, thanks for the tip! I'm gonna give it a go during the weekend.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is going to be such a pain for clients to support. Especially because there's not really a good specification for git - the official implementation is the specification. For my client I think I will just have to wait until this is officially enabled before implementating it. Guess it has to be done though.

I don't understand the bit about distinguishing hashes by length only. If you're going to change it why not add an identifier prefix? Then the logic can be "if length == 128 { its sha-1 } else { read first byte to determine hash algorithm }".

</comment><comment><USER13> Wouldnt an easier solution be to keep the sha-1 to work exactly as is, but add additional hashes to verify the files havent been maliciously modified to keep the same hash. It seems almost impossible to craft a file that has different hashing algorithms equal the same thing. Assuming older versions dont explode when new data is added, it should stay backwards compatible.

The sha-1 and short hashes would be the name that is displayed and used for checking out commits, but not relied upon for security.

</comment><comment><USER14> I've never seen an adequate answer to this but it boggles my mind that this problem wasn't foreseen.

When Git came out we'd already seen a move from MD5 hashes to SHA-1 because MD5 was no longer deemed secure. Of course this was going to happen again.

So why wasn't the protocol and the repository designed to have multiple (hash algorithm, hash) pairs?

At this point it becomes a client and server issue if you support a given protocol or not so you have this handshake to agree on what you're using (eg a server may reject SHA-1), much like we have with SSH.

This seems like it would've been trivial to allow for in the beginning. Or am I missing something?

<comment><USER15> It would have been possible to include the ability to change algorithms in a handshake (agility).

But general current consensus in the cryptography and security community (which I don't agree with) is: "Agility is bad, hmkay". The reasoning is largely because there have been plenty of attacks based on downgrading protocols like TLS to broken crypto by an attacker. Also, the handshake mechanism necessarily enlarges the attack surface of your software, usually in a pre-auth part which is very problematic.

The counter-argument is of course that a lack of agility leads to lots of pain later on, when you need agility because your one chosen algorithm is broken.

There is also the added argument for not using SHA-1 in git: SHA-1 was already starting to "smell" when git was first implemented. Picking something else back then would at least have moved the current problems farther into the future, when SHA-2 might start to be problematic.

<comment><USER16> There are good reasons why agility is bad. It never works the way people imagine.

The fantasy is people think "in case of a sudden algorithm break we can quickly switch to a better algorithm".

This is wrong because:

a) there are no sudden algorithm breaks. You always know way in advance before something is broken. (In the case of SHA-1 there was more than a decade between early warnings and the first attack.) In the case of Git the warnings about SHA-1 are older than Git itself. The problem wasn't lack of agility, the problem was choosing an algorithm that was already known to be bad.

b) if you have agility it means people will continue supporting bad algorithms and use agility as an excuse.

b) happened exactly in TLS. Padding oracles were known, but people chose to ignore it. In TLS 1.2 they included better algorithms (GCM), but chose to keep the bad ones (CBC/HMAC). Then more padding oracle attacks happened. Then people said "oh we have agility, we can disable CBC and ... well nobody supports GCM yet... let's use this other broken thing we have called RC4". Then attacks on RC4 came in.

If by the time people designed TLS 1.2 they would've said "we know RC4 is weak, we know CBC/HMAC (as used in TLS) is weak, we will just support GCM" none of that mess would've happened.

<comment><USER15> The changeover to TLS1.2 only ever could have worked because of agility. Without at least protocol version agility (which implies cryptographic agility), one couldn't talk TLS and its successor on the same port, because there wouldn't be any other way to distinguish them. A new TCP port assignment would have been possible, but a total and utter disaster. Countless firewalls, appliances, routers, middleboxes, rulesets and similar stuff assume that HTTPS is on port 443, changing that would at least take a decade.

That the allowed set of ciphers didn't change enough with TLS1.2 may be right, but doesn't matter for why we do need agility.

Agility is necessary and TLS is the poster-child for why we need agility in such protocols. Whether the same applies for git, where the network protocol isn't that important and ingrained is of course debatable, I think you are right there. But what git has to do now is create agility by cramming it in somewhere, using cludges, hacks and whatever might be possible without breaking too much. It remains to be seen if the cludge will be free of security problems.

<comment><USER17> Given the plethora of downgrade attacks against TLS that have been found over the decades, I'd really hope that there is a better poster-child for cipher agility. If the canonical example of "cipher agility working as intended" is TLS, then I want off this rollercoaster ride.

<comment><USER15> TLS agility is definitely not the poster-child for a good implementation. I do not know if there is any cipher agility implementation I would really call good.

However, TLS is the prime example for why we desperately need agility anyways. Just look at the myriads of ways things broke just by trying to get TLS1.3 to work. And now imagine that totally without any agility mechanism. We would still plan for the big introduction of TLS1.3 a few years into the future.

</comment></comment></comment></comment></comment></comment><comment><USER18> I wish more people would adopt (and better formalize) multihash and related projects [https://github.com/multiformats/multihash](https://github.com/multiformats/multihash)

It's a really simple good idea that has developed in the ipfs world.

</comment><comment><USER18> Perhaps I missed it but what are we doing to future proof the hash algorithm to when we need to transition away from sha256?

Seems like we're going to just have the same problem in another decade if we don't address this now?

<comment><USER19> > In closing, it is worth noting that one of the reasons this transition has > been so hard is that the original Git implementation was not designed to > swap out hashing algorithms. Much of the work put in to the SHA-256 > implementation has been walking back this initial design flaw. With these > changes almost complete, it not only provides an alternative to SHA-1, but > also makes Git fundamentally indifferent to the hashing algorithm used. This > should make Git more adaptable in the future should the need to replace > SHA-256 with something stronger arise.

That's the last paragraph of the article.

</comment></comment><comment><USER20> I remebember during DVCS wars, an argument was raised for Bazaar/Mercurial that they supported pluggable hash algorithms. Git was hard coded to SHA. Now this design decisions is harder to get changed.

</comment><comment><USER21> Other than using a stronger hashing algorithm that produces longer hashes, would there be any advantage in storing two or more separate hashes of an object? The extra hashes could be from a different hash function, or a hash of the reversed bits/bytes.

I wonder about the difficulty of producing collisions for a single 256-bit hash function versus two 128-bit hash functions, four 64-bit hash functions and so on.

<comment><USER22> That reminds me of my phone. It is kinda special. Instead of an eleven digit number, I have eleven one digit phone numbers. When I write them down, I usually just writen them all in one row. So the written version of my eleven phone numbers look just like a normal eleven digit phone number.

<comment><USER23> What?

<comment><USER24> A function that concatenates the results of two 64-bit hash functions _is_ a 128-bit hash function.

Just as a string of individual digits makes a larger number.

<comment><USER25> I mean, technically yes, but it it would be a 128-bit hash function with the security properties of a 64-bit hash function, so it offers little advantage over just using a 64bit hash (which I think was also the point you were trying to make, I think?).

However, that doesn't really address the original question on how much harder cracking 2x64bit hash would be than cracking a single 128bit hash would be.

My best guess there would be that it's really quantify as you start opening up more dimensions besides the number of bits. The gain would mostly come from protection against other properties from one of the algorithms like a potentially hidden backdoor or a undiscovered mathematical weakness. So as long as the strength of the individual hash function holds up, it probably makes sense to diversify between hash functions. E.g. SHA3-256 + BLAKE3-256, probably offers better long-term security properties than using SHA3-512.

<comment><USER26> > but it it would be a 128-bit hash function with the security properties of a > 64-bit hash function

This is not true. Consider two hash functions f and g

        f(x) = md5(x)[0..63]
        g(x) = md5(x)[64..127]

and a third function

       h(x) = f(x) || g(x)

where || is concat

So no, concating multiple smaller hash functions is not any weaker than using a single big one.

<comment><USER25> So your point is that if you take the output of the _same_ 128bit hash function twice, split it into 64bit parts and then put it back together, you still have the full properties of the 128bit hash function? Well, no shit.

I have to admit that I'm not the greatest cryptography whiz, but I can't image that this holds up for _independent_ hash functions, where you should be able to more cheaply run a preimage attack against two 64bit hash functions than one 128bit hash function.

<comment><USER26> > where you should be able to more cheaply run a preimage attack against two > 64bit hash functions than one 128bit hash function.

Try doing that in my example.

<comment><USER27> Your hash functions are contrustructed in a way such that the concatenation has the security properties of a 128 bit hash function (because your construction is equivalent md5). I am not sure that results holds for all concatenations of hash functions. Or for SHA concatenations.

I appreciate you making me think deeper about hash functions. Nice construction.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> I wonder why SHA-256, and not BLAKE2(b/s) or BLAKE3. BLAKE3 is significantly faster.

<comment><USER29> Does performance matter in this context? Git isn't exactly hashing terabytes of data.

<comment><USER30> It does; I've encountered some cases (ingesting large amounts of data into git) where the limiting factor on performance is a combination of SHA-1 and DEFLATE.

</comment></comment></comment><comment><USER31> I am working on a game and version control in the gaming world is definitely weird to somebody coming from web dev. Almost nobody in this world uses git, they all use perforce, svn, and plastic. Apparently got doesn't deal with binary assets well; even with lfs, it's hard to find hosting for your 100-500GB repositories that also supports file locking (another binary- specific feature needed for games that many hosts don't seem to support for some reason).

I wanted to try lfs, but where do you actually go to find cheap hosting for a 100-150GB repo?

</comment><comment><USER32> I couldn't see in the article, but why settle on SHA2-256? Why not something bigger or newer such as SHA2-512 or SHA3-256? Or why not a variable length hash like SHAKE256?

<comment><AUTHOR> I believe this is discussed in [https://lwn.net/Articles/811068/](https://lwn.net/Articles/811068/)

</comment></comment><comment><USER33> When browsing lwn in firefox, "unable to connect" errors are relatively common. Is this just the server being aggressive with prioritizing which requests to serve?

</comment><comment><USER34> Is there a way to opt out of this other than pinning your git executables to an old version or forking?

I want to make sure all my git repos are forever readable by the original git they were produced with, even if newer git versions are used for producing commits.

The article makes some troubling comments like:

> _countless repositories need to be transitioned from SHA-1 to SHA-256._

Absolutely never doing this.

</comment><comment><USER35> maybe some naive question but why not hash content with SHA256 then hash the result with SHA1?

<comment><USER36> That's like saying "why not choose a 20 character password and just use the first 8 characters of it?"

</comment></comment><comment><USER37> So brian finally got closer? Waiting for a long time</comment>


Apple's Share of Smartphone Industry's Profits Soars to 92% - <AUTHOR> http://www.wsj.com/articles/apples-share-of-smartphone-industrys-profits-soars-to-92-1436727458

<comment><USER2> Isn't Tim Cook a supply chain guy? That may partially explain why Apple is so good at squeezing every dollar out of their products.

</comment><comment><USER3> Here's a similar article without the paywall I ran into at WSJ: [http://www.businessinsider.com/apple-92-percent-profits- enti...](http://www.businessinsider.com/apple-92-percent-profits-entire- smartphone-industry-q1-samsung-2015-7)

I noted that Apple is responsible for less than 20% of the industry in terms of units sold last quarter, but makes over 90% of the profit. Considering the prices of a Galaxy S6 and iPhone 6 aren't that different, there is something way different between the operations at Apple and the competition (read: Samsung). The difference is in profit margin, but it's not obvious where (at least to me). Samsung should have great deals with it's affiliates of the same name on chip and screen prices, and it can't be that it's factory conditions are much better than Apple's.

<comment><USER4> Does Apple have to pay a ridiculous patent tax to Microsoft for use of an OS it developed?

<comment><USER5> No, but neither does Samsung.

Apple does have to pay for R&D for its own operating systems though.

<comment><USER6> I thought Samsung signed a deal with MS to licence the patents infringed by Android. Something in the region of $10 per handset.

Source: [http://www.pcworld.com/article/240738/microsoft_signs_androi...](http://www.pcworld.com/article/240738/microsoft_signs_android_licensing_deal_with_samsung.html)

</comment></comment></comment></comment><comment><USER7> When the profit margin is a cool $250 USD and everyone else competes in low price/volume but cant even reach apple's numbers, its not surprising at all. Same is true for the Macbook, they don't ship as much as Lenovo but they do have a margin that their customers are more than willing to pay.

<comment><USER8> Last time I checked, Macbooks cost the same as Thinkpads.

<comment><USER9> Lenovo sells many laptops which cost much less than Thinkpads. Thinkpads tend to be the more expensive models. A quick search for "macbook" and "thinkpad" prices between $900 and $1300 for macbook and between $400 and $999 for thinkpad. Searching for a regular "Lenovo laptop" (excluding Thinkpads) I see prices as low as $190.

</comment></comment></comment><comment><USER10> Unless the methodology has changed "Smartphone Industry" here means 7 firms, Apple, BlackBerry, HTC, Lenovo/Motorola, Samsung, Nokia/Microsoft, LG.

I doubt Xiaomi and all the littler known brands are making that much, but it would be interesting for someone to quantify it.

</comment><comment><USER11> this is a duplicate.</comment>


A Distracted Walk with Fundamental Analysis - <AUTHOR> https://portfolio.construction/blog/2019/02/a-distracted-walk-with-fundamental-analysis <comment><USER2> The "article" is trying to do a basic refutation of the efficient market hyppthesis (EMH), but there's really not much meat here. In fact this looks like pretty weak content marketing in order to sell a product (and the tone is little ranty - Eugene Fama is just "someone in academia"???). The author's argument is that the EMH doesn't really work because we can't assume information spreads instantly - which is true, okay sure, but that's actually not a core claim Fama postulated in the EMH.

While we're at it, what's the point of quantifying your pedagogy using the mathematical formalisms if you don't explain any of the variables? More importantly none of the conclusions are rigorously defended, which is suspect since there are half-baked attempts at quantifying the ideas. The author presents an under-specified equation and then basically sums up his argument by saying, "well this seems like a stretch, because everyone wouldn't receive the same information and act simultaneously, right?"

But that's not what the EMH postulates! Informational efficiency does not require simultaneity. Either the author doesn't actually understand the EMH or isn't attempting to refute it in good faith. Even if the model doesn't perfectly map real world markets, it's not so simple than you can just rhetorically debunk it like this.

I think this[1] is a much more substantive and nuanced article on the same topic. It was coauthored by Cliff Asness, who has the following qualifications:

1\. He has a PhD in finance/economics from the University of Chicago. His dissertation was focused on value momentum.

2\. His advisor was Eugene Fama himself. He's famously disagreed with (or at least critiqued) his mentor's work.

3\. He founded AQR Capital Management, one of the most successful hedge funds in the world. As can be expected, he's now a billionaire.

4\. He still regularly publishes research and hosts a commentary blog in which he critiques the research of others.

Asness obviously doesn't believe in the EMH, but his take is much more balanced than an outright refutation.

_________________________

1\. [https://www.aqr.com/-/media/AQR/Documents/Insights/Journal-A...](https://www.aqr.com/-/media/AQR/Documents/Insights/Journal- Article/The-Great-Divide.pdf)

<comment><USER3> You can discount any article that claims to refute the efficient market hypothesis unless the author includes a bit about how they have already arbitraged this deficiency away and are currently sitting on a multi-billion dollar pile of money.

So uhh, given that he's _got_ billions of dollars, there may actually be something there. Then again, the core skill of hedge funds is to convince people to let you manage their money, which is somewhat different than actual investing skill, so it's still unclear.

<comment><USER2> _> You can discount any article that claims to refute the efficient market hypothesis unless the author includes a bit about how they have already arbitraged this deficiency away and are currently sitting on a multi-billion dollar pile of money._

That's not really fair at all, actually. In general it's perfectly reasonable to prove something non-constructively. There's no _a priori_ reason to assume that a disproof of the efficient market hypothesis would be accompanied by a formula which can generate arbitrary amounts of money for its user. Finance is far more complicated than that.

 _> So uhh, given that he's got billions of dollars, there may actually be something there. Then again, the core skill of hedge funds is to convince people to let you manage their money, which is somewhat different than actual investing skill, so it's still unclear._

That Asness has accumulated billions of dollars in personal wealth is really only one dimension of why I'd say he's particularly qualified to comment on it. In my opinion, it's not even the most compelling - I'd say the fact that he received a doctorate under Fama and is involved in the academic community is a much more resounding affirmation of his arguments.

As for AQR's performance, it's a fair point that most hedge funds don't have a great return. But if you're looking for constructive examples to argue against the EMH, you can just cite Renaissance, Bridgewater, Soros, Baupost, Citadel, DE Shaw or Two Sigma.

</comment></comment></comment><comment><USER4> "Incorporate this however you'd like, either as some future value bonus or future discount factor risk, but the mood of the masses must to be included. And with that, what might be a good investment opportunity in isolation, isn't."

The paragraph above is the final conclusion of the post. It strikes me this is largely a restatement the following words of wisdom attributed to the economist John Maynard Keynes: The market can remain irrational longer than you can remain solvent.

In some ways this is similar to being way too early with a technical innovation. The lack of traction or uptake in the market can last longer than your runway. I've been there.

</comment><comment><USER5> > I've shown that with simple changes to the definition we can make technical > analysis a viable approach.

Wow, someone give this guy a Nobel Prize...

</comment><comment><USER6> The author thinks that randomness is just a simplification: no, it is the statement of lack of information about the future.

Random (in markets) does not mean "following a uniform distribution". It means modelled by a random variable (which is a technical term).

</comment><comment><USER7> I expected this to be about some killer feature for Excel for layout, or users preferring to do their layout in a grid, or something like that. I've seen a lot of documents written in Excel that seemed more appropriate for Word instead.

In fact, the title used for submission here ("More fiction is written in Excel than Word") is a twitter link from halfway through the article.

The linked article's title is "A Distracted Walk with Fundamental Analysis", which seems a much more appropriate title for the content.

<comment><USER8> Yes. We changed the title back.

The HN guidelines say: "Please use the original title, unless it is misleading or linkbait; don't editorialize."

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


How Uber's Shady Firing Policy Could Backfire on the Company - <AUTHOR> http://www.forbes.com/sites/ellenhuet/2014/10/30/uber-driver-firing-policy/?utm_campaign=ForbesTech&utm_source=TWITTER&utm_medium=social&utm_channel=Technology&linkId=10301212 <comment><USER2> The crux of the article is the issue of whether Uber employees are actually independent contractors:

 _" The courts will decide, with the Uber case and with the rest that will follow, whether these workers are truly independent contractors, a classification that depends on many factors, not just the ability to fire. And as of late, it's not looking very promising for the employers.

A federal appeals court ruled in August that FedEx drivers are employees, not independent contractors, a decisions that attorneys said could have serious implications for "sharing economy"-type companies that rely on that model. And a California Supreme Court ruling from June also said that newspaper carriers had been illegally misclassified as independent contractors.

The deciding factor? The company's ability to fire the workers. "Perhaps the strongest evidence of the right to control is whether the hirer can discharge the worker without cause," the opinion said."_</comment>


Using Medicare and Medicaid data for uninsured to price shop medical care - <AUTHOR> https://www.reddit.com/r/datascienceproject/comments/cu2a3a/using_medicare_medicaid_data_for_uninsured_to/ <comment><USER2> I have some experience with these datasets and this topic (and anecdotal experience with physicians) and I don't think this will provide anything useful. Essentially, physicians are still incentivized to bill the code that provides them with the largest reimbursement. And, the physicians are incentivized to bill for any possible code they can. What I think the dataset will provide, then, is a good look at negotiations between the physician and the government--not "what will it cost to heal me?"

In addition, health centers may very well have a policy to simply charge uninsured more for every procedure. That may be because they "negotiate with insurers for better rates" or "know that the uninsured are more risky and won't pay, so we should charge more."

The "best" thing to do, unfortunately, is call around _. For a recent cut to my head, I had to call a dozen places to find the best price. I was "insured" but hadn't met my deductible yet so I'd be paying cash. Ranged anywhere from a quoted price of $850 to $120. Pays to call around.

_Calling around, of course, won't be helpful if the agent misquotes you, your insurance company screws up your paperwork, or it's actually out of network.

</comment><comment><USER3> If this is the billed data I think it is, then this data is super unhelpful. I have done a few different projects for providers (I am an actuary) and I could never find a good use for this data. Billed charges are a made up number, you really need the discounted data (varies between each payor and provider), and need to know what market you are in (employer, ind, Medicare, Medicaid, some kind of ACO or other agreement).

Also, a lot of what the reddit OP wants already exists in various forms (some of them you have to pay for, such as truven data). 'Bundled payments' have been picking up steam for the last five years or so, and there are public data sets that describe things like knee surgery costs in different geographic areas. I think CMS has a website that already visualizes this data as well.

</comment><comment><USER4> I remember some years ago when I had surgery, the surgery was pre-authorized. After the surgery I received a bill for $20k. Insurance refused to pay the surgery place and eventually both parties settled it. I ended up speaking to someone at the insurance company that I went to school with. She said that for this procedure and amount of time for operating room the max they pay is $2k. So, there was no way that company would see $20k.

I also refused to pay as patient is responsible. Few years later I received a proper bill for $300. It was long after they could collect, so I told them to beat it.

</comment><comment><USER5> I've been trying to figure out if there's an alternate ... game that could be played in order to find _actual_ pricing for procedures _ex post facto_. My original (and I know this doesn't work) thought was some sort of competitive billing procedure. It would work like this:

1\. After a procedure K is performed & the payee sends a request to billing for $M;

2\. The payer can request "co-bids" from other sources;

3\. The co-bidder "X" that bids the least/best _gets the money_ (say, $N < $M);

4\. But! "X" now guarantees to accept $N for that procedure K for the _next_ (or some single future) procedure K they perform.

Obviously, a co-bidder could bid $N for procedure K with no intention to ever perform procedure K again, amongst other nefarious things.

</comment><comment><USER6> Sounds like a way to translate the billing codes to normal vernacular would be really useful for them.</comment>


"The greatest human being who ever lived" has died - <AUTHOR> http://www.theglobeandmail.com/blogs/andrew-steele/the-greatest-human-is-dead/article1293395/ As far as where the title reference comes from - Norman Borlaug on Penn and Teller: BS - http://www.youtube.com/watch?v=tIvNopv9Pa8 <comment><USER2> There's a whole sub-genre of science fiction written in the late 1950s which took for granted that in the future there would be wars for food and perpetual famine due to an ongoing population explosion. The green revolution and birth control are the two simple but world-changing inventions that staved off that apocalypse, which seemed so inevitable at the time.

<comment><USER3> Staved = Pushed back the date.

....

I'm honestly not sure why people are dazzled by this guy. Partly it was...his specific intention to increase yields, which make him seem like a humanitarian. The Fordson tractor did more for agriculture (and, much much much more for the economy and day-to-day existence) than this guy. Is Henry Ford the greatest human being who ever lived?

<comment><USER4> Why so negative?

It seems that Europe's population is actually declining, so is japan's, and a lot of advanced countries.

If they keep feed themselves right now, they should be so even 100 years from now, given the same condition (unless we have some drastic global climatic change).

it is the poor countries, whose economies are based in subsistence agriculture, that are having a huge population increase.

So, the other question is, do you have to bring all these countries up to the level of western europe/japan/us in order to stop the population boom? if we have to, then there will certainly not be enough resources for everybody (especially if everybody has to live like american do)?

I have a good counter example for this. You don't have to be super developed in order to have a clear stabilization of the population. Even my country's Albania (which has about 6kUSD gpd), population growth has halted (from 2.2 children per woman in 1990, to 1.7 last year).

So, you don't have to get super developed to have a decline of 'overfertility'. It seems that bringing economies out of rural ones, and into more mixed (agriculture/services/technology), will help the population not to increase so much.

It seems that this is a noble goal to achieve for the rest of the world, and this guy helped on it.

And making crops more durable, and farmers more productive, will make people move out of villages and go to cities, and redirect economies to towards services/manufacturing/technologies, where education is more advantage, and having more kids is very expenvie.

<comment><USER5> The problem is that the declining population is temporary. Every area with declining population, except perhaps Japan which I don't know enough about to say, has sub-populations with higher growth. Eventually, those populations are going to become large enough that the population as a whole will start growing again, and will continue increasing until it reaches the rate of the high- growth formerly-sub population. It's just a hiccup. Unless something external - singularity, war, whatever - intervenes.

<comment><USER6> Scarcity of resources is also a temporary (but serious) problem.

So, pushing back the date of catastrophe far enough is exactly what's needed. Conditions are not static. Often buying more time is all that's necessary.

How do you live for ever? Don't die.

<comment><USER5> Currently resources are not scarce except in the economic sense. But a growing population will eventually surpass ANY POSSIBLE resource base. Robin Hanson's most recent post on Overcoming Bias <http://www.overcomingbias.com/2009/09/limits-to-growth.html> discusses this in some detail.

</comment></comment></comment></comment></comment></comment><comment><USER7> This guy isn't famous because people who complain about GM food, the environment (or _whatever_ ) are louder and harder to ignore than scientists quietly solving those problems. Science and technology have provided most of the solutions to our most pressing problems, typically quietly, over a long period of time, and with little fanfare. This noble work will go on even if "eco-warriors" or anti-GM activists only want to whine and make little impact except to make people feel bad.

<comment><USER8> Did you care about this guy before he died? Or are you just using his death to grandstand on some anti-environmentalist rant?

<comment><USER7> No, I hadn't heard of him - that's sorta my point. World changing scientists are not, typically, well known. Famous environmentalists are ten a dollar. So, sure, it's an anti-environmentalist rant because I'm anti-environmentalist but I consider it a pro-science rant at heart.

</comment></comment></comment><comment><USER9> Unbelievable, I'll take the 'over the top titles' but false economic statements like: "When his seeds were used widely in 1963, Mexico instantly went from famine-prone to a wheat-exporter. Their wheat harvest was six times greater after"

I guess that's why Mexico has been a net wheat IMPORTER since the 70's , subsidized and even banned wheat imports to protect the agro industry. Relevant sources without the sensationalist tones:

[http://docs.google.com/gview?a=v&q=cache%3ApHwA9V6vKXgJ%...](http://docs.google.com/gview?a=v&q=cache%3ApHwA9V6vKXgJ%3Awww.californiawheat.org%2FNews_Info%2FCalifornia%2520Wheat%2520Mexico%2520Fact%2520sheet.pdf+mexico+wheat+import&hl=en&gl=mx&pli=1)

[http://translate.google.com.mx/translate?hl=en&sl=es&...](http://translate.google.com.mx/translate?hl=en&sl=es&tl=en&u=http%3A%2F%2Fsubsidiosalcampo.org.mx%2F)

<comment><USER10> Does any of that contradict the statement: _"When his seeds were used widely in 1963, Mexico instantly went from famine-prone to a wheat-exporter. Their wheat harvest was six times greater after"_ ?

The seeds may have been capable of increasing the Mexican wheat crop by a factor of six, but not capable of making Mexican wheat production price- competitive with producing it elsewhere and shipping it to Mexico. They may have been a net importer since the 1970s, but presumably that means they were in fact a net exporter in the 1960s.

<comment><USER5> In fact, since the 1970s, the almost sole cause of poor crop production has been political; there have been droughts, but only a small portion of the poor countries have been affected by them at any given time. The most common causes have been either the gov't cutting off supplies to "rebels" or politicians beholden to poor urban masses holding down food prices so much that farmers can't sell their crops for enough to break even, so they grow only enough for themselves (or both together, with other stupidities thrown in, like current Zimbabwe).

</comment></comment></comment><comment><USER11> Norman Borlaug on Penn and Teller's Bullshit! program: <http://www.youtube.com/watch?v=tIvNopv9Pa8>

</comment><comment><USER12> Ad hominem attack completely unexamined by the article's author: """Of his harshest critics Borlaug stated, "some… are the salt of the earth, but many of them are elitists. They've never experienced the physical sensation of hunger. They do their lobbying from comfortable office suites in Washington or Brussels. If they lived just one month amid the misery of the developing world, as I have for fifty years, they'd be crying out for tractors and fertilizer and irrigation canals and be outraged that fashionable elitists back home were trying to deny them these things." """

Logical breakdown: 1) My critics are elitist who have not experienced hunger. 2) Therefore, they are wrong.

Relationship to actual argument: nonexistent.

As a note, I do think Norman Borlaug was a remarkable person. But there are lots of interesting questions to ask about his work, and it doesn't make someone an "elitist", or a bad person to ask them. Asking them doesn't mean they think Norman Borlaug was a bad person either. A few that spring to mind...

1) How many have died from malnutrition after crop yield booms resulted in rapidly expanding populations suddenly constrained when the next yield limit was hit?

2) If education expenditures for the third world matched those given for improving agriculture and food aid starting in the 1960's, what would the "third world" look like today? Better? Worse? What if expenditures had been divvied evenly between the two?

<comment><USER7> _But there are lots of interesting questions to ask about his work, and it doesn't make someone an "elitist", or a bad person to ask them._

It didn't say anything to the contrary. Note the phrases _"of his harshest critics"_ and _"many of them."_ He claimed that many of his _harshest_ critics were elitists - that does not mean he thought _anyone_ who criticized his ideas was elitist. I would suggest that he believed his harshest critics to be those presenting no reasonable basis (from his POV, at least) for their claims.

</comment></comment><comment><USER13> This is an honest question: How does creating more food prevent these problems? Won't populations grow enough to consume all available food? Haven't populations in 3rd world countries exploded since the "green revolution"?

<comment><USER14> It turns out that countries with better crop yields per person, require fewer people, resulting in reduced population.

<comment><USER15> Citation?

<comment><USER14> Citation: [http://nue.okstate.edu/crop_information/The_Story_of_Wheat.h...](http://nue.okstate.edu/crop_information/The_Story_of_Wheat.htm)

In particular: "Demographers, who had been watching the exponential rise with alarm, now forecast that the population will peak below ten billion—ten gigapeople—not long after 2050. Such a low forecast would have been unthinkable just two decades ago. Already, in developing countries, the number of children born per woman has fallen from six to three in 50 years. It will have reached replacement-level fertility (where deaths equal births) by 2035.

This is an extraordinary development, unexpected, undeserved—and apparently unnatural. Human beings may be the only creatures that have fewer babies when they are better fed. "

<comment><USER15> Thanks. I was a bit skeptical, but thats an interesting read.

</comment></comment></comment></comment></comment><comment><USER16> This has been covered a few times already.

Here's one:

<http://news.ycombinator.com/item?id=819926>

</comment><comment><USER17> If you do believe that his work is worth continuing, I recommend donating to the Borlaugh foundation. My wife & I just did: <http://borlaug.tamu.edu/legacy/donors/index.php>

</comment><comment><USER18> Compare the treatment by the Economist at [http://www.economist.com/obituary/displaystory.cfm?story_id=...](http://www.economist.com/obituary/displaystory.cfm?story_id=14446742)

</comment><comment><USER19> Again?

</comment><comment><USER20> here is the bullshit feature Penn and Teller did on him: <http://www.youtube.com/watch?v=A2cR2-3Y56U>

</comment><comment><USER21> Christmas already?

</comment><comment><USER22> voted down for misleading title. i'm still alive.

</comment><comment><USER23> instead he's killed us all

700 years ago there were two million people in my country, now 60,000,000+

</comment><comment><USER24> This title made me think Nelson Mandela had passed away</comment>


Garnet – a graphical toolkit for Lisp - <AUTHOR> http://garnetlisp.sourceforge.net/ <comment><USER3> The name of the C32 spreadsheet mentioned in the article is an acronym:

"C32 has been implemented as part of the Garnet system. It is an acronym, and stands for CMU's Clever and Compelling Contribution to Computer Science in CommonLisp which is Customizable and Characterized by a Complete Coverage of Code and Contains a Cornucopia of Creative Constructs, because it Can Create Complex, Correct Constraints that are Constructed Clearly and Concretely, and are Communicated using Columns of Cells that are Constantly Calculated so they Change Continuously and Cancel Confusion."

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.18....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.18.3001&rep=rep1&type=pdf)

<comment><USER4> Im actually more confused

<comment><USER5> I am Completely Confused by the Cacophonous Cascade of Cryptic Cant and Catchphrases in this Comment.

<comment><USER3> It will all make more sense after you read some more BAMcronyms.

[http://www.cs.cmu.edu/~bam/acronyms.html](http://www.cs.cmu.edu/~bam/acronyms.html)

</comment></comment></comment></comment><comment><USER3> Yay Garnet! ;) I worked on Garnet with Brad Myers at CMU, on the PostScript printing driver. Brad is really into mineral acronyms, and I came up with an acronym he liked: "GLASS: Graphical Layer And Server Simplifier".

Garnet had a lot of cool ideas in it, especially its constraints and prototype based object system.

A few years ago I wrote up a description of a similar system called OpenLaszlo, and how OpenLaszlo's constraint system compared with Garnet's constraint system. Garnet had a lazy "pull" constraint system, while Laszlo had an event/delegate based "push" system. Each used a compiler to automatically determine the dependencies of constraint expressions.

Constraints and Prototypes in Garnet and Laszlo

[http://www.donhopkins.com/drupal/node/69](http://www.donhopkins.com/drupal/node/69)

The problem we ran into with supporting PostScript with Garnet is that we wanted to use Display PostScript, but Garnet was using CLX, the Common Lisp X Protocol library which was of course totally written purely in Lisp.

Of course CLX had no way to use any client side libraries that depended on XLib itself. I'd steer clear of using anything that depends on CLX for anything modern. (Does CLX still even exist?)

Brad Myers produced "All the Widgets," which must have some Garnet demos in there somewhere! [1]

[1] All the Widgets, sponsored by the ACM CHI 1990 conference, to tell the history of widgets up until then: [https://www.youtube.com/watch?v=9qtd8Hc90Hw](https://www.youtube.com/watch?v=9qtd8Hc90Hw)

<comment><USER6> > > [http://www.donhopkins.com/drupal/node/69](http://www.donhopkins.com/drupal/node/69)

"Constraints are like structured programming for variables"

Love it! Having been very interested in constraint programming and also dabbled a bit here and there[1][2][3], what do you think is holding back constraint programming?

[1] [http://2016.modularity.info/event/modularity-2016-mvpapers-c...](http://2016.modularity.info/event/modularity-2016-mvpapers- constraints-as-polymorphic-connectors)

[2] [http://blog.metaobject.com/2014/03/the-siren-call-of-kvo- and...](http://blog.metaobject.com/2014/03/the-siren-call-of-kvo-and-cocoa- bindings.html)

[3] [http://blog.metaobject.com/2015/09/very-simple-dataflow- cons...](http://blog.metaobject.com/2015/09/very-simple-dataflow-constraints- with.html)

<comment><USER3> > what do you think is holding back constraint programming?

All the constraints. ;)

As you mentioned, there are tricky two-way mathematical constraints, like Sutherland's Sketchpad [1] and descendants [2], and Gosling's PhD Thesis [3], where the system understands the constraint expressions mathematically and transforms them algebraically.

[1] Ivan Sutherland's Sketchpad: [https://en.wikipedia.org/wiki/Sketchpad](https://en.wikipedia.org/wiki/Sketchpad)

[2] Geometer's Sketchpad: [https://en.wikipedia.org/wiki/The_Geometer%27s_Sketchpad](https://en.wikipedia.org/wiki/The_Geometer%27s_Sketchpad)

[3] Algebraic Constraints; James Gosling; CMU CS Department PhD Thesis: [http://digitalcollections.library.cmu.edu/awweb/awarchive?ty...](http://digitalcollections.library.cmu.edu/awweb/awarchive?type=file&item=362626)

And there are simpler one-way data flow constraints like Apple's KVO notification [4], Garnet's KR based constraints [5], and OpenLaszlo's event/delegate based constraints [6].

[4] Introduction to Key-Value Observing Programming Guide: [https://developer.apple.com/library/mac/documentation/Cocoa/...](https://developer.apple.com/library/mac/documentation/Cocoa/Conceptual/KeyValueObserving/KeyValueObserving.html)

[5] KR: Constraint-Based Knowledge Representation: [https://docs.google.com/viewer?url=http%3A%2F%2Fwww.cs.cmu.e...](https://docs.google.com/viewer?url=http%3A%2F%2Fwww.cs.cmu.edu%2Fafs%2Fcs%2Fproject%2Fgarnet%2Fdoc%2Fkr%2Fkr- manual.ps)

[6] Oliver Steel: Instance-First Development: [http://blog.osteele.com/posts/2004/03/classes-and- prototypes...](http://blog.osteele.com/posts/2004/03/classes-and-prototypes/)

As you pointed out, KVO constraints simply say that object.x = otherObject.y, so there's not much to them.

I think one thing holding back constraint programming is that they require an interpreter or compiler to understand them, or the programmer to write code in a constrained syntax.

Garnet's KR constraints are written as Lisp expressions implemented by Lisp macros, that parse the expressions and recognize certain expressions like "gvl" for "get value", and named path expressions. KR wires up the dependency graph based on that information, and marks the constraint as invalid if any of the links along the dependency path change, as well as when any of the final values the expressions reference change. But it doesn't understand the mathematical expressions themselves. At the time I was working on it, it didn't know hot to figure out which branches of conditional expressions mattered, so it would assume it depended on everything in the expression. (i.e. like the C expression "size = window.landscape ? parent.width : parent.height" \-- if window.landscape is true, it depends on parent.width, else it depends on parent.height, but ). It only recalculates the constraint values lazily when you read them. ("pull" constraints).

OpenLaszlo constraints are written as JavaScript expressions that the OpenLaszlo compiler parses, and it creates some JavaScript data and hidden methods behind the scenes that go along with the class, which are used at runtime to keep track of all the dependencies. You don't have to use a special expressions in constraints to read values, but you do have to use object.setValue("key", value) to write values. (This was because OpenLaszlo was targeting the Flash runtime, and that was the most efficient trade-off, since Flash didn't support property setters like modern JavaScript does.)

OpenLaszlo constraints used a "push" model of propagating all dependent changes forward when you called "setValue", because that was the best trade- off at the time for speed and usability and how it was intended to be used. But with getters and setters you could implement a more convenient constraint system that didn't put so many constraints on the programmer and how you use them.

</comment></comment></comment><comment><USER7> The C32 acronym is just for fun - here's some more: [http://www.cs.cmu.edu/~bam/acronyms.html](http://www.cs.cmu.edu/~bam/acronyms.html)

We continue to do research on constraints in my group, see: [http://cjs.from.so/](http://cjs.from.so/) (but it's in JavaScript - <USER2> Lisp). There are many commercial uses of constraints today, such as for graphical layout and "data bindings" (connecting the model and the view) in many toolkits.

Brad Myers, CMU

</comment><comment><USER8> Interesting, but are there any actual modern GUI frameworks for Lisp?

<comment><USER9> I've looked into it a bit. The answer appears to be… sort of. It depends on your definition of "modern," how many hoops you're willing to jump through, and which dialects of Lisp you're willing to use. These are some of the more promising options I found.

For Common Lisp, one of the longer-lasting and best supported options appears to be CAPI, which comes with LispWorks ([http://www.lispworks.com/products/capi.html](http://www.lispworks.com/products/capi.html)), but that costs a grand and is not open source, so that's kind of out of the picture for most people. If you're looking for commercial option that will just work, though, this might be worth investigating. (They seem to have recently released a "hobbyist" version that is only $500, but you can only use it for "non-commercial and non-academic purposes," so I'm not really sure how useful that is.)

Ceramic ([http://ceramic.github.io/](http://ceramic.github.io/)) lets you use Common Lisp to make desktop web apps using Atom's framework ([http://electron.atom.io/](http://electron.atom.io/)). While that comes with all the disadvantages of making desktops apps with HTML+CSS+JS, it seems to be one of the more professional and easier to set up options.

If you're using a Java implementation of Common Lisp, such as ABCL ([http://abcl.org/](http://abcl.org/)), you can presumably use any Java GUI framework. I've heard, however, that using Java libraries is significantly more awkward in ABCL than, say, Clojure, and that you might need to write some Java code to bridge the gap. The main attempt to get that to work I've seen appears to be this framework ( [https://common- lisp.net/project/snow/](https://common-lisp.net/project/snow/) )—I'm unaware of any applications actually written like this.

Clozure CL (not to be confused with Clojure) has bindings to Apple's Cocoa framework ([http://trac.clozure.com/ccl/wiki/CocoaBridge](http://trac.clozure.com/ccl/wiki/CocoaBridge)). Apparently there's a fairly battle tested cross-platform implementation of Cocoa that you can use to make it run on Windows and Linux too, but I'm having trouble finding a link to that right now. I think it was the framework used to port Comic Life to Windows, if that helps. Regardless, though, this sounds like a pretty scary option for someone without prior Cocoa experience.

Most of the more practical looking options I found seemed to be for Scheme.

Racket ([https://racket-lang.org/](https://racket-lang.org/)) comes with a GUI toolkit that was originally forked from wxWidgets. The IDE is built in it, among other things. It has some quirks that wxWidgets doesn't, though—for example, all the widgets are native except for _all text entry controls,_ which makes accessibility… interesting. (Also, on my computer, at least, they don't quite cooperate with high DPI displays.)

Chicken Scheme apparently has good bindings to IUP ([http://wiki.call- cc.org/eggref/4/iup](http://wiki.call-cc.org/eggref/4/iup), [http://webserver2.tecgraf.puc-rio.br/iup/](http://webserver2.tecgraf.puc- rio.br/iup/)), a fairly lightweight framework that uses native widgets on Windows and Motif/GTK on Linux/Unix/OS X. I wouldn't really call it modern, but it does look fairly convenient—the Scheme API seems to basically let you define GUIs in structured s-expressions ([http://wiki.call-cc.org/iup- tutor#porting-some-examples-from...](http://wiki.call-cc.org/iup- tutor#porting-some-examples-from-the-iup-distribution)). (Also, I'm pretty sure it _does_ support Unicode, and that the IUP site is just out of date.) This is the option I'm leaning towards learning.

Kawa Scheme runs on Java, providing the same benefits as ABCL, but it seems a little more battle tested, and provides native support for making Android applications ([http://www.gnu.org/software/kawa/Android-view- construction.h...](http://www.gnu.org/software/kawa/Android-view- construction.html)). It's used to, among other things, power MIT App Inventor. (You can actually unzip App Inventor projects and find Scheme files inside, which is kind of fun. I kind of wish the App Inventor team would make the framework more accessible from Scheme. :p)

And, of course, if you're willing to settle for dialects of Lisp more distant from Common Lisp or Scheme, you can use Hy and any Python GUI framework ([http://docs.hylang.org/en/latest/](http://docs.hylang.org/en/latest/)), or Clojure and anything Java.

Hopefully there are some good ones I missed, because Lisp-like languages seem like they would be pretty cool for GUIs.

<comment><USER10> > Racket ([https://racket-lang.org/](https://racket-lang.org/)) comes with a > GUI toolkit > that was originally forked from wxWidgets.

The GUI was rewritten in 2005 and there are no signs of wxWidgets left ([http://blog.racket-lang.org/2010/12/racket- version-5.html](http://blog.racket-lang.org/2010/12/racket-version-5.html))

There are now native widgets on Windows, OS X, and, Linux.

> (Also, on my computer, at least, they don't quite cooperate > with high DPI > displays.)

There are support for high resolutions displays at least on OS X - maybe the situation is different on Linux?</comment></comment></comment>


Benefits of Fasting - <AUTHOR> http://fahia.ca/fasting <comment><USER2> I've been following a "diet" of eating a normal lunch approximately once per day (usually around midday) and then fasting until the next day, save for an extra fruit or two while at work, and a small bit of something salty during the evening if I feel like I need it.

I don't know if it's the most effective way to lose weight, but my trend is definitely downwards, and it's improved how I feel overall quite drastically. A lot of it is probably just improvement from not overeating, but I can't deny the effects.

I think my diet has been working so well for me because it's so easy to follow. I don't count calories nor do I have complicated rules about what to eat (I do try not to go overboard), only when. Dealing with the feelings of hunger has also become easier over time.

<comment><USER3> I ate once a day for years. It was great, as long as I didn't do anything too strenuous, where I would need to catch up. The studies relating to fasting and longevity for other species, convinced me in the 90s and I started to try it out circa 2002 and it just stuck. My father experienced the same thing when he tried it for a month. Maybe there's a genetic predisposition of some sort, since it doesn't work well for everyone.</comment></comment>


Apply game mechanics to your app (video) - <AUTHOR> http://www.youtube.com/watch?v=ihUt-163gZI

<comment><AUTHOR> Is anybody aware of some effective examples of applying game mechanics to apps? (besides those mentioned in the video)

The best example I know is stackoverflow.com, which uses votes, badges, reputation etc.

<comment><USER2> To me "game mechanics" are just another way of saying "behavioral economics."

Game mechanics are about exploiting irrational but predictable psychological levers in the human mind. To that end, there are lots of apps that use game mechanics, some more obvious than others:

Foursquare/Gowalla are obvious. You get random rewards and points for doing various real-life activities like traveling and eating out.

Opower. See, e.g., this article [http://latimesblogs.latimes.com/greenspace/2009/10/californi...](http://latimesblogs.latimes.com/greenspace/2009/10/california- embraces-psychology-of-influence-to-reduce-energy-use.html)

Mechanical Turk. Why would an American do work for $0.50/hour? It's not rational, and I think it's the game-like nature of mturk.

Many websites use the quest/reward mechanic to guide users through the registration process and the first few key steps of the application, e.g., LinkedIn's "your profile is 75%" complete mechanic.

<comment><AUTHOR> I agree that behavioral economics greatly informs "game mechanics" but I don't think the levers it relies on are all irrational. My utility (pride, sense of accomplishment etc.) from answering questions on stackoverflow.com might far exceed the utility from the maximum monetary gain I could achieve from an alternative use of my time, thus making me spending time on answering stackoverflow.com questions perfectly rational.

</comment></comment></comment><comment><USER3> Amy Jo is brilliant.

Weight Watchers uses game mechanics: [http://www.wired.com/gaming/virtualworlds/commentary/games/2...](http://www.wired.com/gaming/virtualworlds/commentary/games/2008/08/gamesfrontiers_0811)

Mint was experimenting with it: [http://www.techcrunch.com/2009/04/28/mint- turns-personal-fin...](http://www.techcrunch.com/2009/04/28/mint-turns- personal-finance-into-a-game-its-not-as-bad-as-it-sounds/)

They're building achievements into the new Honda Insight: [http://www.popsci.com/cars/article/2009-02/eco-drivers- ed-20...](http://www.popsci.com/cars/article/2009-02/eco-drivers- ed-2010-honda-insight?page=1)

Yahoo calls them Reputation Design Patterns: [http://developer.yahoo.com/ypatterns/social/people/reputatio...](http://developer.yahoo.com/ypatterns/social/people/reputation/)

They work. My company provides game mechanics as a service that can be integrated into any site or application: <http://www.bunchball.com/products/nitroworks.shtml>

Some of our customer sites that are using game mechanics successfully: <http://www.warnerbros.com/loyalty> \- WB loyalty program <http://www.espin.com> \- social network for teens <http://www.dundermifflininfinity.com> \- NBC's social network for fans of The Office <http://www.characterarcade.com/> \- USA Network's casual gaming site.

You can see a video of me talking (very fast, for 23 minutes) about how this stuff works here: [http://xmedialab.tv/auckland-%E2%80%9Ccommercialising- ideas%...](http://xmedialab.tv/auckland-%E2%80%9Ccommercialising- ideas%E2%80%9D/2009/08/) \- click on "Rajat Paharia presentation"

I tweet examples whenever I come across them here: <http://twitter.com/bunchball></comment>


Why You Always Read About Y Combinator Startups on TechCrunch - <AUTHOR> http://uncov.com/ycombinator-techcrunch-butthappy <comment><USER2> There's no "formal agreement," because we don't have the power to dictate to startups we fund how they should deal with the press. We tell them, as I would tell any founder, that it is good to be covered in TC, and TC is generally willing to write about them, because they know YC is a genuinely good source of leads. Each one of these startups has already been selected from among many applicants.

</comment><comment><USER3> This is absolute B.S. I work for an online tech pub (The Industry Standard), and we have also attended YC events and reported on YC startups. There was never any restrictions on the timing of our reports other than what individual YC-funded entrepreneurs (not YC!) requested.

I believe that PG and JL have enough on their plates without having to micromanage press coverage to give Techcrunch this sort of edge -- they seem to be much more interested in simply introducing press to founders, and letting the two parties take it from there.

</comment><comment><USER4> So, Ted Dziuba always strikes me as pretty much negative about everything. I don't know him personally, but everything I've ever read by him has been hyper-critical of everybody involved in our industry. And yet, he's involved in the industry as well (he has some kind of media startup or something, that I don't remember and can't be bothered to look up), and so ought to have a sympathetic view of the trials and tribulations of this life.

Attacking everybody and everything just doesn't seem like a healthy way to approach life to me, and whenever I read his articles, I'm tempted to respond in kind and explain what a douche he's being...which is then transferring the unhealthy attitude onto me.

I didn't realize uncov was a Dziuba effort, or I would have skipped it. And next time I will. Life is too short to spend it railing against everything and everybody, and I certainly don't want to get sucked up into his hate maelstrom.

<comment><USER5> pressflip.com

</comment></comment><comment><USER6> Investor calls up press contacts for their portfolio companies, news at 11.

<comment><USER5> Hilarious - reminds me of Ric Romero.

</comment></comment><comment><USER7> "YCombinator startup will be featured on TC in exchange for the exclusive launch story."

Translation

"TC: Hey, tell us about your startups when they're ready launch, we want to write about them on our popular and relevant website. YC: OK."

</comment><comment><USER8> I don't really buy this for a number of reasons, which is not to say that YC companies don't do exclusives with TC, but the author makes it sound way too shady.

<comment><USER9> I think the more interesting question might be why does this sound shady. It's not coincidental. People have a tendency to regard press 'deals' as very shady and be very suspicious that they are occurring.

<comment><USER8> It only sounds shady the way the author spins it. PG explained it in plain language above, and it sounds normal there.

</comment></comment></comment><comment><USER10> Michael Arrington has made no secret (in the past, at least) of the fact that he HATES being scooped and LOVES to get exclusives. And so he should! He's trying to run the best blog in the game, so unless a piece of news is truly massive, why does he need to run non-exclusives?

As such, it's no real surprise that a lot of Y Combinator startups make it on to TechCrunch. As pg explains above, Y Combinator pretty much tells their startups this, and if they give Arrington an exclusive, that coupled with pg's reputation can seal a story pretty easily.

<comment><USER11> No "best of class" publication tries to operate under such an edict. It's absurd when you think about it. The Wall Street Journal breaks some killer stories, but also reports on all of the day's news. If they didn't no one would subscribe, they'd wait to hear about the exclusives from someone else who provided all the news. More over, these publications practice actual journalism and go get the news instead of waiting to be briefed by some web 2.0 jack ass "exec".

</comment></comment><comment><USER12> I work for Georgia Tech's (I hate to use the term) incubator. Very different types of startups come out of there than YC. But media and investors come to us every day looking for new companies. Why? Because we see a lot of deals and vet them. YC does the same thing. Angels, VCs, and TC know that PG sees a lot and only accepts the best. PG is the Good Housekeeping Seal of Approval for Web app startups.

</comment><comment><USER13> its simple really, Arrington trusts PG's judgement on what is a good or a bad startup, so he covers them so that he can be one of the first ones to cover the next reddit

</comment><comment><USER14> What is worse than politics on Hacker News? Bad technology drama.

 _On Lisp_ is fucking awesome and that will never change.

</comment><comment><USER15> I don't read TC because the signal/noise ratio is not good for me, sometimes there is some interesting article but most of the things are rumors, startups with no relevancy covered, and so on. I guess there is space for the Ars Technica of the web...

I know this is more a news site about development startups but I bet that one of the best kind of startups one can build today is _content_ startups. The internet is big and full of users but good stuff to read are rare.

</comment><comment><USER16> Irrational negativity. Read the first few sentences and quit. I'm really glad that this sort of article doesn't reach the front page that often.

</comment><comment><USER17> OK Teddy, we get it. You hate Arrington and his website. Get over it and find better ways to spend your time than slinging vitriol.

</comment><comment><USER18> link. bait. for. failed. website.

<comment><USER9> worked?

</comment></comment><comment><USER19> Sigh. If we ignore uncov, will it go away again?

</comment><comment><USER20> The answer is simple. It is the same reason why most of you here automatically vote for anything posted by PG to Hacker news :)</comment>


Open is Not Better... Better is Better. - <AUTHOR> http://500hats.typepad.com/500blogs/2007/08/facebook-not-fo.html

<comment><USER2> Open _is_ better, because closed just sits there. You have to wait and hope that the Powers That Be will support what you want, and that they won't just decide to eat your lunch.

Yeah, often Open is "some assembly required". But that's true of Closed as well. STFU and start hacking, people.

</comment><comment><USER3> >>"Open _is_ better, because closed just sits there.."

um, and wtf is that supposed to mean? better perhaps in the eyes of some geek elite, but not in the eyes of your mainstream users. they have no fucking clue what 'open' means.

i believe it was paul graham himself who said "make something people want"... he didn't say "make standards-compliant features, as determined by a few self- professed open standards committees & bloggers".

seriously.</comment>


How to Recover from API Downtimes and Errors - <AUTHOR> https://blog.bearer.sh/api-error-fallbacks-remediation/ <comment><USER2> finally a company that cares about APIs :-)</comment>