Show HN: Craigslist Car Search  - <AUTHOR> http://carsabi.com <comment><USER2> According to the Craigslist Terms Of Use (<http://www.craigslist.org/about/terms.of.use>)

7\. CONDUCT

You agree not to post, email, or otherwise make available Content: ...

u) use automated means, including spiders, robots, crawlers, data mining tools, or the like to download data from the Service - unless expressly permitted by craigslist;

I am wondering if you already have permission from craigslist?

<comment><USER3> They have RSS feeds. This, for instance, is Nissans around NYC:

[http://newyork.craigslist.org/search/cta?query=nissan&sr...](http://newyork.craigslist.org/search/cta?query=nissan&srchType=T&format=rss)

<comment><USER4> I usually have half a dozen RSS searches added to my Google reader for items I am keeping an eye out for. Using the advance search operators and RSS feeds, I usually am the first person to reply to ads.

</comment></comment></comment><comment><AUTHOR> Hey all - we built this because we really like buying off craigslist vs dealerships. Its still pretty new but we'd love to know how we could make it better, so any and all comments are much appreciated. Thanks!

<comment><USER5> I wish I had this site this summer when I was looking for a used car. This was exactly what I wanted; mad props!

</comment></comment><comment><USER6> I used www.autotempest.com late last year to find my latest car and I'm glad to see some competition emerging.

After a quick review, two things that strike me:

1\. One feature I like about AT is being about to see which cars are in which markets. Even though the search radius may include 5 surrounding cities, it would be nice to see some physical separation between the markets when combing through the results.

2\. One feature I DIDN'T like about AT is that in trying to accomplish [1] from above, I often found myself annoyed when nothing was found in specific markets. This resulted in me having to click through the pagination to see if anything existed in other markets. The better way to handle this would have been to show only those cities with results, in order.

Good work so far!

</comment><comment><USER7> Interesting market, with probably a lot of emerging competition from players who understand how to get listing inventory and make interesting insights about the "value" of each listing. This is something we're testing at FindTheBest with our Cars For Sale section (<http://buy-a- car.findthebest.com/>). We've got a lot of the same functionality that Carsabi has, but we don't scrape Craigslist for our data. In addition, we can also show how an individual car for sale compares to similar cars in terms of price, mileage, etc. on detailed pages. For example, I know that this 2012 Audi A3 is selling for $2,000 less than the average for all other 2012 Audi A3's for sale now on our site (<http://buy-a- car.findthebest.com/l/280922/2012-Audi-A3>). And with hundreds of thousands of listings, this data starts to be reliable. Also can show for some cars, how they were reviewed by experts (with no effort from the posting user), by relating cars for sale with cars we've reviewed on our cars section (cars.findthebest.com). Glad there are a lot of people interested in disrupting this market though - there's a lot more we can do to help users find a great car to buy.

</comment><comment><USER8> This looks fantastic! Reminds me of padmapper, for cars. I'm really liking some of the things you've done to parse out information into a more digestible/searchable format. The dynamic filters, mousing-over-to-see- different-images, and allowing me to 'favorite' listings makes this a godsend compared to manual craigslist-surfing. Have you considered searching by color? I know this won't be easy to parse out but perhaps image recognition would be more reliable?

Well done!

<comment><USER9> Ya, adding color search is definitely on our roadmap. It'll be pretty easy for dealership cars, since they usually list it, and for Craigslist hopefully some blob detection will work.

</comment></comment><comment><USER10> This is great. Just literally gave up searching CL for a new car after ten minutes of click/back/click/back and saw this here. Timing couldn't be better, and it's quite intuitive.

</comment><comment><USER11> Nice interface. A few thoughts:

* There is no way to get back to the home screen. If I want a blank slate I have to manually clear out the fields.

* I can't bookmark searches, send them to friends or search for multiple models at the same time because everything is cookie based. Having my search from my last session come up when I enter <http://www.carsabi.com/> is also a bit creepy.

* Clearing the "max price" field is broken. All future searches come back with zero results. Refreshing the page shows "$0" in the field.

<comment><USER9> Ah yes, looks like we need to set some kind of sensible default for the maximum price.

Would you prefer to just bookmark searches, or login and be able to "save" them? (have them show up as separate tabs next to Saved Listings, or something like that)

<comment><USER11> Saved searches are usually more trouble than they're worth; sensible URLs are far more flexible.

The problem with the maximum price is not that I'm entering "$0" it's that I literally can't reset the input to a null state.

</comment></comment></comment><comment><USER12> Part of the problem with this is that nearly all of the best deals I've found on Craigslist (mostly camera lenses) were because the person actually _misspelled_ the one key word in the title, which lead me to be the only person (or one of very few) who noticed the listing.

So I do hope that "Mazda Miata" also looks for listings without the word "Mazda" and also looks for the misspelled "Maita", etc, as well

<comment><USER13> I purchased my 4Runner like this. 3 reposts over a month with "4 Runner" and dropped the price $1500 each time. He needed to sell it fast. I got a really good deal.

</comment></comment><comment><USER14> No Datsun?!?

For "car guys" you need to allow searching by the platform code. Way more important and specific than the decade-spanning model names. For example "e30" should return '83-91 BMW 3 Series.

Love that you can specify Slushbox/Manual and exclude salvage titles.

Very annoying that middle-clicking car posting titles on the 'grid view' page does not open the cars in new tabs. I want to scan through the list and open all the ones I find interesting, then look through the details one at a time.

Clicking the site's logo (top left) should bring you back to the no-current- search homepage. Not edit the current search. Right now it feels as if you can't entirely clear the search. Clicking back to the homepage should definitely do that.

I use this site for a list of desirable year/model cars. You might get a few ideas from them: <http://autoemu.com/>

<comment><USER15> I've noticed that the kind of listings for "e30 m3" versus "1989 m3" is going to end up being from a different kind of owner...

<comment><USER14> Yeah, definitely. But searching "e30" could not only do a keyword search but also compile the right cars from the right years.

</comment></comment></comment><comment><USER16> Love it, the interface is great.

I'd like to see query parameters stored in the URL instead. As others have mentioned, it'd be nice to be able to bookmark pages and you currently can't. In addition to the bookmarking use case, I'd want to be able to email links to the results (e.g., so my dad could check them out).

It was also initially confusing to return to the homepage to find my past query, not the search form. Even if you don't get around to embedding search parameters in URL right away, consider adding a clear button to erase all of my input and let me start fresh.

More of a nitpick, but when I made a typo on my zip code on the main page and hit submit, it also erased my entry for the search box. The form data should be persisted even if there is an error, and the problem input should be highlighted in red or something.

</comment><comment><USER17> dw5ight - Let me show you your future (<http://notifywire.com>)

You created a really nice site. Unfortunately, if you have any success CL will make legal moves to shut you down as they did with NotifyWire (which I created).

My software actually reduced server load on CL's servers when compared to the alternative (everyone using an RSS reader to do the same thing). So don't believe the BS about server load, they want complete control.

If you want to talk about what happened, send me an email email@example.com

</comment><comment><USER18> Very useful. When I bought my Honda '92 on Craigslist, I was optimizing for cost and therefore spent a few weeks just feeling out the price range for model, mileage, and title (I was only looking at clean titles). It seems that the search settings here do a good job covering what my primary focus was.

In order to jump on the hottest deals, I would set up an IFTTT condition to email me when new queries were posted on Craigslist. Would be cool to have some monitoring with this site.

Regardless, very nice work!

</comment><comment><USER19> Nice job. Suggestion: specify what format you expect for the "Near" field. It took me a few tries to realize it wanted a ZIP code (and all the while it was telling me to "match the requested format").

Also, did you get permission from craigslist to index their listings? I was looking into building something like this, but their terms said something along the lines of "don't access our site with a crawler unless we give you permission".

<comment><AUTHOR> Thanks! I think we'll try to link directly to google geocoding later, but for now I'll definitely add zipcode placeholder text.

As to Craigslist - we'll see? We actually built a pretty robust classification engine that you can run on any html, so we've added about 600 dealerships in California and are planning on running the crawler on dealerships nationally soon if we can get more server money. I think we're hoping that if we provide a free service where you can see what better deals Craigslist has compared to Autotrader etc people will generally think its cool instead of lame. Thanks for checking us out!

</comment></comment><comment><USER20> This is awesome, but maybe consider persisting some basic parameters in the URL string so that I can bookmark a particular page that I like to check often?

</comment><comment><USER21> Very nice. Used it to research upcoming purchase quickly, would have signed up to persist saved results if you had that option.

Main feedback - browser refresh, back/forward, tabs, middle-click should work, e.g.

\- refresh now loses half the state (why half?)

\- opening 'Click to view listing' messes up state (loses saved)

\- want to be able to middle click on 'Details' to open in new tab

Nice to have: integration with Edmunds to appraise the car

<comment><AUTHOR> 1\. Yeah, pretty much everybody today told us to make tabs work. Going to add for sure 2\. Hadn't thought of saving searches (not listings) yet, great idea 3\. Damn! My js skills suck, will debug 3\. I'll check with Edmunds if they have an API, that could be cool. In the mean time we were going to add some stats about how any car compares to others nationally with the same model, year, and mileage

thanks!

</comment></comment><comment><USER22> Love it! Searching on value feels like it'd be useful for a trader, but not necessarily an individual with a strict price limit. How about adding a value measure to the boxes? Then users could sort by price but still pick out the real bargains.

Also would be nice to search for several models together and/or criteria rather than models (e.g. "manual hatchback between $7 and $10k").

Good luck!

<comment><USER9> Definitely, we'd like to add more comparison as to how good of a deal you're getting, but just haven't had time yet.

The hatchback/sedan/... is on our roadmap too. It's a little tricky, because often sellers don't post it explicitly, and doing computer vision on the pictures, would be very hard.

<comment><USER22> Great. I wondered if you could take whatever you're using for the "Best Value" ordering and display that metric in the boxes (so no need for more analysis).

Maybe you could store which models are always hatchbacks and always sedans, as a starting point (relatively few models have a hatchback version in the US so I think this would get you 80% of the way there). For those where there's a sedan/hatchback version, perhaps assume it's the sedan unless sellers include hatchback keywords - and If in doubt, maybe show the result anyway with a question mark icon?

</comment></comment></comment><comment><USER23> You're very vulnerable to CL shutting you down.

</comment><comment><USER24> Some feedback:

1\. didn't work for me until I realized I have to enable cookies?

2\. how do I search for any kind of hatchback?

3\. did my scrollbar just turn pink in chrome? really? Are we back in the 1990s with IE ?

4\. be sure to get permission BEFORE you start crawling them:

<http://www.google.com/search?q=craigslist+sues>

<comment><USER25> +1 to #2:

It'd be super neat to associate that may not be explicit in your fields or the source CL data with certain make/models.

</comment></comment><comment><USER26> pretty good, although for craigslist, there is really no sense in letting someone search within 14 days.

anything that's a good deal is gone almost right away

I lost out on like a dozen cars before I bought my last one. And that was only because I saw the ad get listed in the previous 5 minutes, and went right away to test drive it.

As far as feedback, 1 bug - when you scroll through the makes, it keeps hiding. Especially annoying if it's a brand at the bottom of the list(i.e. Mercedes).

Feature wise, the map of the car's location isn't that useful, much better would be to just list how many miles away the person is...and maybe even estimate the time to get there.(i.e. I remember thinking oh 30 miles, not that bad...then you spend 45 minutes driving to and from there, and pretty much your entire day is gone, just to see one car)

<comment><AUTHOR> Yeah, this is totally true. I think we'll be adding a notification system with saved searches soon, but we wanted to see if anyone liked the idea at all first.

Also with the 14 days thing - we're trying to build something that can crawl dealership websites as well, and are hoping to have this going nationally sometime soon. The entire idea is that Autotrader sucks and basically raises the prices for everyone while presenting a shitty interface - for things as large and expensive as cars I think the internet could literally track all instances available, allowing a rational decision process behind purchasing sans prioritization of pre-existing distribution channels or advertising budgets

Also will fix the make thing. Thanks!!!

<comment><USER27> Before you do much crawling of car dealer websites, you should talk to the companies who build the sites. (Dealer.com/Vinsolutions..etc) They have systems in place that package up the car listings for their dealers and send them in csv/xml format to many sites like Autotrader/Cars.com on a daily basis.

<comment><AUTHOR> no kidding?! That would make my life soooooooo much easier. If you have any contacts would be stoked to make the connection - my email is firstname.lastname@example.com, else I'll shoot them a line and see if anyone wants to talk to two guys in an apartment :P Thanks!

</comment></comment></comment></comment><comment><USER28> This has some similarity to Autoglance (which is more Hipmunk-like in its UI, currently does not include craigslist data, but does allow searching by color) posted here a few days ago:

<http://news.ycombinator.com/item?id=3484875>

</comment><comment><USER29> Finally a used car search service that makes sense. Though it needs a way to bookmark search results.

</comment><comment> mkr-hn I don't see a selection for Saturn's S series. One of the best lines they ever had.

[http://atlanta.craigslist.org/search/cto?query=saturn+sc2...](http://atlanta.craigslist.org/search/cto?query=saturn+sc2&srchType=T&minAsk=1000&maxAsk=3000)

</comment><comment><USER30> Very cool. What's the software stack behind this? How are you performing searches across all this very diverse data? For example, you must be doing some sort of text-analysis to retrieve the _mileage_ property out of the text, no?

<comment><AUTHOR> Craigslist is a ton of NLP to figure out common ways to phrase mileage etc... also catch all the mispellings.

We're also experimenting with some structured parsing for the universal dealership parser we alluded to - this means trying to figure out which part of the page has a listing so we dont accidentally report the mileage from a warranty or similar listings lower down the page... turns out to be a fairly tricky problem but its also a ton of fun to work on! Will keep you posted if we start having a ton of success automagically crawling the interweb. Thanks!

</comment></comment><comment><USER31> I like it. I'm located in Canada and when I put in my canadian zip code first just to get back to the main page again. You should give a notification when someone enters in a zip code you no longer support instead of failing silently.

<comment><AUTHOR> yeah, that's a major fail on our part. I'll add a notification that only USA is currently supported - thanks for the feedback I honestly hadn't even thought about international stuff yet :P

<comment><USER32> "I honestly hadn't even thought about international stuff yet"

You must be American.

</comment></comment></comment><comment><USER33> Nice. Needs saved searches and "anded" searches that would search for more than one thing at a time without having to enter it each time. Some sort of notification app for smartphones would be a good thing too.

</comment><comment><USER34> I can't seem to get this to work. I type "Vancouver" in the "near" box and I just get a message that says "Please match the requested format.". What's the requested format? What did I do wrong?

<comment><USER9> You have to enter a zipcode, sorry that's not clear.

<comment><USER35> Please add support for Canada.

Heck, while you're in there, make it work world-wide.. CL is, so you may as well be.

<comment><USER36> Agreed! If you are using the RSS feeds, there should be an easy way to include us Canadians :)

</comment></comment></comment></comment><comment><USER37> The zipcode doesn't deal with leading zeros on autodetection properly. Mine said "2138" where it should have said "02138", so it took me a minute to realize it was a zip code.

<comment><USER38> It seems like the auto-detection is off anyway. I'm in 10003, and it said "7927" for me. I'm on a desktop, without any kind of wi-fi or GPS, so not sure where it got that - certainly not by IP

</comment></comment><comment><USER39> I tried to search for "bmw m series". After the search box leaves focus, it's value changes to "BMW 3 Series", which is the first choice in the suggestions.

Don't you guys like the M cars? :)

</comment><comment><USER40> I'm from Australia, but when I enter text into the "Near" box it says "Please match the requested format.".

What format was requested? I tried a postcode, and suburb, neither work.

Confusing as :(

</comment><comment><USER41> I have a promise from one of the founders that they will be adding motorcycle search... ok that's a lie. I have no such promise, but I want motorcycle search

</comment><comment><USER42> This is very cool and would be helpful for more than just cars if it weren't in violation of the terms of use on Craigslist.

</comment><comment><USER29> Finally a used car search service that makes sense. Though it needs a way to bookmark search results. Great job regardless.

<comment><USER43> I think padmapper's two-tiered approach of allowing one unauthenticated and then authenticated use for access to bookmark and sharing features is elegant, and doesn't annoy people who just want to check the site out or use it lightly.

</comment></comment><comment><USER44> Great idea, definitely will use this for my next car. Probably much easier to build a business around this than Padmapper.

</comment><comment><USER45> On my laptop in Firefox the feedback button covers the keyword search. I suggest moving it to the upper right corner.

</comment><comment><USER46> Well done! I like it a lot. I'll probably be in the market for a car soon and will definitely check it out. Thanks.

</comment><comment><USER47> This is really well made. I'm building something similar for other product categories. Hope to put it on HN soon.

</comment><comment><USER48> Can we know what language/framework/technologies are used on your site? It's pretty well done, congrats.

</comment><comment><USER49> BUG: Zip codes are losing leading zeroes - make sure you store them as strings rather than numbers.

</comment><comment><USER50> Love this! So user friendly. Id love to see features used to create a new criagslist car posting.

</comment><comment><USER51> Would like the ability to search by cylinders, displacement, horsepower, and also 2wd, 4wd, awd.

</comment><comment><USER52> Where's Infiniti in the make list?

<comment><AUTHOR> wow. we seriously forgot to add Infiniti - will fix tonight, thanks!!!!!!

::facepalm::

<comment><USER14> Needs Datsun too! What, do you guys have a thing against Nissans?

</comment></comment></comment><comment><USER53> I searched for something and now it is stuck with that result. Even if I go to a new tab.

</comment><comment><USER54> In the search results, clicking to view a result is non functional on the iPad

</comment><comment><USER43> Great Work! Nice feature set, looking forward to using this in the future.

</comment><comment><USER55> Very well done! Make it for rooms for rent as well please...

<comment><USER56> <http://www.rentjungle.com>

</comment></comment><comment><USER57> Awesome tool, will use to buy next car.

</comment><comment><USER58> Doesn't work with UK postcodes

</comment><comment><USER59> US only? How about Canada?

</comment><comment><USER60> Amazing. You are god.

</comment><comment><USER61> oh please craig, let it stay...

</comment><comment><USER62> these guys are awesome!

</comment><comment><USER63> my gripe with 90% of car searches.

i'm not after one specific car. i'm buying a used car.

i have a fixed budget and a some cars that I would avoid. everything else is fair game.

craigslist is the only one that get's it correct.

       1. put your price.
       2. get a bunch of crap you don't like
       3. add -crap1 to the search
       4. repeat 2 and 3 until you get things you like
       5. select a few, call, inspect, buy.

limiting by brand/model is like starting to shop by color.

<comment><USER64> I've felt this same way for a while, I've been running a used car site since 1995 (<http://www.ausedcar.com>). The sad thing is I've experimented with all sorts of other ways to search for cars over the years like what you are recommending (in the past I've let you search by fuel economy, etc...) but nothing seems to convert (ie work) as well as the same convention everyone else uses of Make and Model :\\.

Also Craigslist will probably shut down the linked site soon, it's quite unfortunate how Craigslist essentially took the entire FSBO car market, but won't innovate in the way that this site shows it could.

<comment><USER3> I can't agree more on the second point. If only they added mileage, year, make, model fields, this would instantly make car search painless.

What they have now is a bunch of unstructured data that users have to sift through.

CL is great, but the lack of innovation doesn't make any sense to me.

<comment><USER65> The unstructured data makes Craigslist a much easier place to post listings. I don't have to click or press TAB and ask myself "what is this field now?" You could arguably find the make / model through natural language processing, which with CL philosophy and resources might be a stretch.

<comment><USER63> that's a trade off. a bad one.

in CL you don't think about posting, but your ad will be removed by other sellers with higher price (happened to my nexus one when i tried to sell) and buried in a couple hours. and expire in a couple days. And then, the READER has to put in all the time the writers didn't put.

on other sites, you waste some time to write, but you can be sure you will not be removed without reason, the ad last longer, and the buyer can get there quickly.

</comment></comment></comment></comment></comment><comment><USER66> Awesome.. I really like it. I can definitely see lots of people including myself using it for my next car search.</comment>


Neutrino discovery–a step closer to finding charge-parity violation - <AUTHOR> https://phys.org/news/2017-06-neutrino-discoverya-closer-charge-parity-violation.html <comment><USER2> "Effect not big enough" implies a judgement about how much matter/antimatter was available to begin with... a tiny effect is entirely sufficient to produce the observable universe if one purports to begin with a truly colossal initial amount of matter/antimatter.

<comment><USER3> Since matter-antimatter annihilation produces radiation, what prevents us from estimating the size of the effect by measuring the background radiation of the universe and comparing it to the amount of observable matter?

<comment><USER2> I presume the volume of the Universe. We can measure average density of residual radiation but getting the total value of energy requires multiplying by volume. Much of the universe's volume may be hidden behind a cosmological horizon (basically, the idea that as the universe's rate of expansion accelerates the greater the distance from us (Hubble's constant), eventually the rate of expansion exceeds the _c_ and thus light from that part of the universe can never reach us, making it unobservable).

</comment></comment></comment><comment><USER4> Stupid question: Is neutrino oscillation deterministically sequential? That is, does an electron neutrino always turn into a muon neutrino, which then always turns into a tau neutrino, which then always turns into an electron neutrino (or the reverse order)? Or does an electron neutrino sometimes turn into a muon neutrino, and sometimes into a tau neutrino?

If it's sequential, and if the antineutrino sequences in the opposite order, this effect could be explained just by the distance of the beam run being a fraction of the oscillation distance such that it's hard to get anti electron neutrinos, because at that distance, you're getting anti tau neutrinos instead.

<comment><USER5> A neutrino is born in a weak eigen state (e,mu,tau) and propagates as a mass eigen state (m1,m2,m3). The two bases are related by a rotation matrix of three angles and three phases of which one, the CP violation phase, can in principle be measured with long baseline neutrino experiments. The oscillation happens because each mass state propagates at a different frequency. So while a numu starts out with some fraction of m1, m2 and m3 states, it soon becomes a different mixture which is neither nue, numu nor nutau. Instead, when the neutrino interacts, it does so with some admixture probability of doing so in the form of each possible flavor.

<comment><USER2> So it's basically a Markov Chain kind of process, but on continuum of time rather than in discrete steps?

<comment><USER5> I guess you could couch the concept in this way but I have not ran across this approach to do calculations.

In vacuum the oscillation probability (ie, the vector holding probability amplitude saying how much of "e-ness", "mu-ness" and "tau-ness" the neutrino has over time) is analytic and almost trivial to apply.

In the presence of matter, forward elastic interactions with electrons in the matter can "pop" or "reset" the neutrino back to a nue weak eigenstate. This is the so-called "matter effect". If the density is constant one can rewrite the oscillation probability formula into a form that is the same as the vacuum one. So, again, easy to calculate.

When going through variable matter densities one must, to be proper, solve a differential equation. Computationally, this is done by stepping the equation, eg with Runge-Kutta. Happily for us humans doing experiments at home, if the matter in question is the Earth then the fact that its matter density is close to uniform in bands (crust, mantle, core) one can do a step-wise constant density approximation that's pretty close to a full solution and much faster.

</comment></comment></comment></comment><comment><USER6> > implies that matter—including galaxies, stars, and even humans—should have > been annihilated by the equal amounts of anti-matter.

That is an odd sentence: "Even humans" after enumerating "galaxies, stars".</comment>


A sliding puzzle, built with Elm - <AUTHOR> http://moroshko.github.io/sliding-puzzle/?width=4&height=4&start=P,L,A,Y,T,H,I,S,G,A,M,E,N,W,O,&goal=P,L,A,Y,T,H,I,S,G,A,M,E,N,O,W,&shuffle=0 <comment><USER3> It's a nice interface. I'm glad arrow keys, the first thing I tried, work. But you're not going to trick me into looking for a sequence of moves that change the parity of the underlying permutation.

<comment><USER4> The game is solvable -- no tricks, just something you've overlooked.

(Hint: Someone who doesn't know about parity might try scrambling the puzzle randomly, then find that they can reach the goal state about half of the time.)

<comment><USER3> Is the thing I've overlooked that there are two As?

<comment><USER5> Yes - easily solvable when you flip the A's

</comment></comment></comment></comment><comment><AUTHOR> Source code: [https://github.com/moroshko/sliding- puzzle](https://github.com/moroshko/sliding-puzzle)

<comment><USER6> That code is so -erm- pretty. And by popular accounts, Elm is a pleasure to develop with. I hope it catches on.

<comment><USER7> I'm pretty keen to play with Elm, but it gives me some pause that an app like this (or the demo at [https://github.com/evancz/start- app](https://github.com/evancz/start-app)) results in... 11k lines of Javascript. Nevertheless, these talks got me bulled up on Elm: [https://www.youtube.com/watch?v=FV0DXNB94NE](https://www.youtube.com/watch?v=FV0DXNB94NE) (Richard Feldman, collegially, on React -> Elm)</a> / [https://www.youtube.com/watch?v=oYk8CKH7OhE](https://www.youtube.com/watch?v=oYk8CKH7OhE) (Evan Czaplicki on the motivation for Elm)

<comment><AUTHOR> That's because the Elm compiler doesn't yet do much in the way of "dead code elimination" (DCE).

However, that will change in a future release of Elm, once Joey Eremondi's work has been fully integrated. My understanding is that integration is not slated for the 0.16 release (imminent) but will likely be part of the 0.17 release.

See: [https://groups.google.com/forum/#!searchin/elm- dev/dead$20co...](https://groups.google.com/forum/#!searchin/elm- dev/dead$20code%7Csort:date/elm-dev/ney653TeOmU/p8pr7JSDAQAJ)

<comment><USER8> Are they planning to leverage the Google Closure compiler the way Clojurescript does? Un-optimized Clojurescript is also huge until it runs through Closure compilation.

<comment><AUTHOR> No, I believe the DCE implementation (still in the works) is specific to the Elm compiler, as opposed to an implementation which organizes the source in such a way as to leverage Google's Closure compiler.

</comment></comment></comment></comment></comment></comment><comment><USER9> Elm looks absolutely fascinating to me, but one of the things that strikes me is odd is the prevalence examples that eschew markup for the canvas. Not a bad thing per se, but definitely a departure from what most JS Frameworks and tool sets show off.

<comment><USER10> And it seems faster than the typical meteor app.

</comment></comment><comment><USER8> I'm so fascinated by Elm. What a great addition to the world of JS tooling. I wish had more time to spend on it, but the Haskell syntax, the strict typing, the Haskell compiler, and reactive JS model, the emphasis on graphic UI building as a native language feature, all just really great and relevant ideas.

<comment><AUTHOR> There's also PureScript, which is a little more "apples to apples" with Haskell. Both the Elm and PureScript compilers are written in Haskell.

[http://www.purescript.org/](http://www.purescript.org/)

[https://leanpub.com/purescript/read](https://leanpub.com/purescript/read)

Also, some of the ideas from Elm are having an influence in the PureScript ecosystem.

For example: [https://github.com/bodil/purescript- signal](https://github.com/bodil/purescript-signal)

See also: [https://github.com/slamdata/purescript- halogen](https://github.com/slamdata/purescript-halogen)

</comment></comment><comment><USER11> Cool. I plan to look at the source code later.

One issue I noticed: when playing with the mouse, if I click on a tile, then click on some other tile, the FIRST tile clicked is the one that moves - <USER2> seems like a bug and is certainly a counterintuitive input behavior.

</comment><comment><USER12> Very nice! More reasons to try Elm out.</comment>


What role should men play in the tech industry's diversity problem? - <AUTHOR> http://www.bizjournals.com/bizwomen/news/profiles-strategies/2015/03/what-role-should-men-play-in-the-tech-industrys.html?page=all

<comment><USER2> > "That person [in the majority group] cannot speak for the underrepresented > group," Quinton said. "They are not part of that group. [But] they can > observe unfair practices and unconscious biases and call that out for the > broader community."

I'm concerned with the idea implicitly presented here: that no man can speak for women, but that _any_ woman can speak for all women.

Honestly, that's ridiculous.</comment>


Ask HN: How to transfer a project IP from a C-Corp to a person? - <AUTHOR> Basically, I want to figure out the cheapest & lowest-friction way to do this IP transfer.<p>Some specific questions:<p>- Any legal document that needs to be signed? I assume there's some kind of IP transfer agreement.<p>- Does this need to involve attorney? Or if the board of the C-Corp agrees, then just do it (e.g., two parties sign the document, then done)?<p>- If the IP transfer is done, can that person start a company on the project and raise VC money? <comment><USER2> The devil (of course), is in the details - I would definitely check with a lawyer. If money is an issue, then call around - many lawyers will do a free consultation, where they could probably tell you if your situation required a lawyer to draft a document, or just something signed by the board.

<comment><AUTHOR> Thanks! Yea, we'll definitely check with lawyer first.

</comment></comment><comment><USER3> I am not an attorney. I recommend hiring one. My lay understanding is that the IP is an asset of the corporation and giving away assets to individuals is likely to be fraught with legal and regulatory hazard. Disputable ownership of IP is the sort of thing that might cause future investment to fall through during due diligence.

Ultimately, the answer to most "do I need a lawyer" questions is, yes, when the stakes are non-trivial.

Good luck.

</comment><comment><USER4> Get an attorney.

This will very likely have tax implications as the IP has some value, and companies cannot (usually) just give away assets to an individual.

Once you own the IP, you can do (almost) anything you want with it, including start a VC-backed company.

</comment><comment><USER5> Sounds like the company needs to sell the asset to the individual, under the terms of a contract. It can be sold for $1, by the way. As others have said, talk to an attorney (the company likely already has someone).

<comment><USER4> It cannot always be sold for $1--the IRS may view the sale as tax evasion if it occurs well below a fair market value.

As an example: if the company had two developers working full-time for a year on the IP, the value of that IP should be in the ballpark of those developers salaries.

This is not always the case, but a reason you should consult an attorney.</comment></comment>


Ask HN: Your First Technical (Security consulting) Interview - <AUTHOR>

Hello HN, I'm a physics major (infosec is really cool though) and I have an upcoming technical (infosec) interview for an internship with an infosec consulting company, and it's half an hour in duration. It's unknown as to whether this is entirely technical, or some other sort of combination of an HR type interview as well as a technical interview.
How do you suggest I prepare for this/does anyone know what I should expect?
Thanks in advance. <comment><USER2> I've worked in Infosec for over 4 years and have been on both sides of the interview process. I have only a few high level pointers.

1\. If you are passionate, show it. If you want to work in the security industry you have to really nerd out on this stuff and not treat it like a day job that "pays the bills".

2\. Don't BS about technical answers. If you don't know the answer to something, that is OK. A good interviewer would rather you walk them through the steps you would take to find the answer than completely make one up. Big no-no.

3\. I don't know what position you are applying for but you should be expected to know some basics about attack vectors, defenses, security strategies, and general computing. Brush up on your scripting skills while you are at it. Python is my language of choice. Bash scripting is also highly desired.

4\. Don't regurgitate a list of tools you know. Pick a few that you have used and explain how you used them..anyone can run an Nmap scan but what do the results mean?

5\. Be friendly and approachable. This goes with any job interview but just a reminder.

6\. Don't stress it too much. It's impossible to anticipate every little detail of every question that will be asked. Be yourself and most of all, be curious.

Hope this helps! Feel free to PM me with specifics and GOOD LUCK! Hope too see ya at the next con.

</comment><comment><USER3> Practice what they preach.

Don't tell them anything they don't need to know. Don't join their WiFi. Don't share information about the organizations you have worked with in the past.

That's and make sure you are familiar with the concepts of OpSec.

Typically in a 30 minute interview the extent of the technical questions are going to be limited to concepts not practice. I can't imagine a 30 minute interview will require you to setup a firewall, or configure a router.</comment>


Australia advocates weakening strong crypto at upcoming "Five Eyes" meeting - <AUTHOR> https://arstechnica.com/tech-policy/2017/06/australia-to-target-encrypted-messaging-apps-at-upcoming-security-meeting/ <comment><USER2> Great idea! So who's head will roll when hackers steal that master key(s) with access to the world's biggest networks?

Any volunteers? Anyone at all?</comment>


Pandora doesn't hash their passwords - <AUTHOR> https://plus.google.com/116797686750161798768/posts/NGV5xQwJywf <comment><USER2> There may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread:

Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute whose name appears to be a randomly generated (encrypted) is updated.

Assuming that is password, stored encrypted, the exposure here may not be what people think. It certainly would mean the password need not be stored at all on Pandora's server. They could just have an HMAC. The password value could be simple extracted from local storage. Has anyone checked to see if this is the case?

 _Follow up_ : Okay, I further confirmed that if I set the password back to a prior value, that field in jStorage flips back to the prior value. So, it looks like it is stored encrypted, locally on the system. I haven't traced through all the JavaScript, but it seems likely that the security issue here is different than perceived, and might even be non-existant.

<comment><AUTHOR> Even if that's the case, though, that actually only mitigates the _least_ problematic issue here (namely, how the passwords are stored on Pandora's end). At least the stored passwords there are behind other forms of security - so regardless of whether they're stored in plaintext or hashed on Pandora's servers, it'd still take an actual breach of Pandora's servers to retrieve them.

The real, major issue here is the fact that passwords are loaded into an HTTP- served page and displayed back to the user. It doesn't matter how it happens behind the scenes - the fact that someone can do either of the following is still majorly problematic:

1\. Walk up to a computer you're logged into and read your plaintext password.

2\. Inject scripts into the main (non-HTTPS) Pandora page and read it out of the DOM.

If they did go to the trouble of saving the password into local storage with encryption, one has to wonder what they were thinking, given that it's a lot of effort for a solution that's far less secure than the trivial effort of just storing hashed passwords.

<comment><USER2> 1) No matter _what_ they do, if someone walks up to a computer that you're logged in to, they have a very good shot at getting your plaintext password (there's a distinct chance it's in a memory buffer somewhere). With a minor bit of effort, they can get access to any future password you use. This is a basic principle of security for anything other than MAC style security systems (and even then...)

2) I think there _is_ a very real risk there, but of course, unless they use HSTS (and therefore always HTTPS) everywhere, there is a risk of this. Even if they use HSTS (which isn't broadly supported in browsers yet), almost no-one checks TLS certificates for man-in-the-middle attacks. In short: the man-in- the-middle attack risk is always a risk unless the user takes extraordinary efforts. They could do more to mitigate it, but it'd undoubtedly have some seriously negative user experience consequences. It seems like a very high bar to hold Pandora to given the nature of their service. If you _are_ going to hold them to that standard, you might want to start with a more significant target like say.... the Apple Store.

<comment><AUTHOR> Re #1: There's still a matter of degree, however - this takes zero technical knowledge and zero external tools, works on every platform that Pandora runs on, and requires maybe 5 seconds of time.

Re #2: Again, it's a difference of degree. Invalid TLS certs will at least give a browser warning that a user isn't used to seeing (in modern browsers), cluing them in that something might be up. Sure, some users might bypass it anyway, but there's at least some tip-off. Furthermore, there's no reason why the password needs to be in the DOM past the login page, which can easily be served over full HTTPS with no user experience impact. Yes, that can still fall prey to session hijacking if you don't use HTTPS for the rest of the site, but session hijacking doesn't give you passwords that you can use to go break into other sites.

<comment><USER2> #1: You know what also requires zero technical knowledge and zero external tools and requires maybe 5 seconds of my time? Typing in a new password for the account and clicking "save".

#2: It needn't be an invalid TLS cert. It could be a valid TLS cert pointing to another domain. The browser provides no warning and you only notice it if the check the domain is different from the one you expect. Watch out for domains that are only different because they use a funky character that _looks_ like the one you are expecting.

<comment><AUTHOR> #1 - yes, which is also a problem! But is actually less serious, because that doesn't give you knowledge of the old password which could be shared with another site. (Obviously in the ideal case it wouldn't be, but let's face it, it is for the vast majority of users.)

#2 - which is something that browser vendors are working to address (e.g. by displaying non-ascii characters in slightly different ways, e.g. punycode, and by blacklisting domains used for phishing, etc).

<comment><USER2> #1: It might be a problem, but it is also a clear indication to even a naive user that if they leave their browser logged in to Pandora, their account be compromised.

#2: Right. So there is a possibility that some day in the future, if you are really careful and check your TLS certificate every time you do something with your password, Pandora will be exposing you to a huge gaping hole, that you would otherwise only be exposed to if you used the Apple Store, Amazon, Ebay....

<comment><USER3> #1: How many times is too much when replying with #1 and #2?

#2: Answer: this many times.

So anyway, everyone change your Pandora password and be done with it. You can't buy anything with a Pandora account except to be able to listen to Pandora. That is not worth stealing, even if it is a great service. I pay for it, and I'm not going to stop because of Apple. They may have the library, but they don't have the years of experience that Pandora has in its market. I do think Apple will own the high-end home entertainment market eventually.

<comment><USER2> #!: 42. The answer is always 42.

<comment><USER3> Bring your towel much? ;)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking?

It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is _storing_ users' passwords in plaintext. It is possible that Pandora remembers your password server-side for your session. I hope that this is the case. If it turns out to be anything else-- plaintext passwords in database, etc.--then Pandora is worse than LinkedIn.

<comment><USER5> What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.

<comment><USER6> Simple, for every user that the hackers have, try their password for the associated email account, guaranteed they will gain access to many email accounts. Now they have access to their banking accounts.

<comment><USER7> This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam. Have their been any large scale attacks to gain access to bank accounts to then clean them out somehow?

On top of that, how does getting access to someone's bank account even help you? You have to transfer the money to another account, which leaves a trail...

<comment><USER8> _> This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam._

The more password databases are hacked, the better password cracking becomes, and the more sites black hats get access to. It's a vicious cycle. Yes, people sometimes do get large amounts withdrawn from bank accounts.

<comment><USER9> This. For more information on why this is the case, here's a pretty good article on it.

[http://arstechnica.com/security/2012/08/passwords-under- assa...](http://arstechnica.com/security/2012/08/passwords-under-assault/)

The simplified version: Every time a password is cracked it is added to a database of hashes used to hack other databases. Essentially crowdsourced cracking.

<comment><USER10> That only works on broken sites that don't salt.

<comment><USER11> If I was to try to break salted passwords, my first inclination would be to find the largest set of known passwords and try those before resolving to a pure brute-force approach. Thus if you password "ILikePuppies" is ever exposed as a password, then I would consider it insecure.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Thoughts? <https://news.ycombinator.com/item?id=3798597>

<comment><USER13> Proof that 99% of generating good conversation on HN comes from a well-phrased title.

<comment><USER2> Actually, proof that a provocative but false headline on HN will still get the sheep to vote up your article. ;-)

<comment><AUTHOR> For the record, the title was actually edited from what I submitted it as.

<comment><USER2> ...and it is still wrong. They _do_ hash their passwords.

<comment><AUTHOR> Encryption is not the same as hashing.

That said, when I said the title was edited, I was not referring to myself editing it.

<comment><USER2> > Encryption is not the same as hashing.

 __UPDATE __:<http://news.ycombinator.com/item?id=4552358>

If mrb is right, it looks like they are storing it locally _without_ encryption, which _is_ indeed bad.

What I had written before seeing that:

</comment></comment></comment></comment></comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>==

Yes it is not. As a consequence, they are not mutually exclusive.

The title would be correct if it said, "Pandora stores encrypted passwords locally". Guess how much less interesting your post would be with that title? ;-)

They hash their passwords. They encrypt their passwords.

I'd prefer they only did the former, but the fact that they do the former at all is _NOT_ what most people commenting on this thread understand.

</comment><comment><USER14> I wish someone would make a one-pager that says:

"Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot water. Here's how simple it is to fix. Forward this to your tech guy. Oh, and until you do, we'll put your company on this wall of shame."

Every time I receive a welcome email showing my password in plain-text, I'd gladly spend 5 minutes finding the email of an exec, or simply sending the link to support. Why? If the service is valuable to me, it's probably worth 5 minutes to protect my account and others'.

Would pair up with someone here if you want to knock it out.

<comment><USER2> Someone shouldn't do that, because a) though the poster _thinks_ they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.

<comment><USER14> I disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non- technical higher-up can go a long way for things where customer service may not see the bigger problem.

<comment><USER2> I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally.

However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints.

Telling a non-technical higher-up there is a problem, is also a good way to get a technical person in to trouble. If it is merited, no problem, but if you are wrong, you've just rewarded good work with a load of crap. It is _much_ more appropriate to follow up with the appropriate party and at least give them a _chance_ to respond before sounding the klaxon.

<comment><USER14> Good points.

</comment></comment></comment></comment></comment><comment><USER15> This is very bad from a security standpoint but you'd be surprised how many websites do this.

Here is a list <http://plaintextoffenders.com/>

I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text.

The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset it.

<comment><USER16> > Anytime a website shows you your password or emails it to you, it's a bad > sign. It means it is stored in plain text.

No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.

<comment><USER17> Encrypted passwords are functionally equivalent to "stored in plain text".

<comment><USER18> Intuitively that makes no sense so I'm wondering if someone could explain?

<comment><USER19> It's not exactly equivalent, but often is due to poor implementations. The web application has to have access to the encryption key in order to make the password check. That means if the web process gets compromised in any way, the attacker can get the plaintext password.

However, it is still safer from a straight db dump type of attack. The concern for me, though, is if a company can reverse my password, I have _no_ faith they are doing anything correctly WRT security.

<comment><USER20> _The web application has to have access to the encryption key in order to make the password check. That means if the web process gets compromised in any way, the attacker can get the plaintext password._

Well, not necessarily, since they could be using asymmetric encryption (encrypt the password received from login, compare the result with the stored ciphertext), and keep the decryption key offline.

That said, very few of them do, because if the application can't access the passwords anyway, then there's usually no point in encrypting vs hashing them. An exception would be a manually operated password recovery system.

</comment></comment></comment></comment></comment></comment><comment><USER21> Confirmed. No asterisks.

<input type="password" value="hunter2">

<comment><USER22> <http://bash.org/?244321> ... classic :)

</comment></comment><comment><USER23> Is there a need for the password to even be printed there? Usually the flow for changing the password is inputting the current password, then typing the new password twice.

<comment><USER24> Exactly. That brings up another bonehead move by Pandora - if you've made it here on someone else's account (presumably they left it logged in), you can change their password without knowing their password (ignoring the fact that you can already get their password from the DOM).

But I guess that's a minor issue compared to _exposing_ your password. Either way, the whole programming dept. at Pandora needs a lesson in passwords.

</comment></comment><comment><USER25> Why are people still relying on developers to implement proper password security instead of using unique passwords?

<comment><USER26> Why are we still relying on passwords rather than a secure PKI key-based access method in which unique keys are generated for each remote system accessed?

<comment><USER27> There's the possibility of authenticating with a SSL certificate. Fedora uses this method for a web service.

There is also OpenID, but not many sites are using it unfortunately.

</comment></comment></comment><comment><USER12> It seems like they "fixed" people being able to read the passwords by replacing the the form value with __USE_EXISTING__...

It's still trivial to automate account takeover though. Here's a PoC to take over pandora accounts on your network using MITMProxy and Tornado: <https://github.com/JackWink/Pandora-Account-Takeover-Tool>

</comment><comment><USER28> I had a Pandora account long before they bowed to the music cartel and restricted access to anyone outside the US.

I am now in an odd situation where I cannot login to change my password, or delete my account (not that I trust any delete account functions these days anyway).

Is there anyone here working for Pandora that could help me?

<comment><USER28> Found a workaround. You can still get to the login page: <http://pandora.com/login>

From there you can say you have forgot your password: <http://www.pandora.com/forgot.vm?target=>

Completing this form sends a forgotten password email to your registered email address.

That link provided allows to you reset your password.

</comment></comment><comment><USER29> I see __USE_EXISTING__. I promise that's not my password, either. It seems that the server interprets this as an implication that it should keep your existing password. So I would expect if it's ever using a different value on the client, it's an accident, because this feature implies there's no reason for the client to ever save the password (not that there's a valid reason to do that anyway).

That is, unless I'm actually seeing this after they've patched the issue?

<comment><USER30> I'm pretty sure they patched it, that's what I'm seeing too.

I have a feeling that they just put a bandaid on an issue that is going to get cracked open eventually.

</comment></comment><comment><USER31> This is terrible. No site has any business "knowing" my password. To me, not hashing is a violation of my trust right there. I'm a paid Pandora user and have been their evangelist for many years and supporter through all their tough times. Just seeing my password in plain text in the DOM Inspector makes me embarrassed. This should have never happened. They should fix this. Soon.

</comment><comment><USER32> I don't get why people don't do this. It's not that hard. The modification would be about 2 lines of code. If you're unhappy about storing 128 bits for everyone's password you could even just take an 8 character substring of the hash or something. It would be a lot better than nothing.

</comment><comment><USER33> Eek, nothing more frightening than seeing my own password there in the plaintext of the HTML...

<comment><USER2> It's not in the plaintext of the HTML. It's in the DOM. You know, the think that you can hook in to capture your password when you type it in...

</comment></comment><comment><USER34> This is very shocking.

It's just ASTOUNDING to me that in the year 2012 — one of the largest and most well-known companies on the internet (listed on NYSE, Alexa Rank 306, $100 Billion+ in revenue) could allow such a stupid vulnerability to persist.

<comment><USER35> Not to say it's excusable by any stretch, but their revenue in 2011 was roughly $138 million, not billion.

<comment><USER34> argh, obviously you're right – this is the second time i've done something like this today, I need definitely need more sleep

</comment></comment></comment><comment><USER36> What.The.Hell?

You would figure companies out there would have learned a lesson or two by now.

Wow.

</comment><comment><USER37> To me the funniest thing is that they rely on the 'password' input type to obfuscate the password. If you change it to 'text' its just a plain text password sitting there. So... somebody thought, "well we're going to have the password here, better make this input 'password' so people can't just see it over your shoulder, it's private!"

</comment><comment><USER38> It also seems the password is being passed in the clear...

</comment><comment><USER39> Can't help but notice that its a google+ user, that happens to work at google. Must be some strong kool-aid over there in Mountain View.

</comment><comment><USER40> Neither does Hover, still, despite being outed here nearly 18 months ago and assurances by a Hover rep that they were working on tightening security and would have it completed by September (2011).

Some companies just do not give a shit about (your) security,

<comment><USER40> Okay, I have to take this back. It looks like they did finally implement this sometime between now and June (when I last checked). Better late than never.

</comment></comment><comment><USER41> If your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?

<comment><USER42> If a site is indifferent, incompetent, or stupid about password security, you should assume they are the same with credit card security until proven otherwise.

<comment><USER41> This is an incredibly dangerous assumption. It implies they're doing credit card security right just because they put a crypt() call in their code.

Always assume they're doing it wrong, because usually they are.

<comment><USER42> I'm not suggesting that implication. The implication is that when you know someplace seriously botched security in one area, you should assume all their security is suspect.

The default most of us have to use is to assume when we use websites is that they are doing things right, so seeing no problem in one area (login passwords) doesn't change anything about our confidence in the rest of the site (credit cards). It stays at default.</comment></comment></comment></comment>


The first Django site to run on Python 3 - <AUTHOR> http://myks.org/django-python3/ <comment><AUTHOR> Since the showcase is low on information, here's a summary of the current status:

\- the porting strategy is explained here: <https://docs.djangoproject.com/en/dev/topics/python3/>

\- the porting work happens in the master branch; commits related to the Python 3 port are usually prefixed by [py3]: <https://github.com/django/django/commits/master>

\- the test suite doesn't pass yet, but the hardest part is done: <http://ci.djangoproject.com/job/Django%20Python3/>

\- most of the work happened over the last three weeks, and 5 or 6 core developers are contributing significantly

</comment><comment><USER2> Not only a major boost for Python 3 adoption but also a reference for how Unicode handling [1] can be successfully ported from Python 2.x libraries.

They seem to be on schedule as well, which is brilliant [2].

[1]: <http://wiki.python.org/moin/PortingDjangoTo3k> [2]: <https://www.djangoproject.com/weblog/2012/mar/13/py3k/>

<comment><USER3> yeah we already had in Pyramid 1.3 for ages ;-)

I can never be surprised enough how people are excited about django features that others take for granted.

<comment><USER4> How well does Pyramid work with Python 3 (production ready)? And what are the pros and cons of Pyramid vs. Flask or some other lighter weight way to build web apps with Python 3?

<comment><USER3> As far as I can tell, many people use it in production just fine. As for Pyramid vs. Flask, well pyramid gives you more, but you can use it flask-like if you want.

</comment></comment></comment></comment><comment><USER5> So glad to see python 3 being adopted more and more by major web frameworks. This might be the wrong place to ask, but have there been any updates on python 3's wsgi or flask support? I've been out of the loop.

<comment><USER6> PEP 3333.

Armin Ronacher has long been grumpy about Python 3 so don't count on a Flask port any time soon

<comment><USER7> > Armin Ronacher has long been grumpy about Python 3 so don't count on a Flask > port any time soon

There are different reasons for why I am grumpy though. The things that stop me from porting stuff to Python 3 from the side of Python are largely resolved. In that regard I am just a lazy person and nobody cares about Python 3 __YET __. As far as the general development of the language goes there is still a lot missing in Python 3 that worked in Python 2 so I am not excited yet.

Port will happen though, just have to decide when I will break the API to make it possible. As it stands right now a port won't be possible without breaking Werkzeug's API because it's just one level too low.

<comment><USER8> > _In that regard I am just a lazy person and nobody cares about Python 3 > YET._

You'd be surprised.

</comment></comment></comment></comment><comment><USER9> Heck yeah! My startup uses python heavily, and it's ALL Python3 except for the public-facing website... which is currently Django1.4+Python2.7. As recently as six weeks ago, I tried porting it over, and had to abandon the effort... as soon as this gets stable enough, you can bet we'll make the switch.

</comment><comment><USER10> We are a django shop and I have been concerned about the transition to python 3 for our projects as well as the community in general. Even though I don't think this the end all for a migration, it is a really promising sign. Nice to see this transition starting to occur in the django world.

</comment><comment><USER11> Relatedly, what's the correct way to install Python 3 on a Linux server (debian based) so I can try this? while keeping Python 2.x.

The last time I tried doing that I ended up in some weird quagmire with the LD_LIBRARY_PATH being messed up. There must be a standard way to install it?

<comment><USER12> What's wrong with:

apt-get install python3

It's always worked for me.

<comment><AUTHOR> Django targets Python >= 3.2, and Debian stable provides 3.1.

FYI the demo uses a manually compiled Python.

<comment><USER12> In that case, I wouldn't worry about installing for all users. I'd build from source and configure with the --prefix argument. Then I'd start Django using that specific Python.

Or, since Django on Python3 doesn't seem production ready yet, I'd "upgrade" to Debian testing or unstable, and hope that by the time Django became production ready Py3.2 was in Debian stable.

</comment></comment></comment></comment><comment><USER13> Awesome, good to see this move forward. However, what is the django ecosystem support like?

<comment><USER14> That's the next step - authors of 3rd party apps will need to port their code. We've started putting together some documentation to help authors write single-source code (i.e. code that runs on both 2.6+ and 3.2+). The idea is that they'll use the tools we did, plus the things we learned, to port their apps. <https://docs.djangoproject.com/en/dev/topics/python3/> is a start on that documentation, and hopefully we can flesh it out even more for 1.5.

</comment></comment><comment><USER4> What is the estimated release date of Django 1.5?

<comment><USER15> Django aims for time based releases every nine months ([https://docs.djangoproject.com/en/dev/internals/release- proc...](https://docs.djangoproject.com/en/dev/internals/release- process/#release-process)). Since 1.4 was released on 23rd March, that would put 1.5 just before Christmas, appropriately enough. But real life might push it back to January.

</comment></comment><comment><USER11> Does anyone know how they decided on that porting strategy? Why not move to Python three and run 3to2 for backwards compatibility?

<comment><USER16> 3to2 as I understand it works best for supporting Python 2.6 and 2.7

Django had committed to supporting older versions of Python 2.x that weren't Python 3 friendly (largely because of older installations of RHEL and CentOS).

Here was a discussion asking about dropping 2.4 support during development of Django 1.3: [http://python.6.n6.nabble.com/Django-1-3-and- Python-2-4-td50...](http://python.6.n6.nabble.com/Django-1-3-and- Python-2-4-td509988.html)

Django 1.2 still supported Python 2.3+, Django 1.3 supported Python 2.4+, Django 1.4 supported Python 2.5+.

Django 1.5 (which is the current trunk) finally has Python 2.6.5 as its minimum platform which reduces some of the major compatibility pain points.

</comment></comment><comment><USER17> As a mainly php dev on the server-side, I've been interested on expanding to Python / Django for some time but the whole v2 and v3 thing put me a bit on hold.

Glad to see it moving.

</comment><comment><USER18> I don't use Python for anything so I don't really care about Django updates, but I found this cool anyway. It was interesting to look through the code on the page in order to figure out how the page printed out that code. It was also interesting to see just how little code (Python, HTML, and CSS) is needed to make a professional-looking page.

</comment><comment><USER19> nice to see django take python 3 seriously

</comment><comment><USER20> Best thing I've seen all day.

(Go ahead and downvote me, this comment has absolutely value, yet despite knowing that I'm so happy I still feel compelled to post it. :)

<comment><USER21> I'm apathetic, but please let's not start the trend of self-aware "downvote me" or "why the downvotes?" comments on this website. I'm of the opinion that it's needless, manipulative clutter.

<comment><USER22> I agree that the former is clutter, but the latter is good, as long as the commenter is clearly trying to learn from/correct whatever mistake they had made. e.g. "This is being downvoted and I don't understand why. Could someone please explain the problem?" or "Why the downvotes? Is it because ...?"

<comment><USER21> I guess I prefer the fire-and-forget approach, only going back to edit my own comments for spelling and grammar ("EDIT: ... EDIT 2: ... is sort of grating to me). You make a good point though, and I don't believe that comment-self- awareness is universally an attempt at manipulation.

</comment></comment></comment></comment><comment><USER23> Well, the authors of frameworks and libraries still on Python 2 and without having concrete upgrade plans will have to either do something soon or others will take their space.

Python 3 is here, now.

<comment><USER24> > the authors of frameworks and libraries still on Python 2 and without having > concrete upgrade plans will have to either do something soon or others will > take their space.

Do you know of anything new on PIL (<http://www.pythonware.com/products/pil/>) ? Or any similar library that might replace it for Python 3?

<comment><USER25> Pillow (<https://github.com/python-imaging/Pillow>) is a fork of PIL. If you look at recent commits, you'll see one that claims to make it more Python 3 friendly, but not quite Python 3 compatible because of differences in the C code. So maybe a good opportunity for someone to jump in and fix that.</comment></comment></comment>


Apple's defense of the App Store just shows how hard it is to compete with Apple - <AUTHOR> https://www.theverge.com/2019/5/29/18644045/apple-defends-app-store-policies-antitrust-eu-spotify <comment><USER2> > The message here seems to be that if companies don't like Apple's policies, > they've got other options. Go find your riches on Android or make a Roku > app. But developers have a huge financial incentive to be in the App Store. > It's often been reported that iOS users spend more money on apps than people > with Android phones, and Apple leans on that advantage.

Apple's argument would seem to be that this financial incentive is the direct result of their policies, so forcing them to change those policies would reduce or eliminate this financial incentive.

It's a reasonable argument, although I think it's unknowable whether it's true.

Legally, it might not matter.

<comment><USER3> I tend to agree with this argument, and here's why: Apple's brand across the board is about controlling every aspect of the user experience so they can make it a cohesive experience the user enjoys. They do this at the expense of short-term monetary gains from things like advertising, and don't give a damn about making life difficult for their business partners. This is not the result of their success but likely the reason for it. There's a reason it was so culturally difficult for them to license "clone" Mac hardware in the 1990s; it's just not in their DNA.

They understand that the _end user relationship_ is all that matters. For Apple's brand to succeed, they have to own the relationship entirely so they can protect their users from bad actors. That is literally why a large segment of people choose Apple products. Do iPhones have malware problems on the scale of Android? No, because of Apple's heavy-handed control of the App Store. I honestly think Apple would shut down the App Store entirely in favor of something more universal like WASM before ceding control of the user experience. General platform security / privacy also benefit from this approach.

<comment><USER4> Are we justifying potentially illegal behavior by saying "that's their brand" and it helps them get wealthy in the long run?

Monsanto does the same with seeds. They do RnD, develop seeds and force farmers to buy seeds directly from them, control end to end and probably produce higher-yield crops with lesser diseases. It is their "brand" but should we justify that behavior?

<comment><USER5> > justifying potentially illegal behavior

No, that's putting the cart before the horse. The question isn't "is this (presumed) illegal behavior justified?"; the question is "this behavior is illegal _if_ it is unjustified -- is it justified?". The illegality (should) be a result of answering the question "is someone hurt unfairly?" If the behavior in question is profiting from their own hard+smart work and not sharing the wealth as much as partners want, it shouldn't be illegal (or at most, the illegality is in keeping too high a share of the profits). If the behavior is bait-and-switch trapping people and ripping them off by hooking them with deceptively low onboarding price with high back-end "debt service", then it should be illegal.

This is the principle underlying anti-trust/monopoly law.

</comment></comment></comment></comment><comment><USER6> It's funny that Apple shows competing alternatives to Safari on iOS when in fact all iOS browsers use the same engine.

[https://www.apple.com/ios/app-store/principles- practices/](https://www.apple.com/ios/app-store/principles-practices/)

</comment><comment><USER7> Relevant article by former App Approval Chief at Apple: [https://medium.com/@phillipshoemaker/apple-v- everybody-59030...](https://medium.com/@phillipshoemaker/apple-v- everybody-5903039e3be)

<comment><USER8> From the article:

> _Target, for example, is a standard, old-school brick and mortar shop. You > go to find specific products and walk up and down aisles. When you find > something that interests you, you don't purchase it through that product. > Instead you bring it to the Target checkout clerk, and they will charge you > for it. And believe me, Target gets their fair share of the purchase of that > item. If Target finds that the product has stickers telling you to purchase > this item from Amazon or another location for a lesser amount, Target will > remove the item from the shelves, and rightfully so. It is their brand that > is bringing in the customers, not the products._

It seems at first glance like this would largely contradict Apple's earlier arguments that purchases are between app developers and consumers, and that it's just an intermediary in the process[0]. Anyone willing to comment about a subtlety to this argument I could be missing?

[0]: [https://www.mercurynews.com/2019/05/13/apple-app-store- lawsu...](https://www.mercurynews.com/2019/05/13/apple-app-store-lawsuit-can- proceed-supreme-court-rules/)

<comment><USER9> I don't believe it contradicts it. Apple claims that it does not set the price, the developers do. That's what they mean when they are just the intermediary, they facilitate the transaction but are not part of it.

I think his example is poor because Target does set the prices on products, for the most part. I think something better would be a flee market. The flee market operators provide services to facilitate the sales of the vendors and they can also choose which vendors are allowed to sell in their market, but they do not control the prices the vendors sell at.

<comment><USER10> Just as a point of precision, Target does not _technically_ set the price of any given manufacturer's goods. What they do when you get to that point in your talks with them, (and only if you're not ginormous), is to strongly suggest that you sell your product at such and such price. If you don't, they're gonna walk and sign on your competitor instead.

It's devilishly ingenious, because, as I found out the hard way, in a court of law, they don't consider that to be setting the price. You still have the power to set your own price. You just won't be in Target if you pick the wrong price.

<comment><USER5> What do you mean? Target doesn't by wholesale and resell? They don't sell products for their own revenue, and pay for those products as an expense? Is the retail sale price a factor in the computation of how much the wholesale provider is paid?

</comment></comment></comment></comment></comment><comment><USER11> If you think it's tough dealing with Apple, try running an app that allows adult content.

We're not allowed in the app store, we're not welcome on any major payment platform, and thanks to Apple dragging their heels on PWA support in Safari, we don't have any access to push notifications (or most of the other major native features).

The vast majority of our traffic is on iOS, but we're completely locked out from providing a native experience thanks to Apple's bullshit policies.

<comment><USER12> The policies are everywhere

[https://www.theverge.com/2019/5/29/18644537/google- marijuana...](https://www.theverge.com/2019/5/29/18644537/google-marijuana- android-play-store-policy-ban-direct-sales-facilitation-apps)

</comment></comment><comment><USER13> Apple needs to allow you to change the default apps (similar to how you can change the keyboard) for this argument to hold up.

<comment><USER14> Also allow apps to allow purchases inside without going through Apple's in-app purchases. Maybe they need to decide on a case-by-case basis, or maybe only for apps for companies with a large external presence, but not being able to buy eBooks through the Kindle app, because Apple wants it to go through their own in-app purchases instead of Amazon's own payment gateway, is frustrating.

<comment><USER15> If they allow enough In app purchases not to go through the store then they have no way to collect money from anyone, Since all apps could then just collect their money that way.

If you limit it only to an anointed group of large companies then you have formed a cartel, which itself is likely illegal.

<comment><USER16> They could do something like Microsoft has with Azure where you have an Enterprise Agreement whereby you pay some licensing fee and then they allow companies to route through their own payment gateways to make for a better user experience.

People say Apple care about the user, but they don't, they care only insofar as ensuring lock in. They don't care if you hate Apple, just so long as you keep giving them your money. As long as you don't hate them enough to leave, they've done enough.

The only way to fix it is if enough companies make their user experience so much better on Android that having an Android device is a more attractive offering than an Apple one and enough users flee Apple for alternatives... but companies don't give a shit if you want Android or Apple, what they care about is how much they have to pay developers to win your money and your eyeballs on their products.

I've worked on a number of high value development teams for these types of apps across mobile platforms and this attitude has been common across all of them: If they can still win your money through a crippled user experience that it costs them a minimal amount to maintain across both platforms, that's what they do. They want Apple's market. They want Android's market. They don't want to maintain two applications and two development teams because that increases costs and they want similar user experiences on each device because brand fragmentation hurts their image. So in this sense Apple is also hurting Android and it's evidence they don't really give much of a fuck about the user as long as they're getting your money.

I say this as someone who has experience on the inside of development teams that provide the apps you love on the devices you love, and I say this as someone who loves my Apple devices but am by no means an iFanboy.

<comment><USER15> Your arguments rest on the idea that the independent software providers don't care about the user experience and are simply going to try to minimize costs. You said as much.

Therefore, If Apple allowed alternative in app purchase experiences, there would simply be a race to the bottom to provide the cheapest user experience they could get away with on both Apple and Android devices.

</comment></comment></comment></comment></comment><comment><USER17> _But the most interesting parts of this new site relate to competition. In one section, Apple goes over the core, built-in apps on iOS and lists the many popular third-party options that are available from the App Store in each category as alternatives._

I dare someone to try it. Take all of the default apps and hide them away in a folder somewhere and replace all of them with alternatives. Let me know 1) the quality of your user experience and 2) of all of the annoyances, how many of them are due to the lack of "special" capabilities and integration only available to the in-house apps?

</comment><comment><USER18> 2 things I really hope from this. Apple can no longer block side-loading, and the dumb restriction on browser engines goes away, but I guess I will see how this law suite goes.

Also It's hilarious how they claim it's competitive. You can only install one app store.

</comment><comment><USER19> " (Apple takes a 30 percent cut of subscriptions for the first year a customer is signed up and 15 percent for each year thereafter."

That is a considerable amount of paper.. How do you make any money when their cut is so high? Anybody with experience? I wonder how this shakes out annually with an app like Netflix.

<comment><USER2> Netflix doesn't give up 30% or 15%. It's listed as an example of a "Reader" app, so Netflix subscriptions take place entirely outside of Apple's infrastructure[0] and therefore Apple get zero of that money.

> How do you make any money...

The remaining 70%/85% is a pretty good start. As they say before that point, "developers have earned more than $120 billion worldwide"

[0] The point Apple glosses over here is that Netflix isn't even allowed to provide a link back to their site for subscribing within the app, which seems difficult to defend.

<comment><USER20> Netflix only recently removed in-app subscriptions; before that they _were_ paying X% to Apple for every subscriber who paid via iTunes. And still are for anyone who is still paying that way. Although surely it was a sweetheart deal always below 30%, and potentially below the 15%.

</comment></comment></comment><comment><USER21> Apple's market share is low enough that it may continue to be unchallenged by enforcing all its own apps to be the default apps. Antitrust will probably not apply to them, I suspect.

<comment><USER22> The US government (for example) doesn't care about Apple's world wide market share, they care about the US.

And in the US Apple's market share is MUCH higher.

<comment><USER23> Still 10% below Android though.

<comment><USER24> Not according to [1]. Install base of iOS is higher in the US

[1]: [http://gs.statcounter.com/os-market-share/mobile/united- stat...](http://gs.statcounter.com/os-market-share/mobile/united-states-of- america)

</comment></comment></comment></comment><comment><USER25> I had three apps denied because they where 'too close to existing Apple products'. (They where not). Break that monopoly!

</comment><comment><USER12> What a joke! Apple made a product people enjoy using and an App Store people trust. Now, companies are complaining that Apple is stifling innovation because their App Store is charging 30% and making competitive products. Tough shit. It's their walled garden. Don't build for the App Store if you're afraid of competition.</comment>


So, you think you're a Hacker, kid - <AUTHOR> https://medium.com/robek-world/so-you-think-youre-a-hacker-kid-700cb199f03c <comment><USER2> I feel like I'm more of a hacker now that I'll start reading his blog. Also, lovely sig: "robek.world is stupid hipster trash and is part of the problem."</comment>