Ask HN: Web development is broken – why? - <AUTHOR> I think that web development is broken - you need to know so many packages. Why, so simple thing like web app development is so hard? <comment><USER2> Just write the way you used to. All the newer toolchain technology is optional. Most libraries you might want to use include compiled versions as well that you can include with standard script tags. It doesn't have to be difficult.

That said, if you resist change too fiercely, you're only making it hard on yourself and those you have to work with who enjoy learning newer technologies ;) And while they do tend to increase complexity, it can be justified by producing more maintainable, easier to understand code.

</comment><comment><USER3> Are you thinking of node.js and JavaScript? There are many other ways, platforms, languages and frameworks to make web apps and web sites.

I think your complaint is nonsensical, over-generalized at best.</comment>


China Is Reluctant to Blame North Korea, Its Ally, for Cyberattack - <AUTHOR> https://www.nytimes.com/2017/05/17/world/asia/china-north-korea-ransomware.html?em_pos=small&emc=edit_dk_20170517&nl=dealbook&nl_art=4&nlid=65508833&ref=headline&te=1&_r=0 <comment><USER2> Blaming NK for ransomware is a major cop-out and public disservice.

By playing the "state actor" card the corporate PR can shift blame from themselves to make them instead seem the defenseless victims, thus changing public perception and reducing the lessons that need to be learned here.

The NSA and CIA can be blamed for hoarding vulnerabilities and, more importantly, failing to keep control of them.

Microsoft can be blamed for having the bug in the first place.

Microsoft can be blamed for not having a good silent background no-reboot update.

And punters can be blamed for not updating.

Etc.

Everyone - governments, software companies, software engineers, the public - can all learn something.

Instead I fear that the press will make a big thing or "state actors" being to blame and nobody will learn anything :(</comment>


C doesn't know the meaning of "private" or "protected" (SFW, poetic) - <AUTHOR> http://dis.4chan.org/read/prog/1312655446/4

<comment><USER2> SFW, and pretty awesome.

<comment><AUTHOR> > _SFW_

Duh, indeed. Edited title, thank. And it _is_ awesome, totally agree :D</comment></comment>


Show HN: Shirtloop - <AUTHOR> http://www.shirtloop.com Hey, this is a very basic MVP, tech-wise but the underlying business infrastructure runs deep.  I have the relationships, my grand picture is to build a portal etc, where independent printers can bid on jobs, text alerts etc, but for now, I am doing things the old fashioned way, via email and phone calls.  What are your guys' thoughts? <comment><USER2> I like this idea, although I am not a graphic tee designer, so I cannot comment on its viability. I think the site look and feel could definitely be improved, though. Bootstrap is a great way to get the site started, but the site feels sparse, both in information and layout. Which printers are bidding? What shirt sizes can the bidder expect? What is the expected turnaround time? Has anyone seen a success story with the service?

The website needs a lot more content and information, and it would also be nice for customers to know who is behind the site. A sales email address and an 888 phone number seem a little impersonal when so few details are revealed about how the service works--especially since it doesn't look like users register for accounts to keep track of bids?

<comment><AUTHOR> At this point, its all pretty personal. There are only two of us on the team, and the 888 number actually gets directed straight to my cell. I hear what you are saying though, the plan is to build it out, but I wanted to get in front of customers right away, and figured this was a good compromise. I thought about things as a "fancy" landing page.

</comment></comment><comment><USER3> After reading the site and clicking the sign up button, it appears that this is for a "one run" job of x shirts. What if I am interested in on demand printing... any plans to support that (for example, printing as I get orders, which could only be a couple shirts at a time)?

Also, I'm concerned about quality of print, with the unknown of who these printers are, how do i know that it's a good quality print? Is there a guarantee?

<comment><AUTHOR> You can do an "on demand" submission at any time, typically though, it is not cost effective. 99% of our work is done via screen printers, which is a time consuming process, some will bid a small number like that, some won't. Everything is guaranteed, if you are not happy with the print quality, we refund 100% of the purchase. Quality tees are a catch-22, in that on demand (1 or 2 at a time) is not cost effective, but how do you know the design will sell, etc, so there is risk involved. If you have an specific questions about selling your own designs (I assume that's why you were asking), let me know. Eventually I would like to have printers save screens, or keep a rotation that I can send out to allow small ecommerce sites to do 1-2 at a time, as orders come in, but Im not there just yet.

</comment></comment><comment><USER4> I just forwarded this info out to my fraternity, good luck!

<comment><AUTHOR> Much thanks, I really appreciate it!

</comment></comment><comment><USER5> This is very cool. How many printers have signed up?

<comment><AUTHOR> We haven't formalized "sign up" per se with the printers, we have relationships with with a bunch though, the site says 100s, its not quite there just yet, but hope to be in the next couple of weeks.

<comment><USER5> I'm interested in throwing my print company into the mix! kevinkhandjian at gmail if you get a minute</comment></comment></comment>


Patent Monk – The patent search engine you always wanted to exist - <AUTHOR> http://www.patentmonk.com

<comment><USER2> congrats on the launch, linking figure/element numbers to is a feature i've had on my list of features of things i'll never build for awhile. also, have recently added thumbnail search results (think google patents had this ages ago, but has since retired it if they did) and a smarter weighting of keyword search (e.g., filtering out noise from sections and boosting hits in claims/abstract/etc). would love to help out if needed (contact info in profile)

<comment><AUTHOR> Thanks so much for the feedback! I'll contact you soon after today's launch is over and I get some sleep lol. The problem we're tackling now is automatic citation in the spec. so that highlighting text gives you the column and line numbers.</comment></comment>


Alex St. John: I Apologize - <AUTHOR> http://www.alexstjohn.com/WP/2016/04/21/i-apologize/ <comment><USER2> Since the site is currently experiencing a Database error, here's the link to the google cache:

[http://webcache.googleusercontent.com/search?q=cache:2Zf0Pqw...](http://webcache.googleusercontent.com/search?q=cache:2Zf0PqwgCC4J:www.alexstjohn.com/WP/2016/04/21/i-apologize/+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER3> Wow. A sincere, well executed apology can do wonders in patching up one's reputation. This just makes him seem like an even bigger buffoon.

There was a lesson to be learned here and it seems like he's uninterested in learning it. Or even pretending to.</comment>


Results of the 2015 Underhanded C Contest - <AUTHOR> http://www.underhanded-c.org/?2015 <comment><AUTHOR> My apologies, there doesn't seem to be a way to permalink just the winning entries' blog post.</comment>


Ask HN: Why does Salesforce need such large overhead? - <AUTHOR>

If you look at their financials - http://www.google.com/finance?q=NYSE:CRM&fstype=ii - and click on Annual Data, you will see that for their last fiscal year their SG&A was approximately 80% of their Gross Profit.
Why is that? Is it because they are the first real 'large' cloud computing company, so they have to kinda beat the path to customers and raise their awareness or are they doing something wrong?
Their Cost of Revenue is very low, for a tech company at only 19.75% of Revenues. As opposed to Google's 37.39%, and Apple's 60.62%.
So why on earth is their SG&A so high?
Thoughts, anyone? <comment><USER2> Selling into and servicing the SMB (small and medium business) market requires a lot more SG&A. There's less scale than selling into large enterprises.

<comment><USER3> With the name that Salesforce has, their only issue would be convincing SMBs that they need a CRM -- not that Salesforce would be the one to pick. Maybe they still need to convince those SMBs of their need for CRMs. Maybe.

</comment></comment><comment><USER4> Much of there SG&A is from a salesforce. Their product requires people to spread the word.

</comment><comment><USER3> I know a couple of people who work there. Salesforce is bound to be modeled after Oracle, from whence founder Benioff came. (It's also where he made all his connections, benefitting from a lifelong friendship with Larry Ellison.) IIRC Oracle has a similar pattern of big internal expenditure.

4000 employees: that's the number I just dug up using the internets. That right there is a lot of overhead for a company that should be taking a more can-do, shoestring approach.

In summary: they waste because they feel they can. Salesforce is a big name, and so they're partying like it will never end.

<comment><AUTHOR> Interesting...I never would have guessed that it was frivolous...but that's just RIDICULOUS!!!

$1.3B revenues with $80M profits, and crazy spending just because they can. Ugh...I shirk at the thought.

<comment><USER5> It seems to me like they could be prime for disruption.

The latest redesign is dreadful. It's like they decided that CRMs should be exactly like twitter, or facebook or OH MY GOD LOOK BIG SHINY THING WE MUST HAVE THAT IN THE RELEASE!

When it was rolled out nobody knew where their stuff was, it took a couple of days for everyone to get used to it. A good CRM should get out of and stay out of the way of sales. You should spend as little time as possible in it. Not updating statuses or following accounts (no, seriously it does that).

I'm not surprised they're only making $80 million profit given the stuff they're blatantly wasting their time on.

<comment><USER3> I've never heard of anyone who thinks that Salesforce is a well-designed, easy-to-use app. Disclaimer: I haven't used it much, so this is just based on other people's opinions.

Disruption: sure. Bound to happen. Someone is going 37signals this thing at some point (i.e. make a simple app that does everything you need but no more). The hard part: busting through the Salesforce marketing machine. The name is everywhere, and I expect to start hearing "no one ever got fired for choosing Salesforce" any day now. It's just like IBM used to be: big, mediocre, and widely used.

<comment><USER6> ... and now they're no longer widely used? ;-)

<comment><USER3> IBM ain't what it used to be, that's for sure. Still in the game, certainly. Similarly, I don't expect Salesforce to die out any time soon, but the market share it commands may diminish if seriously better competitors emerge.</comment></comment></comment></comment></comment></comment>


Old Concept Cars - <AUTHOR> http://oldconceptcars.com <comment><USER2> SEAT concept cars from late 90s and early 2000s were impeccably designed. They don't look dated at all.

[http://oldconceptcars.com/category/1930-2004/seat/](http://oldconceptcars.com/category/1930-2004/seat/)

<comment><USER3> They look very neat.

This would come from a tradeoff between going very bold with something that won't have a chance in a million to become the future, or staying very close to the present and showing an iteration on what could be the next year's model.

For context, the Audi TT went out in 1998: [https://www.autoevolution.com/cars/audi-tt- coupe-1998.html](https://www.autoevolution.com/cars/audi-tt-coupe-1998.html)

Audi was iterating actual products on designs very close I think to seat's concept cars.

</comment></comment><comment><USER4> I can't stop laughing at the one that looks like someone said "Hmm, I like this low profile front end, but it needs something else...I know! I'll melt another front end on top of that!"

The little egg car seems almost futuristic today, the only giveaway being the narrow steering column.

The one with the steering joint in the middle of the car was like every last place British entry on Full Metal Challenge. Turns out that's a terribly impractical idea.

<comment><USER5> The Peugeot Moovie concept car is kinda the 21st century version of the egg one: [https://www.google.com/search?q=Peugeot+Moovie&tbm=isch](https://www.google.com/search?q=Peugeot+Moovie&tbm=isch)

</comment></comment><comment> King-Aaron Suddenly, everything else is obsolete: [http://oldconceptcars.com/wp- content/uploads/Sir_Vival_10.jp...](http://oldconceptcars.com/wp- content/uploads/Sir_Vival_10.jpg)

</comment><comment><USER6> The Lancia Megagamma: [http://oldconceptcars.com/1930-2004/lancia-megagamma- concept...](http://oldconceptcars.com/1930-2004/lancia-megagamma- concept-1978/)

This concept basically invented the minivan/MPV (no sliding doors, but most European MPVs don't have them).

After Fiat/Lancia passed on putting it into production themselves, multiple manufacturers took note and began working on their own production versions. The Japanese were actually the first to market with the 1982 Nissan Prairie and 1983 Mitsubishi Chariot. The Americans and Europeans were next: Chrysler launched the 1984 Dodge Caravan and Plymouth Voyager, while Matra and Renault launched the 1984 Renault Espace (it was designed by Matra and originally intended to be sold by PSA as a Talbot... but PSA killed the Talbot brand and with it their partnership with Matra at the last minute, so Matra took the design to Renault).

</comment><comment><USER7> Well, hello there, good lookin'. [http://oldconceptcars.com/1930-2004/honda- fuya-jo-1999/](http://oldconceptcars.com/1930-2004/honda-fuya-jo-1999/)

Makes the old Scion xB look downright charming, and I didn't think that was possible.

<comment><USER8> The Scion xB is one of the best vehicles I have ever owned. I traded in my 2001 Jetta VR6 (mystifying mass airflow sensor issues VW could never fix for more than a couple weeks) for an xB in 2004. It had its flaws, but for a daily driver, I think you'd be hard pressed to find a better car than those first generation xBs. Mine is currently owned by my parents and has 300K+ and the only major service has been a new clutch at 175K.

</comment></comment><comment><USER9> Reddit has a great subreddit for images like this: [https://www.reddit.com/r/retrofuturism](https://www.reddit.com/r/retrofuturism)

</comment><comment><USER10> This should be a slide deck for startup school, or any product management course.

So many of these seem like obviously terrible ideas, and yet, these are what happens when you design products without customers.

You can see where some of them were just derivations of other companies design languages, where others were the expression of one meaninglessly novel idea (the catamaran car). Some of them you can see the thing they thought would be good (big windshield, aerodynamics, ornamentation, minimalism, quirkiness, etc), but when you tried to wrap a car around that idea, it was uncanny and un-car-like.

For each of these abominations, there are software and startup analogs, I'm sure of it.

<comment><USER11> I also like to think they were built thinking outside the box, because that box didn't exist yet. I think we should stop from time to time and think about our designs, is this the only and perfect way to design it? or maybe I'm just copying what everyone is doing?

Now days most cars, web pages, apps, phones, TVs, look the same, yes that has its benefits and maybe customers just want the same old things, but I always wonder how different designs would be if apple made a different iPhone, Ford a different model T, xerox a different UI...

<comment><USER12> At least with cars, I don't think you can trace most of their features back to the Model T. The model T had a completely different control scheme, wagon-like suspension, band brakes (for parking only), and was only available in black.

<comment><USER13> The Model A, however, had the standard 3-pedal layout.

</comment></comment></comment></comment><comment><USER14> This one looks like a Tesla Model

[http://oldconceptcars.com/1930-2004/ssangyong- ccr-1-1995/](http://oldconceptcars.com/1930-2004/ssangyong-ccr-1-1995/)

<comment><USER15> Saw a mid 90s car that looked like that at a car show this summer:

[http://car-from-uk.com/sale.php?id=102913&country=uk](http://car-from- uk.com/sale.php?id=102913&country=uk)

</comment></comment><comment><USER16> I was always bummed the VW one liter never materialized. At first, it was supposed to get insane gas mileage. Though I did see in a magazine that the new microbus is supposed to come in a few years. It looks pretty cool.

<comment><USER17> You could buy it for a few years for a hundred grand, hand built.

</comment></comment><comment><USER18> If you're enjoying this content make sure to spend a few mins poking around Syd Mead's incredible work:

[https://www.pinterest.com/pin/240942648784206721/](https://www.pinterest.com/pin/240942648784206721/)

</comment><comment><USER19> The future is no longer what it used to be...

</comment><comment><USER20> The Nissan 126x from 1970 is one of my favourites. It was also a popular Matchbox car in the 70s (As Datsun 126x)

[http://oldconceptcars.com/1930-2004/nissan-126x-concept-1970...](http://oldconceptcars.com/1930-2004/nissan-126x-concept-1970/)

<comment><USER21> Reminds me of the Lancia Stratos Zero [https://en.wikipedia.org/wiki/Lancia_Stratos#Stratos_Zero](https://en.wikipedia.org/wiki/Lancia_Stratos#Stratos_Zero)

</comment></comment><comment><USER22> Wow, why can't I get a Siata Berlina on top of a Subaru BRZ drivetrain without a million dollars.

<comment><USER23> An Austin-Healey 3000 sure would get you awfully close to the general aesthetics.

</comment></comment><comment><USER24> Wow -- this site really reminds me of Vintage Ad Browser - on topic, here's some car ads from the 70s :) [http://www.vintageadbrowser.com/cars- ads-1970s](http://www.vintageadbrowser.com/cars-ads-1970s)

</comment><comment><USER25> I'm a fan of the Electric Egg! Definitely out of its time

</comment><comment><USER26> My favourite is on there. It has a modular, rearrangeable dashboard: [http://oldconceptcars.com/1930-2004/opel-junior- concept-1983...](http://oldconceptcars.com/1930-2004/opel-junior- concept-1983/)

<comment><USER27> I wonder how much of the dashboard could really be relocated. Bosch had just began developing the CAN protocol that year and chips wouldn't be available until four years later. There's an illustration I found [0] that shows how the modules connect and based on the history of the automotive databus, I don't think it would have been able to give you a dashboard as populated as the image in your link. There would need to be a pair of power pins along with a pair of pins for every value you would want to read out (either for analog voltages or RS-422 since SPI/I2C/CAN had not been invented yet). I'm guessing there might have been hard restrictions on some modules like the stereo and speakers, why would you want the speakers to be anywhere else in the car? Going off of the typical dashboard in the 80s, you have speed, tach, fuel, battery level, oil temp, radiator temp, and the odometer and a trip meter. Maybe integrate the trip meter with the odometer value to reduce the 3-4 wires needed for displaying/resetting it. The clock would only need power. Then add in the climate control, that has to be at least a couple more signals for temperature and fan speed and maybe an on/off for the AC if it was available at the time. Don't forget all the status lights, that is going to add a lot more pins to these connectors. The actual pictures don't show any of how they connect. The illustration shows what looks like two connectors. Maybe that's how they did it, two 25 pin d-subs would probably be enough for running everything out to every module dock, impractical but possible. You could accomplish this today with a single 4 pin connector: power, ground, can+, can-.

[0] [https://cardesignnews.com/media/imported/servlet/file/275197...](https://cardesignnews.com/media/imported/servlet/file/275197_466.jpg)

</comment></comment><comment><USER28> If you took the wings off, this would be an astonishing car: [http://oldconceptcars.com/category/1930-2004/mercer/](http://oldconceptcars.com/category/1930-2004/mercer/)

</comment><comment><USER29> The 1942 "Electric Egg" looks like a VW Beetle:

[http://oldconceptcars.com/1930-2004/paul-arzens-loeuf- electr...](http://oldconceptcars.com/1930-2004/paul-arzens-loeuf- electrique-1942-the-electric-egg/)

<comment><USER30> I'd say it looks like an Isetta with a massive glass front:

[https://en.wikipedia.org/wiki/Isetta](https://en.wikipedia.org/wiki/Isetta)

<comment><USER17> You can soon buy that thing again in an electric version called the "Microlino".

</comment></comment></comment><comment> crooked-v My favorite from the first few pages is the '55 Gilda. It's hella swooshy but still looks like it'd be a practical car to drive as long as you glued some mirrors back on.

</comment><comment><USER31> Delighted to find my favourite concept car of all time (the Renault _Racoon_ ) featured. Pity something similar never made it to market.

</comment><comment><USER32> SsangYong CCR-1 (1995) looks very similar to Teslas

<comment><USER33> Specifically the Model X: It's electric and with gull-wing doors. As a bonus the front bumper has an uncanny resemblance to the Model 3's design.

</comment></comment><comment><USER34> Love this site. And love the concept cars of the 60's, 70's. Then, for me, things sort of went sideways.

</comment><comment><USER35> Is there a game with most of these? It would be amazing to see this instead of boring gta real-like cars.

</comment><comment><USER36> Anyone know about the copyright on these images? I can't find a link on the page.

</comment><comment><USER37> The Spohn looks like a warthog.

</comment><comment><USER38> Manta Ray (1953)

Too early by 100 years!

<comment><USER39> I like the way it looks like it is hovering.</comment></comment>


Shadows & CSS3 for n00bs - <AUTHOR> http://owltastic.com/2009/12/shadows-and-css3/ <comment><USER2> Can someone explain me the current fashion to have pale text-shadows? I find it strange-looking.

<comment><USER3> It makes the text look slightly embossed. It makes as much sense as rounded corners. I think it does look a little better, but I also think that's because it's new. I've been meaning to map these kinds of style trends and determine their half-life.</comment></comment>


A few things about Redis security - <AUTHOR> http://www.antirez.com/news/96 <comment><USER2> It is NOT OK for networked server software in 2015 to be "totally insecure if exposed to the outside world" without having this warning in large letters stressed very visibly in documentation and in the software installation process!

As is, Redis should probably default to only using the UNIX socket (where filesystem permissions apply), with TCP-enabling configuration options having impossible-to-miss warnings in example configs and documentation.

In the blog post there's this part, castigating inattentive users about falling pray to this fail-open nature of Redis:

"The problem is that, whatever we state in our security page, there are a lot of Redis instances exposed to the internet unintentionally. Not because the use case requires outside clients to access Redis, but because nobody bothered to protect a given Redis instance from outside accesses via fire walling"

Sounds like the author should really have another hard think about this stance.

<comment><USER3> I have been in this position myself and I agree with your stance. Networked software should be secure by default. The assumption should be "networked" == "exposed to the Internet". From my redis.conf:

"By default Redis listens for connections from all the network interfaces available on the server."

In my case the reason Redis ended up exposed to the Internet was another dev "updated the configuration" to the default provided by the package. Okay, perhaps that was the wrong thing to do, but it simply shouldn't be that easy to expose an vulnerable service to the Internet! I understand that people should run firewalls too but a belt and braces approach should really be taken here.

PS. While I'm moaning, Jenkins is another big offender in this respect. I can't be the only person to have tried side-step its own security by having it only bind to localhost and using SSH tunnelling only to find something which can execute arbitrary code is exposed to the public Internet when the configuration is switched back to its default. Yes, a firewall would fix it, but as far as I'm concerned, Jenkins shares some of the blame for being insecure by default in the absence of one.

<comment><USER4> The way redis is pre-configured out of the box has certainly been evaluated by antirez and the rest of his team extensively. There are tons of things behind the scenes which I'm sure factor into why one might bind to every interface that we as end-users aren't aware of. Either way it's up to the engineer or IT team to perform a little due diligence and be cognizant of what their software is binding to. If something's going to be deployed, and it's _networked_ , and it's _production_ \- spend five or ten minutes to do an impact analysis beforehand. You don't even have to do anything rigorous. Spend 5 minutes with out of the box utilities. Netstat -p and grep for whatever you added.

Back in the day, daemons (especially IRCds) would have a 'comment me to enable' line arbitrarily inserted into the generated conf file which would prevent the daemon from starting up entirely. You'd spend 10 minutes reading through the config files rather than just presuming it was configured the way you want. The belts and brace approach should be that. Stupid users won't be able to just 'gem install <foo>' or 'apt-get install <bar>' then complain so often that an engineer who has contributed so much to the community (remember Antirez was doing this for ages, as a father, operating the entire project by himself (support and all), for multiple years before he finally was able to work on it full time) has to take time out of his day to justify "hey guys, you're sort of responsible for the way you configure your daemons".

<comment><USER3> I wasn't attacking Antirez. We wouldn't be having this conversation if we didn't agree Redis is essentially good work. I was attacking insecure by default. The point is is that it's not unlikely that someone might accidentally revert to the default configuration even when due diligence was done in the first place.

Can you please go beyond vague references like "tons of things behind the scenes" and "certainly been evaluated". What's the direct answer to the question: "Why can't it just listen on loopback by default?"

I'm not sure "stupid users" and "clever Antirez" gets us any further towards a proper answer here.

</comment></comment></comment></comment><comment><USER5> I don't even expose redis externally, I tunnel all connections over ssh using autossh and a restricted user on the server running redis.

Something like:

      autossh -M 0 -N -L 6379:localhost:6379 -o "ServerAliveInterval 60" \
      -o "ServerAliveCountMax 3" -o "StrictHostKeyChecking=no" -o "BatchMode=yes" \
      -i /home/tunnel/.ssh/id_rsa email@example.com

Then on the clent side you just connect to localhost:6379 as if redis was local.

Edit: Should add autossh automatically reconnects the tunnel if the connection fails. Vanilla ssh does not.

<comment><USER6> FWIW: Appointment Reminder also does this. It's part of your healthy HIPAA- approved breakfast.

(One of the other things you should strongly consider, if you care about HIPAA compliance, is using either full-disk encryption or encryping the directory where Redis' data file resides. We do this with encryptfs. We also encryptfs the Tarsnap cache directory, which holds recoverable cleartext. Tarsnap archives are encrypted automatically without requiring further work.)

There also exist another dozen or so box-ticking requirements with regards to procedures and documentation, but those are the main rubber-hits-the-hard-disk things you have to do with respect to using Redis for PHI.

<comment><USER4> Oh Patrick, I bet you know what I'm going to ask even before I ask it. Implementation details please.

<comment><USER6> I'm having trouble parsing this -- what details do you want about what?

<comment><USER4> Oh sorry, what other things did you do to fulfill the PHI criteria? I've had PCI-DSS, SOX and federal security experience, but nothing in healthcare. As such, I was wondering what sort of security protocols were required, and how much of it (if any) is just hand-waving security theater ?

</comment></comment></comment></comment></comment><comment><USER7> That I never have to care about remembering admin user names and that the configuration is so utterly trivial is part of why I love Redis so much. I am lazy and forgetful and "database systems" tend to scare me by being so complicated. I never really know if my Postgres user accounts are set up the right way. On my first job, SQL Server privileges were a frequent annoyance when deploying, testing, etc, and I'm pretty sure the whole "security" thing there was a total illusion anyway.

</comment><comment><USER8> Given the example of being able to write stuff to the ssh authorized_keys it would be prudent to simply chroot your redis installation. It seems like a easy, if somewhat old fashion solution, to at least that part.

Generally speaking I think way to many services assume that they're allow to roam the filesystem freely, when chrooting should be "the bare minimum" one could expect.

<comment><USER9> Debian does this in the default installation, it uses capabilities I believe, not chroot, but the result is that there is a "white list" for directories where Redis can write, which are just /etc/redis/... to rewrite the config, and the dir where Redis persists.

</comment></comment><comment><USER10> Just been hacked through this method and cannot believe how redis can ship with such ridiculously insecure defaults, and that they don't even MENTION the security concerns from the quickstart guide, which is what the majority of people would use to get redis installed and set up.

[http://redis.io/topics/quickstart](http://redis.io/topics/quickstart)

Unbelievable.

<comment><USER11> > such ridiculously insecure defaults

Like having port 6379 be open to anyone who happens to wander by? Your firewall was horribly configured and you got burned, take this as a learning opportunity to fix your mistakes.

<comment><USER10> exactly, but one wrong doesn't excuse another. just because I didn't have my firewall configured correctly doesn't mean software that I use should a) have insecure defaults and b) not make a song and dance about them on the page designed to get you up and running with it.

</comment></comment></comment><comment><USER12> [https://github.com/antirez/redis/blob/unstable/redis.conf#L4...](https://github.com/antirez/redis/blob/unstable/redis.conf#L435)

# Command renaming.

# It is possible to change the name of dangerous commands in a shared # environment.

# For instance the CONFIG command may be renamed into something # hard to guess so that it will still be available for internal-use tools

# but not available for general clients. #

# Example: #

# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 #

# It is also possible to completely kill a command by renaming it into

# an empty string:

#

# rename-command CONFIG ""

I'm a big Redis fan, and have used most of its power, including the great HyperLogLog stuff, I never really looked at the CONFIG command and would not have imagined it would allow such things even.

Is CONFIG commonly used? What are the use cases?

</comment><comment><USER13> Except if no config file is specified Redis defaults to binding to 127.0.0.1 instead of localhost? The docs even advertise:

> This is perfectly fine if you are starting Redis just to play a bit with it > or for development, but for production environments you should use a > configuration file.

Not to mention you can over-write arbitrary files by setting the dbfilename and config directory (Not sure why this is an interactive option to start with?).

</comment><comment><USER14> Hmm 9 hours ago and some script kid has already performed this on my local vagrant-box? Pretty funny. I was running it behind vpn and I guess that's why it got exposed.

They didnt even bother changing the keyname.

</comment><comment><USER15> elasticsearch redis

who's next?</comment>


Carl Malamud's Lawsuit-Fighting Kickstarter to Put Public Standards Online - <AUTHOR> http://nextcity.org/sharedcity/entry/carl-malamuds-lawsuit-fighting-kickstarter-campaign-to-put-public-standards <comment><USER2> The docket for the lawsuit Carl is fighting can be found here:

[http://www.plainsite.org/flashlight/case.html?id=2506677](http://www.plainsite.org/flashlight/case.html?id=2506677)

Appropriately, PlainSite uses a lot of materials that Carl helped make possible (including Aaron Swartz's initial PACER data dump, which he still hosts).

</comment><comment><USER3> I am really torn on this lawsuit. I work with NFPA standards. Currently many standards are available online for free on the nfpa website.

The issue with this being a completely free publication is how would we maintain the development? The people who sit on the committees already volunteer their time.

NFPA still has to maintain the documents, handle grant application, research, publications, free resources (like fire safety month). Would they be able to solicit enough donations to handle even their core duties. Large companies could handle it but how many copies are sold to firms that would prefer not to spend anything on it?

<comment><USER4> It would be great if you could add some context for readers who don't know about NFPA, or about how the US standards system currently works. Otherwise I'm (from India) having a hard time trying to figure out why public works standards would ever need to be monetized/paywalled/copyrighted?

<comment><USER5> Starting halfway through the article:

"To the SDOs [standards development organizations], the system works rather well. They take on the burden of developing standards, an obligation that in many other countries falls on government. They convene experts and build systems for collating and distributing these standards. They even offer limited free access... [Malamud] argues, the effect of these standards is felt on the ground each and every day, as well as in the pocketbooks of local governments. In a video posted by Malamud, the head building inspector for Sonoma County, Calif. testifies that the country spends about $30,000 during a code cycle buying copies of building code for staff."

Everything the government uses as a standard should be _freely_ available to the public in a machine readable format. By selling standards to the government I assert the SDO's should be required to forfeit their copyright. But that will never happen; it's the same bullshit as with PACER and court documents, some asshole has found a way to rent-seek on publicly owned IP and the system allows it because few people care out loud.

<comment><USER6> In fact, court rulings have upheld that once a standard becomes a law, the SDOs DO forfeit their copyright. "The law can't be copyrighted" has legal precedent dating back to the 1800's, and was most recently upheld (specifically with respect to building codes) in the vase of Veeck vs. SBCCI:

[http://www.studentweb.law.ttu.edu/cochran/Cases%20&%20Readin...](http://www.studentweb.law.ttu.edu/cochran/Cases%20&%20Readings/Copyright- UNT/veeck.htm)

That's why Malamud hasn't been sued by the ICC, even though he makes their primary publications (The International Building Code, which every state uses some flavor of) freely available.

</comment></comment></comment></comment><comment><USER7> This stuff is well worth supporting. It annoys the heck out of me when IEEE and ANSI hold standards hostage.

</comment><comment><USER8> He's setting himself up for failure everybody agrees with the fact that all public standards should be available on the internet however very few people are willing to pay for that to happen.

We kind of think it's the government's duty to release and make public on the internet as well as everywhere else these standards without us having to spend our hard earned money on it.

That's what we pay taxes for.</comment>


Instant Messaging Is Going Corporate - <AUTHOR> http://www.forbes.com/sites/howardbaldwin/2014/02/17/instant-messaging-is-going-corporate/ <comment><USER2> IM has already been in corporate America for a while. I've worked for a couple Fortune 200 companies over the last 10 years and all of them (plus the smaller companies) have all had IM. The services listed in the article I've never heard of, but it seems to overlook the already obvious big dogs that have been out there:

SameTime. This used to be used when the company was Lotus Notes based.

Microsoft Communicator. The IM program that is bundled with the enterprise Exchange and collab tools that Microsoft provides.

Skype. For companies that might have a looser network policy, or have to deal with talking to many external clients, this is the easiest way to communicate cheaply, and also has pretty high usage vs something like asking your customer to install and figure out how to use an IRC client.

<comment><USER3> Yeah, I had to check the date on this article. Even the behind -the-times company I used to work for had IM five years ago.

</comment></comment><comment><USER4> It's been this way for a while. Corporate IM that is integrated with ActiveDirectory and other backoffice apps (document repos, source control, continuous integration) is super useful. HipChat is our current champ. The only time it falls apart is when you want to chat with a customer/vendor/etc. Then you're back to phones. If someone can break down that 4th wall, they will be rich.

</comment><comment><USER5> My highest usage of instant messaging came when I was working at a large consulting firm. Everyone used it there, because we were scattered, and phone messages and email were too slow. I don't think it's going corporate, I think it's been corporate.

<comment><USER6> I started in the corporate world in 2001 and the company heavily used IM... we used SameTime</comment></comment>


Show HN: Guided Recipe Creation - <AUTHOR> http://www.recipelabs.com/add/

<comment><USER2> It's interesting. Wholesale scraping of thousands of other peoples' recipes is ballsy, clever, but makes me a bit queasy.

But, I'm not sure how useful it is _in this packaging_.

The service that makes a shopping list for me for a given dish seems valuable. But the service that tries to lay out quantities seems sketchy. All you're providing is an ingredient list, not the technique; to get technique, you have to click through to one of a zillion recipes, and none of the ingredient lists in those recipes corresponds exactly to the ingredient list in your app.

Also, you need to do a better job with proteins. You can't make duck confit with "N pounds of duck"; you need duck legs (also fat, which didn't come up in the list at all). Similarly, chicken paprikash is made with thighs, not "N pounds of chicken". The solution to this is probably just to break animals up into retail cuts in your database.

There's a genuinely valuable "recipe lab" product to be built using a database of flavor profiles (like The Flavor Bible), a database of ratios (like from Ratio), and a database of core techniques ("roast", "braise", "fry", "aromatize", etc).

One thing that'd be neat to do would be to scrape flavor pairings from your database of recipes, do build a bottom-up "Flavor Bible" instead of trying to figure out a way to get the rights to the Flavor Bible itself.

<comment><USER3> _It's interesting. Wholesale scraping of thousands of other peoples' recipes is ballsy, clever, but makes me a bit queasy._

You probably already know this, but the ingredients lists are not copyrightable according to [<http://www.copyright.gov/fls/fl122.html>]. It seems from reading that site that the list of steps that gets loaded when you import a recipe _may_ be subject to copyright, depending on how closely those steps resemble the original recipe's instructions, and whether the original instructions were copyrightable.

I'll agree that common flavor pairings, frequently associated spices, and best techniques for a given ingredient are the more interesting data. It'd be great to ask the database what spices are frequently used in Thai food, for example. Combine it with a list of local suppliers of hard-to-find or imported ingredients and you have a winner.

<comment><USER2> So, what you really want is _The Flavor Bible_ (you can get it on your Kindle), which is an intensely well curated, expert-driven dictionary of flavor pairings. For instance, Thai: Thai basil, bell peppers, CHILE PEPPERS, _cilantro_ , _coconut_ , coriander, cumin, _curries_ , fish, _fish sauce_ , _garlic_ , ginger, herbs (fresh), _lemongrass_ , lime, mint, noodles, _peanuts_ , rice, shirmp paste, sugar, _turmeric_ , vegetables.

The basic database you're looking for already exists (and, if you cook regularly, at a very reasonable price). You should just buy the book. Yes, it does beg to be a web app, but you need the expertise behind the book more than you need the convenient interface. I'm wary of convenient- but- bad- answers to important questions.

</comment></comment></comment><comment><USER4> A lot of comments here are about what you can't do with this site (with the usual conclusion that therefore the site is useless). Sure, there are some things it doesn't do. It doesn't teach you how to cook, or do your shopping, or do your homework...

But for what it is, I love it. A recipe is two parts - the ingredients (in what proportions), and how to use them. This completely separates the "how" from the "what" and that's great. Sometimes, I know how to make something, but I need suggestions on what the proportions should be. I like that I can add my own ingredients and find out proportions, or that new ingredients are suggested below. In fact, coupled with the recipes on the side, I can find out how to make it, and immediately vary to my taste. A normal recipe doesn't do that, and unless I've made something many times, I might not have the proportions down pat.

Complaining that this product isn't a different product doesn't make sense to me. If you are completely uncreative when cooking and require exact recipes then don't use this. Or if you already know how to cook something, then why do you care, for example, that "duck" is listed instead of "fat" and "duck legs"? For anyone in between, I think you can use this to easily and successfully adjust a recipe you already sort of know. And that's cool.

</comment><comment><USER5> I think this is really cool from a technical perspective, but I don't understand the purpose of the guided recipe tool.

Why would I want to create a recipe with the tool in the first place? If I'm just submitting an existing recipe of mine to an online database, then the ingredient/quantity predictions aren't that helpful. If I'm trying to create a new recipe, then why would I want to submit it? I've never cooked it before - it might be terrible!

Even a short blurb on the recipe tool page explaining what I should use it for and why it's useful would be helpful. As it stands, this dumb user doesn't get it.

BTW, I love the design of the main page and the "create a recipe page". Very clean and easy to use. However, while viewing a recipe, I found it a little odd that the ingredients were listed in the right column. I found myself looking at the picture and reading the instructions before ever seeing the ingredients.

</comment><comment><USER6> One cool feature would be how to handle substitutions. For example, if I am trying to make a pie crust. And I don't have butter, it would be good to be able to cross out butter, and see crisco or vegetable oil added to the list. Or by adding Crisco, see that the butter is removed from the menu. Because a Pie crust recipe without shortening does not a pie crust make.

However general baking is more difficult than cooking, since the ratios are so much more important. But it also means the app would have so much more value added in this context.

</comment><comment><USER7> It looks nice. I like the simple and functional design.

I don't know how I'd use this though. If I want to make pancakes and type that in it gives me six of the seven ingredients required for basic American pancakes.

What would be useful is if I can input the ingredients I have and the app will tell me what I can make -- and create a shopping list for items I don't have (including coupons).

<comment><AUTHOR> <http://www.recipepuppy.com/> is what I made to search for recipes that use ingredients you already have. It lacks the shopping list functionality though.

</comment></comment><comment><USER8> I see the biggest value in the auto-generated Nutritional Information. Obesity is one of the major factors behind high healthcare costs in the U.S.

If you can incentives image upload along the recipes, you could build a nice database with image and calories as a label. Then you are one step towards building algorithm where you shoot a photo of your food and get approximate calories. This gives you millions of dollars of healthcare venture capital from obesity prevention programs for household environments.

P.S. Plum Vodka is called Slivovitz.

</comment><comment><USER9> Pretty cool - I like it. Sort of like the Chef expert system written years ago by the Conceptual Dependency people except I bet you are matching recipe title names and recipes on the web to the text entered for "What is the dish?"

Because it is really important for my health to track my vitamin K intake, five years ago I built a recipe web site (cookingspace.com) that gives a breakdown of nutrients in recipes that I use. Simple to do, except figuring out the USDA nutrition database.

</comment><comment><USER10> You need units; I typed in lasagna and got suggestions for "200 cheese" and "1 beef".

EDIT: just realized that I actually typed in "lasanga", hence the weird ingredients.

</comment><comment><USER11> Cooking + statistics = ♥

Design is really nice, I'll just make hover menu font little bigger and changed the color of "ask a question" btn.

</comment><comment><USER12> There's a related but different recipe tool in the UK:

<http://www.foodily.com/>

<comment><USER13> I much prefer Recipe Labs; the front page is actually useful to me since I can immediately fiddle with recipes or browse existing ones without being nagged about "signing up".

Minor niggles: \- on the "newest recipes" list: they all say things like "Created on 24 minutes ago". Drop the "on" (presumably this is there for older recipes that might get a date against them?). \- after clicking on "coupons" some of the top menu links are no longer correct

I often find myself wondering what to cook of an evening so a good recipe site is definitely of interest. Looks like it's aggregating quite a lot of other content though so I guess the challenge is for it to be better at recipe searches than Google.

<comment><AUTHOR> Thanks! I fixed the minor niggles.

</comment></comment></comment><comment><USER14> Did you do the OSQA implementation yourself? I want to deploy OSQA for an idea in a niche area I'm testing. I want to do Q&A but I also want to add a news section sort of like the setup here on Hacker News. I'm not sure how easy it is to customize OSQA though. I am not a developer so I would be willing to part with a few dollars to get this done.

</comment><comment><USER15> You should definitely show temperatures and measurements in SI units as well for us Scandinavians (and other non-crazy folks)!

</comment><comment><USER16> Interesting concept. I suppose this is based on statistics/ml, which is nice for finding positive matches. It doesn't work with diets avoiding certain ingredients like vegetarian, vegan or gluten-free. Typing gluten free, the first ingredient I get is flour. Vegan curry gives me some butter curries. Edit: order of words

</comment><comment><USER17> Very nice job and I although I'm not much of a baker I think I could see myself using this as I have always wanted to tweak some of my favorites. One thing I noticed if you import a recipe is that you get a bunch of _0.666666666667_ type units, you probably should just provide the fraction for those.

</comment><comment><USER18> Hmmm, lamb rogan josh requires 54 onions? And 406 (and a half) lambs?

As other's have said, probably better not to focus too much on quantities and more on necessary/optional ingredients and how to source them.

</comment><comment><USER19> Is there any way of changing how the ingredients are measured ie pounds to grams?

Also.. perhaps cups is not the best way to measure onions ;)

Nice work though, design looks slick

</comment><comment><USER20> Great idea - I particularly like the "just add basil" option when I was making lasagna.

Btw, you spelled "cholesterol" wrong in the nutrition information section.

</comment><comment><USER21> There's a small bug where if you try to add another ingredient after you've typed something in the box, it deletes the current row and adds a new one.

</comment><comment><USER22> Really nice, although if I type for example "omellete" (notice the typo) instead of "omelette" it gives me an HTTP500..

</comment><comment><USER23> Design is cool and I love the concept. You seem to have fallen into the (lack of) contrast trap with the text though.

</comment><comment><USER24> How did you get that labs page looking like stackoverflow? Have they finally open sourced their code?

<comment><AUTHOR> I am using OSQA for the Question and Answer section

</comment></comment><comment><USER25> Wow this thing is awesome. Wish it was a little faster.

<comment><AUTHOR> The server is under more load than I expected. I wish I could fix this is the near term, but if you try again later it should be much faster.

</comment></comment><comment><USER26> Yum, except you might have to tweak whatever function you're using to add or multiply ingredients... I typed in "popcorn" and it suggested using 9 1/2 cups of popcorn =) I think you might need to average that out??? <https://strikesapphire.com/popcorn_ludicrous.png>

Also, btw. Corn syrup? Not a common household ingredient (nice rip off the packaging list, I guess?) 3/8ths cup of sugar on TOP of the corn syrup? Dude, you're crazy!

<comment><USER26> Oh wait, I'm seeing it says "Popped popcorn". Well, if you're not going to tell me how to make it I'm not sure why I'm going to your site =\</comment></comment>


Google Wants to Kill the URL: Chrome 13 Lets Users Hide the Address Bar - <AUTHOR> http://www.readwriteweb.com/archives/google_wants_to_kill_the_url_chrome_13_lets_users.php

<comment><USER3> As long as there's a hotkey to reveal the URL field once hidden, I'm all for it.

> _The effect is a 30 pixel gain in vertical space and transforms the standard > viewing window in Chrome into a full-screen view._

I'm sure it's not for everyone, but those few additional pixels of screen real estate will make a difference, especially on netbooks.

I greatly admire the Chrome team's continued push for greater browser UX.

<comment><USER4> Yes. Especially when using a webapp like GMail, the URL doesn't matter once you're in the app. I'm not saying I think URLs should not be accessible if someone wants one, but they're mostly just a user distraction. Perhaps a "who you are trusting" notification would be useful? Basically, just the hostname and the level of trust conferred by SSL certs, lack of inclusion in whatever blacklists Google keeps, etc.

<comment><USER3> I agree; I think the only _real_ downside of hiding the URL field by default is the loss of the "secure padlock".

A (naïve, immediate) solution I can think of is showing the URL field as you switch tabs―padlock included.

<comment><USER5> Hey good call on the padlock issue I hadn't even thought of that. However, I don't it should be visible only when switching tabs. I think instead it should be added to the tab itself that way it's always visible. However, that means presenting some kind of divider or something on the tab itself so that some one can't fake it with a favicon. Perhaps by coloring the tab and adding the padlock at the right most of the tab. This way it will be less likely to confuse it with the favicon.

</comment></comment></comment></comment><comment><USER6> "Google's Chrome browser will give users the ability to kill that final remnant of the fact that they're actually using the Web - the address bar."

Wrong. File system browsers (e.g. Nautilus) typically show the URI, viz. the name of the folder that you are browsing.

This is a savvy move on Google's part because deprecating the URL means that you have no option for finding resources, _except search_. Search through your browsing history. Search through your filesystem. Search through the web.

Using search more can be pretty sexy, if your search works well.

<comment><USER7> I think you make a good point but I disagree on the conclusion. Even if it works well I don't think Search is the be-all-end-all

In my opinion the ideal web is one that is properly categorized via url. For example, if I knew all magazines had an author listing at "magazine_url/Authors" then it would be easier for me to type in Time.com/Authors then it would be to use Search.

Now obviously things aren't that well organized right now but REST has done a lot to move us in that direction and I have no reason to think that wouldn't continue. If things are someday that organized it won't matter if users have grown accustomed to hiding the url.

So while I agree this is savvy for Google because it makes the user more dependent on search I don't think this is good for the web.

<comment><USER8> I don't think bravura was arguing that it was good for anyone but google.

I agree that's it's bad for the web, but historically walled gardens seem to always fail in the long run but google's attempt to build a UI "wall" around the open internet seems to be working quite well.

I'm guessing UI people will praise it for "making things easier" for the imaginary "grandma on the internet", security focused people will rightly be scared by this and phishers will absolutely love the idea.

</comment></comment></comment><comment><USER9> I think there is a bigger concern of phishing attacks... Without an address bar its harder to confirm that you are actually visiting X.com

<comment><USER10> Exactly my sentiment over at <http://news.ycombinator.com/item?id=2564086>:

I wonder how this might impact the overall security? Right now URL bar provides useful information about the domain where you are at. Hiding the URL box could bring back the most brain-dead attacks like hosting a phishing site on a regular HTTP (no cert = no warnings from the browser) and hidden URL cloacks the fact that the URL in fact is "bankofameri.ca".

<comment><USER11> Certainly they will still have some way of indicating the domain, at least with SSL. It might actually make users more aware of the domain since it won't be sandwhiched between URL gibberish.

</comment></comment></comment><comment><USER12> _To activate teh hidden URL bar, users will also have to right-click a tab and select "Hide the toolbar" [sic]_

The sources quoted in this article in no way support the conclusion present in the title. As phlux said, other browsers have enabled you to turn off the address bar. Are they trying to "kill the URL" too? No, and neither are Google.

This article comes off as little more than sensationalist (albeit apparently effective) link bait.

<comment><USER13> I agree.

The same is true for _a lot_ of other articles we happen to read. The title says one thing, but the actual body of the article has little (or even nothing) to do with it.

Hey, I understand their job is getting people to read what they write, but it looks to me like the signal-to-bullshit ratio is getting worse.

</comment></comment><comment><USER14> The analogy in my mind has always been that of the command line. Most users these days do not use the command line. But many tech people still do, as it is a very effective tool.

Likewise, the address bar - I still hand-type most of the sites I regularly use, because I can type them faster than navigating my various bookmark folders. Which also negates any inspiration to find better bookmarking tools.

I also have the unfortunate job of maintaining SharePoint sites, for which there are many standard URL strings I can throw onto a site that will get me to various admin pages.

I am sure other platforms have similar structures, where hand-typed addresses can manipulate the site in some way to the benefit of those who support it.

And maybe that is where Google will end up - with the address bar being the command-line-equivalent for their web-based OS.

<comment><USER15> Agreed. I still hand type most URLs and weird ones I use bookmarks for...but it's more and more rare that I hand type anything more than the basic domain...anything with an actual URL structure I navigate to...

</comment></comment><comment><USER16> The URL bar serves as the search bar as well, and for most people that's their primary mode of navigation. Even if they don't really care about URLs, I don't see anyone wanting to add another step every time they do a search.

<comment><USER17> I'm clicking ctrl + L before searching anyway :)

<comment><USER16> Ctrl + K gets you into search mode only. I find it annoying sometimes when what I'm searching is similar to a URL in my history, so it's useful to specify it's a search with a "?" before a query.

</comment></comment></comment><comment><USER18> I hope they keep the address bar for new tabs. In fact, I just realized this is basically the only time I use the address bar

\- ctrl+t opens a new tab with the cursor in the address bar

\- after typing 2-3 letters, chrome knows where I want to go

\- hitting enter takes me there

I've found this is the absolute fastest way to navigate to any regularly visited websites. No pointing, clicking, or browsing through bookmarks - <USER2> a few keystrokes and I'm there. As for new websites, Google search is perfectly efficient.

<comment><USER19> t n↵

Those are my first 3½ keystrokes in the morning.

<comment><USER18> HN shortcut? Me too :)

</comment></comment></comment><comment><USER11> I was getting ready to post a rant about how this violates the principles of the web, but I actually can't think of any principle that says you have to show URLs all the time. The earliest browsers probably didn't. I'm sure you will still be able to _enter_ URLs through some popup widget.

Ultimately, if people can't read URLs then there's no great value in shoving it in their face. We might as well use that space for something they do understand. If it showed _just_ the domain or SSL creds, users might pay more attention to them since they wouldn't be buried in noise from the rest of the URL.

I'm not happy that Google search is effectively replacing the DNS as the web's canonical index, but that has been happening for a while and it's driven by a very real user need. I would consider hiding the address bar an effect rather than a cause.

</comment><comment><USER20> Some article was temporarily the top Google hit when searching "facebook login". This caused some confusion among URL-unaware facebook users.

[http://jonoscript.wordpress.com/2010/02/18/some-people- cant-...](http://jonoscript.wordpress.com/2010/02/18/some-people-cant-read- urls/)

</comment><comment><USER21> If it's what I think it is, they used to have this feature for app tabs last year, then removed it. I couldn't find much writeup, here's [http://lifehacker.com/5608189/restore-chromes-toolbar- when-w...](http://lifehacker.com/5608189/restore-chromes-toolbar-when-web- apps-are-installed) a mention. I'm happy it's back.

</comment><comment> mike-cardwell I like being able to see the address bar. It lets me know that I'm viewing the page that I think I am.

</comment><comment><USER22> I'm happy, as I've argued for this a few times on the CR-48 list. Not sure how this will work with lack of direct access to extensions and so forth, but perhaps this will spur innovation among 3rd party UX developers.

</comment><comment><USER23> Personally I think killing the URL is one of the first steps to crystallizing Google's goal of replacing desktop apps with web apps. It all fits...

</comment><comment><USER24> To be honest, I think this is a terrible idea. Let's hope they keep it optional rather than forcing this implementation on every user.

</comment><comment><USER25> You have been able to turn off the nav bar in FF and I think IE for ages.

<comment><USER26> Also, Safari. My favorite way of browsing docs is to open them up and hide the tabbar, urlbar and statusbar at the bottom of the screen. this leaves me with a very minimalist window and let's me focus completely on what I'm reading.

<comment><USER27> F11 (aka fullscreen)?

<comment><USER26> I'm running Mac; F11 does the opposite and shows my desktop.

</comment></comment></comment></comment><comment><USER28> Every browser has had this feature since the beginning of time. Just press F11.

It automatically pops up if you press Alt+D to enter url or move the mouse to the top of the screen.</comment>


Physics prof fired from oil spill cleanup job due to controversial blog. - <AUTHOR> http://www.latimes.com/news/nationworld/nation/wire/sns-ap-us-oil-spill-professor,0,3504925.story

<comment><USER2> It's unclear to me why the professor's opinions on homosexuality or multiculturalism would impede his ability to find a solution to our current predicament in the gulf, which requires a rapid and expert insight.

If his other four colleagues selected by the Obama administration were unable to work with him, that would be one thing. There doesn't seem to be any public indication of that. This mostly seems to be a bow from the administration to pressure to enforce political correctness.

It would be a shame if the professor's absence unnecessarily prolonged or impeded a rapid solution to the gulf oil geyser. The longer that geyser is allowed to spill, the greater the devastation to marine life and the gulf economy.

<comment><USER3> Look at his publications:

<http://wuphys.wustl.edu/~katz/publist.html>

He does not seem to have particular expertise on this problem.

<comment><USER4> He entered the project based on aptitude and left based on politics. That's why it's unsettling.

<comment><USER3> Here's a good summary of the team Steven Chu, himself a Nobelist, appointed:

[http://tpmmuckraker.talkingpointsmemo.com/2010/05/mission_im...](http://tpmmuckraker.talkingpointsmemo.com/2010/05/mission_impossible_obama_taps_crack_team_of_scient.php)

Note that Katz is called the "What am I doing here" person. And note, the above summary piece was posted in advance of those writings coming out.

I think the real issue is, why did Chu ask Katz to join the team in the first place? He's really not got the same track record as the others on the team. Not even close.

<comment><USER5> Sometimes it's good to pick people who are experts in related fields but with no direct knowledge of the issue -- it's a source of unbiased ideas that can be valuable. My impression is that that's the whole idea behind this JASON team, to bring together people from various fields of science who all bring their particular viewpoint to a problem. It's the whole idea behind the word "interdisciplinary"...

<comment><USER3> <blockquote> In the days when Sussman was a novice Minsky once came to him as he sat hacking at the PDP-6. "What are you doing?", asked Minsky. "I am training a randomly wired neural net to play Tic-Tac-Toe." "Why is the net wired randomly?", asked Minsky. "I do not want it to have any preconceptions of how to play." Minsky shut his eyes. "Why do you close your eyes?", Sussman asked his teacher. "So the room will be empty." At that moment, Sussman was enlightened. </blockquote>

My point: not to confuse "no preconceptions" with "not much directly usable knowledge." Look at the resumes of the people on the team. You've got the head of one of the premier research institutions in the nation (Sandia), a national medal of science winner who has consulted about the Kuwait oil well disaster, a robotics engineer, and a petroleum engineer. And an astrophysicist.

About Feynman, remember, he was a Nobelist and widely understood, when he was appointed, to be the most brilliant physicist of the latter half of the 20th century. His university (Caltech) runs a NASA facility, JPL, where his sister and a lot of his colleagues worked.

</comment></comment></comment></comment></comment></comment><comment><USER4> It's unfortunate his social views became a "distraction"--whatever that means. I am disappointed. He should not have been dismissed due to social pressure. He's not running for a political office.

He's a smart man who's trying to solve a very important, urgent science problem. His involvement should only be tied to his problem-solving abilities.

We need to band together--irrespective of barriers and beliefs--like in the movie Independence Day--where all the countries united to defeat the alien invaders :)

<comment><USER6> ... should NOT have been cut ... I think you meant to say. Correct ?

<comment><USER4> fixed wording

</comment></comment></comment><comment><USER7> Let's be clear about what he said in his blog that's so inflammatory.

Essentially, he said that gay people are morally culpable for AIDS, and that the monogamous gay people are culpable because they belong to the same group much how people belonging to the KKK are to blame even if they aren't the exact person committing violence.

<comment><AUTHOR> He really didn't say that. He compared homosexuals to people who ride motorcycles without a helmet, not the KKK. He also criticized the homosexuals and IV drug users who spread disease.

What this has to do with his ability to mitigate an oil spill is beyond me.

<comment><USER7> "Post-Script October 9, 2005: In recent weeks this essay has been the subject of controversy at, and even beyond, Washington University (see, for example, recent issues of Student Life). A number of critics have asked if monogamous homosexuals are also culpable. Quite apart from the question of the definition of monogamous (sexual contact with only one person in a lifetime? serial monogamy? some cheating? etc.), I suggest the following analogy: A man joins the Ku Klux Klan. He is not violent, and would never hurt a fly; he just wants a safe place to express his racist feelings. Is he culpable for the Klan's past acts of violence? I believe that even though he is not criminally responsible for acts that occurred before he joined, he is morally culpable for joining the Klan. The Klan has blood on its hands, and anyone who joins must share the guilt. So, too, with the homosexual movement."

<comment><AUTHOR> My mistake.

</comment></comment></comment></comment><comment><USER8> It's disappointing at a time like this that when all Americans need to come together and focus on relief efforts and recovery efforts in the Gulf, someone in power decides a person's divisive position on an issue affects his ability to focus on a problem.

<comment><USER9> If it affects other people's ability to work with him, it matters.

<comment><USER10> Maybe it effects his ability to work with them, and they should be removed.

I don't like homophobia, though I do agree with him on diversity (based on what the article showed): that we should focus on people's merits, and not their race, for college admissions and jobs.

However, it's my understanding that he only wrote this stuff on his blog; that he wasn't preaching about it at work, or in this scientist group.

If some scientist is too effected by the personal writings of this guy on his blog that they are unable to work with him, then that scientist should leave the group. Moreover, for someone to be removed from a government position based on his personal beliefs, expressed on his personal web site, is very clearly a violation of freedom of speech.

To put it another way, suppose someone on the team believed that women should have the right to vote, and this offended the sensibilities of other members of the group. Should that person have been removed?

Just because his ideas are wrong, doesn't make them any of our business, or the government's, or that groups'.

<comment><USER11> jeez, I have probably worked with a lot of people who have divisive controversial views diametrically opposed to my own.

who cares!

The immature, overly political people on the team, that's who!

I don't agree, though, that this is a violation of his free speech rights. He can still speak. Its more a violation of his employment agreement, if anything at all.

<comment><USER10> I have to disagree with "I don't agree, though, that this is a violation of his free speech rights. He can still speak."

Freedom of speech doesn't mean that you have vocal cords. It means you are free from reprisal for your speech. This was a government appointment, and the story says that the DOE confirmed that the reason for his removal was because of his writings. So, the DOE punished him, by removing him from this appointment, based on his writings.

<comment><USER12> Freedom of speech doesn't typically imply no fear of reprisals from employers; why should it in this case?

<comment><USER10> In essence, it comes down to government use of power. Private companies may discriminate based on beliefs, because the positions they offer are not created by use of force, whereas all government positions are.

Put in a concrete, extreme example, consider if all teaching positions across the US required a statement of belief (say, in god). This would clearly be a violation of the establishment clause (really, tied to freedom of speech, but you could make another example that is more closely linked to the current situation). However, if some private catholic school required its teachers to believe in god, that would not be a violation, because the constitution binds the government, not private individuals or groups.

So, in a clear answer to your question, "why should it in this case?", it should because the constitution is a set of rules for the government to act upon, not for private companies.

<comment><USER12> A set of rules for the government to act on in exercising powers peculiar to government, no?

Hence the historical importance of tenure for judges, for example. I assume his university position is likewise protected by academic tenure?

So I respectfully disagree. Whatever this is, it isn't a freedom of speech issue.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> wow, lots of homophobe-apologists masquerading as free speech crusaders here tonight.

it doesn't take a genius to realize that:

a) having a lightning-rod homophobe/bigot on the team will turn into a PR nightmare and result in a media circus

b) it'd be better to not have such a circus and focus on the important stuff

c) removing the bigot puts this problem behind you so you can focus on the task at hand

furthermore, $50 says this guy is a self-hating closet homo. wait for it....</comment>