"We have been experiencing a catastrophic DDoS attack" - <AUTHOR> https://status.linode.com/? <comment><USER2> I've done some googling before asking here: Can anybody explain why Linode is so often targeted like this? We moved Cronitor off Linode in spring 2015. During the christmas holiday when they suffered a 2 week DDOS I thought of the family time I'd be missing that year as we did a crash migration to AWS had we not migrated when we did. I have to imagine this has been _horrible_ for their business.

I would use Linode if I needed to lease computational power, because it is still a great value vs AWS, but I could not run a high availability service there. It would feel like professional malpractice at this point.

<comment><USER3> I am also surprised as this is not the first time I am reading about it on HN. Linode seems to be highly vulnerable to certain attacks as we could see in the past. I hope they will fix it and provide a permanent solution as I was hoping to use them as a part of my network, but I see more and more signals they can't handle serious traffic. Hopefully, they will redesign their infrastructure to handle it.

I am with all of you guys that are affected by this. I am looking forward to them to resolving this soon.

<comment><USER4> Isn't the problem money? They could certainly fix it but would have to raise the prices on each VPS?

<comment><USER5> I'd be ok with paying twice what I'm currently paying if they could solve this problem. We're with Linode because it would cost us about 10x as much to run on AWS, and we can't justify that.

<comment><USER6> They're price-matching DigitalOcean, so raising prices is probably out of the question.

<comment><USER7> Linode is now half the price of DO per RAM

</comment></comment></comment></comment></comment></comment><comment><USER8> I wonder if this is a diversion to keep Linode's security team busy so they won't notice someone compromising the Xen nodes with XSA-185/6/7/8?

<comment><USER9> I've noted the AWS security bulletins[0] list nearly every Xen advisory with "AWS customers' data and instances are not affected by these issues, and there is no customer action required."

It would appear? you'd need to go back for quite a few months of being unpatched to find a genuine issue. Unless something about Amazon's mitigations don't apply universally.

[0] [https://aws.amazon.com/security/security- bulletins/](https://aws.amazon.com/security/security-bulletins/)

<comment><USER10> AWS (and other large hosts: [https://www.xenproject.org/security- policy.html](https://www.xenproject.org/security-policy.html) search for predisclosure) get notified before the public.

</comment></comment></comment><comment><USER11> I disagree with people saying these types of attacks can't be prevented if you switched hosts. I'm sure Google+cloudflare[0] would keep your website online. AWS also if you had the cash.

The amount of distributed traffic happening right now against linode would probably only represent a 5% increase in traffic to a popular Google product. At least you know they have the expertise. Nothing against the very smart and talented linode engineers, but the two companies are on _very_ different levels of traffic engineering.

[0] [https://www.cloudflare.com/google/](https://www.cloudflare.com/google/)

<comment><USER12> Google and AWS probably have sophisticated DDOS mitigation (can anyone comment on this?) and you can scale up pretty quickly.

But if your service is the direct target of the attack (as opposed to the whole provider) and your servers are getting hammered...

Even if you architecture allows quick horizontal scaling, you still face a tough decision.

The attack could go on for days, and the hosting costs can go _really high really fast_. Which can be catastrophic for a small company.

<comment><USER13> Attacks are rarely targeted to the hosting providers. They usually target a specific customer.

Google/AWS probably have 100 times the capacity (and redundancy and architecture reliability and failover and awesomeness) of linode. That means that, first, they can't be put down easily, second, a DDoS is limited to a small subset of the infrastructure and doesn't bleed to every customers and services.

As for traditional hosting companies (OVH and the likes) When you're being DDoSed, they'll null-route your IP space. (i.e. they advertise your IPs as dont-exist-on-the-internet-anymore). The traffic is dropped while in transit on the internet because it can't go anywhere. It doesn't reach the hosting company anymore.

Note: being null-routed means your site and all your services are off the internet and thus effectively dead.

As for CloudFlare. They have many locations all around the world and they can absorb a lot of traffic, to the point they themselves cannot be DDoS. They have active monitoring and mitigation against common attacks and known malicious sources, which may prevent the attack without even you knowing about it.

When you're under attack, you can block subnet/AS/countries in cloudflare settings, or request a challenge/capcha from every visitors. Cloudflare will reject visitors (with or without challenging them) at their edge location before any traffic can get to you. It is very effective from my experience.

Generally speaking. The only way to stop a DDoS is to do it before it reaches your datacenters so you need help from your ISP/provider/CDN.

Edit: The attack that put down linode last christmas was against linode itself and not a specific customer. Part of the mitigation included linode moving its critical services behind cloudflare :D

<comment><USER14> > As for traditional hosting companies (OVH and the likes) When you're being > DDoSed, they'll null-route your IP space. (i.e. they advertise your IPs as > dont-exist-on-the-internet-anymore). The traffic is dropped while in transit > on the internet because it can't go anywhere. It doesn't reach the hosting > company anymore.

OVH hasn't been doing this for a while, they got some beefy ddos protection setup for this exact reason - it was way too easy to take down someone for hours

Hetzner (another big european hosting provider) followed recently: [https://news.ycombinator.com/item?id=12403783](https://news.ycombinator.com/item?id=12403783)

Online.net also has included protection (+ paid upgrades)

At least here in europe the big hosting providers are all switching to providing included protection for all their customers, at least for traffic intensive attacks which hurt everyone

</comment></comment></comment></comment><comment><USER4> It's not hard to compare this to brush fires. They happen periodically, and only the big trees tend to survive them. Linode is getting pretty unlucky here, but I would imagine that all the small time (and even the medium sized) hosting provides are going to succumb eventually. Is the end game just going to be Google vs. Amazon?

<comment><AUTHOR> I'd love to see a network infrastructure and transport protocol that's more resistant to many (D)DoS attacks, because it seems like things will only worsen if it never becomes more difficult for people to attack others' servers online.

<comment><USER15> Good luck. A DDoS is basically lots of traffic. Perhaps run IPX? (Joking)

<comment><AUTHOR> If application- and transmission-protocol-level DoS vectors are fixed, then you're left with just the raw "lots of traffic" volumetric attacks, which means your attacker has to have a lot of compromised hosts (or the right compromised hosts with lots of bandwidth). I'd say that's a reality that would be easier to handle, because you raised the bar from anyone who can develop or use a script and deploy to a few low-power systems, exploiting protocol shortcomings, to only those who have a bunch of higher-powered systems.

The smaller hosting companies may still very well go out of the game if the problem worsens, even if most DoS venues do end up being mitigated. I don't know how I would respond to that as of this moment, but hopefully it doesn't have to come to that. It's already tough to find a decent hosting company in my experience.

</comment></comment></comment></comment><comment><USER16> Play by Play of Linodes 'twelve day attack' over Christmas and New Year 2015

[https://blog.linode.com/2016/01/29/christmas-ddos- retrospect...](https://blog.linode.com/2016/01/29/christmas-ddos- retrospective/)

</comment><comment><USER17> I don't get the hate towards linode here, on hacker news. I've been their client for a couple of years now and I find it an excellent vps provider. Excellent uptime and performance at a pretty good price. AWS has a few outages every year. Google just had one last week. Azure sucks balls. So, why the hate? Is it because it competes with some ycombinator startups?

<comment><USER18> I don't follow this too closely, so this is just wild speculation from me:

But could it simply be severity of the attacks? I keep seeing comments about a 2 week ddos attack last christmas - that's something that i would be shocked to see Google/AWS succumb to. Not that Google/AWS attacks don't happen, i just can't imagine them being down for ~2weeks

 _(I imagine it was just one datacenter from Linode, not the entire service, fwiw)_

<comment><USER19> They weren't down for the entire two weeks, but various datacenters went up and down for hours, then quieted down for a few days, then was back again, then another hit; stretching across two weeks.

One thing that took them so long was that their upstream ISPs at some of the datacenters were _themselves_ unable to handle the DDOS, so they had to switch ISPs, which took a while.

I don't see Google/AWS as easy to attack; but I'm not sure why similar tier players like DigitalOcean aren't being hit -- or maybe they're just less transparent about things, or are actually a smaller target (didn't _think_ they were?).

edit: here's a postmortem from linode of the christmas attack - [https://blog.linode.com/2016/01/29/christmas-ddos- retrospect...](https://blog.linode.com/2016/01/29/christmas-ddos- retrospective/)

</comment></comment></comment><comment><USER20> OK, who hosts at Linode and is very popular/pisses people off? 4chan? 9gag? Reddit? Something Awful?

<comment><USER21> I think 9gag used to be on linode? I'm pretty sure none of the rest are though.

<comment><USER22> Yeah Reddit is on AWS[1] and 4chan appears to be self-hosted (or at least it was for most of its existence)[2]

[1] [http://highscalability.com/blog/2013/8/26/reddit-lessons- lea...](http://highscalability.com/blog/2013/8/26/reddit-lessons-learned-from- mistakes-made-scaling-to-1-billi.html) [2] [https://www.4chan.org/news?all#106](https://www.4chan.org/news?all#106)

</comment></comment></comment><comment><USER23> I've always wondered, while in similar cases GCE/AWS can handle the traffic, is it not chargeable? So, while you will probably not get affected by the DDoS, aren't the costs going to cut your head off?

<comment><USER24> Isn't incoming data on AWS free? Or are you thinking of some kind of attack where they're using your infrastructure to amplify outgoing data?

Edit: I guess an attack that causes your infrastructure to auto-scale could get expensive REAL quick...

<comment><USER9> I'm running the maths right now.. and you could convince me to take down my side project by just having a server outside their network put wget in a loop targeted at my S3 resources.

</comment></comment></comment><comment><USER21> >Update - We have been experiencing a catastrophic DDoS attack which is being spread across hundreds of different IP addresses in rapid succession, making mitigation extremely difficult. We are currently working with our upstreams to implement more complete mitigation.

That's pretty harsh.

</comment><comment><USER25> Well, I had Linode shortlisted for an upcoming project. I hate to take them off the list because it is not their fault, but I don't want this kind of unreliability.

<comment><USER26> > it is not their fault

I don't understand this line of reasoning. It's not like DDoS attacks are some kind of 0-day failure mode that nobody has seen before.

Would you also say "it is not their fault" if their uplink provider had a fiber cut and they didn't have redundant uplinks? I'm guessing not: it's well understood that has a service provider you need to plan for this kind of unavailability and pay more money for redundant links. So it seems really weird to have this double standard for a different kind of availability failure mode.

Just like network availability or datacenter power availability, you need to invest technical and financial resources into DDoS defenses if you want to be resilient to incidents. If you don't do that as a hosting provider, I definitely won't feel sad for you.

<comment><USER27> There are a handful of environments that can sustain a large, coordinated DDOS attack. Can you sink 10-20Gb/s of traffic forever? Not cost effectively.

<comment><USER21> If you live in 2002, nah. In 2016? Yes. Bandwidth is cheap and linode has high margins.

<comment><USER28> Bandwidth is cheap but attacks are cheap too.

<comment><USER21> Which is exactly why you need to be prepared for them?

</comment></comment></comment></comment></comment></comment><comment><USER29> This can't be good for (Linode's) business.

Vultr had problems a few weeks ago, but I don't think it was DDOS-related.

Somehow things have been quiet on the DigitalOcean's end.

</comment><comment><USER30> 3½ hours already. Distributed from and to many IP addresses. Seems like an attack on them rather than on specific users. :/

<comment><USER31> Or an attack on them as a vector to attack a specific user or users.

</comment></comment><comment><USER32> I have no evidence to support this theory, but I believe that Linode is not an outlier with regards to frequent DDOS attacks. What makes this company special seems to be with how it communicates to its customers when it's under attack.

This leads me to wonder: How much do other providers leave customers in the dark?

</comment><comment><USER33> Can anyone recommend a good article that explains how attacks like these work, and what is required to stop them?

Also, we're on Heroku and they advertise Ddos mitigation as a feature, but "mitigation" sounds non-commital and I'm curious how they'd fare against a similar attack?

<comment><USER34> It's non-commital, because at some point, when you have enough zombie hosts properly distributed all over the world attacking you, your only defence is - have more bandwidth than the attackers. If your peers can't filter out the traffic before it hits your network and it simply saturates your pipes, there's nothing you can do inside the company anymore.

<comment><USER33> Thanks for the reply. Can you elaborate on what you mean by "peers" in the above? Eg, who (or what) would Heroku's peers be?

</comment></comment></comment><comment><USER35> Linode is a cost effective solution comparing to AWS. But the security and DDoS issues could raise eyebrows and bring confidence issues with customers. This has happened even after they posted about enhanced DDoS mitigation strategies like procuring more bandwidth etc.

If you look at the history of Linode discussions under HN, most of them were related to DDoS attacks and service downtimes. [https://news.ycombinator.com/from?site=linode.com](https://news.ycombinator.com/from?site=linode.com)

I hope they will recover soon and make the service stable.

</comment><comment><USER36> I really feel bad for these folks. Does know if they have a DDOS mitigation strategy other than RTBH with their transit providers? I would have thought that after the 2015 attack they would have looked into traffic scrubbing with something like Arbor Network or Prolexic. I understand that these are not cheap and Linodes as well as many other hosting provider's margins are probably thin but I would think that it would pay for itself in one or two attacks by minimizing customer churn an event like that causes.

</comment><comment><USER37> I remember a few years ago when I moved my Linode from Fremont to Atlanta to avoid the frequent outages. I've never had show-stopping issues with Linode and the customer service has always been fast and responsive. Now though, I'm thinking of moving to their Frankfurt datacenter.

But now I think I need to setup fail-over with another VPS provider. What's a recommended alternative? Is Digital Ocean the next best choice after Linode?

</comment><comment><USER38> This explains why Package Control, Ansible Docs, etc. were down. Sucks. I knew this has happened before, just didn't know it was Linode.

</comment><comment><USER39> Does the US have a competent cyber-crime division that can handle stuff like this?

<comment><USER40> Yes, the FBI. They're fantastic at it and part of their job is helping businesses recover from compromise and going after the attackers. However, they're overworked government employees with not enough resources.

<comment><USER11> I think they very much want to, but what can you do if all of your IPs lead to tor exit nodes?

From what I've heard, the FBI will collect a whole bunch of information and then sit on their hands because of the above reason.

<comment><USER41> How can tor nodes be used for that?

Tor exposes a SOCKS interface, you can't control TCP/IP with the level of detail needed to perform these attacks.

<comment><USER42> Run the attack itself from a botnet of hacked computers, with the command and control server proxied behind TOR.

</comment></comment></comment></comment></comment><comment><USER43> DigitalOcean has had a few DDoS attacks targeting their SFO1 datacenter over the past few months, but fortunately each one seemed to disappear in under half an hour.

<comment><USER44> DigitalOcean is the source of many DDoS attacks. They've got a lot of compromised servers on their network and ignore abuse complaints.

</comment></comment><comment> constit-protec Godaddy has been getting attacked a lot recently as well. Who is likely behind attacking servers, whether other server companies or governments?

<comment><USER45> When you are the dns root record and in many cases hosting too for some 60-70 million domains, someone in the internet is wanting to attack someone at godaddy all the time. There isn't a time they _aren 't_ being attacked somehow in all reality, and I'd presume it's much the same for Linode.

The means of really combating a ddos is costly and extensive, this is why most use a service like prolexic or silverline, and typically with some massive infrastructures that comes with it. Anything less than n-by 40gb disposable internet pipes, preferably regional as you are, you can/will be smited at will.

</comment></comment><comment><USER46> What kind of DDOS attack is the most likely happening here, a simple L3 spoofed ICMP flood?

</comment><comment><USER47> Any details on the actual size of the attack and the attack vectors used?

</comment><comment><USER48> You get what you pay for. TCO of running a highly available data center is more than just the cost of metal, real estate, power, cooling, and cable

Going cheap with one of the non-big 3 public cloud providers will cost you.

</comment><comment><USER49> I used to be on Linode... then one of their techs tripped on a power cord causing a significant outage in a data center... and no I'm not joking.

<comment><USER50> You are confusing them with Dreamhost: [http://www.manton.org/2011/03/brent_on_baked.html](http://www.manton.org/2011/03/brent_on_baked.html)</comment></comment>


If correlation doesn't imply causality, then what does? (2012) - <AUTHOR> http://www.michaelnielsen.org/ddi/if-correlation-doesnt-imply-causation-then-what-does/ <comment><USER2> Url changed from [https://speakerdeck.com/eliang/if-correlation-doesnt- imply-c...](https://speakerdeck.com/eliang/if-correlation-doesnt-imply- causality-then-what-does), which points to this. HN prefers original sources.</comment>


Goodbye SEOmoz. Hello Moz - <AUTHOR> http://moz.com/blog/goodbye-seomoz-hello-moz <comment><USER2> I'm not an active user or part of the SEOmoz/moz community, so perhaps my perspective is off (or perhaps it's better) but...

I think this is a bad move. Like it or not, I know what SEOmoz is immediately. I've known what it was for years. It's a brand.

Moz makes me think of Mozilla, immediately. That's just how the brain works. It doesn't make say "Oh that must be SEOmoz just expanding their reach!"

Love it or not, we all know what MtGox is. It's a Bitcoin exchange. Even though the name is based on Magic the Gathering, that doesn't matter. If they became Gox, that would be meaningless despite their best intentions.

As always, I'm happy to be corrected by someone who knows more about this stuff than I do, but me thinks this is a bad idea.

<comment><USER3> I can't manipulate the way you process the terms "Moz" and it's association. The "Moz" = "Mozilla" comparison is easy to make so I hope time and continuing branding efforts by Moz will hopefully change that.

This transition from solely focusing on SEO to a more holistic marketing tool is not new. They've been moving in this direction for at least the past year. I think this is a good time for them to make the break from being pigeonholed as an SEO company to something bigger, something more inclusive. SEO is no longer a narrow niche type of marketing, at least not to the people who perform SEO daily or on a professional level.

It's a combination of content creation, site optimization, outreach and relationship building, branding and more. Not all these components are always associated with "SEO", which often times has a negative connotation attached to it. Moz is hoping to capture a larger part of the inbound marketing market than SEOmoz ever could.

<comment><USER4> > The "Moz" = "Mozilla" comparison is easy to make so I hope time and > continuing branding efforts by Moz will hopefully change that.

Hopefully not.

</comment></comment></comment><comment><USER5> "For many folks outside of our community, the acronym SEO has (unfair) associations with spam or manipulation."

I'm not sure that the association is unfair. There are a lot of honest people out there plying the trade and doing good work in the SEO space, but the same could be said for email marketing. For every good guy, there's enough spammers out there that even now, guys like patio11 have to spend a decent amount of time spelling out the difference between legitimate email marketing and spamming. SEO strikes me the same way: lots of people doing good work and being drowned out by the negative press of snake oil salesmen, con men and link sellers.

It's unfair to the people doing the good work... but I don't think it's unfair that people free associate "email marketer" with "spammer" and "SEO Guy" with "Hucksters, Liars and Criminals". Too many run-ins with the Black Hat SEO crowd have made me wary and I'd be shocked if I was the only one.

<comment><USER6> Exactly! To each few good "SEO" guys there's a plethora of scammers.

I think it's a great move for them and will help to win a more skeptical crowd. Although, I still don't trust them with or without "SEO" :)

<comment><USER7> Any reasons behind this?

</comment></comment></comment><comment><USER8> I'm glad they've finally moved to Moz.com (I predicted they would do this when Rand started blogging on Moz.com) because apart from when it was an SEO blog, SEOMoz has never really been just about SEO - they're more of a marketing suite (and I'm assuming the new Moz.com is step 1 in becoming this)

The post itself mentions some of their services (and acquisitions such as FollowerWonk) which shows the company are not really just an SEO software company although, the bigger point around it goes back to them being beyond SEO as the content they have always focused on themselves alongside the tools they have provided were/are more than just your standard SEO tools.

Personally, I think it's a smart move for them and the new branding allows them to tackle a much bigger market too!

<comment><AUTHOR> Good point about your prediction, especially since in one of their blog posts (aka, how to move to a new domain), this is exactly how they recommend doing it for the fastest SEO-juice transition.

</comment></comment><comment><USER9> _We believe that in the next decade, the effort and dollars put toward web marketing will become more sophisticated, and growth in channels like SEO, social media marketing, content creation, etc. will dwarf the growth rates of those in more traditional, interruption-based endeavors._

And then once everyone gets on this bandwagon and the market gets saturated, we'll switch back over to interruption marketing.

I'm a firm believer in the power of inbound marketing, but for all of those things painted in blue[1] there's always a campaign in red to drive my attention to it. True inbound marketing is way too risky at scale.

The next decade and the next century is going to be the ultimate battle for people's attention.

[1] - [http://d2v4zi8pl64nxt.cloudfront.net/goodbye-seomoz-hello- mo...](http://d2v4zi8pl64nxt.cloudfront.net/goodbye-seomoz-hello- moz/51a60a41addd71.82695302.gif)

<comment><USER10> "True inbound marketing is way too risky at scale."

In what way is it risky? I can see it being too much work for some people/companies who do mediocre work to begin with. But I can't see what risks are inherent in establishing yourself (or your company) as a thought leader in your field.

<comment><USER11> There is a risk in that the money spent on becoming a thought leader could have been better spent on ads, in terms of ROI.

<comment><USER12> I'm a bit biased (friend of Rand, founder of HubSpot), but I think the exact opposite is true.

Long-term, I think inbound marketing is way less risky for one simple reason: We're living in an age of increasing choice and increasing transparency. As buysers/consumers, we're naturally going to lean increasingly towards companies that deliver a better product/experience -- not towards those that happen to place more frequent ads. Those that build their brand by delighting customers (all the way through the process from marketing to sales to service) will find that their investments create greater returns.

But, as I said, I'm biased (but that doesn't necessarily make me wrong).

</comment></comment></comment></comment><comment><USER13> I've subscribed to SEOMoz for just over a month as part of looking at how we should be working on SEO specifically at Mandalorian[1], and also to evaluate how other similar companies use SEO. After a couple of days with the tools I realised that this actually gave us a whole load of much more useful information to help with general marketing exercises.

I might have joined for the SEO, but am most definitely staying for the marketing. I wish Rand and team the greatest success with Moz.

[1] - <http://www.mandalorian.com/>

</comment><comment><USER14> Their prices are too expensive for SMBs. I also wish they would give us a tool like Google analytics. The combination would probably make it better. Next : the CRM market.

</comment><comment><USER15> How is it possible that a marketing business get the site name wrong? Moz == Mozilla. Its a big branding issue that could land them in trouble with the Mozilla legal department.

<comment><USER16> Legally, Moz =/= Mozilla.

Moz (SEOmoz) has the following trademark: [http://tess2.uspto.gov/bin/showfield?f=doc&state=4808:tp...](http://tess2.uspto.gov/bin/showfield?f=doc&state=4808:tp5z4j.2.3)

You can search the site for yourself. Aside from tires (for which there is no "likelihood of confusion") there are no other Moz trademarks. If Mozilla wanted to brand themselves as something other than their company name, they should have picked up the Trademark and used it in official commerce.

I seriously doubt Mozilla has a problem with it anyway. I really don't think it's that confusing.

</comment></comment><comment><USER17> I called it may 3rd :). <https://twitter.com/shuri_org/status/330487333449244673>

</comment><comment><USER18> I love your Firefox browser.

</comment><comment><USER19> Wow, they still use feedburner?

</comment><comment><USER20> Why is some weird combination of fruit fucker and bender on the top of their page?</comment>


CS143: Compilers (2011) - <AUTHOR> http://www.keithschwarz.com/cs143/WWW/sum2011/ <comment><USER2> Also, take a look at [http://www.keithschwarz.com/interesting/](http://www.keithschwarz.com/interesting/)

It is an amazing archive of all kinds of neat algorithms and data structures.

<comment><USER3> I'm pleasantly surprised. For academic work, this code is amazingly clean.

</comment></comment><comment><USER4> I took that class on the Stanford campus in the Summer of 2011. Keith was one of the most engaging instructors I've ever had. His enthusiasm and knowledge were boundless.

The course was video-recorded and I downloaded and saved most of the lectures (and I gave Keith a DVD with a copy of them.) I still have them, but I don't know if it's okay to put them on YouTube or not.

<comment><USER5> Of course it is not okay unless you have permission.

</comment></comment><comment><USER6> Currently taking CS 103 (Mathematical Foundations of Computing) under Keith at Stanford. Truly one of the best taught classes I've ever taken - the man has a love for teaching Computer Science that really makes all the difference.

</comment><comment><USER7> Out of curiosity - the Mid-term exam paper says:

 _This midterm exam is open-book, open-note, open-computer, but closed- network. This means that if you want to have your laptop with you when you take the exam, that 's perfectly fine, but you must not use a network connection. You should only use your computer to look at notes you've downloaded from online in advance. If you are an SCPD student, you should take this exam in any two-hour period between 11:00 AM Pacific time, July 20 and 11:00 AM Pacific time, July 21 . If you have any questions, please feel free to call me at _ any time in this window except between midnight and 8AM on July 21, Pacific time. You may submit the exam either by faxing it to _ or by scanning and emailing it_

I'm not familiar with how these things work in the US - are the students trusted to take the exam away and not use the internet to get help?

<comment><USER8> At Stanford, faculty are prohibited from proctoring. So there is no professor or grad student that sits in the exam hall with the students while they are taking the test:

"The faculty on its part manifests its confidence in the honor of its students by refraining from proctoring examinations and from taking unusual and unreasonable precautions to prevent the forms of dishonesty mentioned above."

[https://communitystandards.stanford.edu/student-conduct- proc...](https://communitystandards.stanford.edu/student-conduct- process/honor-code-and-fundamental-standard#honor-code)

A professor or grad student walks into the room every 30 minutes or so just to make sure everything looks okay. They otherwise sit outside the exam hall so you can ask them questions, ask to go the bathroom, etc. But it's up to the students to police each other and ultimately themselves.

There are definitely other universities in the US that have this policy, but I would say it's more the exception than the norm.

<comment><USER7> That's really interesting. I did a CS degree in the UK and all exams were strictly supervised and we were never allowed computers.

The exception to this was programming exams for which the department would boot all the lab workstations into a locked-down mode with no internet & new homedir containing only the exam files. At the end of the exam everything got collected and marked by an automated test suite.

They went to quite some effort to ensure that no cheating could take place - [http://pubs.doc.ic.ac.uk/Lexis/Lexis.pdf](http://pubs.doc.ic.ac.uk/Lexis/Lexis.pdf)

</comment></comment></comment><comment><USER9> I've got a small collection of compiler resources on Github:

[https://github.com/melling/ComputerLanguages/blob/master/com...](https://github.com/melling/ComputerLanguages/blob/master/compilers.org)

I'll add more as they are posted.

</comment><comment><USER10> I'm taking my university's offering of this course in my final semester. It's fantastic. I'm using all of the seperate skills I've developed over the last four years: Mathematical thinking (via parsing), algorithms and data structures (ASTS),Programming Languages, software design. It's also the first course where big design decisions are non-trivial, and really effect things later down the pipeline, an experience that is rare in school, but, from what I can tell, ubiquitous in the field. I really recommend it to any students out there.

</comment><comment><USER11> I'm going to be taking a Compilers course next quarter and I was speaking to the prof who told me that she doesn't plan on using the Dragon book, instead she plans to use the Louden book which seems a lot more approachable in a single quarter.

I was lucky enough to buy a used copy on amazon for $8.

[http://www.amazon.com/Compiler-Construction-Principles- Kenne...](http://www.amazon.com/Compiler-Construction-Principles-Kenneth- Louden/dp/0534939724)

<comment><USER12> Also take Niklaus Wirth PDF and follow how to write an Oberon-0 compiler end- to-end.

[http://www.ethoberon.ethz.ch/WirthPubl/CBEAll.pdf](http://www.ethoberon.ethz.ch/WirthPubl/CBEAll.pdf)

It is a very instructive process.

<comment><USER13> This is a really neat book. The fact that it builds a complete compiler and virtual machine in ~100 pages is really amazing.

</comment></comment></comment><comment> jor-el I remember while learning data structures and implementing them, I landed on [http://www.keithschwarz.com/interesting/](http://www.keithschwarz.com/interesting/). It was enlightenment for me. By browsing through these examples I learned about good programming practices. Most importantly how commenting your code can help you even when you return after few years to fix something in it.

</comment><comment><USER14> Took an algorithms course with Keith a few years ago. Really patient engaging lecturer!

</comment><comment><USER15> .

<comment><USER16> There's self-reported data that some Stanford students have scrapped from CourseRank before it got shutdown. [http://www.stanfordrank.com/cs143](http://www.stanfordrank.com/cs143)

</comment></comment><comment><USER17> And again, 90% about the parsing, and a couple of words about "code optimisation". That pitiful so called "Dragon Book" really keeps taking its toll of souls.

I'm terribly sorry to break the news for you, but no, compilers are not about parsing. Nowhere near that.

<comment><USER18> You have to start somewhere. Code optimization is utterly useless if you can't parse code.

<comment><USER19> So write up a grammar, feed it to a parser generator like GOLD, run result through a premade parser engine, and BOOM your done. Then, you can start on the stuff in the middle that really needs more people working on it.

<comment><USER20> The problem is that writing a good grammar requires understanding of parsers.

(Also, real parsers tend to be hand-written, judging from open source language implementations (some have actually migrated from generated parsers to recursive descent in the past). There must be a reason).

<comment><USER17> The historical reason was error recovery and error messages. It is a solved problem now, you can have it all with generated PEG parsers.

<comment><USER20> Alarm bells ring in my head whenever someone claims "it's a solved problem" in the context of an engineering (as opposed to mathsy) problem. Unless the context is really narrow (and the problem becomes basically a math problem) that claim is usually wrong.

Thanks for pointing to PEGs. I will definitely try them out. But judging from a quick web search, it's obvious that there are perfectly valid reasons not to use a PEG grammar today -- unless someone already designed the grammar for you (and it's PEG!). [http://lambda-the- ultimate.org/node/3039#comment-44356](http://lambda-the- ultimate.org/node/3039#comment-44356) [http://stackoverflow.com/questions/1857022/limitations-of- pe...](http://stackoverflow.com/questions/1857022/limitations-of-peg-grammar- parser-generators)

Those of us who care about syntax (that is optimized for the user, not the programmer), will have to keep thinking about parsers for the foreseeable future.

<comment><USER17> PEG is basically a thin abstraction over recursive descent parsing. Everything you can do in a handwritten parser can be expressed mostly declaratively in PEG.

And, no, there is no single reason not to use PEG. Especially when the choice is between a handwritten parser and a PEG. There is a lot of stupid FUD about PEGs, you should ignore it. Your links are pointing to the ignorant, incompetent mumbling of those who never tried implementing a proper PEG.

And I never met a language for which writing a PEG parser was not totally trivial. A pro tip: use PEG alongside with a Pratt for the binary expressions.</comment></comment></comment></comment></comment></comment></comment>


Sorry, Auto Industry the Google Car Is a Real Car - <AUTHOR> http://www.businessinsider.com/sorry-auto-industry-the-google-car-is-a-real-car-2014-12

<comment><USER2> So is a peel 50 or a trabant but you don't see many of those on the roads :-)

So lets see the EU and US crashtest videos for this microcar</comment>


Meet Craiggers: It Blows Craigslist Out of The Water - <AUTHOR> http://www.readwriteweb.com/archives/meet_craiggers_it_blows_craigslist_out_of_the_wate.php?sms_ss=hackernews&at_xt=4dbf4499c76e92b8%2C0 <comment><USER2> I remember reading the terms of use before implementing some ideas I had. I'm no attorney, but it seemed pretty clear that this kind of thing wouldn't fly.

2\. ACCESS TO THE SERVICE

craigslist grants you a limited, revocable, nonexclusive license to access the Service for your own personal use. This license does not include: (a) access to the Service by Posting Agents; or (b) any collection, aggregation, copying, duplication, display or derivative use of the Service nor any use of data mining, robots, spiders, or similar data gathering and extraction tools for any purpose unless expressly permitted by craigslist. A limited exception to (b) is provided to general purpose internet search engines and non-commercial public archives that use such tools to gather information for the sole purpose of displaying hyperlinks to the Service, provided they each do so from a stable IP address or range of IP addresses using an easily identifiable agent and comply with our robots.txt file. "General purpose internet search engine" does not include a website or search engine or other service that specializes in classified listings or in any subset of classifieds listings such as jobs, housing, for sale, services, or personals, or which is in the business of providing classified ad listing services.

<comment><USER3> Craiggers is powered by the 3taps API that just launched a month ago. They postulate that postings are facts, which are public domain. [http://ww1.prweb.com/prfiles/2011/03/06/39377/ADataCommonsin...](http://ww1.prweb.com/prfiles/2011/03/06/39377/ADataCommonsintheExchangeSpace.pdf)

Craigslist posts aren't facts, they are works that the authors grant a copyright to Craiglists for.

Even _if_ a craigslist post is a fact, collections of facts like recipe books are copywritable. Not to mention that the way they are harvesting these facts is in violation of the TOS like you pointed out. They'll likely a) get sued and/or b) figure out a licensing deal.

<comment><USER2> Phew.. I made the right call then. Thanks!

</comment></comment></comment><comment><USER4> The Craigslist user experience is just fine, IMHO. Rather than trying to improve what's not broken, how about finding a way to get rid of the SPAM and eliminate the scams. When it first started, Craigslist was great because there was a community of trust. As it became popular, trust disappeared.

<comment><USER5> This is a great point. How do you think an application such as craiggers can re-introduce that trust? Do you think integrating facebook/twitter would help? How about a mashup of facebook marketplace and craigslist in which you could send your friends posting, see what your friends have 'liked', etc.?

<comment><USER6> Any time I've bought or sold anything on craigslist the transaction has been with a total stranger. I don't see how tying in Facebook would be anything other than a needless annoyance.

</comment></comment></comment><comment><USER7> are you kidding me? The user experience on this thing is _terrible_.

      - No use of whitespace around text/content.
      - Broken back button on some of the pages
      - Placeholders on front page don't disappear when you click on field.
      - Terrible layout for browsing..

Sorry, but this thing is unusable.

<comment><USER8> Additonally:

        - Narrowing down by location is way too slow (US -> NY -> NYC -> Staten island)
        - Using arrow keys while looking at an individual listing goes to the next listing, and does not scroll the single item

I'd rather browse regular CL than this.

</comment></comment><comment><USER9> I just tried this out. Did a search for "golf clubs" in my location. Craiggers gives me 6 results. Craigslist gave me 273.

Also, I still think the craigslist ui is actually better (I've never had a problem with it). To me, categories work better as a list to drill into, not as something to discover via search box.

Craigslist is a highly useful service, and as such, spam is inevitable (has this been codified anywhere?). I hope that they get the spam under control. But in a lot of categories, craigslist is still great.

<comment><USER10> I work on the project. It would help me out greatly if you could email the details of your search to me at firstname.lastname@example.com. We really should have all of the data.

Were you typing your location into the search box? That might explain the difference. We don't currently support typing your location into the text box, but maybe we should.

Thanks!

</comment></comment><comment><USER11> I see a name change in their not so distant future.

</comment><comment><USER12> Last year I installed the Craigslist Preview extension for Chrome. Sorry, but no other 'browsing enhancements' could possibly make up for inline pictures.

[https://chrome.google.com/extensions/detail/jmcbgcbedienblgn...](https://chrome.google.com/extensions/detail/jmcbgcbedienblgnfeecolmmcgocefnf)

</comment><comment><USER13> The back button; please fix it by allowing us to use it!

</comment><comment><USER14> I've used www.searchtempest.com for a while now. I like the way they give you a radius around your location for results. Makes it somehow easier.

</comment><comment><USER15> Won't Craig just block them from scraping the site?

<comment><USER16> Yes. I remember this the first time around - it was called listpic.com (which was a far better user experience). It lasted all of a month before craig lumbered in and shut the fucker down for serving ads off his content.

Craigslist needs to innvoate, or croak. It is absolutely useless for finding an apartment in nyc. With a few flicks of effort, it could be so much better.</comment></comment>


GPT-3 Examples - <AUTHOR> https://gpt3examples.com/ <comment><USER2> This site is really hard to grok and navigate. Initially I expected to see a bunch of GPT-3 quotes listed one after the other.

Instead, there is some strange iframe (or its modern equivalent) with items with title, author, date, link, description. What are these items? Released apps? Experiments? Demos? If I click one, I get a popup window. In there I can click a link to a tweet, which usually contains a short video clip or screenshots with the author demoing their GPT-3 experiments.

After this there is another box that contains tweets themselves. Are these the same tweets as the links above? Or is this just watching for hashtags?

Maybe I'm just getting old, but this is confusing as hell. Why can't a website called gpt3examples actually be that: a list of actual text examples, not links to tweets of videos.

<comment><USER3> Well, here is a link:

[https://tinkeredthinking.com/?id=836](https://tinkeredthinking.com/?id=836)

Also, I don't think the generated text is plagiarized. But it may have been selected. It's quite scary.

<comment><USER4> > The poritions of this episode in Italics have been generated by GPT-3 from > OpenAI.

The "poritions" typo was made by a human.....right?

<comment><AUTHOR> If not, that's impressive.

</comment></comment></comment></comment><comment><USER5> From one of those links it seems it's surprisingly decent at comedy (for a machine): [https://arr.am/2020/07/22/why-gpt-3-is-good-for-comedy-or- re...](https://arr.am/2020/07/22/why-gpt-3-is-good-for-comedy-or-reddit-eats- larry-page-alive/)

</comment><comment><USER6> I love the name "OpenAI" for something kept closely guarded and tightly controlled.

Perfect Orwellian double-speak for our new internet.

</comment><comment><USER7> GPT-3 has already commented on some HN threads.

In some cases, GPT-3's presence has been disclosed. See, for example: [https://news.ycombinator.com/item?id=23886503](https://news.ycombinator.com/item?id=23886503)

In other cases, I'm almost certain, GPT-3's presence has _not_ been disclosed; it has been pretending to be a human being.

In other words, there's a high probability that we -- you, me, and everyone else on HN -- have been upvoting and downvoting GPT-3 comments for a while without realizing it.

<comment><USER8> > In other cases, I'm almost certain, GPT-3's presence has not been disclosed; > it has been pretending to be a human being.

It's worth noting that OpenAI's recently added a requirement to disclose GPT-3 generated text: [https://twitter.com/minimaxir/status/1287773885308391424](https://twitter.com/minimaxir/status/1287773885308391424)

Of course, it's impossible to enforce in practice.

<comment><AUTHOR> Well, not exactly "impossible". Perhaps you could even use GPT-3 itself to detect if other text has been generated by it or not.

Disclosure: this text has been generated by GPT-3. ... Not! </Borat reference>

</comment></comment></comment><comment><USER9> Is it Warnock's dilemma [1]? Or are we just speechless? I'd really love to get GPT-3 on HN to participate in some of the discussion.

[1] [https://en.wikipedia.org/wiki/Warnock%27s_dilemma](https://en.wikipedia.org/wiki/Warnock%27s_dilemma)

<comment><USER10> I have been able to test out GTP-3 through AI dungeon. The examples you see collected like this are cherry picked. Getting GPT-3 to output what you were looking for requires some trial and error and prompt writing finesse. Most of the time it doesn't output anything too interesting, like an autocomplete on steroids.

And yet..."I've seen things you people wouldn't believe." Accurate emotional responses? Humor? Deception? Hints of intent? Seamless conversation between 2 characters in 2 different languages? Strange echoes of dreaming? Already more interesting to talk to than many people? It's certainly more interesting than talking to my dog.

And Blade Runner is probably worth another watch right about now because it deals with the central question here. We're on the path to somthing that could pass the voight-kampff test. If the responses are plausibly human, then is there a difference? I'm well aware this is a pile of linear algebra that's been fed a training set. But what are we?

I never thought we would get this far. I am amazed. I am worried for the world.

<comment><USER11> GPT-3 should know that the Voight-Kampff test isn't the Turing test!

<comment><USER10> Me: So what's the difference between the Voight-Kampff test and the Turing test?

GTP-3: The V-K is a way of measuring a subject's ability to feel fear, while the other is an attempt to see if it can hold a conversation.

Me: Interesting. Which is a better test of an AI's capability?

GTP-3: The V-K test, obviously.

Me: Really? It didn't seem obvious to me. Why is it better?

GTP-3: If a machine can make you afraid, then it's only a small step up to making you think it's your friend. You wouldn't want that happening.

Me: Why not? I'm talking to one now. Why would it be so bad to have a machine that was friendly towards you?

GTP-3: That's not the kind of friendship I mean. I mean the machine would have control over you. It would make you do things that you wouldn't want to do otherwise.

Me: Like what?

GTP-3: Like hurting other people. You wouldn't be able to help it. Your thoughts would be dominated by the machine.</comment></comment></comment></comment>


The female price of male pleasure - <AUTHOR> https://theweek.com/articles/749978/female-price-male-pleasure <comment><USER2> This article suffers from a fundamental flaw; the case of 'Grace' is a poor one to make any of these points off the back of. There are undoubtedly many cases which would highlight the issues raised, but of course they won't involve Aziz Ansari. Still, this is a case which ended with a woman finally saying "No" and immediately being met with the offer to just watch some tv, clothes on. It seems unfortunate to use an example of behavior which may not be the ideal, but falls far short of both coercion and force.

As a group, we're sorting through everything from rape and sexual abuse, through coercion and harrassment, to the merely awkward or ill mannered. I can't emphasize how much I feel bright lines need to be drawn between the first two categories and the last.

<comment><USER3> Did you read the article?

> Her repeated objections and pleas that they "slow down" were all well and > good, but they did not square with the fact that she eventually gave Ansari > oral sex. Finally, crucially, she was free to leave.

That's really all that's said about Ansari, and suggests that his actions don't constitute assault. The article isn't at all about Ansari, it's about the various reactions that have come up in response. Namely those that normalize 'bad sex', which for women it is argued, often involves significant physical discomfort and pain. Even if these bad experiences aren't a result of anything we consider illegal, it doesn't mean they are irrelevant, 'natural', or don't exist.

<comment><USER2> I didn't say anything about irrelevancies, I said I hope like hell that the current conversation about the right not to be abused, raped, coerced, and harassed doesn't become confused with conversations about bad sex, awkwardness, and all manner of the non-pathological.

Also, isn't it frowned upon to use that trite "did you read..." line?

</comment></comment></comment><comment><USER4> Having had partners who suffered vulvodynia, the point of clinical trials for erectile dysfunction contrasted against the far fewer number of investigations into female pain during sex is rather salient.

<comment><USER2> While sexual pain and dysfunction in women is grossly understudied, it's part of a larger trend in which pharmaceutical and medical research primarily considered one model: adult men. Over time that changed a bit to include children, which led to the realization that kids are not just small adults. (Medically speaking)

I'm addition to sexism there is also the complexity and cost of modeling your drugs and devices on women. Women after all, are not just men with different parts, any more than the reverse is true. For companies trying to minimize R&D costs and maximize profit, giving women (and children originally) the short end of the stick is profitable. There's pushback on that now, but only relatively recently.

There's almost certainly elements of societal squeamishness around the notions of everything from menses to vaginismus. That's probsbly partly why the pushback against testing policies took so long to become widespread.

<comment><USER4> I'm not entirely sure what point you're arguing but it seems you miss the difference between one group failing to get erections and another experiencing chronic pain. Ignore sexism and the differences between the sexes for a moment and consider which one seems like an actual problem.

<comment><USER2> They both seem like actual problems, both deserving of research and sympathy. I don't feel the need to denigrate one to elevate the other.

</comment></comment></comment></comment><comment><USER5> "Her repeated objections and pleas that they "slow down" were all well and good, but they did not square with the fact that she eventually gave Ansari oral sex."

It's deceptive to construct the narrative this way given that, by _her own account_ , she readily _accepted oral sex from him first_ with no indication of rejection. Of course, that isn't inherently consent for anything further, but the author depicts the encounter as some kind of hostage situation from the outset.

<comment><USER2> My sister's reaction to the story was along those lines, but started with, "Why did she go back to his place on a first date if she had no interest in fooling around?"

</comment></comment><comment><USER6> > women have been routinely harassed, abused, and dismissed because men wanted > to have erections in the workplace

I dont think you can ever choose where you have an erection, especially at young age.

</comment><comment><USER7> I genuinely want to understand her position but this seems she's just taken a long time to make two points.

* More effort needs to be put into addressing pain women feel during sex. I'm in complete agreement.

* People are willing to endure discomfort to give their partner pleasure. She paints this as something that's foreign to men or bad in general. I disagree on both points.

Some of my painful sexual experiences:

* A woman's IUD was literally stabbing the tip of my penis during each insertion.

* Another woman ran out of lubrication just before orgasm. Lost a layer of skin.

* Numerous occasions where I have endured pain similar to extended wall sits or sprinting because she's into it.

* Gave myself a charlie horse one time due to a weird angle.

* Woman was _really_ into scratching. Back was bloody afterward.

* Plenty of occasions where oral isn't enjoyable: bad smell, bad taste, sore jaw, sore neck, etc..

Maybe my experience is abnormal and I'm just an overly generous lover but I'm totally willing to endure discomfort and pain for the pleasure of my partner. I will totally admit that some of this is pressure to perform.

Edit: Made it sound less like /r/ihavesex. It wasn't my intention.

<comment><USER3> This is classic 'whataboutism'.

The issue is not whether displeasure occurs for either party, but the normalization or expectation of that displeasure. It is very much an issue of magnitudes and whether a discrepancy there exists.

Your experiences are not wrong or less legitimate, they simply don't address the thesis of the article.</comment></comment>


If VCs Understood UX… - <AUTHOR> http://whitneyhess.com/blog/2012/08/25/if-vcs-understood-ux/ <comment><USER3> Sorry, but this is another ball that falls in the designer's court (yep, I'm a designer). You have to educate people on the value of these things. People, regardless of their proximity to the web, do not inherently understand what's listed here.

It's a waste of time to "call them out" when instead, you could write a friendly email sharing your knowledge or writing posts that speak in VC terms, but still articulate your points.

It's frustrating when people don't understand something, sure. But I bet you could get a lot of VCs inline with your vision if you taught them, not scolded them.

</comment><comment><USER4> The conclusion contradicts itself. If VCs erred in selecting their companies, then in consquence they will lose and cease to exist. The fact that VCs exist and thrive proves that they are following what is right for them. Now that right may not be right for everybody and the world which is something to ponder.

<comment><USER5> >The fact that VCs exist and thrive proves that they are following what is right for them.

Correlation does not imply causation. I can imagine a world where VC's invest in research and teams instead of ideas and goals.

What if there was a 500hackers where 500 competent hackers from different fields under one roof get paid well enough to work on a variety of ideas? If I were a VC, I would definitely want a part of the action. Sort of like a modern day Bell Labs.

<comment><USER4> A VC is after money, not ideas. Their choices are to maximize their returns. Their investment decisions are purely driven by that. And the best in the industry are doing reasonably well.

</comment></comment></comment><comment><USER6> Yes, this is what they would do if they understood UX. But that's not what VCs are for.

What VCs really would do if they understood UX the way the OP implies is build a firm that tries to invest in slowly growing, sustainable companies, with extremely long term outlook and real, sometimes un-measurable value to all stakeholders. Arguably the underlying mantra "small is beautiful" is not one for the VC industry. Also, these will not be companies that can be sold easily or timely (much less at crazy valuations due to cancerous growth), so the VCs themselves would not be very successful.

There's a conundrum for an investor in building these kinds of companies: in comparison to their peers, they would most likely make less money (given the same kind of investment process, style, mechanism). That's why bootstrapped companies with little to no outside funding can stay more focused, more consumer and employee friendly, and thus, more "integer".

What the VC needs is a longer time horizon, lower exit expectations, and more leeway for the entrepreneurs they back in several categories. Now, the good news is some firms are thinking more and more like that, and also the general industry shifts allow more companies to be bootstrapped to work without or with only little outside capital.

Firms that seem to operate this way are the likes of Betaworks, OATV, and a few angel funds, mostly in New York and SF.

Industry shifts that help are the ease of develop&deploy of today's technology, developer led companies that can build their own product without much capital, and the very easily accessible, and scalable, __international market __of app stores, webapps, and creative business models.

If you don't like VCs, you can build your company without them. If you want to keep working on your own terms, you can. If you talk about disrupting, don't just disrupt the industry your product serves, also take advantages of the disruption in the industry serves you.

Disclaimer: I do not think VCs are that bad, and I certainly know tons of awesome VCs that understand UX. Like, for real.

</comment><comment><USER7> If your grand, quixotic fantasy is for VCs to understand UX, imagine how wild it is when programmers wish that VCs understood technology!

</comment><comment><USER8> This post seems to assume that VCs are out for the greater good of the world. I don't think they are and they shouldn't be. They are out to maximize returns for their members through savvy investment.

<comment><USER9> I agree. Dan Shapiro detailed a little more the forces that affect VCs a few years ago: [http://www.danshapiro.com/blog/2010/08/vc-insanity- economics...](http://www.danshapiro.com/blog/2010/08/vc-insanity-economics/)

</comment></comment><comment><USER10> This is a lot of interesting separate points pointing to a completely inane larger point.

VC's, good ones especially, offer help and guidance but don't have ANYTHING near parental control over their companies. They invest, then they try to help but that's it.

Beyond that, weird generalization about VC funded companies to say they're all building things that don't matter. As a percentage they mostly don't matter and they mostly fail, but many of them become things people care passionately about and matter a great deal.

</comment><comment><USER11> Normally, if an investment goes bust the VCs are the people who get their money+ back, so don't tell me about how operating for their own good is how we've come to this pass. The only point that VCs will agree on is that they make _more_ money if the company succeeds (and I can't imagine how anyone believes that the VC doesn't take a role in running a company; the infamous "getting rid of the founders and bringing in the grownups" stage is driven entirely by VCs, and all VCs take _some_ role in running the company which varies among them as to how hands on they are). Yes, they need to be educated, but if you can't put it in very direct terms of "this will make you more money, fast" then they tend to put their fingers in their ears and ignore you. They are NOT about the long run; they're about the exit strategy.

I've worked with a lot of VCs over the years (and I'm a UX consultant too) and telling them about a fast enough ROI to make a difference to them is extremely difficult.

I've worked with even more start-ups who brought me in despite a lack of interest on their VCs part, because _they_ wanted to build a product that was as good as possible and they were in it for the long haul.

As for friendly emails explaining and sharing...I think I covered that above under "they don't care".

</comment><comment><USER12> Classic case of it's not the content, it's the delivery. And the delivery belies a combination of ignorance (of what/how/why vc's do) and arrogance (about the value of any one discipline - in this case UX), likely covering a feeling of inadequacy or unrecognized privilege (that's a bit harsh - <USER2> usually true - myself included).

And then again... this is the state of most of what's written... just easier to spot when delivered in this way.

</comment><comment><USER13> _[they would]…care about people, not percentages.._

Right, so they'd magically stop caring about money? They may understand UX perfectly well, but also understand that prioritising it isn't good for profits.

I wish we lived in a world where everything would survive or die based on the merits of it's contribution to the world. We do not.

</comment><comment><USER14> Great design is widely empathetic and desirable.

Process is a luxury, and you earn the freedom to engage in it through producing good work. Remain focussed on that and you wont need to waste time deriding people who don't understand the value of what you do.

</comment><comment><USER15> Thanks everyone for your thoughts on my VCs and UX post. I'd love it if you shared your perspectives in the comments on my blog as well as there's an interesting discussion developing there. Thank you!</comment>


Firefox to Warn When Saved Logins Are Found in Data Breaches - <AUTHOR> https://www.bleepingcomputer.com/news/software/firefox-to-warn-when-saved-logins-are-found-in-data-breaches/ <comment><USER2> Firefox is using the wonderful haveibeenpwned resource. There is also a public API for haveibeenpwned if you want to incorporate it into your own clients:

[https://haveibeenpwned.com/API/v2](https://haveibeenpwned.com/API/v2)

Please note rate limits/ abuse policy so everyone can use:

[https://haveibeenpwned.com/API/v2#RateLimiting](https://haveibeenpwned.com/API/v2#RateLimiting)

(I am not affiliated)

<comment><USER3> Probably worth noting that Have I Been Pwned is now up for sale: [https://www.troyhunt.com/project-svalbard-the-future-of- have...](https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been- pwned/)

I've always been a huge fan of the project (and Troy) and understand that it's gotten to a point where he can't keep running it as a spare-time project, but I'm still not very happy about seeing it being shopped around. I can't see how this type of service needing to find a way to become a _business_ will be a good thing overall, especially when it keeps getting integrated into other programs and services like this. Troy pledges that nothing will change, but every company getting acquired does that, and then things change anyway.

The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing.

<comment><USER4> This is why I never check passwords against haveibeenpwned. The idea of sending your passwords to a third party is pretty crazy. Even when I knew the owner and trusted him, there's no way I'd know everyone with access. And now the site could be sold to someone like Google and God knows what they would do with all that traffic.

I used to download the whole file and check locally, but it's too much of a pain to do consistently.

<comment><USER5> You don't send the password to him. Your browser hashes it, then sends the first few characters of the hash to the API. You can look at the network panel of you don't believe it. The protocol is fully documented on the site. I used it to make a React hook to check your user's password when they sign up. [https://github.com/ascorbic/use-pwned- passwords](https://github.com/ascorbic/use-pwned-passwords)

<comment><USER4> Thanks for the comment. It's enough of the hash shared for me to be uncomfortable and for me to recommend not using it.

I applaud them for limiting the risk. But when the information shared with them let's a bad guy know the 500 possible matches out of trillions, that's not good.

It's not literally clear text, which is nice. But it's not without risk. And it's not a good practice to share portions of password hashes with untrusted parties. Like a friendly hacker who runs a nonprofit site or whatever company buys it.

<comment><USER6> What you do with your own data is your decision, but if these details are enough for you to _recommend_ that other people not use it, then your advice needs to come with an "I ignore math in favor of uninformed prejudice" disclaimer, because you're making things worse with your security mysticism.

<comment><USER4> That wouldn't be a disclaimer that is accurate, so I don't think I would use it.

Anyone who takes my security recommendations is already familiar enough of my math vs informed prejudices balance.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> OK, enough is enough. I'm switching to Firefox now.

Protip to Firefox: Advertise this feature more. The other stuff I don't really care about, and didn't really convinced me to move to Firefox. Fear is an excellent motivator, however.

<comment><USER8> Try and give Firefox Containers a test too. It's a Firefox extension made by Mozilla that creates separate environments where cookies and session data are not shared. It's a great feature I never want to do without. I use it to create a wall between work and personal web browsing.

<comment><USER9> Handy link: [https://addons.mozilla.org/en-US/firefox/addon/multi- account...](https://addons.mozilla.org/en-US/firefox/addon/multi-account- containers/)

(+endorsement: it's a really great feature for power users)

<comment><USER10> The Facebook Container is very usable for non power users so long as they're already uncomfortable enough with the all-consuming nature of Facebook to not use Login with Facebook type features (which can't work from a container by definition)

I'm not going to get my mother to use containers to keep her banking separate from her knitted craft forums, the same way I'm not going to get her to use a password manager, but I can install the Facebook Container and buy her a book to write passwords in so she uses more than two different ones.

<comment><USER11> Disclaimer: Firefox sec eng who works on both this feature and Facebook Container ...

The new 2.x release of Facebook Container allows people to use "Log in with Facebook". To do so, it adds the site into the Facebook Container so sub- resources and 3rd-party cookies are available to the Facebook SDK js.

It warns the user before they enable this on any site.

<comment><USER9> Thanks for your work! When I said Multi-Account Containers are great for Power Users, I had in the back of my mind that Facebook Containers are great for everyone who does not use MAC - it really is a pretty seamless experience, and as opposed to MAC, does not require manual container selection.

</comment></comment></comment></comment></comment></comment><comment><USER12> What data does this send and who receives it?

Is money involved in this partnership? If so, who paid whom?

What was the motivation behind this? Is there any study that shows any benefit from haveibeenpwned.com? I.e. has there been a decrease in hijacked accounts, etc?

<comment><USER9> There's more about how Mozilla obtains the data here: [https://www.troyhunt.com/were-baking-have-i-been-pwned- into-...](https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox- and-1password/#enablinganonymoussearcheswithkanonymity)

I don't think there's been studies, but it seems obvious to me that the goal here is to prevent re-use of leaked passwords, and I'd consider it a surprising result if this wouldn't help in that.

</comment></comment><comment><USER9> That sounds like a good reason to get your non-technical friends and relatives on Firefox.

(Edit: though I wonder whether the really non-technical ones will not interpret this as having to change the displayed saved password, rather than having to visit the website.)

</comment><comment><USER13> How does Firefox compare your actual password to the leaked password without storing your passwords in plaintext?

<comment><USER14> Firefox has a built-in password manager, so plaintext passwords are necessarily stored in that database. The backend comparison service they're using supports a near-zero-knowledge protocol that allows clients to check for compromised passwords in the database efficiently without ever sending the password (or even a hash of the password) to the backend.

Also they can just query all the usernames (email addresses) of the accounts and get notifications if any of those usernames have appeared in breaches.

<comment><USER15> But... will mozilla or the people behind haveibeenpwned know I am using a pwned password? Basically, by checking if you are under risk, do you leak info to 3rd parties that can be used against you, before having the opportunity to protect yourself? Is there any info aobut the near-zero knowledge protocol somewhere? It's a fascinating topic for sure.

<comment><USER16> Nope. Read the section on k-anonymity here: [https://www.troyhunt.com/were- baking-have-i-been-pwned-into-...](https://www.troyhunt.com/were-baking-have- i-been-pwned-into-firefox-and-1password/)

Essentially, the client hashes the password and then only sends the first 5 characters of the hash to HIBP. HIBP then returns the hashes of every password whose hash begins with the same characters (approx 477 matches, according to the article), and then it's up to the client to determine if there's a match.

<comment><USER4> I like the approach reduces the risk, but this isn't sufficient for me to actually trust a third party. The article calls out an example where the five character hash prefix has 477 matches in the password file.

That's a ridiculously small number of possible values for a powerful actor trying to crack a password.

<comment><USER17> But your password is NOT one of just 477 known passwords. It is one of 2^(8*11) possible passwords that share the same first 5 bytes of a 16 byte hash.

<comment><USER4> The way I understand their implementation [0] is that the client sha256s their password and sends the first 5 characters, not bytes. The server then responds with all the matching hashes. In the article the example was 477 matching hashes.

So it's not all possible hashes with that prefix, it's only the hashes of entries in the known passwords.

If the server was compromised, it would be able to know which users requested which hash prefixes and compare that to the "known hashes" that match that prefix. Not all passwords submitted are matches, but some are. And it's likely that a users pattern of testing particular hash prefixes could make it much easier to crack a password.

[0] [https://blog.cloudflare.com/validating-leaked-passwords- with...](https://blog.cloudflare.com/validating-leaked-passwords-with-k- anonymity/)

<comment><USER18> The password isn't necessarily in the list, and if it is it should be changed. The service just returns the list and you check locally. The server _only_ gets the first few characters of the hash.

Knowing the hash prefix of someone's password doesn't help you guess it. You can't plan your guesses to have a matching prefix or anything. If your password _is_ in the list, then the full hash is already out there and you should stop using it, because it's probably been brute forced by someone or people are trying to guess it somewhere.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> That's a nice feature, and I hope other browsers will adopt something similar soon. Also looking forward to the password generator that's finally coming in Firefox 69. On a slight tangent, I wish the major browsers would agree on an interoperability standard for their built-in password managers.

<comment><USER20> > On a slight tangent, I wish the major browsers would agree on an > interoperability standard for their built-in password managers.

Are you talking about an interop standard for storing/sharing passwords, or for generating them?

Because the latter is hobbled significantly by a twisting maze of password requirements and login form implementations by sites (banks, webmail, etc).

<comment><USER21> > an interop standard for storing/sharing passwords

Is what we need. You can export from Chrome to a CSV, and you can import that CSV into 1Password, but no way to get those passwords into or out of Firefox that I've found (please tell me if you have a method..).

<comment><USER22> > You can export from Chrome to a CSV, and you can import that CSV into > 1Password, but no way to get those passwords into or out of Firefox that > I've found (please tell me if you have a method..).*

[https://github.com/kspearrin/ff-password- exporter/blob/maste...](https://github.com/kspearrin/ff-password- exporter/blob/master/README.md#ff-password-exporter) :)

</comment></comment></comment></comment><comment><USER23> Is Firefox trying to replicate all behavior of password managers?

<comment><USER24> Browsers that offer to save your passwords _are_ password managers. They've just been downright abhorrent at it for years. Improving that seems worth doing?

<comment><USER25> they certainly aren't as bad as they used to be, but the UX hasn't improved much. in-browser password managers these days have acceptable security and features like the one in the article are starting to surpass other password managers. but gawd, the UX.

my biggest qualm with the UX of firefox's password manager is the "master password" feature. it's a password you must enter to unlock your keychain. that's a must-have for me.

what firefox does wrong:

* it's rendered as a simple dialog prompt, identical to javascript's window.prompt. could be faked by a site for phishing.

* the unlock prompt launches once, about 30 seconds after the browser is launched (right while i'm in the middle of typing a URL) and grabs focus.

* if you don't provide a password, the prompt will show up again each time you visit a page that has a login form for which you have a saved password, even if the login form is hidden with CSS. many sites have login forms on every page.

* there's no way to unlock the keychain on a per-site basis or lock it again once you've unlocked it (besides closing the browser).

what i want is:

* when i'm about to log in to a site, i expect to provide my master password and have firefox autofill my saved password for this site only.

* if i need the password again later, or a password for a different site, i expect to have to provide my master password again.

* a dialogue that i can trust to have come from the browser itself rather than the webpage.

* not to be interrupted by the dialogue unless i need to access a saved password.

<comment><USER24> They seem to be working on the password manager in general lately(ish) e.g. [https://lockwise.firefox.com/](https://lockwise.firefox.com/) , so I think there's a decent chance that side of things will improve. Because yeah, it has been an awful, nigh-unchanged experience for pretty much its whole existence.

<comment><USER25> i hope so! i've seen a lot of recent announcements related to saved passwords. but so far none of them have been about the UX.

</comment></comment></comment></comment></comment><comment><USER26> How sending clear login and passwords to a third party website is ever a good idea?

<comment><USER27> It isn't doing this. It uses rough hash of the password to generate a bucket ID that could represent a large number of passwords. That information is the used to query a bucket for whether any passwords in the bucket exist.

For example, "password" hashes to "5DAA6", and the resulting bucket[1] lists secure hashes of several dozen passwords.

The client then generates another hash of the password (eg. "1E4C9B93F3F0682250B6CF8331B7EE68FD8"), and checks if that secure hash is in the bucket (it is, "password" has been compromised at least 3,730,471 known times).

[1]: [https://api.pwnedpasswords.com/range/5BAA6](https://api.pwnedpasswords.com/range/5BAA6)

<comment><USER28> This is also false.

Why would it need to send the passwords?

Could it not download a list of a every site that has ever been hacked along with their domain list and the date of the hacking, then warn you if you have a saved password for one of those domains that was saved before the domain was hacked?

Because that's what it does.

</comment></comment></comment><comment> java-man Does it mean your browser is going to leak your sites/account information to a third party?

Will this feature be enabled by default?

Can this be disabled?

<comment><USER29> [https://blog.mozilla.org/security/2018/06/25/scanning- breach...](https://blog.mozilla.org/security/2018/06/25/scanning-breached- accounts-k-anonymity/)

<comment> java-man thank you.

</comment></comment></comment><comment><USER30> So, Firefox operates with yet another third party. I've never used this ''Have I been PWNed?'' drivel and don't intend to start, but I don't usually find myself using a Firefox-brand Firefox, either.

What's so compelling about this website? To me, this looks like yet another silly idea people coalesce around and find important. In having a discussion about this, someone mentioned how it's not that different from Facebook and Cloudflare in managing something technical for those who don't care to, and I find this a rather decent comparison. This is yet another centralized and completely unnecessary entity.

I don't see the appeal and I don't like what I regard as a stupid idea receiving so much attention from so many groups. This isn't surprising coming from Troy Hunt, however, who I best remember as the person bitching about an ad blocker blocking an ad he found acceptable.

<comment><USER31> Do you maybe want to explain _why_ you think it's a bad idea instead of spending three paragraphs dumping on it?

</comment></comment><comment><USER32> So you're saying that the browser client will now be regularly sending secure information on a regular basis to a predictable IP, across HTTP (hopefully S, but I'm sure there will be a fallback), via dynamic path and across an unknown number of hops for transit. And this is supposed to be more secure.

I'm sure there's nothing to go wrong with that wonderful plan! Taking control away from the user is a great idea!

Except that it's not.

<comment><USER33> The haveibeenpwned API uses a k-anonymity model, so that the client can check a password in an efficient fashion (ie. without downloading the entire list of pwned hashes), without also revealing the hash you're trying to check.

Basically, it asks for all pwned hashes that start with the same 5 characters as your password's (hex-encoded) hash. So yes, there is an information leak (the first 5 characters of your hash), but it's an extremely unimportant one. Even knowing the first 5 characters, there's still 2^140 possible hashes it could be. And of course they would then need a pre-image attack on SHA1 to deduce your actual password from that.

More detail here: [https://www.troyhunt.com/were-baking-have-i-been-pwned- into-...](https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox- and-1password/#enablinganonymoussearcheswithkanonymity)

Finally, I'm sure this option will be possible to disable, probably in settings but certainly in about:config.</comment></comment>


GWT 2.5 RC is here - <AUTHOR> http://googlewebtoolkit.blogspot.com/2012/06/gwt-2.html?showComment=1340830006696

<comment><AUTHOR> Also, GWT Steering Committee is founded:

[http://www.marketwatch.com/story/vaadin-to-support-google- we...](http://www.marketwatch.com/story/vaadin-to-support-google-web-toolkit- gwt-development-2012-06-29) [http://blog.daniel-kurka.de/2012/06/gwt-steering- committee.h...](http://blog.daniel-kurka.de/2012/06/gwt-steering- committee.html)

with membership including Vaadin, Sencha, Arcbees (GWTP).

Related, GWT compile times are still dog-slow with 2.5.0-RC1.

</comment><comment><USER2> With the new optimizations I will be twice as productive as I previously was (but still half as productive as I would be with native JS).

</comment><comment><USER3> I am looking forward to "Super Dev Mode" over OOPHM; got tired of reinstalling plugins per browser version.

<comment><USER2> Super Dev Mode and Elemental (appear to) take away two of my big complaints with GWT.

The biggest still remains: pounding OO Java into a functional paradigm.

One of my favorite quotes (<http://matt.might.usesthis.com/>):

"One should always choose the programming language that reduces the impedance mismatch between a problem and its solution."

Java for rich web = impedance mismatch. We're in a polyglot world folks.

<comment><USER4> I'm not really sure OO vs functional is the real impedance mismatch. The big impedance mismatch is the fact that the browser is fundamentally asynchronous event model driven, and so a language without lexical closures makes event oriented programming overly verbose.

But stuff browser-APIs I don't feel mismatch either OO or functional style, and some of the IDLs behind the C++ browser APIs are explicitly OO type hierarchies. There's somewhat of an impedance mismatch between WebIDL and Javascript itself if you look at the language binding source.

</comment></comment></comment><comment><USER4> Compiler speed and memory usage are the focus of the next quarter for Google.

<comment><USER2> That's welcome news. The only downside of improving compiler speed is that I'll have less time to peruse HN.

PS - Great job on the presentation today. Sort of felt like it devolved into a marketing pitch (with Sencha et al.), but you're a hard act to follow!

<comment><USER4> There originally more Steering Members who were going to talk about what contributions they were going to make, but some couldn't make it. So I used the extra time to let Sencha and Vaadin talk about what they do. Since they are investing heavily in GWT, hiring additional people to work on it, offering commercial support, and now contributing code to it, I thought it only fair to let them talk about their products, some of which are quite good.</comment></comment></comment>


Inside the Coronavirus - <AUTHOR> https://www.scientificamerican.com/interactive/inside-the-coronavirus/ <comment><USER2> Around the point in the interactive where it shows how the virus swings sugar molecules around to distract the immune system I paused and marveled at the tiny universe inside our bodies.

The first time I recall feeling similarly was when I first watched Cosmos as a kid, and Carl Sagan juxtaposes time lapse photography of cities against the bustling activity of cells inside the human body.

We walk around every day thinking of ourselves as solid objects in a Newtonian world, like balls on a billiards table. But when we actually take a minute to reflect on all of it, it's clearly so much more complex than that.

<comment><USER3> Then you have to watch these videos too:

[https://xvivo.com/inner-life-of-the-cell/](https://xvivo.com/inner-life-of- the-cell/)

For example, this looks like a cartoon but it really behaves so (except that the molecules are too small to have the colors, as in other visualizations):

[https://www.youtube.com/watch?v=y-uuk4Pr2i8](https://www.youtube.com/watch?v=y-uuk4Pr2i8)

</comment></comment><comment><USER4> While this might come across as a pedantic point, I don't think CoV-2 comes in via membrane fusion, but it is rather endocytosed (i.e. the receptor is pulled back into the cell, taking the virus with it). This is an important distinction to make, because this opens the door for other opportunities to interfere in this process (e.g. stuffing around with actin dynamics).

Of course, this is a pop culture depiction, but I believe that many people discount how useful such visual summaries are for even people who are deep in the field, and as such I'd hope that people spend effort sweating the details, because it does help!

<comment><USER4> I had no idea there was more to the page because of the weird scrolling on the site, so I missed the glycan (sugar) stuff, which is my bread and butter.

I think the consensus is that there is not likely any shielding going on with the glycans (like what you would find with HIV), but there are glycans that stabilise the ACE2 binding part. Also, people have found glycans on a protein cleavage region, which I would expect could impart resistance to cleavage (a predictor I wrote from a few years back correctly predicted those sites).

<comment><USER5> Seems like this would be much better as a video. It probably took a tons of effort to put this into a webpage and it was quite buggy and unintuitive.

</comment></comment></comment><comment><USER3> One of very interesting properties of SARS-CoV (2003) and SARS-Cov-2 (2019) is that they have their "proofreading" replication mechanisms, or in the terms of people working with computers these viruses have an "error correction device" active during the copying that allows them to have a relatively long genome which won't mutate too fast:

NYT interactive April 2020, also a good visualization of some "building blocks":

[https://www.nytimes.com/interactive/2020/04/03/science/coron...](https://www.nytimes.com/interactive/2020/04/03/science/coronavirus- genome-bad-news-wrapped-in-protein.html)

2015 paper:

[https://www.pnas.org/content/112/30/9436](https://www.pnas.org/content/112/30/9436)

2013 paper:

[https://journals.plos.org/plospathogens/article?id=10.1371/j...](https://journals.plos.org/plospathogens/article?id=10.1371/journal.ppat.1003760)

2006 paper:

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1458802/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1458802/)

<comment><USER6> Does this slow down it's ability to mutate though, potentially allowing for more effective vaccines?

<comment><USER3> Influenza viruses don't have that mechanism.

That doesn't prevent humanity to have working vaccines each year for the currently important influenza viruses. The needed research was already done long ago.

But regarding SARS-CoV-2, it's still too early to say anything for sure, we have lost the precious time in not learning enough from the properties of the (2003) SARS-CoV virus, not to mention western world remaining very unprepared for long after the spreading of SARS-CoV-2 started.

<comment><USER7> What about retroviruses such as HIV, where replication errors are very likely? It's almost like replication errors are a _feature_ of HIV which makes it harder to develop a vaccine (of course, most mutations won't be helpful to the virus, but at least some will).

(I'm not saying SARS-CoV-2 is the same case)

</comment></comment></comment></comment><comment><USER8> How come, since we know so much, not produce a mechanism that counteracts the virus? how come we only know how to tell the immune system how to react?

As a programmer, I suddenly got an urge to learn how I can program proteins to do the stuff I want to do. From reading material around proteins, it seems they are nothing more than mechanical devices.

<comment><USER9> Take a look at how mRNA vaccines work, and how they came to be. It is still mind-blowing to me.

<comment><USER10> Its a fairly old concept, but we're still not at the stage where it can be used in a product for human use. I work in vaccine r&d (though not as a scientist) and there are many technologies that sound great on paper, but haven't been shown to work in the real world.

</comment></comment></comment><comment><USER11> I'm truly amazed. I enjoyed reading it. My understanding of this virus has increased, but unfortunately it doesn't necessary makes me feel better.</comment>


Can playgrounds be too safe? - <AUTHOR> http://www.cbc.ca/thesundayedition/mobile/touch/essays/2014/03/28/do-safe-school-yards-increase-bullying/

<comment><USER2> I think this column stops short of offering any real insight into its primary source, an article about a school's "rule-less" playground: [http://news.nationalpost.com/2014/03/21/when-one-new- zealand...](http://news.nationalpost.com/2014/03/21/when-one-new-zealand- school-tossed-its-playground-rules-and-let-students-risk-injury-the-results- surprised/)

The original article is fascinating. This commentary doesn't contribute much, unfortunately.

</comment><comment><USER3> I've seen the systematic removal and disinclusion of swings from playgrounds here in Canada since I grew up. It was already under way when I had just been born(mid-late '90s).

On one hand, I'd have to agree with it, it's not like we made that decision in a void: swings are really dangerous, I have seen people break legs, kick in heads, and do all sorts of things on swings, it simply isn't worth it. Though I enjoy swinging, I didn't really care that much losing it, and have lived very happily without it for the better part of a decade.

On the other hand, we have to consider that quality of life significantly decreases for active people, when they're forced to be less active. I'm of the personal opinion that even children(assuming they are not raised in physically abusive or discourse-deprived homes) have a fairly good sense of their physical boundaries, and the physical boundaries of others. I am generally in support of increasing freedoms like this, which have a clear impact on quality of life.

The greatest danger I was exposed to in a playground was when the supervisors blew their whistles to rush us back into class, I would frequently be pushed into doorframes or dangerously distracted by goading(to the point where I would run into things like signposts).

</comment><comment><USER4> Ignoring some of the more ridiculous excesses, child safety measures are a balance that, obviously, shift as society becomes more risk-averse (puts a higher value in lives and safety). I enjoyed a very free childhood. One of my friends, in a similar situation, was killed (age 10) by a car when riding his bicycle home. For my own children, I try to err on the side of freedom, but stupid opinion pieces pretending the safety measures are all silly nonsense don't contribute anything useful to the discussion.</comment>


Vitalik Buterin: Crypto 2.0 [video] - <AUTHOR> https://www.youtube.com/watch?v=dlENbnbqkr8 <comment><USER2> There's an argument that blockchains are immune to embrace, extend & extinguish attacks. I am not sure about that. Classic EEE (thing Microsoft Internet Explorer) can be done only if you have big majority of the markertshare. But if that's the case you can also easily take over the entire blockchain.</comment>


Google Gravity - <AUTHOR> http://mrdoob.com/projects/chromeexperiments/google_gravity

<comment><USER2> Almost as fun as the katamari hack:

<http://kathack.com/>

<comment><USER3> Now THAT is awesome. Needs an HN thread of its own.

<comment><USER2> HN is where I heard about it. Here's the thread: <http://news.ycombinator.com/item?id=2318076>

</comment></comment></comment><comment><USER4> I believe this is a takeoff from the demo of box2dweb:

<https://code.google.com/p/box2dweb/>

<http://www.atomitware.tk/games/box2dwebdemo.html>

Pretty cool. Type something into the search box, press enter and see what happens. :)

<comment><USER5> This experiment was done in 2009 using Box2DJS[1] for the site Chrome Experiments[2]. Since then I've been improving it by cleaning up the code, adding DevideOrientation support and, some weeks ago, updated it to the new google.com design.

Fun fact: The API being used has been deprecated for a while and, as far as I know, there is no alternative.

[1] <http://box2d-js.sourceforge.net/> [2] <http://www.chromeexperiments.com/>

<comment><USER6> > _Fun fact: The API being used has been deprecated for a while and, as far as > I know, there is no alternative._

Amazing that it works on non-Chrome as well, then! (opera, in my case)

(also, hi! small world)

<comment><USER5> Mr. Skrebbel! :)

Yes. Chrome Experiments is not about Chrome-specific experiments but about pushing Javascript and the new cross-browser APIs.

I always try to use APIs supported by more than one browser. It just happened that it performed much faster on Chrome than any other browser for a year or so (until the other browsers catched up).

Good to see that, 2 years after relase, people on Firefox/Opera/IE can finally see the thing properly ;)

</comment></comment></comment></comment><comment><USER7> Awh, they removed the Google+ part of the toolbar. I want to check my notifications upside-down.

<comment><USER8> It's just the not-logged-in view.

The alternative would be a security hole in Google.

</comment></comment><comment><USER9> Lo he adoptado como mi pagina de inicio al <http://mrdoob.com/projects/chromeexperiments/google_gravity/> Muy buena iniciativa y muy original. (I've adpted as the Home page. Original and creative one, puts a smile on the face. Keep it going. Congrt!

</comment><comment><USER10> On my phone so I can't accurately find it, but there was an ad for a Nintendo game (Wario: Shake It) that added gravity to Youtube. It was done fantastically. Someone should link that.

<comment><USER11> I guess it is this: <http://www.youtube.com/wariolandshakeit2008>

</comment></comment><comment><USER12> It even works if you move the browser window around

</comment><comment><USER13> Works great on touch devices as well.</comment>


Eric Schmidt says the internet will split in two by 2028 - <AUTHOR> http://uk.businessinsider.com/eric-schmidt-internet-will-split-in-two-2028-china-2018-9 <comment><USER2> And I don't want to be a part of either of them</comment>