Silicon Valley Decides It's Just Too Hard to Build a Car - <AUTHOR> https://www.bloomberg.com/news/articles/2016-10-25/bill-ford-to-silicon-valley-the-future-of-cars-is-in-detroit <comment><USER2> The Submarine giveaway here was the zero mentions of Tesla. They had quotes from a Ford family member but none from someone at one of the "tech" companies. I really struggle to feel like the news gives me a good understanding of the reality of the situation.

<comment><USER3> Yes, how is Tesla not Silicon Valley? Bloomberg used to be a great news source, but it has deteriorated sharply.

</comment></comment><comment><USER4> I suspect that the car industry's troubles with hiring software engineers as mentioned in the article has more to do with leadership in the auto companies. If they have leadership that understand software and software engineering, then they can set up an environment that appreciates the unique environment that software engineers like. They certainly have the financial resources to hire away competent software engineers from other firms.

<comment><USER5> I suspect that their troubles have more to do with the need for software developers experienced in stuff that's not JavaScript or some other "cool" technologies. They probably also require people to read/write and understand software spec documents, something most software devs in SV can't do.

<comment><USER6> I imagine it definitely has something to do with it. When I'm looking for a web dev I get 3+ CV's / day. When I'm looking for someone to help with my end of things (imaging device design and computer vision)... Well, I'm still looking and it's been two years.

<comment><USER4> People with these skills _do_ exist. Perhaps it has something to do with your location. For instance, your name is EpicEng, which _might_ mean that you work for Epic, the large medical record company in Wisconsin. Epic is not located in an interesting place or a place conducive for career growth with other companies, in contrast with say, SV, NYC, Boston.

Alternatively, if it is important enough to the firm, they should be offering significantly more money than they are.

<comment><USER6> Oh, sure, they're out there. I work in SD, so we do have access to talent (though we also struggle competing against SF.) My problem has been finding someone who is a software engineer first, e.g., not solely an academic type. We need them too as they're the people with depth in the computer vision arena, but I'm looking for someone who understands digital microscopy, image processing and analysis, but who will also write robust, production level software.

It's a bit of a niche and I was fortunate enough to be exposed to it early in my career.

</comment></comment></comment></comment></comment><comment><USER7> TLDR; The article is not only void of any new information but also falsly claims that Google has given up on manufacturing its own self-driving car without citing any sources[1]. Then it goes on to get quotes from "experts" asserting that building cars is too hard outside Detroit. That's basically about it.

Its all bull crap, if you ask me, and potentially paid article by some lobby. If a tiny company called Tesla can build a car out of nowhere, so can others. Although, the risk taking appetite of big tech companies has certainly went down recently and it does remains questionable if they can actually pull off putting car on market.

[1] There has not been any news (like Apple) on Google giving up on car project. In fact as per recent interview, the project is alive and well: [http://www.theverge.com/2016/10/25/13307364/google-self- driv...](http://www.theverge.com/2016/10/25/13307364/google-self-driving-car- design-yoojung-ahn-interview)

</comment><comment><USER8> No car company builds cars from scratch (a few niche players might come close but they are economically insignificant despite the astronomical prices of the vehicles). I have a friend in the industry and his description of car makers is that they are kit assemblers (it's not said disparagingly).

Of course BMW, Mercedes, GM, etc. do a lot of design work but a lot of the parts are either standardised or within the customization range of their suppliers.

This is of course how Tesla managed to get into car making so quickly, by buying as much material and expertise and manufacturing capability from existing suppliers as possible.

If Apple and Google have decided to leave it to the existing big players that doesn't sound like any kind of defeat to me, just recognition that there are organizations that already have the expertise and supply chains up and running available to provide what the market wants.

<comment><USER7> And in fact even _you_ can build your own car. Just search for kit cars. You can make it even self-driving (almost) with hardware like this: [http://www.nvidia.com/object/drive- px.html](http://www.nvidia.com/object/drive-px.html)

</comment></comment><comment><USER9> Tesla, in contrast, is good at building cars, but sucks at safety-critical self-driving systems.

Google has an effort with Fiat-Chrysler to build 100 self-driving minivans. The article seems to have missed that.</comment>


Ask HN: Really simple display ad network software? - <AUTHOR>

Hey everyone, a friend of mine in Miami is looking to do an ad network with an international focus.  He basically wants something like fusion ads (display ads, simple tracking, no payment integration needed either). Is there anything out there similar to openx? <comment><USER2> <http://ikoo.com> check out kalemat

</comment><comment><USER3> Http://Adtaily.com kind of thing?

</comment><comment><USER4> Trafficspaces

</comment><comment><USER5> something like buysellsads?</comment>


Ask HN: Starting a code school for kids. Any advice? - <AUTHOR> I'm starting a coding school for kids in Canada and was wondering if anyone has ideas/experience getting started? <comment><USER2> A few things:

* Ask the kids what they want * Pairs * Small projects (small wins) * Outside mentors (teens, local programmers, etc) * take a page from [https://www.recurse.com/](https://www.recurse.com/) and reimagine it for kids</comment>


Instacart Workers Screwed by the Algorithm Are the Latest Gig Economy Strikers - <AUTHOR> https://www.thedailybeast.com/instacart-workers-sick-of-being-screwed-by-the-algorithm-gear-up-for-strike <comment><USER2> "Heidi Carrico typically made between $600 and $900 each week from the grocery-delivery app. That was several app updates ago."

I had Adsense on my website several years ago and Google changed the algorithm so I went from making $2000/month to around $300..and eventually nothing. Should I have organized and gone on strike?

I never relied on that for my sole income and neither should anyone working for sites like Instacart.

<comment><USER3> In your case you could convince others online to stop using Adsense while you look for another platform.

People will either find out the hard way this is not a full time job, or the company will be convinced to raise wages.

</comment></comment><comment><USER4> I'd assume that IC is running lots of different studies at any particular time, and that pay rates vary by location and by person.</comment>


Computer Science Video Lectures (i just compiled this list) - <AUTHOR> http://freescienceonline.blogspot.com/2009/02/computer-science-lectures.html

<comment><USER2> Great list. Thanks!

Why weren't the old SICP lectures included?

[http://groups.csail.mit.edu/mac/classes/6.001/abelson- sussma...](http://groups.csail.mit.edu/mac/classes/6.001/abelson-sussman- lectures/)

<comment><AUTHOR> because it's like 10th post on computer science lectures. see the right sidebar.</comment></comment>


Issue: Bitbucket relies on the Referer HTTP header - <AUTHOR> https://bitbucket.org/site/master/issues/10726/bitbucket-relies-on-the-referer-http <comment><USER2> Seems fairly clear that this is a Django issue, not a Bitbucket issue. Maybe change this link to point to the equivalent Django bug: [https://code.djangoproject.com/ticket/16870](https://code.djangoproject.com/ticket/16870).

<comment><USER3> So when my car breaks down I should expect Toyota to say "sorry that's a Takata issue take it up with them"?

<comment><USER4> But that's not what happened here at all. Bitbucket has responded explaining why this (self-inflicted) bug exists (a security decision in an underlying framework) and deferred to the framework maintainers for further discussion because they have the best context on why that decision was initially made and under what scenarios it might be changed.

<comment><USER5> They chose to use a framework without understanding the implications of its security issues. When one comes up, they tell their users it's someone else's problem. Maybe they're an impoverished company that can't afford to pay to solve the problem. Or they dont care much.

</comment></comment></comment></comment><comment><USER6> Does anyone know of a good alternative to the atlassian suite? Given their price structure and popularity, I'd expect them to fix stuff like this in a timely fashion, and fix some basic UI issues.

Bitbucket server (aka "stash") examples:

\- Create a pull request (the most common workflow in bitbucket) takes far too many page loads, and is buried in "hamburger"/"more options"

\- For teams with per-developer repos, it does not remember which repos the currently logged in user frequently uses, so you scroll through everone on the team's name for most operations. (And the new version "improved" this in some places with a JavaScript-heavy list that renders like molasses on no-gpu xeon vms).

\- Each product (bitbucket, jira, confluence) uses a different markup language.

And so on. I could complain about other workflows or other products, but this is pretty typical for their stuff.

<comment><USER7> I would be interested to know as well. To add to your list. If you need to scale up to huge intsances it hurts. Repo Clones take huge amount of resources for some reason, and updates require hours of downtime to spin the cluster up again. Aparrently there development team haven't even had a very large instance for test until late 2016 so fixing there issues is likely to take time.

<comment><USER8> Bitbucket product manager here.

Sorry to hear you've been having trouble. What you describe is most definitely unusual so I'd suggest contacting us (or having your admin contact us) at support.atlassian.com so we can look into it.

The team has spent a great deal of effort over the entire life of the product to ensure it performs at scale for broad range of load profiles. The notion that we only recently had a very large instance for test is untrue. Perhaps someone got the wrong idea from our most recent series on how we build Bitbucket Data Center to _already_ support massive scale: [https://developer.atlassian.com/blog/2016/12/how-we-built- bi...](https://developer.atlassian.com/blog/2016/12/how-we-built-bitbucket- data-center-to-scale/)

</comment></comment></comment><comment><USER9> Relying on the referrer header for CSRF protection is dubious at best. Just use a token like everybody else, protect against session fixation, call it a day.

<comment><USER10> They are using a token, just like everyone else... this is just some added protection on top

Let's not spread FUD :)

<comment><USER6> But this isn't added protection. Here is the textbook list of security goals:

\- availability

\- integrity

\- confidentiality

It breaks availability and confidentiality to protect against an attack that is already prevented by https.

This is like installing an open ip cam and welding my padlock shut, then claiming you've improved my storage unit.

<comment><USER10> Have you read the discussion on security.stackexchange.com ?

there's no decrease in availability by an attacker (there's only a self inflicted denial by the user)

there's also no decrease in confidentiality for the service itself (and if the user uses an appropriate extension[0], or the browsers implement an appropriate whitelist mechanism, there's no confidentiality decrease for the user in general either)

This is simply defense in depth

If you leaked the SECRET_KEY/misconfigured the CSRF creation (which should be impossible, but it's the whole point of adding layers) AND the victim is being MITM AND you don't implement HSTS AND You correctly set cookies as Secure

You would have a potential vulnerability, exploitable (only?) via CSRF, which this check prevents

[0] like [https://addons.mozilla.org/en-US/firefox/addon/smart- referer...](https://addons.mozilla.org/en-US/firefox/addon/smart-referer/) but I'm not advocating for the use of this extension

<comment><USER6> So redirecting all port 80 requests to [https://<domain>/](https://<domain>/) (or otherwise kill port 80 on the server).

Then, make sure each page view overwrites / clears any side-effecting session state.

Put another way, why should unexpected cookies change the side effects of post requests?

Anyway, if the browser is connecting via port 80, the MITM can just use a transparent http->https proxy to rewrite the referrer, and forward the request to the https server, so you've already lost.

<comment><USER4> I think you're misunderstanding the attack scenario here:

> Anyway, if the browser is connecting via port 80, the MITM can just use a > transparent http->https proxy to rewrite the referrer, and forward the > request to the https server, so you've already lost.

That wouldn't actually work since the user's active session cookie has the "Secure" flag set (i.e. isn't sent over HTTP). Sure if the user logged-in again on the HTTP page you could exploit this with a transparent proxy but there's very little outside of implementing HPKP that BitBucket could do to prevent that attack.

<comment><USER10> Exactly

But even shutting down access to port 80 on the server wouldn't be enough: the attacker only needs the victim to send the request, it doesn't need for the plaintext request to actually reach the server

(did you mean HSTS instead of HPKP, btw? The scenario I described didn't involve MITM of a HTTPS connection, and thus HPKP wouldn't be strictly needed )

also, I agree that the condition under which this check might be useful are quite convoluted... since Security is often in tension with Usability there is a case to be made for less defense-in-depth, and removing (potentially?) redundant checks... but I think we should be wary of making simplistic arguments for it, due to how delicate web app security is

<comment><USER6> Agreed; killing port 80 just decreases the chances the browser makes subsequent port 80 requests.

I still think the referrer is only helping paper over a deeper design flaw (using cookies to carry post state) at the expense of getting some users to trade privacy for availability, and decreasing performance/opening up attacks for people that install extensions as a workaround.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I really don't think this is a big deal. I run a medium size website with well over 2000 uniques users per day and also require the referer header to use the website. So far, I've yet to receive a single complaint or find a browser that doesn't send it.

It might be optional as per the spec, but it's completely ubiquitous at this point, and provides an easy way to add an extra layer of safety for web developers.

</comment><comment><USER12> Well, you should not post from HTTP to HTTPS anyway.

I highly doubt there is any good reason to do it anywhere, and on the one case you think you got a good reason (I still doubt it), don't try to anonymize the hell out of a logged-on request.

<comment><USER13> From memory when this came up, I think the concern is someone spoofing a non- HTTPS version of your site to trick a browser into posting to the HTTPS version? Someone that understands this stuff properly will need to chime in.

<comment><USER14> It looks like Django relies on client-side tokens embedded in cookies for CSRF protection, there is no server-side state that the attacker has to guess. A MITM can trick someone to visit [http://example.com/](http://example.com/), set their own token in a HTTP cookie for example.com, use the same token in the POST request to [https://example.com](https://example.com) and it will pass validation, as cookies set over HTTP are still sent to HTTPS.

Should be easy to mitigate this by using server-side CSRF state, or signing the tokens.

<comment><USER10> I'm a bit confused... I thought that Django always signed the CSRF tokens with the app's SECRET_KEY

But upon looking at the code, it seems that the SECRET_KEY is only used to reseed the PRNG O_o

[https://github.com/django/django/blob/stable/1.10.x/django/u...](https://github.com/django/django/blob/stable/1.10.x/django/utils/crypto.py#L54-L77)

<comment><USER13> Secret key is used for signing. [https://github.com/django/django/blob/master/django/core/sig...](https://github.com/django/django/blob/master/django/core/signing.py#L156)

<comment><USER15> Unfortunately the csrf implementation doesn't use that. (At least not in the absence of a session store.) It "encrypts" the random token by adding a random salt to it, but has no way of validating that after generation. When a csrf protected request is made the token in the cookie is compared to the token in the POST data, but not validated in any other way.

[https://github.com/django/django/blob/master/django/middlewa...](https://github.com/django/django/blob/master/django/middleware/csrf.py#L50)

I wonder how much of this is just a political issue about the core/contrib division and the fact that csrf is in core while sessions is in contrib. It seems to me that the "right" fix is to make csrf protection require a session store, and move (at least) the signed cookie session support into core.

Edit: Actually it looks like cookie signing is already implemented in core, so now I'm really unsure why csrf isn't using that already.

<comment><USER10> Yeah, weird... I guess that since sessions are enabled by default, they didn't bother making it independent/explicitly requiring it

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> How dare Bitbucket have a bug in their code while the rest of us live and breath standards compliant perfection?

</comment><comment><USER17> Twitter does this. If you filter all referrers, all Ajax requests fail (even posting something).</comment>


Comments in JSON - <AUTHOR> http://fadefade.com/json-comments.html <comment><USER2> There is a interview with the inventor of JSON somewhere. In that interview he explained why he did not allow comments in JSON like in XML. He said - if I remember correctly - that it was intentional to not have comments in JSON. The reason way that comments could be misused to add additional information for a parser. For example in XML you could use comments and a special parser could use these comments to create code while parsing. He did not want that. He wanted every JSON parser to be a JSON parser and nothing more. If you wanted to have comments in JSON he said that you could simply make the comments inline and have a convention for the keys which are comments for example every key ending with _comment could have a value which is then seen as a comment by the application but not by the parser.

<comment><USER3> "I removed comments from JSON because I saw people were using them to hold parsing directives, a practice which would have destroyed interoperability." \-- Crockford

This is horrific design reasoning. It's an authoritarian, presumptuous, "punish everyone in the classroom because one child misbehaves" mentality.

Comments would be useful in JSON _because comments are useful in code, and JSON is code_. For example, I might have a config file that I'm typing in that I want to leave a documentation trail for.

Don't tell me I can do a silly thing like redefine a field, as if it's "neat". It's an abomination that I have to resort to such things. And guess what: by resorting to such things I can still do precisely what Crockford claims he was trying to prevent. So his rationale is not only insulting to one's intelligence, it's sheer stupidity.

<comment><USER4> > and JSON is code

JSON is data. It appears to be JS code, but JSON is data. Data is not code ( [http://www.c2.com/cgi- bin/wiki?DataAndCodeAreNotTheSameThing](http://www.c2.com/cgi- bin/wiki?DataAndCodeAreNotTheSameThing) ). That's why the idea of data holding parsing directives is silly. If you want to do that, then embed that in the data (hold a MsgType key in the data records). There's no need for comments unless you are trying to use it for something other than raw data.

<comment><USER3> Nonsense. This is just more arrogance.

JSON is code because I use it as code. It's not your business to tell me it's not code -- _you haven 't seen how I'm using it_. And don't go chirping that I should only do things your way, it's none of your god damned business what I'm using it for.

Further, if JSON was really only data, then it's an incredibly stupid way to store data, given that it has a human-readable syntax that the computer can only deal with after it's been parsed. As data, it's bloated and inefficient. To the extent that JSON is a good format, it's code. To the extent that it's data, it's not a good format.

<comment><USER5> > JSON is code because I use it as code

You can't use JSON to compute things, therefore it is not code (unless you are willing to concede that any document format is code).

<comment><USER6> > _unless you are willing to concede that any document format is code_

Because it is. Data vs. code distinction is arbitrary. The following sequence of characters:

"echo 'foobar';"

can be interpreted as describing a string, a series of tokens, a piece of code, a piece of music or a small icon, whatever interpretation you choose.

<comment><USER5> Yes, I understand that "code is data". This does not mean that data, in general, is code; unless you are willing to make the words completely meaningless. "Code" requires some notion of an execution platform/environment, which does not exist for arbitrary data. Here is a string: "the quick brown fox jumps over the lazy dog". Or how about "\u0000\u0000". That is not code, as generally understood.

<comment><USER6> > _" Code" requires some notion of an execution platform/environment, which > does not exist for arbitrary data._

Arbitrary data don't exist without some notion of an execution (or interpretation) platform.

We tend to use "code" as a word for "commands telling some execution process what to do" and "data" as a word for "information that is meant to be transformed" but in reality this distinction is meaningless; both are fundamentally the same thing, and even our "code" vs. "data" words have blurry borders. It's very apparent when you start reading configuration files. For example, aren't Ant "configuration files" essentially programs[0]?

We all know what we usually mean in context by saying what is "code" vs. what is "data", but one has to remember, that in fact _they are the same_ \- minding it leads to insights like metaprogramming. Forgetting about it leads to dumb languages and nasty problems, and is generally not wise.

[0] - the answer is: yes, they are, see [http://www.defmacro.org/ramblings/lisp.html](http://www.defmacro.org/ramblings/lisp.html) for more.

ETA:

Questions to ponder:

\- are regular expressions code, or data?

\- is source written in Prolog code, or data?

Also I recommend watching [http://www.youtube.com/watch?v=3kEfedtQVOY](http://www.youtube.com/watch?v=3kEfedtQVOY) to learn how what would be data, as defined by formal grammars of some real- world protocols, can - by means of sloppy grammars and bad parser implementation - cross the threshold of Turing-completeness and become code.

<comment><USER5> I understand all this. Like many people, I've written programs in C++ templates. But I think we're talking past each other because you want to make a pedantic point. I'm using the words as they are generally understood, not in a technical computer science way. I'm talking about first-level stuff, not metaprogramming. Let me give you some questions to ponder:

\- Is the text of _Hamlet_ code?

\- Was it code as soon as Shakespeare wrote it?

\- If not, did it become code once the electronic computer was invented? Or did that happen once a version was stored in a way accessible to an electronic computer?

\- Did all the existing paper copies immediately become code at that point as well?

<comment><USER7> > Is the text of Hamlet code?

> Was it code as soon as Shakespeare wrote it?

Yes, the text of a play is code meant to be executed by humans.

<comment><USER5> That is pretty funny, but not what I was going for :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> jmcdonald-ut I'm sure there are counter points to what I'm about to bring up, but three observations:

1\. In my experience JSON is frequently output programmatically, and taken in programmatically. Comments are not useful in these cases.

2\. The only time comments could be perceived as useful then would be when parsing JSON by eye or hand. However, it is not difficult to parse JSON and understand it unless the keys have used obfuscated names. If key naming is obfuscated, comments aren't really the correct solution.

3\. "An object is an unordered set of name/value pairs", as mentioned by jasonlotito and others earlier. There is no guarantee that a JSON parser will give you the right value if there are two of the same keys in the same scope.

<comment><USER8> Re: #1

I know there is a lot of JSON handling that happens behind-the-scenes, but there is also a non-trivial amount of JSON that I have manually created and/or altered, and have to share with a team.

It's a blessing and a curse, these modern NodeJS projects -- it's awesome that I can simply create/modify a .json file with a few properties, run a command, and magic happens. However, if I want to try and communicate out the intent of the values to my team of 20+, it becomes really convoluted. The projects all magically work by looking for foo.json, but if I comment that file then it breaks.

So I have to create another foo.comments.json, add another script that will remove the comments and then call the original instructions. Then I need to create additional documentation instructing the team to ignore the developer's docs regarding native use, and to run the application with our own homebrew setup.

It also can make testing a pain in the ass, because now I can no longer comment out values, I have to remove them completely. Not a huge deal, annoying nonetheless.

<comment><USER9> Why not adding an object field with identifier a_comment:"blabla..."

The advantage I see in this way of commenting is that the comment becomes accessible inside the program instead of being stripped off by the parser. For the human reader it's also more obvious.

Unfortunately, it's not possible to add comment to anything else than objects. But the OP's proposal as well.

<comment><USER8> Why have comments in code at all, then? You could always just make a variable/constant, with the added benefit that the comment becomes accessible inside the program...

But that makes no sense at all to me. I agree that using comments as metadata/directives is typically an antipattern hack, but what about for non- metadata comments? Embedding comments into code is just as ass-backwards as embedding code into comments. Neither is right.

> For the human reader it's also more obvious.

Strongly disagree here -- if I open a file that I've never worked in before, I have faith that the comments were meant specifically for me. Likewise, I assume all code in the file is _not_ for me (on account that I'm not a compiler/interpreter/etc.).

</comment></comment></comment></comment><comment><USER10> Given the RFC says "The names within an object SHOULD be unique", there's nothing stopping me from writing a parser that takes the first name/value pair and throwing all the others on the floor. Or even better, picks a random name/value pair when the same name appears. Both of these behaviours are allowed by the RFC, and would break this hack.

Putting comments into JSON in this way is a hack and shouldn't be used by anybody who has any interest in writing maintainable software. Relying on ambiguities in an RFC and someone saying "JSON parsers work the same way" is a good way to end up with a really obscure bug in the future.

<comment><USER11> At least in ECMA-262 5, Ch. 15.12.2, there is a NOTE: "In the case where there are duplicate name Strings within an object, lexically preceding values for the same key shall be overwritten."

It still does not feel right.

</comment></comment><comment><USER12> This is misguided. You don't need comments in a JSON config file. Why? Because you don't use JSON for config files that need comments.

JSON is like duc(k|t) tape. It's really easy to stick two things together with it. That doesn't mean you always should. It's the simple thing that gets the job done so you can focus on what matters.

One shouldn't pick JSON for your config files and then hold it up as good design. "Look at me, I'm daring and _not using XML_!" Using JSON is crap design, but good engineering means sometimes picking something crappy and not wasting effort on things that don't matter in the end.

If your configuration files become both complicated and important enough that you need comments, then you should stop using JSON. If your duck tape job starts needing additional reinforcement, then you should probably just get rid of the duct tape and do it right.

If one of your requirements is a sufficiently trendy yet commentable config language, look into YAML. Also, gaffer tape. The white kind is easier to write on.

<comment><USER13> If crap design like JSON is the right engineering choice sometimes (and I agree that it is), that seems like an argument that adding comments in this crappy way may sometimes be the right engineering choice.

<comment><USER14> Relying on undefined behaviour in a parser for comments is something I find quite hard to define as "the right engineering choice" in any situation.

</comment></comment></comment><comment><USER4> The JSON RFC ([http://www.ietf.org/rfc/rfc4627.txt?number=4627](http://www.ietf.org/rfc/rfc4627.txt?number=4627)) says

        The names within an object SHOULD be unique.

SHOULD is defined ([http://www.ietf.org/rfc/rfc2119](http://www.ietf.org/rfc/rfc2119)) as

        3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
           may exist valid reasons in particular circumstances to ignore a
           particular item, but the full implications must be understood and
           carefully weighed before choosing a different course.

Salient point is that you would need to ensure that you are only using JSON parsers that tolerate duplicate names (and use the last value)

<comment><USER14> > Salient point is that you would need to ensure that you are only using JSON > parsers that tolerate duplicate names (and use the last value)

To drive this home a bit more forcefully, it requires knowing the behaviour of your parser where it is marked as "undefined" in the spec.

If that isn't enough to stop you, DON'T USE JSON. A patch level change in a library could break your code in a non-obvious way _and it would be your fault_. If you want comments, DON'T USE JSON, JSON DOESN'T HAVE THEM.

<comment><USER15> Note that if your parser is the ES-standard JSON.parse, then the behavior here is in fact defined by ES5 section 15.12.2, even with duplicate names.

</comment></comment></comment><comment><USER16> This hack, while nice, is still just a work around. I highly recommend that if you can, in as many places as possible use YAML instead of JSON.

JSON works great for on the fly communication with frontends that are running JavaScript, or for communication between JavaScript processes like Node.js servers. But for configuration files and other things that need comments YAML is many times better, both for it's clean, Markdown reminiscent structure, and its native comment support.

Node.js has a great module called js-yaml ([https://github.com/nodeca/js- yaml](https://github.com/nodeca/js-yaml)) which automatically registers handlers for .yml and .yaml files, allowing you to require them in your Node.js code just like you can with JSON files.

It also comes with a YAML parser for the browser side of things, so if you want you could even communicate YAML directly from the server to the client side, although frankly I don't see much advantage to sending YAML over the wire instead of JSON. (And as others have mentioned below untrusted YAML sources could insert malicious objects in YAML, so I wouldn't recommend this technique.)

You can even use YAML for your package.json in a Node program: ([https://npmjs.org/package/npm-yaml](https://npmjs.org/package/npm-yaml))

<comment><USER17> YAML is neat, but library developers have a history of writing unsafe YAML parsers.

There's the famous Rails vulnerability due to YAML. Python needed to add 'yaml.safe_load'.

YAML is a little too rich. It's always one poorly thought out convenience feature away from disaster.

<comment><USER18> And JSON was often "parsed" with eval().

<comment><USER19> That's not really a problem with JSON though is it? Anything you run through eval() is a disaster in the making. Maybe the problem is that people are trying to make data formats too powerful, and too many things seem to be creeping towards Turing completeness that don't need to be.

I think parsers for JSON and Yaml, INI etc should be designed in such a way as to make it impossible to assign anything like an object, class, function, etc. Numbers, strings, and collections of numbers and strings... that's all you should get (though obviously "string" is frought with peril.) Anything more is unnecessarily complex.

<comment><USER20> It is a problem with JSON in the sense that it's a JavaScript subset, 'in practice' \- modulo the Unicode support that goes beyond JavaScript. So it's to be expected that eval() will be used as a convenience by developers, ignoring the security implication that comes will eval() hoisting full JavaScript.

The way to have avoided the issue would have been for JSON to have a grammar that broke eval(). But one could argue the ability to pass JSON into eval() to get JavaScript is one of the reasons JSON became popular to begin with.

</comment></comment></comment></comment></comment><comment><USER21> This would completely break any event driven (streaming) parser.

<comment><USER22> Or a parser that simply discards existing keys.

<comment><USER14> Which, importantly, would be perfectly fine according to the spec (as I understand it).

<comment><USER23> Indeed, the spec states that keys SHOULD be unique (with RFC 2119 meaning) and leaves behavior unspecified in case of duplicate key.

<comment><USER14> My favourite example of dealing with undefined behaviour is this:

In practice, many C implementations recognize, for example, #pragma once as a rough equivalent of #include guards — but GCC 1.17, upon finding a #pragma directive, would instead attempt to launch commonly distributed Unix games such as NetHack and Rogue, or start Emacs running a simulation of the Towers of Hanoi.[7]

Source: [http://en.wikipedia.org/wiki/Undefined_behavior](http://en.wikipedia.org/wiki/Undefined_behavior)

</comment></comment></comment></comment></comment><comment><USER24> My first thought in seeing this was that objects aren't guaranteed to maintain order: "An object is an unordered set of name/value pairs" \- [http://www.json.org](http://www.json.org)

<comment><USER25> There is an intrinsic order in the text though. it's up to the parser to keep clobbering a value every time a new value comes in for a given key.

This seems like a bad idea. It seems heavily reliant on edge case behavior. But hey, might work well for the original author.

<comment><USER14> > it's up to the parser to keep clobbering a value every time a new value > comes in for a given k

Nope, parsers are perfectly in their rights to do whatever they want with multiple keys. They could read them backwards, sort them, whatever. The behaviour in the instance of multiple keys is undefined.

> This seems like a bad idea.

It is an astonishingly bad idea. I'm concerned by it being so high on the page.

> But hey, might work well for the original author.

Depends on their parser. It's undefined behaviour according to the spec. It might work now, but I'd argue it doesn't work well, as a patch level change could bork this.

<comment><USER25> I'm not so sure. I think, JSON falls back to the ecma script standard for specific details. The object initializer semantics seem to force a left to right evaluation order, in the ecma spec around page 65. I'll admit my claim was unfounded when i made it, and I only went to the spec to avoid being wrong :) If I were to implement a JSON parser, I would now feel obligated to eval in order, due to my reading of the spec.

However, I think we wholeheartedly agree, don't rely on this behavior. It is an outright strict mode error.

</comment></comment></comment></comment><comment><USER26> This definitely qualifies for a Zen style thwack over the head with a stick and a reprimand of "stop being clever!"

</comment><comment><USER27> This sounds great until some parser uses the comment definition instead of the value. Is it defined in the spec that parsers need to use the last defined value for a key?

<comment><USER28> Since the order of an object's keys is not guaranteed, it seems like even if a parser respected the last-defined rule, you could still potentially end up with the wrong field last.

</comment></comment><comment><USER29> Can we all just agree, as a community, to add comment support to our JSON parsers? Hell, I'd do a PR on V8 if I knew C++.

It's ridiculous that I can't document notes on dependencies in my NPM package.json, or add a little reminder to my Sublime Text configuration as to why I set some value, because we're using JSON parsers that can't handle the concept of ignoring a line with a couple slashes prefixing it.

IMO - either we add comments to JSON, or we stop using it for hand-edited configuration.

<comment><USER30> Crockford's rationale for not supporting comments is that people use them to add meta data to the object (e.g. type annotations) which makes it hard to consume with different parsers.

<comment><USER29> Trusting the community to do the right thing is better than handicapping your users.

Regardless, of course, people add metadata to JSON already - there's zero reason you can't "_type": "int". It's a completely arbitrary reason.

<comment><USER30> right - but that is valid syntax! any json parser can understand that, and that's what he recommends doing instead. But if you're doing this in comments, you end up writing your own mini language to describe your annotations, and nothing else knows how to parse it. that should clearly be avoided.

<comment><USER31> If JSON had comments, then of course any JSON parser could understand those comments just as well as they can currently understand "_type": "int". What am I missing?

<comment><USER23> That because they're comments specific JSON parsers could (and likely would) interpret processing instructions embedded in those comment to toggle behaviors on the fly. Crockford's fear (founded I think) was that comments would be used to "extend" json.

<comment><USER31> Yes I get that. What I don't get is how "_processing_instruction": "whatever" is any different.

<comment><USER30> when you do

        {
            "_type": "int",
            "foo": "123"
        }

a JSON parser will always know how to represent that object. How you process that object is up to you.

However, when you write:

        {
            // @type int this is a comment
            "foo": "123"
        }

and you call JSON.parse(), what would you expect to get back? You can no longer represent it as a simple object, you need some way to access the comment, how do you do that? Moreover, whose responsibility is it to process the annotation in that comment? the parser's? Should you get back an integer rather than a string for obj.foo? how would you support different types of annotation? What happens if you're using parser A and your client uses parser B? Does parser B support all the annotations that parser A supports? If you need to modify a JSON structure, e.g. JSON decoding, adding a property and re- encoding, should the comments be preserved? ...

You can see that having comments introduces a whole host of other questions, ambiguity and would only make it harder for different platforms to share data. Avoiding this kind of cruft is why JSON is winning vs XML for most things these days.

<comment><USER31> In the eyes of compliant parser (assuming JSON supported comments) it is just a comment like "_type": "int" is just a key-value pair.

However, when using ad hoc parser, then all bets are off what the result is in both cases again, not just the comment case. Regardless of comment support in JSON the same problem appears to exist.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Funny story. JSLint[1] does not approve of this technique. I asked Crockford to implement the duplicate check in April 2009 via email. 20 minutes later, out of nowhere, he was done implementing that check and wrote back "Please try it now."

This guy is fast. Especially nice considering we do not know each other at all.

[1] [http://www.jslint.com/](http://www.jslint.com/) \- JS checking tool from the inventor of JSON

<comment><USER33> I sent him an email once asking for the same JSLint license that he gave to IBM (you know, the one without the "do not use this for evil" clause.)

He responded that he was getting annoyed by everybody asking for this, so it was going to cost me $100K to obtain such a license.

I responded that I only asked for that license in order to annoy him (and thanks for the confirmation that it worked), because his immature license clause is annoying everybody else.

</comment></comment><comment><USER34> Note that these comments would disappear the second you use a JSON-aware tool to manipulate one of these files.

<comment><USER35> You hope it is the comment dupe that disappears and not the field you want.

</comment></comment><comment><USER36> Instead of using tricks that rely on parser implementation behaviors, why not just put an actual comment field in the object?

        {
            "myvalue_comment": "This is a comment",
            "myvalue": 42
        }

<comment><USER37> That example is fine, but you wouldn't want a long comment getting loaded into memory because the parser doesn't know any better.

<comment><USER38> for that matter, just do:

{

      "comment":"this is a comment";
      "value": 45;

      "comment":"this is also a comment";
      "value2": 64;

      "comment":"we like overloading the comment field";
      "stringval":"but these stay the same";

    }

<comment><USER14> Then the parser might fail, and rightly so. A comment lower down shows it failing in a simple parser in go: [https://news.ycombinator.com/item?id=6147478](https://news.ycombinator.com/item?id=6147478)

Keys SHOULD be unique.

<comment><USER38> SHOULD != SHALL

And, no, this scheme doesn't break the go parser because there isn't a typeshift between the "comment" fields, they are all strings.

[http://play.golang.org/p/bxcIIyAeph](http://play.golang.org/p/bxcIIyAeph)

<comment><USER14> Ah fair enough on the break, I was wrong there.

But if the spec says that keys SHOULD be unique, what's the behaviour when they aren't?

<comment><USER38> I would agree it's very hackey and probably not a good idea since the spec is liable to change. But I wouldn't be sad if the spec were changed to allow for this, or to allow for comments.

<comment><USER14> > I would agree it's very hackey and probably not a good idea since the spec > is liable to change

Well it's not really about the spec changing, the spec doesn't have a defined behaviour for duplicate keys.

> But I wouldn't be sad if the spec were changed to allow for this, or to > allow for comments.

I don't think duplicate keys should be allowed, but I've no strong feelings on comments. I don't think there's any real need for them though.

<comment><USER38> I'm biased, back in the BeOS -> Haiku days, I was wanting some sort of configuration textfile that would neatly be able to be parsed into a BArchive object (and presumably transmitted into a BMessage). XML was all the rage at the time, so I wrote for myself a sort of XML-ish format, but I never contributed it to the tree. I learned the problems with XMLs (should it be an attribute or an innerText?). I wanted something with a bracket notation, but JSON had not been discovered by crockford yet, if it had been I would have gotten more involved and tried to have it be adopted.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> Terrible spec-violating hack aside, the idea of the author soliciting upvotes on StackOverflow doesn't sit well with me. I'd hate for SO solutions to become diluted by answers from users who are 'marketing' for upvotes.

</comment><comment><USER40> It is a 'hack' as discussed in the article and I will probably never use it. JSON should be either self explanatory or documented, I don't see any reason why you would add this unnecessary clutter to these messages.

It is already hard to read as is and it's making it worse to read and confusing, if some big service would start using this, you would have to know about this 'hack' otherwise he would have to look up what the hell is going on.

Also, this is the same information for each call and thus redundant, makes your messages larger when an advantage of JSON is that it's generally a small message.

</comment><comment><USER41> This, to me, looks like an example of relying on a nondeterministic implementation. To my knowledge, the standard doesn't prescribe that parsers take the second/last of a duplicate key. As a result, this is relying on implementation-specific choices which can lead to a terrible upgrade process.

Switch to a different JSON parser, does it still work? probably. but I wouldn't bet that much.

If I were implementing a JSON parser, might I throw an error on a duplicate key? maybe. Maybe I would just print a warning?

If I were every going to give someone advice it would be to never do this.

</comment><comment><USER42> You should use standard JS comments and process them out. Douglas Crockford's offical answer on comments, [https://plus.google.com/118095276221607585885/posts/RK8qyGVa...](https://plus.google.com/118095276221607585885/posts/RK8qyGVaGSr). Essentially just process them out beforehand with something like jsmin, pretty straightforward.

</comment><comment><USER43> This is a horrible hack. You should use JSON-LD [1] to describe the fields of your JSON. It's a W3C standard!

Also, it's _not_ defined in the JSON standard in which order an implementation needs to parse the JSON fields/keys. So you could end up with potentially wrong results!

1\. [http://json-ld.org/](http://json-ld.org/)

</comment><comment><USER44> This is a nice trick, but probably only should be used in systems where the set people touching the code is a limited, rarely-changing set of people and anything using the JSON is strictly going to treat the last defined value as the value to use. Dragons lurk elsewhere!

</comment><comment><USER45> > Believe it or not, it turns out JSON parsers work the same way

 _Please_ don't do this. There's almost certainly some parsers out there currently that don't work like this, and if not, there likely will be one day.

</comment><comment><USER46> I do something else that is a lot more readable:

        {
          "#": "this is a comment for the next line",
          "url": "http://foo.bar"
        }

Simple.

<comment><USER14> Hopefully you don't use the same key multiple times, as that's not guaranteed to work in different parsers.

</comment></comment><comment><USER47> if I ever saw this in a project, I would remove those comments in a heartbeat. The behavior here is specific to the json parser. JavaScript is not the entirety of programming.

It does break the json parser in the Go standard library, in a totally nonobvious way: [http://play.golang.org/p/BsDd47vWna](http://play.golang.org/p/BsDd47vWna)

I would be surprised if it doesn't break many parsers, especially json parsers in static languages. If you want that sort of behavior, don't use json.

</comment><comment><USER48> This is a celebration of programmers' ability to generate unmaintainable code by exploiting implementation dependencies. People get _fired_ for pulling this horseshit every day!

</comment><comment><USER49> A common practice in config files is to comment out whole sections e.g. optional proxy server settings. This sort of multi-line comment is not addressed by this hack

</comment><comment><USER50> Well, here we go: [https://github.com/kgabis/parson/issues/7](https://github.com/kgabis/parson/issues/7)

</comment><comment><USER51> Don't use them, there is no such thing. Make your comments first class citizens in the data.

</comment><comment><USER52> Nice hack but fails JSHint.

[1] [http://jshint.com/](http://jshint.com/)

</comment><comment><USER53> JSON has comments already. It just requires you to decide what the comment marker is.

</comment><comment><USER54> I thought JSON is mainly for machine to machine consumption.. who reads comments?

</comment><comment><USER55> This is a recipe for disaster.

</comment><comment><USER56> Neat trick! Not sure I'd trust it, and might be confusing for anyone reading who didn't know this.

</comment><comment><USER57> That seems pretty fragile.</comment>


GistDeck – turn markdown gist into slide - <AUTHOR> http://gistdeck.github.io/jcouyang/8acfc555a718d62b77b2#1 <comment><USER2> I see a problem with code syntax highlighting on slide 13; anyone else?

<comment><AUTHOR> that was intent to explain how to use syntax highlight for different language.</comment></comment>


A Sex Pistols Concert Film Languished for Four Decades - <AUTHOR> https://www.nytimes.com/2017/12/22/arts/music/sex-pistols-documentary-doa-a-right-of-passage.html <comment><USER2> If you have the slightest chance interest in the Sex Pistols, punk rock, or even the story of how something small and sincere can shake up an industry and culture, check out the documentary The Filth and The Fury. It covers some of the same territory as DOA, but I think better captures the cultural and economic stagnation in the 70s.

</comment><comment><USER3> Did I miss something in the article? It didn't make it clear as to where I actually can see it or how...

Edit: I eventually went googling for it, and disappointed I need BlueRay/DVD to view. It can't be hard to distribute digitally these days....

<comment><USER4> Amazon Video has it for purchase/rent: [https://www.amazon.com/D-Right- Passage/dp/B078HV33TL/ref=sr_...](https://www.amazon.com/D-Right- Passage/dp/B078HV33TL/ref=sr_1_fkmr0_2)

</comment></comment><comment><USER5> Sharing this wonderful two minute '80s Japanese overview of British punk for no real reason other than that I happened upon it the other day: [http://www.dailymotion.com/video/x4ryjm](http://www.dailymotion.com/video/x4ryjm)

<comment><USER6> Not sure which language that is - Turkish maybe? - but it's definitely not Japanese.

</comment></comment><comment><USER7> [https://dangerousminds.net/comments/crucial_punk_doc_doa_a_r...](https://dangerousminds.net/comments/crucial_punk_doc_doa_a_right_of_passage_finally_restored_for_a_hi_def_d)

</comment><comment><USER8> Wow the Sex Pistols a corporate created punk band aka the Nsync of punk. I have no idea why anyone even cares about this band besides the horror and evilness which is Sid Vicious (Edit I said Johnny Rotten but Im not far off).

"The Sex Pistols were the brainchild of young entrepreneur Malcolm McLaren."

Nothing drives my Punk Rock childhood crazy then people putting this corporate fake band some honor. Rant over.

[https://www.rollingstone.com/music/artists/the-sex- pistols/b...](https://www.rollingstone.com/music/artists/the-sex- pistols/biography)

<comment><USER9> I assume you mean Sid Vicious rather than Johnny Rotten, a smart and articulate guy whose other band, Public Image Ltd deserves plenty of acclaim regardless of whether or not they are punk "enough".

It's not like Malcolm McLaren was the Simon Cowell of his era. He started out as a shop keeper, had deep ties to the scene, and was an artist himself.

Plenty of worthwhile bands have had a leg up from well connected people over the years. At the very least it brings visibility to other artists in the genre and it certainly shouldn't detract from your enjoyment of Holidays In The Sun.

<comment><USER8> I preferred Joy Division, early Talking Heads, EARLY B-52 and Ramones over anything of the Sex Pistols. They just were famous for being jerks.

</comment></comment></comment><comment><USER10> The most interesting thing about this article, to me, was that apparently nobody can decide how to spell the title. Is it "right" or "rite"? Even Wikipedia can't decide, mentioning both alternatives:

[https://en.wikipedia.org/wiki/D.O.A.:_A_Rite_of_Passage](https://en.wikipedia.org/wiki/D.O.A.:_A_Rite_of_Passage)

<comment><USER11> The film poster says "Right", the trailer says "Right"; seems pretty conclusive. I'm really not clear why most articles say "Rite".

Wikipedia in particular should know better, but they already have a problem with cluelessly pedantic hypercorrection ([https://xkcd.com/1167/](https://xkcd.com/1167/)). I keep expecting them to try to "correct" Pet Sematary.

<comment><USER10> The trailer says "right" in the frame, but the video title says "rite": [https://www.youtube.com/watch?v=q2CbNRVHPM0](https://www.youtube.com/watch?v=q2CbNRVHPM0).

However, you seem to be correct. Since the poster and trailer agree, it seems that the title is "right".</comment></comment></comment>


Show HN: multicasting video chat site I built over xmas break - <AUTHOR> http://chat.io

<comment><USER2> Very nice. Can you provide some references you used, particularly the video side? I'd like to learn to build one for myself.

<comment><AUTHOR> The video component uses Adobe Cirrus for p2p streaming. <http://labs.adobe.com/technologies/cirrus/>

</comment></comment><comment><USER3> Really nice work! Node.js you kill it real-time!

</comment><comment><USER4> Could you add a standard account system?

<comment><USER5> will never understand why people cut 99% of the internet off by offering only twitter/facebook signup...

i never implemented either of those, but couldn't be so much easier than openid to justify that number

<comment><USER6> I don't mind connecting with Twitter. What I find absurd is requiring the right to tweet on my account at any time without my explicit permission.

<comment><AUTHOR> ah, I have removed that settings from the app.

<comment><USER6> Fantastic!

</comment></comment></comment></comment></comment><comment><USER7> Doesn't work for me:

Mac OSX Lion, Chrome and Safari and Windows 7, Chrome

</comment><comment><USER8> I've put together a review of your app. I hope you find this helpful.

[http://moustach.io/welcome/e/reviewed/XBjgCj6nwjKCTot6UTH5ms...](http://moustach.io/welcome/e/reviewed/XBjgCj6nwjKCTot6UTH5msJjqzAEZIm8/p0v6Awhqse6B1irAw9UZNQ)

</comment><comment><USER9> Man, that is lovely wood pattern. Made this yourself?

<comment><USER10> <http://subtlepatterns.com/?p=904>

</comment></comment><comment><USER11> Very nice indeed! Keep it up.</comment>


AWS Re:Invent Presentations - <AUTHOR> https://aws.amazon.com/events/events-content/?awsf.filter-series=*all&awsm.page-cards=1 <comment><USER2> Can anyone point out some of the good ones?

Just about every presentation I went to this year at re:invent was not particularly good. They lacked depth and just seemed to be saying "just use this aws product" and you'll be all set.

<comment><USER3> This is one of my main problems with the AWS everything advocates. I'm ok with using AWS mostly for a few key things like infrastructure, but I want my tooling to be independent and able to adapt to other situations. For example,why should I ever use CloudFormation over Ansible or Terraform when it lacks many features and can't be applied to other providers?

<comment><USER4> Well, then you get the worse of both worlds. Why use AWS at all if you're not using their managed services? You're spending more on raw resources and just as much on maintenance.

As far as Terraform, there is nothing portable about it. Each of its provisioners are cloud specific.

<comment><USER3> > Why use AWS at all if you're not using their managed services?

Is this a serious question? I can value the infrastructure the AWS provides, such as regions and availability zones, while not wanting to get tied into their other services including the managed services for reasons such as business requirements for cloud agnosticism, which is for example one reason I tend to use HAproxy instead of ELB even on stuff on AWS. With CI/CD pipelines applied to infrastructure and a move towards no-ops, the maintenance costs of self-managed infra is reducing more and more.

I understand for some shops with a lack of personnel or knowledge to accomplish that self management may want to buy into a holisitic solution, but I think it's awfully intellectually disingenuous to not recognize the potential value of _not_ buying into a holistic solution in _certain situations_.

Also, common, 'cloud specific'? So if I want to spin up my stack on Google or some other platform, I just have to rewrite a few lines of some .tf files. If I want to do that and I'm tied to CloudFormation.... I'm sol...

<comment><USER4> Really? You would go as far as managing your own load balancers instead of using a managed, highly available ELB from AWS?

Have you tried using Terraform across providers? It's far more than just "a few lines of codes". If you just want cross region availability and still manage things yourself, there are much cheaper ways than AWS.

<comment><USER3> Yes I would, there are some cases where the featureset is better. Also, it really is just a few lines of code. If you separate out IAC-code and configuration code even if you are running through say a jenkins pipeline it's not much trouble to change a few .tf files around to get the same result on a different provider... You act like writing terraform is hard or convoluted and I don't understand where you are coming from on that.

[https://github.com/terraform-providers](https://github.com/terraform- providers)

<comment><USER4> Do you get the cross AZ redundancy? and you're managing more servers and probably spending more than just using an ELB. What about the HA from the target servers? If you were using a load balancer + autoscaling group with a min/max of 2. If your server went down or your entire AZ went down, autoscaling would bring another one up. If the server or AZ went down running your load balancer, it would also be redundant?

One of our web servers crashed in the middle of the night once. I got an alert saying it crashed and that another one was brought up. I turned over, went back to sleep and investigated the next morning. If the "server" running an ELB crashed, I wouldn't have to care.

Do you really think that you're going to be changing providers Willy nilly once you reach any type of scale?

It's just like all of the bushy tailed "architects" who use the repository pattern just in case one day their CTO on a whim decides to move their six figure a year Oracle installation to Postgres.

What business value is being added by going through all of the trouble of staying "cloud agnostic" compared to the lack of HA and maintenance.

Btw, we also don't have to manage Jenkins servers. We have a cloud formation template with parameters and quick create link that a developer can click on to create a CodeBuild project anytime they want to create a new build project. They specify the Github link that triggers the job. You then specify your build steps as a list of bash (Linux) or Powershell (Windows) commands in a yaml file.

We could also do the same with CodePipeline - create a CF template that creates Code Pipeline jobs on the fly, but we do use OctopusDeploy for deployments.

CodeBuild runs Docker containers to run builds. Again no servers to manage but I believe by default it can run 50 builds simultaneously. If a build job needs custom tooling or a custom version of a runtime, the developer can build a custom Docker container to run the build.

You're doing more work just in the eventuality that you may want to rip out your entire infrastructure and you're paying more for the privilege.

<comment><USER3> You've obviously fully bought into AWS and don't want to hear anything to the contrary. That's fine if it works for you, but you aren't interested in honest conversation, so I'm done here.

<comment><USER4> It's not about "fully buying into AWS". I would say the same about Azure or GCP - well not GCP I wouldn't trust Google for any infrastructure. If you have a static workload and the staff to handle infrastructure, AWS may not be worth it. Use a colo or a cheaper service like Linode. Everything I use managed services for I've done on prem.

I'm saying that it is just as much a waste of money and time to use _any_ cloud provider just to duplicate what you could do at a colo.

I would say the same thing about spending extra money for Oracle or SQL Server. Why spend extra on a commercial solution and not take advantage of it. You wouldn't use Excel just to create CSV files.

<comment><USER3> I come from places where that have self-managed on-prem datacenters, with self-managed CPU/GPU clusters, and using CloudFormation for internal infrastructure simple is a non-starter, but with some stuff in AWS, why would we do half CF and half terraform? Do it in tf et al for both. Yes I have occasionally used ELB/EFS in front of HAproxy for some of the reasons mentioned, because I recognize some situations where the value-add is worth the tradeoff.

The entire point of my post is that lock-in to AWS can be bad in certain situations, which I have tried to clarify multiple times now and you have ignored every time. I'm not saying it's bad in all situations, just that it can be bad in some. Your extreme defensiveness seems strange to me for that reason.

I look at it like datacenter design. You don't have just one isp. You have multiple ISP lines incoming, often in different forms (aerial/underground/wisp) so that you are never too dependent on one thing. Your metaphorical datacenter may have a OC-3840, and that may be a big feature for you, but you should at least admit to yourself and customers not having other ISP lines might be a weakness, despite the awesomeness of the 3840..

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I found a lot of videos of the actual presentations on the AWS Events youtube channel here [https://www.youtube.com/channel/UCdoadna9HFHsxXWhafhNvKw/vid...](https://www.youtube.com/channel/UCdoadna9HFHsxXWhafhNvKw/videos) . Would've been nice if they were linked on OP's page.

</comment><comment><USER6> reinvent was a total waste of time. i didn't know that you had to reserve a seat in every single session you wanted to attend. didn't get into any.</comment>


RIM CEOs to Give Up Top Posts in Shuffle  - <AUTHOR> http://online.wsj.com/article/SB10001424052970204624204577177184275959856.html?fb_ref=wsj_share_FB&fb_source=home_oneline

<comment><USER2> Quote from The Globe and Mail article[1] I read earlier:

      "...new chief executive officer says the company is doing
      everything right and does not need a change in
      strategy..."

oh boy!

[1] [http://www.theglobeandmail.com/report-on-business/at- researc...](http://www.theglobeandmail.com/report-on-business/at-research-in- motion-a-new-ceo-vows-to-silence-the-doomsayers/article2310968/)

<comment><USER3> That's generally a good thing to say when the people that he has to calm the most are the Street and their demotivated workforce. People as a whole don't like change.

<comment><USER4> Yeah, I agree. Even if you can see the current strategy is failing, you shouldn't go throwing bombs unless and until you think of something better.

</comment></comment></comment><comment><USER5> Official press release:

<http://press.rim.com/release.jsp?id=5358>

and more info:

[https://www.theglobeandmail.com/globe-investor/jim- balsillie...](https://www.theglobeandmail.com/globe-investor/jim-balsillie- mike-lazaridis-out-thorsten-heins-in-as-new-rim-ceo/article2311029/)

</comment><comment><USER6> Too little too late? If we start seeing tons of "expense cutting" measures with no innovation, they need to

a) hire from the outside for a fresh perspective

or

b) get acquired

<comment><USER7> I think their only chance to be relevant would be to get our of the hardware business and rush to be a service company. They should start making Blackberry Enterprise Server integration for Android. They should see if they could get Apple to let the iPhone hook in too.

Their phones are a lost cause. Even if they had an amazing phone in the pipeline, I don't think they could stop their slide if it was released tomorrow.

At this point, BES and their patents are the things with any value.

<comment><USER8> Spot on. People loved their CrackBerries because of the messaging services (and maybe the keyboards), not the tired phone software. iOS and Android devices dominate the enterprise now, but RIM could retain a server-side position BES. IT departments might like a single enterprising message service that can they can standardize across the variety of Android and iOS devices they will have to support.

<comment><USER9> Can someone enlighten me as to what advantage BES holds over the way iOS and Android communicate?

I agree that several years ago, when phone having an IP address was unheard of, BES made all the sense in the world. It's kind of pointless now.

</comment></comment></comment></comment><comment><USER10> Perhaps Ballmer will step aside at Microsoft for Qi Lu, next?

HP would be the other company in my "management-impaired former titans" portfolio which might benefit from a change (they'll probably want to wait a bit, and Meg Whitman is definitely an improvement over some of their other CEOs.)

</comment><comment><USER11> I could see this company earning a spot in future versions of 'In Search of Stupidity'. (If you don't know the book, don't knock what I'm saying before you read it. It's one of my favorite reads about high tech business)

</comment><comment><USER12> According to the press release, they are also out as co-chairs of the board.

Lazaridis is becoming Vice Chair (whatever that means) and Balsillie is retaining his seat but will be stripped of all titles.

</comment><comment><USER13> Perhaps RIM's real value lies in their patents (or lack thereof) and this explains why they are unable to make a viable product?

</comment><comment><USER14> Too less too late. They should focus all their energies on BBX and be a lot more developer friendly.

</comment><comment><USER15> Full article without ad: [http://online.wsj.com/article_email/SB1000142405297020462420...](http://online.wsj.com/article_email/SB10001424052970204624204577177184275959856-lMyQjAxMTAyMDIwMjEyNDIyWj.html) Video: <http://youtu.be/QUFwhpcrCTw>

</comment><comment><USER16> The fact that it took this long for the CEO's to step down reflects the extreme arrogance of this company. I've attended a few RIM-sponsored events in the Waterloo, and it's downright shocking how cocky the reps and developers are. RIM appears to be living in its own little tech bubble, blissfully ignorant that pretty much everywhere else in the first world owns or will own an iPhone.

This company makes a lot of money, they still have a lot of marketshare, but there's no question they are in a serious downdraft. It would be completely normal for any company in this situation to put itself up for sale. I'm a little surprised Google choose to buy Motorola Mobility rather than RIM, given that RIM has a lower market value and has more attractive assets.

Regardless of what it says in the press I imagine finding a potential acquirer of the company will be the first task of the new CEO.

<comment><USER17> "...blissfully ignorant that pretty much everywhere else in the first world owns or will own an iPhone"

Speaking of living in a bubble...

<comment><USER16> What I meant was that RIM and their execs have been insulated from the true damage being done to their business and more importantly their mindshare among developers. Apple's success with iPhone and iPad is absolutely not what I'd call a bubble.

<comment><USER18> You suggested that Apple has some kind of majority market share or something. They don't. Hence, your bubble is showing.

<comment><USER19> It depends on if you are counting devices versus OS... Android sells more than iOS, but the numbers are split amongst all the manufacturers.

<comment><USER20> "Android handsets vs iPhones", not "Android vs iOS". iOS as a platform includes iPhone, iPod touch, iPad and AppleTV.

We'll have to wait until tomorrow [1] to find out whether Android as a platform has a bigger marketshare than iOS does.

[1] [http://www.apple.com/pr/library/2012/01/20FY-12-First- Quarte...](http://www.apple.com/pr/library/2012/01/20FY-12-First-Quarter- Results-Conference-Call.html)

</comment></comment></comment></comment></comment></comment><comment><USER21> Finally.

</comment><comment><USER22> Deck chairs..Titanic..</comment>


Ask HN: How do you not get influenced by others except when you have to? - <AUTHOR>

Obama is evil and planning to destroy the world.  I live in an area where the vast majority of people believe that.  One day, I found myself (to my horror) thinking that as well before I stopped myself.  Everyone is saying it so it must be true, right?
Back to startups.  There's a bunch of common knowledge floating around that is complete junk.  It's awful and if you follow it you'll destroy any value in the startup you wanted to create.  Yet at the same time, these are the people who may become future customers and users for your product.
These people may also become your future employees.  They have deep technical knowledge about things and you want them to do that and only that thing.  You want to learn from them except you don't want to learn from them at the same time.
So, how do you not get influenced by others except when you have to? <comment><USER2> Form a rational framework for evaluating what people say when you are trying to learn from them.. Basically, when people just give you their opinion and refuse to back it up, remember it is only opinion and NOT anything close to fact. Most BS is easy to detect if you just think about it for a little bit. In some cases, you won't have the knowledge to evaluate a statement well. Try to just go back to these tidbits of information when you have an opportunity to test them or you learn something new to evaluate them.

As to the rational framework you should be using, I think the important thing is to have one. Each will suffer from systematic biases and failures of some kind, but as long as you have one you're getting somewhere.</comment>


6 Corporations Control 90% of the Media in America - <AUTHOR> http://www.morriscreative.com/6-corporations-control-90-of-the-media-in-america/ <comment><USER3> Some might ask why this matters. The problem with these six mega-corporations is that they are controlled by a handful of billionaires and a few distasteful foreign governments that do not have the best interests of Americans in mind. These corporations own the US legacy media outlets (e.g., CNN, MSNBC, FOX, etc) and most of the larger online US news sites. They have, in my opinion, been quite effective at brainwashing a huge segment of society with regard to the important political issues of our day. I've long ago moved on to better news sources, but I don't personally know anyone else over the age of 30 who has also done that. It looks like it's going to be many decades before these giant media outlets finally lose their relevance. And that's a crying shame.

<comment><USER4> What other sources do you use, I ask as an over 30 something who wants to see how the other half lives?

<comment><USER5> NoAgendaShow.com; a podcast that covers a wide variety of topics. They are listener funded, so they arent subject to pleasing advertiser (as these 6 big corporation and most news outlets).

One of the hosts is also the 'co-founder of podcasting', took a company public and registered mtv.com, back in the day. They have a very interesting news media deconstruction process; Highly recommended.

<comment><USER6> Steve Jobs himself gave him the title "The Podfather"

</comment></comment></comment></comment><comment><USER7> A long time back, I bootstrapped a SaaS which was useful to my reporter friends. So I tried selling this to what I thought were small town local newspapers. I called up the editorial or business development contacts listed in the paper; whenever I got hold of them, I was redirected to Headquarters,which always was some sort conglomerate enterprise. That is when I learnt the hard way there is not such thing as a local or small newspaper: they are just local branches of conglomerates. I gave up because I did not possess the resources required for an enterprise sales cycle.

<comment><USER8> Keep looking, near me is [http://www.kirklandreporter.com](http://www.kirklandreporter.com) and [http://www.nwnews.com](http://www.nwnews.com). If you can't find one start one, leverage the software you built.

</comment></comment><comment><USER9> This graphic is out of date and has errors in it. It implies the Huffington Post is owned by Time Warner, which has never owned it. In fact, AOL bought it two full years after splitting off from Time Warner.

Additionally, it should be noted that Time Warner recently split its entertainment properties from its publishing properties [1], and doesn't account for the fact that the print publishing world is quite a bit different. Six corporations may own 90 percent of the world's media, but they don't own The New York Times, The Los Angeles Times, The Chicago Tribune, The Boston Globe, The Washington Post, or USA Today. Hmm.

[1]: [https://www.forbes.com/sites/greatspeculations/2014/03/11/ti...](https://www.forbes.com/sites/greatspeculations/2014/03/11/time- warner-nearing-the-separation-of-its-publishing-business/)

<comment><USER10> The article states it has a bunch of things that are no longer up to date, just before the graphic, doesn't it? It says here follows the infographic except this has changed and such and is now owned by this and that.

I didn't really feel like looking too deep into that infographic any more after that. I think it's weird, or lazy, given that this is the meat of the article, why not make a correct infographic then? It already looks like a smudgy 3rd generation copy of a JPG sent through whatsapp, so it could use some cleaning.

It doesn't need to recreate the "funny" clipart figures, just the bar graphs and the correct numbers.

Or they could've just taken the numbers, the correct who-owns-what, and written it as a story, which would've been shorter and easier to grasp than this "keep these errata in mind"-infographic.

I strongly suspect that this article got its upvotes because many people on HN feel it is an important topic to discuss, not because the quality of the article itself is that great.

</comment></comment><comment><USER11> A big difference between the US media and the rest of the developed world seems to be a complete absence of state-owned/subsidized/run media. To me, this seems much more problematic than the limited competition between corporate media.

In the US, it seems that news/stories/investigative reporting without some commercial interest to some company tends to go underreported. There is no money in being critical towards business (except extreme cases) for the media companies, who depend on good corporate relations for advertising income. Critical reporting towards businesses is not happening and government mistrust is promoted with nothing to balance this.

I think that a healthy media climate needs a mix of commercial and public journalism, that balance each other out.

As someone living in the Netherlands, there are several popular TV shows on public TV that, I think, could never exist in the US, because they would be seen as harming corporate interest. An example being a program investigating the background, production and health aspects of all kinds of food.

<comment><USER12> Culturally, many people would dismiss state-owned media perspective as a kind of Pravda. Because of the cultural perspective, two things would happen: firstly, politicians would think it's OK to instruct such media to follow a particular party line; and secondly, journalists and presenters that are the visible face of the media would also follow the party line, because they think that's where the money is coming from, so it would be stupid to do otherwise.

The cultural perspective is widespread and it's at the core of many Americans' cynical approach to the government. "We're from the government and we're here to help" are genuinely scary words to these people; they have not bought into the idea of government as a social contract, or the idea that a consensus of principles could lead to publicly funded media without excessive political bias. Instead, many Americans view government as a necessary evil that we only institute to restrain our worst vices, and if the government shows up, it's because something went badly wrong; that the best government is no government, which we would have if we acted morally.

<comment><USER13> > two things would happen: firstly, politicians would think it's OK to > instruct such media to follow a particular party line; and secondly, > journalists and presenters that are the visible face of the media would also > follow the party line, because they think that's where the money is coming > from, so it would be stupid to do otherwise.

In my experience the opposite is true.

eg in Austria:

* politicans aren't allowed to interfere w/ the state owned programming and it's usually deeply rooted opinion in those institutes to be independent - they are a service to the people of the country not the current government

* private media are usually considered to be in favor of the party that pays them the most in ad spending and follows their own political agendas

* state owned news shows are usually known to be more critical (we done the research, stop BSing please) towards politicians than private ones (which politicians obviously consider unfair)

obviously in reality everything is shades of grey and not black/white. eg journalists still tend to have own political worldviews and report biased with them. but state owned doesn't by default mean propaganda channel.

<comment><USER12> I know; but Americans don't, and a state owned channel would be run by Americans, viewed by Americans and judged by Americans. It would be American, ie be an instrumental tool of power.

</comment></comment></comment></comment><comment><USER14> This is blatantly inaccurate and outdated, which is not to say that there is not massive media conglomeration but rather the information presented is inaccurate.

This link is also reblog spam from a BusinessInsider reblog spam from some other "frugaldad" (FRUGALDAD sounds like a legitimate source of media conglomeration news, doesn't it?) site from 2011, and even BI stated it was inaccurate and outdated back _then_ making it even more so now in 2017.

[http://www.businessinsider.com/these-6-corporations- control-...](http://www.businessinsider.com/these-6-corporations- control-90-of-the-media-in-america-2012-6)

As for the inaccurate info... for starters....

[https://en.wikipedia.org/wiki/Acquisition_of_NBC_Universal_b...](https://en.wikipedia.org/wiki/Acquisition_of_NBC_Universal_by_Comcast#Divestment_by_GE)

[https://en.wikipedia.org/wiki/NBCUniversal](https://en.wikipedia.org/wiki/NBCUniversal)

Anyway. Nobody bothering to check on this stuff, even in a highly intelligent community like HN, is a great example of how inaccurate or untruthful garbage spreads online.

<comment><USER10> I strongly suspect that this article got its upvotes because many people on HN feel it is an important topic to discuss, not because the quality of the article itself is that great.

</comment></comment><comment><USER15> While still small, Netflix probably represents one of the bigger threats to the Big 6. Of course, this makes it a prime merger target. [0] Netflix is not mentioned in the article.

[0] [https://www.fool.com/investing/2016/11/15/better-buy-the- wal...](https://www.fool.com/investing/2016/11/15/better-buy-the-walt-disney- company-vs-netflix.aspx)

<comment><USER16> I'm thinking how Netflix compares to the traditional media. On demand services have much less control of what we're going to watch. Bigger catalog -> better service -> less control.

<comment><USER17> One would think the Internet offers the biggest catalog, yet here we are - <USER2> are free to read your news from any source and I mean any source, however the influence of big media remains. Choice and freedom doesn't mean a better informed audience.

</comment></comment></comment><comment><USER18> I am reminded of a quote that made an impression on me years ago but which I'm unable to attribute:

"If you don't believe ownership matters, you're not playing capitalism anymore."

Really, you shouldn't need to go to such a reductionist extreme to find stats like these troubling. "Tone at the top" is a real enough phenomenon, and you're not going to have much variety of tone at the top if there are only a few tops.

<comment><USER17> What is that quote from?

</comment></comment><comment><USER19> Isn't facebook already bigger than some of the firms mentioned in the articles? Or is it not counted as media?

<comment><USER20> Facebook creates no content whatsoever on its own. Its a crowd-funded link aggregator that earns revenue by ads.

<comment><USER21> Although you are correct, it is not a stretch to say that Facebook "controls" the media in deciding what to show, and how it is shown.

In this way, you could say that "Facebook Controls [a significant portion] of the Media in America"

<comment><USER22> "Media Filter"?

<comment><USER23> When distribution is bottle necked to a single or few locations, the difference between content creation and content consumption blurs significantly. If its not distributed - its not seen. The same net effect as not ever being created.

<comment><USER22> Absolutely. The value of media is solely in distribution, irrespective of the original source. Distribution is kind of baked into the definition.

A term like "media filter" only has value in distinguishing between "traditional" media and companies like Facebook. But, strictly speaking, Facebook _is_ as much the media as traditional outlets and, in this context, those outlets are merely sources for Facebook.

</comment></comment></comment></comment></comment></comment><comment><USER24> I know hardly anyone likes the MSM (myself included), however is this stat so bad? Is it anything unusual for any other industry?

Mature industries consolidate - its just a fundamental nature of the growth process. How many corporations control packaged chicken? cell phones? cement?

No doubt the voices behind such "X mega-corps control Y" are in fact just advocating for legislation changes to mandate that they get a seat at the table.

The very concept of "MSM" is a bit of an anachronism in this age. Not even sure why we should talk about it. There are youtube channels broadcast from a garage that get more daily views than Anderson Cooper ever will. Best thing is to just switch off the TV and let the dinosaurs slowly die...

<comment><USER25> > Is it anything unusual for any other industry?

Isn't that a big problem? Monopolies and oligopolies are crippling capitalism. The "too big to fail" conglomerates become just a part of the political system instead of the economic one.

With the media industry, it gets worse, as it has an important role in keeping the democratic and economic powers in check.

> No doubt the voices behind such "X mega-corps control Y" are in fact just > advocating for legislation changes to mandate that they get a seat at the > table.

Is not that fair? Shouldn't all parts of society be represented in the industry that consolidates the cultural values of a nation? Why should only economic power have representation in the media? It is one person one vote, not one dollar one vote.

<comment><USER24> >Is not that fair? Shouldn't all parts of society be represented in the industry that consolidates the cultural values of a nation? Why should only economic power have representation in the media? It is one person one vote, not one dollar one vote.

Your dollar is your vote. You choose what industries you support by where you spend your dollars (or cast your eyes in this case).

You have the ability to hurt these corporate boogey-men by simply not giving them money / attention. You already have this power, you don't need a politician to give it to you. Use it.

<comment><USER26> The 'vote with your dollars' premise is flawed; the very nature of monopoly is to erode choice by consolidating market position and using influence (government, market) to maintain position which tends to mean creating barriers for more choice / new players to enter the market.

</comment></comment></comment></comment><comment><USER27> The point of the post still stands with control mostly being in the hands of a few corporations, but it is really outdated. The article does mention AOL isn't owned by Time Warner anymore and Comcast owns NBC Universal along with GE never owning Comcast.

Here are the corrections I can point out. I'm not trying to be pedantic or douche. Just in case someone wants to know up to date info and a bit more info on the control of media. Here we go:

Infographic saying "read watch or listen" is incorrect as what we read is more diversified.

Time has spun off from Time Warner. News Corp split. Fox should be the name up there. News Corp is still big in its own right with its newspaper, books, and other assets.

If you want to say the above splits still have the same shareholders, then Viacom and CBS should be featured as one. National Amusements/Sumner family owns both.

The key company missing is Sony. And no mention of the big 3 in music - Sony, Time Warner, NBC Universal. Sony is also one of the big 6 in film.

Netflix should probably be included at this point. Hulu is owned by Time Warner, Disney, Fox, Comcast.

The part saying Time Warner's 178 million users read news each month is out of date now with the spinoff. Reddit alone gets more users per month now with over 200M per month.

Going along with that, magazines are more diverse. Condé Nast (also controlling stake in Reddit), Time, Hearst, and about 3-4 other companies control most of that industry. But not 90%.

Newspapers are much more diverse in ownership and control, but the infographic doesn't mention that too much so leave that.

Clear Channel went through a few things and is now iHeartMedia. You could also mention Sirius XM for radio. They took a stake in Pandora and will probably completely buy them out. Sirius XM themselves are controlled by Liberty Media/John Malone.

Could potentially mention other tidbits of companies like Vice and Vox having minority stakes owned by the big 7 media companies. It's also unknown how Oath owning AOL and Yahoo will fair under Verizon control. Lots of users and readers there.

I think that's all I got. Again not trying to be pedantic or douchey. Just pointing info out. If I got anything wrong, let me know.

<comment><USER28> exactly. Leaving out Sony, Advanced Publishing, iHeartMedia, Hearst, Gannett, tronc, Meridith invalidates the number 6.

what's worse is that iHeart is even in the infographic, but the graphic author conveniently decides not to count it

<comment><USER27> Haha yeah. Thanks for replying! Maybe I should turn my comment and yours into a blog post at this point. Was hoping for more responses and discussion.

I didn't even begin mentioning the big newspaper companies like you (Gannett, tronc).

Funny you mention Advance Publications because of reddit. reddit is beloved compared to these other media empires, but its ownership stakes aren't revealed. There's no idea how much of it is owned by Advance Publications :p.

</comment></comment></comment><comment><USER29> It's worse in the UK, 3 companies own 70% of the newspaper readership. They have huge political influence, especially Rupert Murdoch, who all prime ministers would try to schmooze [https://www.theguardian.com/media/2015/oct/21/uk-media- plura...](https://www.theguardian.com/media/2015/oct/21/uk-media-plurality- threatened-by-dominant-group-of-large-firms-report)

<comment><USER30> Good you still have the BBC.

<comment><USER4> Who are liberal, modern day liberal, which is worse.

<comment><USER30> Is it? How so?

</comment></comment></comment></comment><comment><USER31> This is an add for Morris Creative Group LLC. Although I would say anti-ad, as their slick graphic is out of date. But I might not be going deep enough and the out-of-date graphic has not been redone on purpose like a Nigerian Prince email having misspelled words and grammar mistakes.

</comment><comment><USER32> > 232 media executives control the information diet of 277 million Americans. > > That's 1 media exec to 850,000 subscribers

More like 1,194,000 subscribers. How can one take such a presentation seriously when the authors fail at basic arithmetic?

</comment><comment><USER33> This is what happens when you don't enforce anti-trust laws.

<comment><USER34> > _when you don 't enforce anti-trust laws_

And that is what happens when you accept the legalized corruption of the political system, in the form of lobbying. The same stakeholders control the media corporations and the politician who should regulate them.

</comment></comment><comment><USER35> This is what antimonopoly/antitrust laws should have been used against, but in this merger and aquisition market, the people with the power to invoke them are too corrupted and regulatory captured to do it, and so the people suffer.

Side note: in the past posting or talking about this was easy grounds to be dismissed as a "conspiracy theorist".

</comment><comment><USER8> They stir the pot because people consume their content like it's going out of style. It will only get worse. Don't give them the eyballs, clicks, views or anything else they can measure and generate revenue from.

Everyone of us have more important things to do in life.

</comment><comment><USER36> Why is GE on this? They don't own NBC. Should be updated for 2017. It's not 2011 anymore.

<comment><USER37> I noticed that, too.

Clear Channel is also not Clear Channel anymore and do not own 1100 stations.

It is interesting the conversation it has started in this thread even though it is based on false and out of date information. I guess people just accept the infographic as reliable truth and go with it.

</comment></comment><comment><USER38> Except that media is much more than TV and newspapers. More and more people turn their backs on traditional media and get their information from a blend of many internet sites and witness videos on youtube and so on. And I only see this trend growing in the future.

<comment><USER39> This is true. However, online media is becoming more and more concentrated(and manipulated) as well. Facebook, Reddit, Tumblr, Google, and 4chan all make up a large chunk of our online media, and it should be apparent to most people at this point that each of those sites are either controlled by a company, country, or PR team. It wouldn't surprise me if we start seeing a decline in trust of online media in the future, too.

<comment><USER40> In Europe, generally, 1) webmasters are usually responsible of the comments left in their webpages by their users, and 2) webmasters have to make clear what their names and addresses are.

Myself, sometimes I've thought of creating a forum or a community, only to be turned away when I think of that. Do you think 4chan would have ever existed if moot had had to put his real name and address there, and if he was legally responsible of what people published in 4chan? Impossible.

So all online communities will always be concentrated in the US, at least for the foreseeable future. :(

<comment><USER39> I don't believe the issue is US-vs-nonUS. I believethe issue is internet "capital" concentration, which will emerge regardless of national origin. There is a networking effect that makes it difficult to start a successful platform, and those in power will eventually work to maintain or strengthen their power.

</comment></comment></comment></comment><comment><USER41> Here's a video on Noam Chomsky and manufacturing consent: [https://www.youtube.com/watch?v=tTBWfkE7BXU](https://www.youtube.com/watch?v=tTBWfkE7BXU)

</comment><comment><USER42> Scary how much of an effect how few can have on so many, just wait 'til they all are owned by one person (it'll happen)

<comment><USER25> When I see the polarization around health care in the media I find it really scary. That polarization is not a reflection of the citizens, that most want better health care for everyone, but of a few voices paid with a lot of dollars.

This same thing has happened before, like for example in Italy were Berlusconi abused the media to get favorable ratings. It is part of the tyrant-wanna-be cookbook.

</comment></comment><comment><USER43> I suggest getting involved in New America / Open Markets and directly participate in tackling this problem. The downside to this group is that a number of its funders are, in fact, monopolists themselves.

[https://www.newamerica.org/open-markets/](https://www.newamerica.org/open- markets/)

</comment><comment><USER44> There's a note in the text, but the infographic is way out of date.

</comment><comment><USER45> And both parties misuse media. One example: [http://www.salon.com/2016/11/09/the-hillary-clinton- campaign...](http://www.salon.com/2016/11/09/the-hillary-clinton-campaign- intentionally-created-donald-trump-with-its-pied-piper-strategy/)

</comment><comment><USER46> How does this compare to media ownership in other countries?

</comment><comment><USER47> I'm not sure ownership is as significant as it's made out to be, at least in the case of the New York Times and Washington Post.

</comment><comment><USER48> Better than just 1 corporation

</comment><comment><USER49> America is like a capatalist dream. People seems to trust money and companies more than their own government and laws.

</comment><comment><USER50> And one head of state attacks one network.

[https://twitter.com/realDonaldTrump/status/88150314716807168...](https://twitter.com/realDonaldTrump/status/881503147168071680)

 _shakes head_

<comment><USER51> And Obama used to bitch about Fox News. Now granted, Trump complains a lot more, but then again, what other president has been scrutinized by a news network about how many scoops of ice cream he gets?</comment></comment>