Ask HN: What's the status of Heroku? (and other Rails hosting questions) - <AUTHOR>

This is a followup to a previous thread (http://news.ycombinator.com/item?id=272031) where I asked about Rails hosting options. I'll be at a point soon with my app where I want to deploy it and am taking another look at my choices. Unfortunately, my sysadmin skills are very much lacking and while I want to learn, that's not a priority right now. That pretty much eliminates sites like Slicehost unless I want to pay someone to configure it. (I plan to learn, but taking the time to do that now will add several months onto my timeline, which I want to avoid).
I'm looking for a managed host and my research has led me to HostingRails and Heroku.
My initial impression of those two sites are:
Heroku - Very easy to set up and use, though I've read that they add a banner to your page unless you sign up for a premium account. I'd happily sign up and pay for one, but I don't see an option for that anywhere. Also, the fact that their site hasn't been updated in months worries me a little (correct me if I'm wrong). I'd love to support a YC company and their service looks great, but I'm hesitant.
HostingRails, compared to Heroku, takes a little bit more work to configure, but seems like a pretty good choice. A lot of the negative reviews are years old so its hard to tell whether the downtime issues that some complained about have been resolved. Their homepage guarantees 99.9% up time, which makes me believe that the issues are not longer major concerns. That being said, I worry that some of the positive reviews are actually staff, some parts of their website are a little sloppy, and they make you pay for a year in advance.
What do you guys (and gals!) think? Are there any other options I should consider?
Appreciate the help. (PS: I bought a Macbook yesterday per HN's advice and love it already -- thanks for the pointers!) <comment><USER2> Your concerns with heroku are non-issues. The banner is a semitransparent one that adds an edit button to take you to the online editor for your app. You can configure it to not show ([http://groups.google.com/group/heroku/web/heroku-toolbar- set...](http://groups.google.com/group/heroku/web/heroku-toolbar-settings)). Also, they are very much active in their development: check the google group postings to see what I mean.

</comment><comment><USER3> You should really consider EngineYard (<http://www.engineyard.com/>). They are run by a group of really bright and genuinely nice people.

The founder, Ezra, is around HN as ezmobius.

<comment><AUTHOR> Thanks, but a bit expensive for some just getting started, no?

<comment><USER3> It is expensive. Perhaps consider starting on Heroku and moving the EY later on. If you read testimonials, there are some really amazing stories that show why EY is worth the money. Things like messages from EY helping people with optimizations and tracking down problems in their code.

</comment></comment></comment><comment><USER4> My experiences with heroku has been very positive so far: The online IDE and tools are very robust and they've been responsive to me when I needed to ask questions.

I don't think you'll be disappointed.

</comment><comment><USER5> It's not that hard to host a rails app yourself with apache + mysql + mod_rails.

Just rent linux server and install apache, mysql and ruby, then "gem install passenger" and follow the instructions.

</comment><comment><USER6> I do as much browsing in WebKit as possible. Heroku does not support WebKit and till it does I cannot spend too much time with it.

</comment><comment><AUTHOR> Judging from the first few comments, it seems like I'll give Heroku a go. As always, thanks for the tips.

</comment><comment><USER7> 99.9% uptime is not that great, actually, if you do the math. That's a 44 minute outage every month.

<comment><USER8> Which is not at all bad for a site that's just starting.</comment></comment>


Haskell vs. Ada vs. C++ vs. Awk vs (1994) [pdf] - <AUTHOR> http://haskell.cs.yale.edu/wp-content/uploads/2011/03/HaskellVsAda-NSWC.pdf <comment><USER2> This is a long time ago, but I remember coming across this competition when studying software architecture for my Diplomarbeit.

IIRC, the Haskell solutions were disqualified, and actually for good reasons. The competition was about architecture of the system, with the geo _server_ an example component. Notice that for example Rapide is an Architecture Description Language (ADL).

As far as I can tell, the Haskell team(s) only concerned themselves with the (purposely) simplistic/simplified functionality of the geoserver component, and not the architectural concerns that were the actual point of the competition.

Which, quite frankly, is something I see frequently from the FP community: declare that <complicated actual problem> is _really_ <much simpler problem easily solved by FP>, solve the simpler problem that ignores almost all the real requirements, declare victory and go home.

<comment><USER3> I find that statement hard to believe when so much complicated software in the industry is built using Scala/Haskell/OCaml not to mention so much of research. (STM is an example of how some complicated stuff is solved easily using FP).

Why do you feel they avoid real problems? When did you see that?

<comment><USER4> One time someone posted a "concurrency challenge", and I spent a couple minutes typing out the STM calls that solved it. They balked, for some combination of: that doesn't work in C++, you're not really following the spirit of the challenge, etc. Later they posted a 100+ line solution using condition variables.

Lesson: the "real requirements" typically include that the solution doesn't require learning anything new or weird.

<comment><USER2> Yes, that is true, and I sympathize, I am also often in the position of having a solution that is simpler than seems possible to the "less enlightened".

However, "real requirements" often do include relevant things that aren't stated. I don't know if this was the case here, but "concurrency" is often something you need because of "performance", and so a Haskell STM solution _may_ not be what your C++ hacker is looking for.

The prime example of this is the Haskell "Quicksort" implementation, which is, of course, not actually quick and only vaguely related to the idea of Quicksort.

Another example was SPJ's talk about parallel programming in Haskell, where the result was that a 6 core Haskell version was equivalent to a single core C solution. In the same talk he also boasted that "this is only possible with Haskell", to which an audience member replied that the HPC community had been doing this for well over a decade with FORTRAN.

The problem with the FP community is that there is so much of the latter examples going on that the true cases of the former tend to be less believable.

<comment><USER5> > _Another example was SPJ 's talk about parallel programming in Haskell, > where the result was that a 6 core Haskell version was equivalent to a > single core C solution._

Reminds me of a Rich Hickey talk were he proudly declared that a Clojure solution based on its persistent vector type running on four cores was as fast as the Java/mutable vector solution running on one!

The point there was supposed to be that Clojure's inefficiency is more than counterbalanced by the fact that it makes writing parallel code easier.

I was not convinced, though.

> _In the same talk he also boasted that "this is only possible with Haskell", > to which an audience member replied that the HPC community had been doing > this for well over a decade with FORTRAN._

The FP advocates always seem to use examples which show non-interactive processing of "embarrassingly parallel" vector data. And yes, that is trivial in any language. Even in C land all you need to do is to add one keyword / annotation to your for-loop and you are good.

<comment><USER6> Case in point:

[https://en.wikipedia.org/wiki/Cilk](https://en.wikipedia.org/wiki/Cilk)

</comment></comment></comment></comment></comment></comment><comment><USER7> It's old. It's so old, it predates Haskell's monads as an idea, let alone a solution to the IO problem. It was before Higher Kinded Types and GADTs. Linked Lists were still the primary data structure for everything. Haskell was more like Miranda than it was like Haskell today.

Not only that, but it excluded some of the more prominent languages for prototyping of the time: Smalltalk, SML, Eiffel, and Objective C.

And if you were to do it today, you'd invariably have to include languages that have had 20 years to catch up. Would the same result hold in a world with Scala, Ocaml, F#, Idris, Agda, Swift, and Rust?

Let's face it, this study was a victory for higher order functions and ADTs with pattern matching. Let's not pretend it was anything more than that.

<comment><USER8> > this study was a victory for higher order functions and ADTs with pattern > matching.

So, the bread and butter of Haskell?

There are few languages that do these two things nearly as well as Haskell. All of them are ML derivatives. Haskell, OCaml, and F# come to mind.

Rust has almost-as-good ADTs, but no higher order functions. A number popular of languages support both of these concepts, but not nearly as natively or conveniently.

<comment><USER9> Rust has first class functions and thus has higher order functions. Iterators have a bunch of higher order functions, map for example:

let a = (0..10).map(|x| x*x).collect::<Vec<_>>();

<comment><USER8> I've already responded a couple times with the same content, but the short of it is that rust HOFs are very limited due to its memory model. True functional-style HOFs require arbitrarily sized closures on the heap, and the only way to get that in Rust is by boxing the closures, which ends up being relatively inconvenient. There's a reason no one uses HOFs in rust outside of trivially inlinable examples like the one you give. There are no composition or application operators in the standard library because it's just too syntactically inconvenient to work with HOFs in the same way you would in a functional language.

<comment><USER9> It's true it's not nearly as ergonomic as haskell to pass around functions. You don't necessarily need to box the closure up on the heap in order to store a bunch of functions in say a vector though, it just needs to sit behind some kind of &, &mut, Arc, Rc, Box, etc.

I have seen a few hashmaps that store functions as values, in terms of real world uses.

You mentioned storing functions (closures here) in a vector, this isn't too much of a stretch I don't think:

        let x = |c| c * 2;
        let y = |v| v + 2;

        let b: Vec<&Fn(_) -> _> = vec![&x, &y];

Definitely not "no higher order functions" as you claimed.

<comment><USER8> By the same token, C "supports" higher order functions; you can pass around a function pointer and a pointer to a closure. It's sort of an idiomatic question; HOFs are inconvenient enough in Rust that no one really uses them outside of a few specific cases (like local maps and folds).

<comment><USER9> There's a wide berth between inconvenient, which is subjective, and not supported. HOF's exist in Rust, could the ergonomics be better; that's up for debate.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Speaking of Haskell, Yale, and the 1990s: I ported the 1993 release of Yale Haskell to run on top of GNU CLISP. It only required a couple of small changes. The code is here: [http://git.elephly.net/software/yale- haskell.git](http://git.elephly.net/software/yale-haskell.git)

</comment><comment><USER11> After learning Haskell, I found its approach to solving problems much simpler. I will admit that it was very unusual at first. Lens, monads, template Haskell, and a very powerful types system are the key features that make it standout.

<comment><USER12> IMO, if you just use C++ without subtyping (no inheritance) and only immutable structures, you get most of the "simplicity" of Haskell.

And with C++17 variant, you also almost get pattern matching.

(also, as per "powerful type system", you can do dependent types in C++)

<comment><USER13> Simplicity can never happen without enforcement. If there is no way to _automatically_ enforce the use of this simple subset of C++ then it's impossible to use it on a real project where you have more than 1 developer. A lot of people seem to think it's a trivial, handwavable exercise to come up with this subset - but no-one has ever managed to actually do it. [http://robert.ocallahan.org/2016/06/safe-c-subset-is- vapourw...](http://robert.ocallahan.org/2016/06/safe-c-subset-is- vapourware.html)

<comment><USER14> Is that a plus or a minus? If you're not a purity zealot, then you can step out of those rules where it makes sense, and regard the ability to do so as a plus. If you _are_ a purity zealot, you're appalled at the thought, and want to _force_ people not to do that.

<comment><USER13> I'm not a purity zealot, I'm a correctness zealot. Working on real projects means working with people who are less competent than they think they are; I want to _force_ those people to not introduce bugs, and I'm broadly indifferent to the mechanism for doing that.

</comment></comment></comment></comment></comment><comment><USER15> I really want to see the AWK geo-server implementation. I also want to know who the expert AWK programmer was. AWK is cool, don't get me wrong, but I don't typically think of it as a general purpose programming language.

<comment><USER16> It seemed like one of "I did it because I could" kind of projects. I've used awk to setup some complicated reformatting of text files that I needed cron but I've never even considered using it as a prototyping language. I wonder what kind of ADTs you can build using it and how viable it would be as the backend of a simpler scripting language.

</comment></comment><comment><USER17> This was 1994. Why did they pick AWK as an example language? Perl was already fairly mature at that point.

I happen to love AWK, but this is absolutely the wrong usecase for it: AWK is a highly domain-specific language, and using it here just makes scripting languages look worse than they are (and in the early 90s, scripting languages weren't that great).

</comment><comment><USER18> Previous submission on HN: [https://news.ycombinator.com/item?id=13251855](https://news.ycombinator.com/item?id=13251855) a few days ago.

</comment><comment><USER19> Disappointed that PDF wasn't one of the programming languages.

<comment><USER20> It would be great if that format were somehow Turing complete.

<comment><USER21> Well you can run JavaScript inside a PDF, so technically it is Turing complete.

<comment><USER22> From ~30s of searching, it looks like that's an Adobe Reader feature: [https://stackoverflow.com/questions/9219807/using- javascript...](https://stackoverflow.com/questions/9219807/using-javascript- inside-a-pdf)

My original comment was going to be "Who thought that was a good idea? Maybe there are reasons, but that sounds like a terrible idea at face value".

<comment><USER23> Chrome's builtin PDF reader supports it. You can even find a PDF that uses JS to play a game of pong in Chrome.

<comment><USER24> Well, out of all the places that makes sense, it's Chrome after all.

Either way, it sounds like a pretty bad idea to add this as a feature to Adobe Reader or somehow to the PDF spec. Especially since PDF remote code execution exploits happen relatively often.

</comment></comment></comment></comment></comment></comment><comment><USER25> > 1994

Probably not relevant anymore.

<comment><USER26> "Those who forget the lessons of the past..."</comment></comment>


"Just" - <AUTHOR> http://bradfrost.com/blog/post/just/ <comment><USER2> I have a similar relationship with "Just", but in the context of requirements/implementation at work. As in "can we just stick this thing in a DB?" "can we just add a checkbox to disable this flooby?" "can we just serialize it and be done with it?"

Each time I hear "just" when trying to find a solution to a problem (with always the next question being "how long is it gonna take?") I get suspicious and make a point of playing devil's advocate.

</comment><comment><USER3> I also try to avoid using "just" when asking things from other specialties - for example, asking the ops team to "just install Kafka" after reading one blog post about it.</comment>


Malicious URLs cause Git (v2.26.0) to present stored credentials to wrong server - <AUTHOR> https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q <comment><AUTHOR> Without upgrade, this might be exploited through package managers able to fetch from Git URLs (so NPM, Go Modules, and others).

</comment><comment><USER2> Xcode 11.4.1 came out today and it appears to contain the fix for this.</comment>


Simon Peyton Jones – Haskell is useless [video] - <AUTHOR> https://www.youtube.com/watch?feature=youtu.be&v=iSmkqocn0oQ <comment><AUTHOR> Original title seems like click-bait but the content is really good and to defend the title SPJ really puts Haskell in the useless category right in the video. Of course the more interesting thing is his way of classifying languages along two axes of useful/useless and safe/unsafe and that he sees a general trend of movement along the safe/unsafe axis.</comment>


Free Kindle EBook – DIY VPN and Smart DNS - <AUTHOR>

I put together an ebook using stuff scattered from the web and my own personal experience with modifying home routers and setting up VPN servers with Amazon AWS for streaming geo-blocked content from overseas.
It is free for the next 24 hours on Amazon:
http://www.amazon.com/DIY-OVERSEAS-ONLINE-STREAMING-BOOK-ebook/dp/B00TPRSKBA
I'd like to get some feedback on how to improve it for the next edition so please check it out - I look forward to your constructive feedback! <comment><USER2> Good and interesting book but why even consider DIY a Smart DNS when you have very cheap solutions?

I'm using [https://www.simpletelly.com/](https://www.simpletelly.com/) and they have a 2.5$ per mo. if you pay annually.

</comment><comment><USER3> The 90s clipart cover is really off-putting...

<comment><AUTHOR> Yeah...I've been feeling the same and will definitely invest more on the cover. I paid a whole whopping five bucks at fiverr.com and got exactly what I paid for. :(

</comment></comment><comment><USER4> That's going to be retro-cool in about 5 years...</comment>


How to be a very annoying communicator - <AUTHOR> http://jchyip.blogspot.in/2011/11/how-to-be-very-annoying-communicator.html

<comment><USER2> I've seen a lot of people in academia be guilty of an even more vicious form of "entrapment": delayed entrapment, where they lure you into saying everything is ok and let you dig your own grave, then come back a month later to bury you in it.</comment>


Understanding the 'Science' of Color - <AUTHOR> http://www.ptonline.com/articles/understanding-the-science-of-color <comment><USER2> Excellent article with a lot of practical process considerations. I've got a newfound appreciation for colorized polymers.

</comment><comment><USER3> This looks and reads like a keyword-heavy advertisement.

<comment><USER4> No, this is exactly what manufacturing engineers sound like when talking about thier trade.

It's a fascinating article full of details about the ways coloring plastics can go horribly wrong.

<comment><AUTHOR> I will doubly confirm that is what they sound like. Additionally, he is articulate in addressing the variety of considerations while at the same time not getting lost in the minutia of any one consideration, which is common.

I'm surprised and pleased to see an interest in some of the more technical aspects of materials and manufacturing.

</comment></comment></comment><comment><USER5> Every time someone uses the "Science Of" it's a trap.</comment>


BayesDB: Data science is a communication problem - <AUTHOR> https://www.oreilly.com/ideas/bayesdb-data-science-is-a-communication-problem?imm_mid=0e2279&cmp=em-data-na-na-newsltr_20160330 <comment><USER2> BayesDB and BQL are great ideas in theory. But the problem with building any "general" analysis tool to abstract away underlying complexity is that it must either be (a) a least common denominator solution, or (b) the proverbial hammer to which everything will look like a nail.

The reason why there are lots of different statistical methods is that different problems and different samples from different populations call for different approaches. And frequently the reason why a certain approach is invalid in a particular use case is subtle, difficult to explain, and easy to miss. Abstracting that complexity away from the would-be "scientist" is an invitation for them to develop unreasonable confidence in their results "because the model said so." We have more than enough of that attitude already, thank you very much.

<comment><USER3> I guess what you're trying to say is that BayesDB and BQL are leaky abstractions?

</comment></comment><comment><USER4> I think there's potential here, but the claims made in this article don't really hold for me.

I have no idea why BQL would help facilitate communication between domain experts, business analysts, and data scientists.

The parallel to SQL is telling:

Frankly, almost no domain experts waste their time on SQL and most business analysts have better tools suited for their common use cases. So why would these two groups get much out of BQL?

Plus it's another thing for data scientists to learn?

The three stakeholders mentioned in this article don't seem to really benefit from it.

Why not just use R? It solves the problem of communication with non-technical stakeholders through tools like Markdown, knitr, shiny, etc. It has a relatively long history of use, a supportive community, it's super easy to look up how to do things, etc.

I'm sure there are good reasons for BQL, but this article doesn't really summarize them.

</comment><comment><USER5> > The late Fred Brooks ...

Still alive, as far as I know.

<comment><USER6> Yep, certainly not dead! Recently retired, which is maybe the source of confusion...

</comment></comment><comment><USER7> Maybe this should be incorporated in SQL.</comment>


Building web applications for complete beginners - <AUTHOR> https://icanbuildwebsites.com/courses/cloud-based-web-applications-in-asp-net/ <comment><USER2> Title: Modern web applications in ASP.NET</comment>


GEOS 8-bit operating system - <AUTHOR> http://en.wikipedia.org/wiki/GEOS_(8-bit_operating_system)

<comment><USER2> Our family actually ended up with PC/GEOS (16-bit) at some point in 1993 or 94 or so. Wasn't really that neat to use though, we quickly gave up on experimenting with it and just stuck with DOS and Win 3.1.

</comment><comment><USER3> Memory lane this weekend. First the Amiga Unix article, now this. For us lucky C=128 owners, we could run GEOS or GEOS 128 which could use the C-128's 80 column mode (640x200). That was aspect ratio hell, 640x200 on a 4x3 screen meant you had noticeably rectangular pixels.

</comment><comment><USER4> But what about GSOS? [https://en.wikipedia.org/wiki/Apple_GS/OS](https://en.wikipedia.org/wiki/Apple_GS/OS)

</comment><comment><USER5> I installed GEOS on my father's C-64. I found it was surprising well done although not too practical.</comment>


[Mathematica] How do I draw a pair of buttocks? - <AUTHOR> https://mathematica.stackexchange.com/questions/66538/how-do-i-draw-a-pair-of-buttocks

<comment><USER2> That's the third time this has been posted in the last 9 days. [https://hn.algolia.com/?q=buttocks#!/story/past_month/0/butt...](https://hn.algolia.com/?q=buttocks#!/story/past_month/0/buttocks) .</comment>


In development: Guidance for Chronic pain assessment and management - <AUTHOR> https://www.nice.org.uk/guidance/indevelopment/gid-ng10069 <comment><AUTHOR> I'm submitting this because long term pain is sometimes discussed on HN, and there's confusion about how it's treated and the reasons for that. This is often seen in threads that talk about opioid misuse.

I wanted people who care about this to see this guidance as it's being developed.

NICE (National Institute for Health and Care Excellence) produces evidence- based advice for English health and social care providers. People can expect their providers to be following the guidance (although there's not much in the way of enforcing it).</comment>


Egypt has blocked encrypted messaging app Signal - <AUTHOR> https://www.engadget.com/2016/12/20/egypt-blocks-signal/ <comment><USER2> With XMPP and federated messaging servers they would have at least working infrastructure within their country.

But ...

What exactly happened that XMPP lost on mobile phones? What did they do wrong? XMPP was there before smartphones came, had working clients, and had (for that time) pretty decent encryption.

While I understand that big players like WhatsApp want to bind all users to their own infrastructure, I don't understand why even the niche instant messangers go through the burden of creating their own infrastructure (or relying on Google's) instead of just concentrating on the client side to provide better XMPP clients.

Is XMPP so bad that nobody wants to do that? If so, why?

<comment><USER3> > With XMPP and federated messaging servers they would have at least working > infrastructure within their country.

Why do you think this is true? I can't see how federation is an answer to censorship. They would simply censor access to all the XMPP providers, just as they're censoring access to all the non-federated messengers.

Is your idea that people would spin up new providers so quickly that the censors wouldn't be able to keep up? Every time people switched, they'd have to rediscover their entire social network all over again, and there's an asymmetry between how difficult it is to get everyone over to different hosts while rediscovering where everyone is vs how easy it is for the censors to add a single line to their block list.

It'd be way easier just to have a centralized host and have people switch VPN providers as they get blocked, since then they don't have to rediscover each- other, but that isn't a great user experience either.

Just like with metadata hiding, really effective censorship circumvention is going to require new protocols and new techniques, so we're going to be more likely to see those emerge in centralized rather than federated systems (that are by their nature difficult to update). I think we'll be able to respond in Signal very quickly.

<comment><USER4> > They would simply censor access to all the XMPP providers

First we already know this situation with email, and we see that as a federate protocol email is not censorable. At least not as easy to censor as Signal is.

Secondly it's not possible because their is not a finish list of providers. By the way 1) everybody should-could be its own provider 2) everybody must use its own domain name DNS to make addresses like greeting@name.

Solution for 1) [https://yunohost.org](https://yunohost.org) & [https://wiki.debian.org/FreedomBox](https://wiki.debian.org/FreedomBox) & [http://modoboa.org/en](http://modoboa.org/en)

2) for this point see [https://account.conversations.im/domain](https://account.conversations.im/domain) AND if the DNS is to centralize lets see for GnuNameSystem [https://gnunet.org/gns](https://gnunet.org/gns) for the address like greaing@name see [https://linuxfr.org/users/apichat/journaux/salut-toto- saluta...](https://linuxfr.org/users/apichat/journaux/salut-toto-salutation- regle-editoriale-et-nom-sur-internet)

<comment><USER3> > Secondly it's not possible because their is not a finish list of providers. > By the way 1) everybody should-could be its own provider 2) everybody must > use its own domain name DNS to make addresses like greeting@name.

Just to be clear, this is never going to happen. We do not live in a world where computers are for "computer people" anymore. I've been running my own mail server since 1995, and I would not wish it on anyone.

Running my own mail server has _not_ helped me with:

1) Metadata protection. Every email that I send or receive either has Google or Yahoo on the other end of it. Running my own mail server does not help me "own" my data at all.

2) Data protection. Federated protocols can almost never change (look at the history of IRC, XMPP, SMTP, HTTP). Email is stuck in time, which is why emails are still not encrypted. WhatsApp, on the other hand, had the freedom to deploy e2e encryption to over a billion people very quickly.

3) Censorship circumvention. Email is very easy to identify and filter using DPI. In a world where people are only doing host-based filtering, blocking 100 or 1000 hosts is no more difficult than blocking one. Whether or not there is "a finished list," if people can discover these services, so can the censors. It is much easier for the censors to add a single line to a block list than it is for people to switch to an entirely different provider with an entirely different namespace and try to rediscover all their friends.

If your idea is that every time a host gets blocked, everyone could move to a new one and somehow rediscover their entire social network, it would be _way_ easier just to use a centralized service and access it with different VPNs as they are successively blocked instead. That would prevent you from having to rebuild your entire social network each time, but is still a terrible UX.

<comment><USER4> > I've been running my own mail server since 1995, and I would not wish it on > anyone.

Yes but Internet still young and evolving. Here are modern solutions :

1) [https://yunohost.org](https://yunohost.org) 2) [http://cozy.io](http://cozy.io) 3) [https://wiki.debian.org/FreedomBox](https://wiki.debian.org/FreedomBox) 4) [http://modoboa.org](http://modoboa.org)

And even if everyone won't selfhost one's email or XMPP service, by owning one's domain name (DNS or GNS) he-she can switch from an hosting service to an other. And by owning one's own domain name, he-she wont loose contact with his-her social network. GNS is a good decentralize solution by separating name-identifier-locator [https://gnunet.org/gns](https://gnunet.org/gns)

We have to switch from old email-JID semantic user@host to the new one greeting@name and this is not a technical change [https://linuxfr.org/users/apichat/journaux/salut-toto- saluta...](https://linuxfr.org/users/apichat/journaux/salut-toto-salutation- regle-editoriale-et-nom-sur-internet)

> If your idea is that every time a host gets blocked, everyone could move to > a new one and somehow rediscover their entire social network, it would be > way easier just to use a centralized service and access it with different > VPNs as they are successively blocked instead.

This look like a joke. How many VPNs providers is there ? Won't be blocked ? The only thing you've done is post-pone the problem and save your centralize enclosing business.

With Signal and WhatsApp and other centralizes and enclosing social network precisely you have to rebuild your entire social network when the service go bankrupt / go wrong way or don't evolved / is compromize by intelligence agencies and law / is blocked.

Switching from Signal to WhatsAPP is very expansive because you need to rebuilt your social because you don't own your Internet name (DSN or GNS) nor a conversation address with the semantic greeting@name.

1) actuality this is not true and even if it was it could evolve. A google- centric world is not the end of history.

2) XMPP is an evolution of email and it solve many metadata and data protection problems. Conversations is a good modern solution [https://conversations.im](https://conversations.im) With Snowden revelations and the GAFAM domination many people do hard work to solve those problems, for example the IETF. It looks like you don't want to solve those problems because you want Signal to become a S for GAFAMS.

3) "blocking 100 or 1000 hosts is no more difficult than blocking one." Yes it is more difficult because censors have to discover all these hosts. They don't already now them. Big centralize and enclose social networks as Signal, Facebook or Gmail addresses with semantic user@host are gifts to censors and Intelligence agencies. We've saw it with Prism.

Finally is there perfect technical solutions for political problems ? No, no one is perfect, no one can solved political problems. But some of them are better than other, some make more difficult to censor and spy everybody. Big centralize solutions are the worst and are not "Internet" solutions but they are 20th century "Minitel" Telco bad solutions.

<comment><USER5> > Switching from Signal to WhatsAPP is very expansive because you need to > rebuilt your social [graph]

It's not and you don't, because your entire social graph is on your phone, in your address book. That's precisely the point. As the identifiers and contact lists are owned by the users and not by the messaging service providers, switching between messaging services (taking your social graph with you) is about as easy as it gets. See [https://whispersystems.org/blog/contact- discovery/](https://whispersystems.org/blog/contact-discovery/)

</comment></comment></comment></comment></comment></comment><comment><USER6> And this is why in _western_ countries the politics of encryption should be regarded as a stopgap only. It's better than allowing the police to opportunistically go fishing in your data, but it's no substitute for sound democratic rule-of-law culture.

If politics gets to the point of having to rely on encryption as your only protection then it's simply going to get banned and/or blocked.

<comment><USER7> That's true, and I think it means encryption not only protects speech but also works as a simple test for flagging nation states who're failing to protect the basic human right of privacy for their citizens. If a country tries to stop the use of encryption by its citizens then it's failing to do a good job, and its citizens (and other nations) should be working to make them aware of the problem.

</comment></comment><comment><USER8> Isn't it "weird" that they chose to block Signal app and not the signal- protocol based Whatsapp?

If Whatsapp really implements the same kind of security and privacy measures that Signal does, why is Whatsapp allowed to continue operating?

If signal is preventing them spy on users and they ban it, is in't it safe to assume that Whatsapp is NOT preventing them spy on users, so they let it operate? Wouldn't you expect Whatsapp to be also targeted, especially considering the broad user-base it has compared to Signal?

Yes, I know they had blocked Whatsapp in the past, but they didn't block it now. Which means that something has changed in the relationship of the Egyptian gov and Whatsapp since 2015.

<comment><USER9> I believe WhatsApp encryption is not enabled in Egypt.

<comment><USER10> WhatsApp Encryption is enabled in Egypt - source: I live in Cairo.

</comment></comment></comment><comment><USER11> Due to cutting ties with Google and Facebook as much as possible I don't use Signal nor WhatsApp. What alternatives are there?

I have been using Tox (qTox on Desktop and Antox on phone) and XMPP (Conversations on phone). I also tried Ring (Desktop and phone)

My observation is that there is a lot of user inertia to make people use another chat app, and none of which I tried is in good shape to compete right now with WhatsApp/Signal.

XMPP and Ring share the problem that encryption was an afterthought. That alone is enough to stop widespread adoption. There must not be unencrypted chats nor different security levels. Encryption must be transparent to the user.

Tox doesn't share that problem, and is what I have the highest hopes for. The clients are not yet able to compete with WhatsApp. Antox crashes sometimes, gets reaaaal slow, and doesn't send pseudo-offline messages reliably. Multi- Device support and real offline messaging is still lacking in the protocol. Multi-Device support is not needed, see WhatsApp, but real offline messaging is a must-have. Also, messages must be reliably delivered and in the order they are intended. Tests of mine between qTox and Antox showed problems in that regard.

<comment><USER12> Maybe you have reasons, but your comment doesn't make it clear why cutting your ties with Google and Facebook means dropping Signal.

Google and Facebook started using the same protocol as Signal in the latest versions of their messengers, but they don't interact in any way.

By the same logic you should also stop using HN because it also uses HTTP, just like those big guys.

<comment><USER11> You can't use Signal without GCM or its siblings on other platforms. I don't have Google's Apps on my phone, so there is no GCM.

Using GCM voids your contact privacy. So Signal right now is a no-go.

I do care about whether Google knows who I contact and when. I don't want Google to know.

<comment><USER13> Moxie is open to someone writing an alternative to GCM, but nobody has stepped up and do it. It's much easier to complain about GCM, then to replace it.

Signal's use of GCM does _NOT_ reveal who you are sending signals to, or what is in the message.

<comment><USER11> I didn't mean to critique anybody, but just pointed out why a specific solution is not okay for me. Take it as an assessment of the situation to understand what we have and were we want to go.

I might be ignorant about GCM. My understanding is that first you need to register with GCM and have the connection stay online permanent. That requires Google's Apps, which open the system to Google's Access, which clearly is not acceptable. Secondly, Google knows that way always where I am. I do not want a permanent connection to Google servers. Also, how does GCM know where to deliver my messages when it can't know who I'm contacting? I'm not saying that that is an impossible task, but to my knowledge Google isn't reliably (reliable in the sense of keeping my privacy even if Google were to become the attacker) solving it. [0]

Each of the three reasons given above are enough to not use GCM.

[0] [https://developers.google.com/cloud- messaging/gcm](https://developers.google.com/cloud-messaging/gcm)

<comment><USER11> OK, if GCM delivers the data to Signal's servers, then Google doesn't know who I'm contacting, but the administrator of Signals server does. The two other points stay valid, though.

</comment></comment></comment></comment></comment></comment><comment><USER14> It's not clear to me why Signal was blocked, though. Other governments have blocked messaging and chat applications before, but not for the reasons you'd think. For example, UAE blocks access to voice and video chat applications to protect the commercial interests of the telecoms companies who offer similar services. I'd be curious to know if other messaging applications were blocked in Egypt too, and why.

[http://www.thenational.ae/uae/uae-telecoms-companies-told- to...](http://www.thenational.ae/uae/uae-telecoms-companies-told-to-free-up- internet-calling)

<comment><USER10> Skype voice over 3G is blocked here in Egypt.

</comment></comment><comment><USER15> What do people think about Telegram's ([https://telegram.org](https://telegram.org)) security vs Signal?

<comment><USER16> I'm not sure if you're joking, as the topic has been extensively discussed here in HN for the last six months, at least.

Anyway, in short: encryption-wise Signal is considered to be the state of the art, while Telegram is sneered at due to their homegrown encryption that isn't even enabled by default.

</comment></comment><comment><USER17> I can't say this is surprising, I was talking about the potential of Signal to be blocked by regimes with my friends a few weeks back (both the initial verification text, and client to server communication), and here we are with Egypt being the first to block it.

</comment><comment><AUTHOR> I'm curious as to how they intend to circumvent the censorship from their end.

<comment><USER14> Moxie just committed circumvention support earlier today. Here's the commit:

[https://github.com/WhisperSystems/Signal- Android/commit/5417...](https://github.com/WhisperSystems/Signal- Android/commit/541718fd114a6f2336222a571869e1056cd122dd)

</comment></comment><comment><USER18> This wouldn't be such a problem if Moxie hadn't removed the ability to communicate using SMS.

SMS is federated and very difficult to block without disrupting essential services.

See: [https://github.com/WhisperSystems/Signal- Android/issues/2818](https://github.com/WhisperSystems/Signal- Android/issues/2818)

Of course going the route of using centralized services allows later monetization my Moxie and his brogrammers.

<comment><USER19> A little harsh, isn't it? They have several good arguments for ditching SMS, as explained here: [https://whispersystems.org/blog/goodbye-encrypted- sms/](https://whispersystems.org/blog/goodbye-encrypted-sms/)

Especially this one:

SMS and MMS are a security disaster. They leak all possible metadata 100% of the time to thousands of cellular carriers worldwide. It's common to think of SMS/MMS as being "offline" or "peer to peer," but the truth is that SMS/MMS messages are still processed by servers--the servers are just controlled by the telcos. We don't want the state-run telcos in Saudi, Iran, Bahrain, Belarus, China, Egypt, Cuba, USA, etc... to have direct access to the metadata of TextSecure users in those countries or anywhere else.

<comment><USER20> Yet, Signal leaks the exact same metadata, if one serves an NSL to OWS.

In a way, Moxie's argument (don't tie things to phone numbers, don't use a centralized system for message transport) is exactly why Signal itself is so problematic.

<comment><USER13> Whisper systems did get a subpoena: "the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service."

[https://whispersystems.org/bigbrother/eastern-virginia- grand...](https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/)

<comment><USER20> Retroactively, yes. But the NSA could just require them to log all messages they relay between any two users – and they'd get the same metadata as from TextSecure.

</comment></comment></comment></comment></comment><comment><USER21> Geez, if only there were a protocol with as good encryption but federated so that everybody could host their own server which would make it way harder to block…

[https://xmpp.org/extensions/xep-0384.html](https://xmpp.org/extensions/xep-0384.html)

<comment><USER17> Eh, you'd have to operate a server in the country, and TLS in and out of Egypt is MITMed and outright blocked in many areas from what I've seen when playing with VOIP over there.

<comment><USER2> At least they would have proper encryption within their country. Apparently, depending on central services outside their country makes it too easy to block.

<comment><USER17> Then you have to deal with regulations inside the country itself, I doubt its a free for all inside Egypt network wise.</comment></comment></comment></comment>


LONDON: Need a little help - <AUTHOR>

So I've seen a few posts like this on here over the years (I'm an avid reader, though not much of a reader) and thought it is maybe my time for a go.
My name is Gary, I'm a 23 year old Software Engineer who moved to London from Scotland 3 months ago, I work at a really small development company which I love, but it is mainly remote workers or older guys with family's. Having never been to London before, I don't have many roots here and have two friends from back home who moved here not long before me, but they have picked up new friends from work/flatmates and have started to develop their own friend groups, like they should.
Unfortunately I've not been graced with these circumstance. I'm aware these things can get pretty bad, and I'm determined to not let it go that way. I'm not used to feeling lonely as I had a great friend group back home but I feel that it's starting to get me down. I've contemplated leaving and going back home, but that is something that I really don't want to do. I do love London.
So really what I'm asking - is there anyone around Central London who would want to meet up for a coffee or a pint? I'm just a generally chatty Scottish guy who is looking to meet some new people. <comment><USER2> Hey! I have a very similar story to yours, Scotland Edinburgh, same age, moved 6 months ago to London, software dev working in a startup :)

There are many ways you can build your friend circles in London.

Few things I do myself: attend many meetups with relevant topics to my hobbies and career path; occasionally work on my projects in London Hackspace ([https://london.hackspace.org.uk](https://london.hackspace.org.uk)) where I meet MANY awesome people :) (p.s. LHS has an open social night, check it out)

Hope this helps to get started!

<comment><AUTHOR> That sounds awesome! Thanks for the help</comment></comment>


Does Your Domain Have a Registry Lock? - <AUTHOR> https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/ <comment><USER3> Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it.

That's it.

It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to ask them to manually move domains.

(p.s. That is _not_ some kind of dare to hackers! I am not suggesting you prove me wrong.)

<comment><USER4> The no humans thing also just closes off any path for exceptions that occur outside of what is coded.

I bought a domain for a blogger blog ages ago. At the time google had no domain registry so they partnered with some company.

Years later and google starts hammering me with "hey your credit card is expired we're not going to renew your domain" ...

Fine right?

"Hey go update your payment information on admin.google.com"

Wait. I don't have a g-suite account... and on my personal account my payment info is up to date, so I figure maybe they migrated my email address or emailed me about it but nope.

Then comes circular system where if you forgot X you need Y and if you don't have Y you need X and links on pages that always lead to admin.google.com...

There was no place to find / get help from google. Blogger seems like the information there is wrong / hasn't been updated / abandoned. Just links that ran in circles.

I found the old registrar they partnered with and got them to help.

With Google as far as I could tell there was no way to resolve the issue in a situation where I"m even trying to give them money (granted a nominal amount).

<comment><USER5> Yep, similarly here. eNom successfully "extorted" $300 from me due to it. My fault ultimately in the end though. But it was a stressful couple days, and eNom and Google partnership soured my view of both of them. I no longer do business with eNom.

<comment><USER6> What happened, if I may ask? I use both enom and google...so, I am curious...

<comment><USER7> Just guessing, but the "extortion" fee's are likely due to renewing the domain after it has 'expired', during one of the last chance renewal phases.

[https://help.enom.com/hc/en- us/articles/115003360647-Renew-E...](https://help.enom.com/hc/en- us/articles/115003360647-Renew-Expired-Domains-During-Reactivation-Period)

[https://www.enom.com/kb/kb/kb_1487-last-chance- renew.htm](https://www.enom.com/kb/kb/kb_1487-last-chance-renew.htm)

There is a whole process via which domains expire, they do not simply become available to register upon their 'expiry' date.

Full process is outlined here: [https://tee-solutions.com/index.php/our- blog/127-domain-name...](https://tee-solutions.com/index.php/our- blog/127-domain-name-step-by-step-expiration-process)

<comment><USER8> >"extortion"

Why the scare quotes?

<comment> kube-system The person you're replying to is quoting another comment above and I am guessing they might not agree with the legal connotation the word carriers.

<comment><USER8> I guess, it does fit the common dictionary definitions though. Other companies in the space do not charge such fees.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar.

"Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for all of .ca) to enact a registry lock. This explains it a bit better: [https://cira.ca/ca- domains/optimize-your-ca/registry-lock](https://cira.ca/ca-domains/optimize- your-ca/registry-lock)

I'm having trouble tracking down how to do this for a .com though.

<comment><USER10> > that's easily removed by social engineering the registrar.

I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

<comment><USER11> Quite interesting. How did you do that and what did it take (cost, time, effort)? NearlyFreeSpeech.net started off on this a couple of years ago, and it seems like this is a very costly proposition (something like $80K for accreditation?) that also takes a lot of time.

<comment><USER10> The trick is to forgo ICANN scam and go with a ccTLD. With TRAFICOM (ex FICORA), it was a matter of filling a form. There could have been a small nominal fee but if there was, it must have been very low (under 100 eur).

</comment></comment></comment></comment><comment><USER12> PM at a large, retail domain registrar here.

Registry Lock isn't something most retail registrars will offer, because generally, the vast majority of registrants don't really need it. It's not something you can just put into your domain management panel and roll out to everyone because of all the hoops required once enabled.

That said, Brian Krebs does need it on his domain(s) for obvious reasons - <USER2> domain is a massive target for hacking - and so it's enabled on his domain with specific procedures around how updates happen when required which I won't get into.

Beyond Registry Lock, the best way to secure your domains is to have them in an account with a random username (prevents guessing to aid in social engineering vs. "firstlast" or "flast"), a strong password and 2FA. Perhaps consider a unique account email address that you only use for that registrar account since losing control of that could result in losing control of your entire domains account and all the domains in it (assuming you didn't use 2FA).

On the Registrar side, look for one with good protections to ward off social engineering against the account and domains. In our case, we have a system that requires the account holder's specific consent (obtained via account email) to have a support person view personal information or access the account.

<comment><USER13> This does not seem like a sound philosophical security posture -- that only domains who are "massive targets for hacking" should use Registry Lock.

<comment> kube-system Security and usability is always a compromise. Otherwise we'd all use one-time pads for everything on the internet.

<comment><USER14> The public will soon find out that we should.

</comment></comment></comment></comment><comment><USER15> So according to the article, there is:

1) "registrar lock" \- a service that requires the registrar to confirm any requested changes with the domain owner via whatever communications method is specified by the registrant.

2) "registry lock" \- with a registry lock in place, your registrar cannot move your domain to another registrar on its own. Doing so requires manual contact verification by the appropriate domain registry.

So... I assume the "lock thingy" within most registrars' interfaces (I'm familiar with the one within Namesilo, the registrar I use), is the less restrictive "registrar lock" ?

<comment><USER16> Yes, generally the lock you see is the simple registrar lock.

</comment></comment><comment><USER17> For really important domains, there was MarkMonitor, the high-end registrar. But they've been acquired by an analytics company, so now it's necessary to wait a few years to see if they are still trustworthy.

It's useful to trademark your domain name. That gives you a very likely win if things ever get to the ICANN dispute process.

<comment><USER18> Cloudflare has an Enterprise registry service. If I remember correctly, you can create the ruleset that must be followed before allowing a transfer.

</comment></comment><comment><USER19> Confused, how do you get a registry lock then? Do you have to email your registrar? Why is there so little info on this? Or is this the same thing as clientTransferProhibited that is often provided?

<comment><USER20> You have to deal with the registry directly. Otherwise it's kind of pointless if registrar itself can lock/unlock it.

I have registry lock. I just asked my national domain registry to lock the domain. All that was needed was a strong proof of identity. (not just a photo of an ID, but doing a physical verification in person somewhere, like on the post office or sending a notarized letter) It was free.

But this is a national domain, where I have a high trust in the registry itself (registry manager makes the Turris router, btw, and some key software like knot dns server, etc), and that's also the reason why all my important stuff is linked to this domain.

<comment><USER21> No, some registrars are still the one that manage the communication with the registry. A big reason for the registry, registrar and registrant model is so that the registry do not interact directly with customers.

It also depend on the type of registry. .se for example allow registrars to set registry lock automatically but not unlock. Unlocking is a manual process and there is contractual conditions that the registrar must have verified the identity of the customer who is requesting the unlock, and the registrar must also sign to that fact. So far no registrar has failed yet to do so, thus the legal ramification of failing this has yet to be tested.

<comment><USER20> Different countries, different rules.

</comment></comment></comment></comment><comment><USER22> > With a registry lock in place, your registrar cannot move your domain to > another registrar on its own. Doing so requires manual contact verification > by the appropriate domain registry, such as Verisign — which is the > authoritative registry for all domains ending in .com, .net, .name, .cc, > .tv, .edu, .gov and .jobs.

Putting a 'registry' lock into place has upside and downside. As mentioned in the story the downside is in an emergency it's harder to make a change because of the friction of another step to make a change (and that means any change even DNS servers).

That said it still doesn't prevent social engineering. The implication in the article is that if you social engineer a CSR at a registrar the registrar having to have another step to get a domain unlocked (contact the registry ie in the case of .com et all Verisign) then someone will say 'hmm let's be sure on this'. In theory why would this happen? Once someone has been social engineered that's that, right? (I mean sure it's another step and sure that could mean someone thinks more but...)

Now let's say you take care of a domain using registry lock. What is the tradeoff if someone gains access to your dns servers and you need to change those servers but you can't do that easily because a domain is registry locked and now you need to depend on a registrar to contact the registry and get that done. How quickly will that happen?

My point is it's not a non-trivial decision to make at all and the downside has to be taken into consideration.

One last point. There are procedures in place if a domain is transferred to another registrar to get it back to the original registrar. The best advice is to setup some kind of manual monitoring (not dependent on a registrar) where you periodically check the registry whois for the domain and note any changes to it (dns or otherwise).

</comment><comment><USER23> I'm not able to find a registry lock on google domains. There is a lock feature but i'm assuming that is a registrar lock

<comment><USER24> Probably because the manual management of these requests is relatively expensive.

<comment><USER25> Yeah, CloudFlare is one that offers it, but it seems firmly in "Request Quote/Call Sales" territory for pricing. It dates from when they first intro'd their original registrar offering [1] a few years ago, and they said right out:

> _" CloudFlare Registrar is not designed for the masses. There are plenty of > great mass-market registrars. However, if you're an organization where > losing your domains would be a front-page story, then CloudFlare Registrar > is for you."_

Of course, they later did introduce a mass market offering as well, but not with that set of features! :)

\----

1: [https://blog.cloudflare.com/introducing-cloudflare- registrar...](https://blog.cloudflare.com/introducing-cloudflare-registrar/)

<comment><USER11> Tangent: The mass market offering from Cloudflare does not have a way to buy/register a new domain. It's been way too long since that offering was made public and it's still stuck with just transferring domains from another registrar into Cloudflare.

</comment></comment></comment></comment><comment><USER26> I was never aware of this, and it appears only a tiny handful of TLDs support it. I think BK is overstating the case:

> a more stringent, manual (and sometimes offline)

How is it more stringent? Who's to say the registry (eg verisign) will do any more stringent of an unlock process than the registrar?

<comment><USER27> I've managed domains witha registry lock. It may depend on the registry, but when my boss didn't answer the validation call, the domain didn't get unlocked and we had to wait for the next day's change window (and remind the boss to pick up the phone) to get our nameservers changed.

I'm sure it's still possible to social engineer (it's a human driven process), but there are a lot fewer people authorized to make the changes, and they're probably better trained.

</comment></comment><comment><USER28> Ah yes, domains, my dad registered a domain for me and when he passed away; we missed a payment and the registrar swiftly decided to release the domain and now I lost it. Gone is my [firstname].com now the current owner of the domain tries to buy [firstname] from me on insta, twitter etc.

<comment><USER29> Names are hard, I was pretty bummed when I stopped being able to use swiley in #bitcoin-otc (I think because I lost a key or messed up with the nickname server)

</comment></comment><comment><USER30> This is about a Dutch registrar being social engineered. I specifically chose a Dutch registrar for my Dutch company, thinking that it would be so much harder for non-Dutch people (99% of the world) to social engineer a Dutch registrar. I guess not.

</comment><comment><USER31> I usually register my important domains for several years in the future, and have the register lock on. Some registrars call it transfer lock.

I also Backorder my own domains on namejet, GoDaddy, etc just in case they ever do expire there's still a chance to get them back.

If only there was a company that offered domain name insurance, to make sure you never lose your domain, it's never stolen, dns isn't hijacked, and the site never goes down (ddos attacks, etc.).

<comment><USER32> Ideally you would want your registrar to offer the insurance.

</comment></comment><comment><USER22> > had already protected their domain with a "registrar lock," a service that > requires the registrar to confirm any requested changes with the domain > owner via whatever communications method is specified by the registrant.

Wrong. That is not true. Although some registrars might 'confirm any requested change' that is neither ubiquitous or required by ICANN etc.

</comment><comment><USER33> Safenames provides a registry lock service for about 500$ per year. Cloudflare and Markmonitor cost thousands.

</comment><comment><USER34> Same thing happened to the high profile domain Sex.com by sending a fax. It was almost impossible to get back, and the criminal made millions in the meantime.

[https://en.m.wikipedia.org/wiki/Sex.com](https://en.m.wikipedia.org/wiki/Sex.com)

</comment><comment><USER35> this is one of the things that Russians got right; you had to show up in person (and show your passport), or provide a notarized sale contract, if you want to transfer a .ru domain. At least that's how it used to be, could be different now

</comment><comment><USER25> DNS takeover is a huge issue, but some kinds of mitigation like Registry Lock (as opposed to _Registrar Lock_ aka clientTransferProhibited) also seem to be fairly inherently pricey. It requires multiple actual humans involved, like for .com having the right person actually pick up the phone at the registrar and get in touch with Verisign. Cloudflare offers it for example, but only for their enterprise class Custom Domain Protection [1] service, which they explicitly describe as "high touch" or "very manual", since the whole point is that it's a fully offline/out-of-band communication requirement.

In principle it seems to me that there could be a "per-incident" price model that would more accessible to more general DNS users who setup their core domain DNS and touch it once a decade, where a flat upfront $200 payment (spit balling) enables Registry Lock and two uses, after which the fee must be paid again for more. The idea here is that you'd directly be paying the $100/hour or whatever it costs a couple of engineers to take time for this each time, on the logic you'd be using it very infrequently. This would avoid ongoing subscription costs which might be easier to justify for non-enterprises, while still being feasible for a registrar. I don't know of anyone who does this though.

A lot I think ultimately really does come down to the registry itself and their specific security practices, as well as fundamental tensions between stopping alterations by unauthorized people while enabling recovery by authorized-but-forgot-password-or-token-broke-or[...]-people. Supporting hardware factors for example is great, but if support can just override them that's a hole. Conversely there needs to be some fallback procedure for if a token breaks (maybe a super long key written down and put in a vault, maybe based on payment information). Some methods can be real footguns too, my current registrar for example offers IP address/range restriction options, but it's not hard to see how that could come back around to bite you in the butt in an emergency if not used quite carefully. It's one of many tough problems due to the ongoing primitive state of electronic authentication I guess.

 _Edit to add_ : useful direct quote on Register vs Registry Lock from their initial enterprise-only CloudFlare registrar launch [2]:

> _" Many registrars support Registrar Lock, which prevents the registry from > altering information unless the lock is explicitly removed. The problem is, > if an attacker compromises your registrar account, they can unlock it and > make whatever changes they want._"

> _" Registry Lock prevents changes by any registrar until the lock is > removed. Unlocking at the registry level requires out-of-band communication > between the registrar and Verisign (the global registry operator for several > top-level domains), and is thus very manual. Since most registrars are > volume operations, it's very difficult to find one that takes the time to > literally pick up the phone and call Verisign every time someone makes a > change to their DNS settings."_

So yeah I'm sure that stops attackers real well, but not exactly scalable. "[I]f you're an organization where losing your domains would be a front-page story..." indeed!

\----

1: [https://www.cloudflare.com/products/registrar/custom- domain-...](https://www.cloudflare.com/products/registrar/custom-domain- protection/)

2: [https://blog.cloudflare.com/introducing-cloudflare- registrar...](https://blog.cloudflare.com/introducing-cloudflare-registrar/)</comment>


Death technology will allow to bring back the dead, digitally - <AUTHOR> https://qz.com/896207/death-technology-will-allow-grieving-people-to-bring-back-their-loved-ones-from-the-dead-digitally/ <comment><USER2> Putting aside the philosophical implications, on a technical level this is still a complete fantasy. A good heuristic I like to apply to these kinds of sensationalist articles is to ask how much of the human brain we really understand. The answer is almost none, so recreating it in digital form, faithful to a specific person is science fiction.

What happened to Quartz? These days the articles are such crap.</comment>


Detroit's salt mine: City beneath the city - <AUTHOR> https://www.detroitnews.com/picture-gallery/news/local/michigan-history/2020/01/26/detroit-salt-mine-city-beneath-city/4523991002/ <comment><USER2> Seeing those pictures makes me feel so sad. My Dad worked in sales for Morton Salt. Morton's mine was across the river in Windsor, Canada. Dad went there on a regular basis taking clients down for tours. As a kid growing up I heard so many crazy stories about the place and I was intrigued.

But you had to be sixteen to enter the mine so my Dad said I'd have to wait. I was so interested that when I turned fifteen I told him that I wanted to go down in the mine on my sixteenth birthday and he agreed.

However that year there was a big collapse in a mine in Louisiana that was under a lake. An oil company got mixed up and drilled down into the mine. The water entered through the hole draining the lake. Though the workers miraculously survived the payouts by the insurance companies were huge.

[https://en.wikipedia.org/wiki/Lake_Peigneur#Drilling_disaste...](https://en.wikipedia.org/wiki/Lake_Peigneur#Drilling_disaster)

So then the insurance companies, stunned by the large payouts, banned anyone who wasn't an employee from the mines. Seeing those pictures just brings back all the disappointment.

<comment><USER3> In Colombia there's a great big salt mine just an hour outside of the capital city Bogota, Zariquipa, that has tours, they're ~$15. Highly recommend. It is low quality, darker salt, but it's pretty neat. Tickets to Bogota often run sub-$500 usd from the US if you shop around.

<comment><USER4> Typo; it's Zipaquirá. The mine dates back over 200 years and the main attraction is the Salt Cathedral.

(My mother was born there.)

<comment><USER2> I've got a college friend in Bogota. Now I have two reasons to go see him ;<).

</comment></comment></comment></comment><comment><USER5> For the EU people: [https://archive.ph/YRBZ8](https://archive.ph/YRBZ8)

<comment><USER6> Gives a cert mismatch warning (with a Cloudfare cert) and then show 403 / Forbidden.

<comment><USER7> Do you happen to use CloudFlare's DNS (184.108.40.206)? They have quite a long- standing [1] issue with archive.is. (or the other way around depending on your opinion)

[1]: [https://webapps.stackexchange.com/questions/135222/why- does-...](https://webapps.stackexchange.com/questions/135222/why- does-1-1-1-1-not-resolve-archive-is/135223#135223)

<comment><USER8> If you're using Firefox, also check whether you're using DNS-over-HTTPS (DoH) with Cloudflare. It's in Settings -> Network Settings -> Enable DNS over HTTPS.

</comment></comment></comment></comment><comment><USER9> I like what appears here to be an overhead-electric system catenary system:

[https://www.gannett- cdn.com/presto/2020/01/20/PDTN/dd7f14d1-...](https://www.gannett- cdn.com/presto/2020/01/20/PDTN/dd7f14d1-937d-4f68-9ecd-862a32908773-27.jpg?width=1280)

</comment><comment><USER10> I went down to these mines on a school field trip as a child 30+ years ago. I can almost remember it like it was yesterday, even the smell, and the surprising warmth despite it being the dead of winter outside. I kept a chunk of salt I brought back under my bed for years after that.

<comment><USER11> Why did it have such a significant impact?

<comment><USER10> Well, I was about 8 years old, so it was just ... neat I guess. In a creepy movie kind of way. I remember it being very yellowish but maybe that was the color of the lights.

Also I've never been in a mine since then.

</comment></comment></comment><comment><USER12> The convenience of the location is great. Lots of salt is needed to deice all the roads in the Detroit/Michigan area. The main purpose of the salt there is for deicing. Saves a bunch on transport costs.

[https://en.wikipedia.org/wiki/Detroit_salt_mine](https://en.wikipedia.org/wiki/Detroit_salt_mine)

<comment><USER13> Road salt destroys cars, but hey, Make Detroit Great Again (MDGA)!

The drawback with sand is that it doesn't dissolve in water, so silts everything up.

<comment><USER14> What is the alternative? Roads that become icy probably destroy cars as well, although in a more pinpoint kind of way. At least road salt doesn't cause a lot of fatalities.

<comment><USER15> Electric coils under the pavement to keep the surface temperature above freezing. Unfortunately most cities can't afford it, least of all Detroit.

<comment><USER16> Which cities use that technology?

<comment><USER15> Holland, Michigan for one:

[https://www.mlive.com/business/west- michigan/2016/02/why_hol...](https://www.mlive.com/business/west- michigan/2016/02/why_holland_spends_millions_to.html)

<comment><USER17> As the article states, this system uses waste heat from a power plant transported via water.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> For other nice salt mines you can take a look at Wieliczka Salt Mine: [https://www.krakowcard.com/blog/amazing-pictures- wieliczka-s...](https://www.krakowcard.com/blog/amazing-pictures-wieliczka- salt-mine)

It was run since 13th century till 1996

Also another salt mine that was also used across many centuries lies just around the cordner: Bochnia Salt Mine ([https://en.wikipedia.org/wiki/Bochnia_Salt_Mine](https://en.wikipedia.org/wiki/Bochnia_Salt_Mine)).

</comment><comment><USER19> I don't get any article, only this banner about the EU version

> Welcome to The Detroit News's EUROPEAN UNION EXPERIENCE

Anyone got a link working outside the US?

<comment><USER20> [https://archive.ph/YRBZ8](https://archive.ph/YRBZ8)

</comment></comment><comment><USER21> How has this not been turned into an underground bunker city?

[https://youtu.be/ybSzoLCCX-Y](https://youtu.be/ybSzoLCCX-Y)

</comment><comment><USER22> In Cleveland there is a similar mine that extends far out beneath Lake Erie. Always wanted to get a peek but visitation is practically verboten.

</comment><comment><USER23> The article mentions that the salt was originally used for food. I'm curious how, or if, they prevented contamination from things like machine oil or other artifacts of mining.

<comment><USER15> Salt is often purified by dissolving it in water and precipitating NaCl back out.

This process doesn't always make sense economically, so it's understandable that Detroit uses their own salt for deicing and imports food-grade salt from places where it's cheaper to make. Or maybe in the past they just didn't care about a bit of contamination.

</comment></comment><comment><USER24> There is a salt mine in Kansas that has a good tour.

[https://www.underkansas.org/](https://www.underkansas.org/)

</comment><comment><USER25> I would love to see the remains of these used for underground food farms, like described here: [https://www.bbc.com/news/uk- wales-46221656](https://www.bbc.com/news/uk-wales-46221656)

I'm not sure how well that would work alongside the existing salt mining operations, though.

</comment><comment><USER26> On an aside, that automatic EU-page redirect has got to be one of the worst patterns I've seen so far as a reaction to gdpr ...

<comment><USER27> I am honestly amazed at all the inane crap that the media throws at us. I guess a generic redirect to a generic "EU-page" is still better than putting up 5 popups in my face asking me to subscribe and set "cookie preferences" (which takes me to another 3 levels of windows with sleazy anti-patterns, and clicking "Save" displays a spinner for 3 minutes).

<comment><USER28> That "three minute save spinner" is the most puzzling of all. There is absolutely no upside for the site owner in making the user wait pointlessly and it seems to be exclusive to US sites. European sites tend to be content just having that little unobtrusive "yeah right, it's fine" footer/header, perhaps with some color button trickery for steering users to the non-minimal option. Which isn't exactly nice but surely not a hill to die on. My guess is that those "three minute spinner" implementations are expensive third party compliance plugins that deliberately make the problem they solve look much harder than it actually is.

<comment><USER27> I suspect the spinner and the wait, like the wild labirynth of confusing "options" you have to wade through, are all a part of a strategy to discourage people from clicking anything else than "yes, I agree to everything, use me in any way you desire, just show me the article".

I think people who design and implement these sleazy dialogs should be ashamed of themselves.

</comment></comment></comment></comment><comment><USER29> Is there urbex down there? Seems pretty tempting.

</comment><comment><USER30> Cosmic say detector? Offline storage? Salt is pretty stable, maybe glassified radioactive waste?

<comment><USER31> Funny enough, Portal 2 takes place in an old Michigan salt mine

<comment><USER32> Interestingly, in real life there are no salt mines in Upper Michigan, where the main Enrichment Center is located. There are plenty of other mines, though.

Maybe all of those old test chambers were vitrified in salt instead of just concrete, come to think of it...

<comment><USER3> There's a 14 mile underground submarine communications system in upper Michigan. Despite being hundreds of miles from the nearest ocean, it could contact submarines all over the planet: [https://en.wikipedia.org/wiki/Project_Sanguine](https://en.wikipedia.org/wiki/Project_Sanguine)

At it's peak the system used ~3MW power plant to run the system.

<comment><USER33> Just a note that while there _are_ [1] 3 transmission lines of 14, 14 and 28 miles in the UP, the lines themselves were mounted on (essentially) telephone poles. The end of each line does have 1 to 3 miles of buried horizontal ground wire though and an array of 100 to 300 foot deep bore holes.

[1] or at least were; the project was shutdown in 2004 and while the paths of the antenna lines still seem to be visible on satellite photos[2] it looks like the lines themselves may have been removed.

[2] The transmission station itself is at [https://goo.gl/maps/q5BwduBqbBpAaf1L9](https://goo.gl/maps/q5BwduBqbBpAaf1L9) with the 28 mile antenna segment running roughly north south just to the west, one 14 mile segment running east-west a little to the north of the facility and the second to the south.

</comment></comment></comment></comment></comment><comment><USER34> The salt deposit is a relatively flat seam with an average thickness of 26feet

</comment><comment><USER35> Reminds me of Duckburg

</comment><comment><USER36> Link is broken, it redirects to the .eu subdomain :(</comment>


Ask HN: Resumé review service? - <AUTHOR> Is there any community or service that does constructive resume review for software engineers?<p>Ideally something not US-centric but with more of a global vision? <comment><USER2> I would look at other resumes in your industry/career type and see where yours can be improved.

</comment><comment><USER3> I thought self-promotion is verboten here. Check out my email if you wish to have a conversation.

</comment><comment><USER4> i guess if you just posted yours here, you would get a ton of feedback here</comment>


Hunting submarines with magnets - <AUTHOR> http://www.economist.com/news/science-and-technology/21709948-new-way-detect-even-quietest-boats-hunting-submarines-magnets <comment><USER2> Ah, I thought it might be an article about the magnets that the Canadians literally dropped on submarines! [https://warisboring.com/nato-bombed-soviet- submarines-with-t...](https://warisboring.com/nato-bombed-soviet-submarines- with-tiny-annoying-magnets-ba11cfb5578d)

<comment><USER3> Oh, they gave them up because they were too effective on subs in training?

This is a ludicrous article. NATO must have these ready and waiting.

</comment></comment><comment><USER4> If this works, that would be cool. However, these defense contractors are incentivized to make it seem like something is working so that they beat other contractors to follow-on funding. That doesn't necessarily mean that they are close to making it production-ready for a Navy boat.

SQUID is tough technology. It takes liquid nitrogen or liquid helium to get them cold enough to superconduct. A tank of liquid nitrogen is easy enough to take on a boat, though.

The devices are so sensitive that you can rotate a cheap one 90 degrees and easily measure the earth's magnetic field. Advanced ones are used to measure brain wave activity. My concern is that SQUID devices are so sensitive that they cannot be stabilized enough on a boat in the ocean to prevent noise (from Earth, boats, gyroscopes, liquid nitrogen pumps, etc) that would make it able to consistently detect the Debye effect.

</comment><comment><USER5> This may be an incredibly stupid question, but I know they used gravimeters to map the ocean floor on subs.

And I recall an anecdote of snow fall on a roof effecting their results in a lab, could you possibly use them to detect other subs.

<comment><USER6> If it is based solely on mass, then I don't think so. A submerged submarine is almost neutrally buoyant[0]. It has the same average density as the water around it. Therefore, the mass of the ship is the same as the mass of the water it displaces, and a gravimeter wouldn't observe anything different.

[0] Err, almost. There is no such thing as perfectly neutral buoyancy. In practice, they are very slightly heavy and fly though the water as a lifting body.

<comment><USER5> Cheers! That's a very good point.

</comment></comment></comment><comment><USER7> From space... [https://en.wikipedia.org/wiki/Swarm_(spacecraft)](https://en.wikipedia.org/wiki/Swarm_\(spacecraft\))

</comment><comment><USER8> My computer science teacher in high school was a sailor in the Soviet Navy. He alluded to something like this being used. That would have been in the min 90s or so. At that point we weren't part of the empire so he probably didn't care about keeping the secrets about it.

<comment><USER9> The article mentions an article from 1990 in the Soviet military magazine "Naval Collection."

<comment><USER8> Yap, saw it. The way he talked about it sounded more like a "it already works in practice this way" vs "it could work in theory". But I maybe misremembering, it was a long time ago.</comment></comment></comment>


AppDirect Developer Incubator - <AUTHOR> http://info.appdirect.com/adi/

<comment><USER2> Ive got an app in the AppDirect marketplace and think they're a bunch of great people, I just don't see why anyone in their right minds would go for this.

My understanding of the deal:

"If you're qualified, come work for us for 2.5 years. After that, you have a chance to impress us with your idea. If you impress our panel, we'll give you 6 months of partial salary + support to work on your idea, after which point we'll arrange a meeting with VCs"

Or boiled down even further:

"Defer your startup idea for 2.5 years and take a job in return for a chance for ~6 months of partial salary, some help, and a warm intro to VCs"

The only thing I can think of is that they're hiring lesser qualified people in which case they could consider it a 2.5 year paid training program. But aside from that, AppDirect isn't exactly pushing the envelope of technology and it's substantially the same as when I started working with it almost a year ago. I can't imagine working for them is much different than any other startup in the area.

Even if we put aside the "defer your startup idea" and call it "take whichever idea you have in your head in 2.5 years and we'll see if we can help you make a go of it", it still just seems like it's a one sided deal. Is the post 2.5 year stuff they are offering really worth it? It seems like startup incubators would be the much better option there.

</comment><comment><USER3> Looks like a huge opportunity for those individuals that are not interested in risking it all to join a start up.</comment>


The Economics of Giving It Away - <AUTHOR> http://online.wsj.com/article/SB123335678420235003.html

<comment><USER2> Free does make business sense in the web world when advertising was the primary revenue driver. You cannot sell meaningful advertising without meaningful inventory, so there is a period where you spend "free" with meaningful inventory.

The larger question is whether other business models require the same focus on building a free userbase before implementing the business model. For all those services that charge, it affects user behavior if you implement too early and may limit the market size of the product. But on the flip side, sometimes if you charge, it conveys a sense of value upon the product.

If twitter started charging from the get-go, it would not be as big or as useful of a service as it is now.

</comment><comment><USER3> FREE is as successful as poverty.</comment>


Sense – A Smart Monitor for your entire home - <AUTHOR> http://sense.com <comment><USER2> I see this advertised a lot on Facebook. I'm pretty skeptical of this, though. It attempts to detect energy consumption for particular appliances by the pattern of current load, but I can't imagine this being accurate for most people. Different appliances of the same type will generate very different patterns, and residential power distribution can be _extremely_ noisy.

I think it's an interesting idea, I just doubt the practicality of it.

<comment><USER3> I've actually seen a few projects that use this method over the past few years, and I think you're overestimating the challenge.

Once the servers know the fingerprint for a device, they can recognize that fingerprint in multiple homes. The device doesn't have to get everything perfectly correct right away, but it will recognize a fridge/freezer vs a dishwasher vs a television. A combination of use times, power load etc etc.

I'm not saying it's easy, but enough people have done or attempted to do it using the same method that I don't think it is probably as unreliable as you suspect.</comment></comment>


Ask HN: How to kill Facebook? - <AUTHOR> So I made a bet with a friend 2 years ago that Facebook would go the way of MySpace by 2018. Not that I thought it should, more that I thought it would.
Now it seems I may lose $5, Is there any way to speed Facebook's demise? And, as a side note, now that Zuckerberg has pledged a lot of Facebook's value to the good of humanity should I still try to work towards this goal?
Pros/cons And strategies welcome <comment><USER2> 2 years is a very loooong time! Several things that are working in your favour:

1\. Facebook makes revenue from advertising. People are being increasingly turned off by advertising. As people close accounts, the management gets worried and pushes advertising even more. Advertisers buy eyeballs/clicks/impressions - whatever - it's all about the numbers. Less users, means less value, hence less revenue to FB.

2\. The cool kids don't use what they parents and grandparents use. So as the "oldies" join, the youngsters drop off. But the oldies don't like advertising either ...

3\. FB does NOT pay dividends. So why would you buy shares other than to sell at a profit? Which sooner or later ends up being a re-run of the Tulip Bulb craze. As soon as there are no buyers to be found at a particular price point, the prices collapse and increasing numbers of people try to offload which then pushes prices further down.

Caveat: I'm an engineer not a stock broker nor an accountant, the following is my back of the envelope calcs.

4\. If FB responds to market pressure and decides to pay a dividend, then based on current revenues of $3b and 2.74b shares, you could expect a dividend around 50c which, looking WPP Holdings 2014 financials for comparison (eps 85, div 38, sp 1400), would have a FB share price approx $20 - compare this to currently at $105 ($38 at IPO).

Based on the above, the users and investors will bring about the demise you need to safeguard your bet.

BTW: Did you see the 1983 movie "Trading Places" with Eddie Murphy and Dan Aykroyd?

</comment><comment><USER3> I'm on the bus today and the lady behind me is talking to another about facebook and how she finds it kind of scary that they are suggesting friends to her that she knows and she hasn't given them any information about where she went to school. Then when the wonderment and fear of friends of friends didn't catch, she pivots to I hate facebook. The reason being that its such a time sink.

MySpace was started so the guys could spam users with Viagra ads and diet pills, seriously.

Facebook is keeping closer to its mission which is to let people find and view/share the lives of their dare I say friends.

I strangely would love you to win your five bucks. However Facebook's cash position and willingness to purchase everything that poses a threat isn't changing. It's bizarre to me the number of people I know who are done with facebook. Closed up account. I don't have facebook. I have instagram.</comment>


Deposition dos and don'ts: How to answer tricky questions (2008) - <AUTHOR> http://www.currentpsychiatry.com/home/article/deposition-dos-and-donts-how-to-answer-8-tricky-questions/ee52a1ba792db9cb7690df337d16d21b.html <comment><AUTHOR> Note: This relates to Physicians (Psychiatry) but I think it's helpful in a general sense and a good read.</comment>


Show HN: Flexbox Defense – learn CSS flexbox by playing a tower defense game - <AUTHOR> http://www.flexboxdefense.com <comment><AUTHOR> Hey, author here.

I've always been a big fan of tower defense games so I thought it would be cool to make an open-source version of the game for teaching basic Flexbox properties. It's also a project that's helped me learn Ember.js.

The code is on GitHub: [https://github.com/channingallen/tower- defense](https://github.com/channingallen/tower-defense)

<comment><USER2> In Firefox on Linux (44.0.2), Wave 3 don't seem to be working as intended because for the second tower group you've got:

        div.board__tower-group
            div.tower-group__tower
            div.tower-group__tower
            div.board__tower-group--body

and, even though it's `position:absolute`, Firefox is taking that third child into account when applying `justify-content:space-between`, placing the first tower on the left and the second in the center instead of on the right.

Edit: Here's the Firefox bug [https://bugzilla.mozilla.org/show_bug.cgi?id=874718](https://bugzilla.mozilla.org/show_bug.cgi?id=874718)

<comment><USER3> Same deal in Iceweasel 41.0 - thought I was missing something crucial!

<comment><USER4> Can someone explain to me why this only happens on linux?

<comment><USER5> No, because it's not a Linux only bug. There's a Mac OS X report below, which I can confirm.

</comment></comment></comment></comment></comment><comment><USER6> Very cool! Would love to be able to stop mid wave and tweak a mistake instead of waiting for the whole thing to finish/refresh. Sucks having to retype my rules all over again too.

<comment><AUTHOR> Aye — implementing a "Restart Wave" button as we speak.

<comment><USER7> While you're at it, a "Speed up" button would be handy as well :).

</comment></comment></comment><comment><USER8> Definitely helpful to understanding flexbox. It took me a while to notice the help '?' icon to bring the tooltip back up.

</comment><comment><USER9> On Wave 3, "justify-content: space-between" appears to position incorrectly on Firefox 44 on OS X: [http://i.imgur.com/nx6hROH.png](http://i.imgur.com/nx6hROH.png)

On Chrome, it positions the turrets on the edges as expected.

EDIT: Looks like evunveot noticed the same in Linux and linked to the Firefox bug.

</comment><comment><USER10> Awesome tutorial!

I feel like flexbox could have been so much simpler.. I mean, there's a reason why there are so many "Learn flexbox tutorial" out there. Like, "justify- content: flex-end" won't win any API award.

<comment><USER11> And why not a simple "end" instead of "flex-end"... less to type and in context of "display: flex" obvious.

We will never know, but millions of developers must type it for years.

</comment></comment><comment><USER12> Cool game, but switching tabs breaks the game, you lose all points you didn't yet earn.

</comment><comment><USER13> Another fun 'learn flexbox' games is Flexbox Froggy

[http://flexboxfroggy.com](http://flexboxfroggy.com)

</comment><comment><USER14> This is awesome. I'd love to be able to move the towers around during the waves for some more challenging levels.

<comment><AUTHOR> Thanks! Yep, the idea was to get about 10 or so basic learning levels in and then to add some "challenge" levels, with features like the one you mentioned.

<comment><USER15> Even better: allow using CSS transitions to make moving turrets.

<comment><USER16> Good point actually; you could extend this with a number of properties to make an awesome learn-while-you-play td game for CSS more generally... keep us posted ;)

</comment></comment></comment></comment><comment><USER17> Sometimes, the box where you input the CSS rules will shake when you click on the hint box. Not sure if this is supposed to happen or not, but it was unexpected from me.

Otherwise, I thought this was pretty neat and very informative. Good job and thanks for sharing!

<comment><AUTHOR> The input boxes run a validation check whenever the user presses enter or focuses out of them; if this check determines the input value to be invalid, the stylesheet will shake.

In your case, you were probably typing some input before you clicked the hint box, thus focusing out of the input and invoking the validation check.

<comment><USER18> Okay, but this validation happens _instead_ of opening the help dialog. Whatever event triggers there eats the button click.

When typing an incorrect input, the first place a user will go to fix it is the help. It's a bit of a catch-22 when the help button will only help you _after_ you fix your typos.

<comment><AUTHOR> Hm, I see what you mean. Others have brought this up as well. I'll move the fix up in the queue.

</comment></comment></comment></comment><comment><USER19> Really fun, I enjoyed playing all the waves... Would definitely be cool to have more challenge levels with maybe css transitions to move the tower while the wave is happening :-)

</comment><comment><USER20> This is fantastic as I've just started learning flex-boxes, I did have one problem using it, there's no stop button once the circles start flowing!

<comment><AUTHOR> Fixed!

</comment></comment><comment><USER21> This is cool, I'm looking forwarding to the next waves to be released, as I would love to try other properties like flex-grow and flex-shrink.

</comment><comment><USER22> This is fantastic! I would love to be able to bring back the helpful modal at the beginning of each turn, as a refresher on the options.

<comment><AUTHOR> There is a "?" button in the top right of every stylesheet that brings the modal back up, but I'm also in the process of adding tool tips that are more obvious and always available.

</comment></comment><comment><USER23> It's a fun way to learn flexbox. You should think to add an autocomplete helper when typing the flexbox properties.

</comment><comment><USER24> This is great. I have been meaning to learn the CSS flex box model and thanks to this game it took only a few minutes!

</comment><comment><USER25> Pretty cool. Buggy when changing tabs and I wish there were a speedup button (I don't like tower defence games).

</comment><comment><USER26> Great tutorial !

</comment><comment><USER27> This is great!!</comment>


How China Targets Scientists via Global Network of Recruiting Stations - <AUTHOR> https://www.wsj.com/articles/how-china-targets-scientists-via-global-network-of-recruiting-stations-11597915803 <comment><AUTHOR> [https://archive.vn/oCogv](https://archive.vn/oCogv)</comment>


23 Actionable Lessons from Eye-Tracking Studies - <AUTHOR> http://www.virtualhosting.com/blog/2007/scientific-web-design-23-actionable-lessons-from-eye-tracking-studies/

<comment><USER2> Thanks for posting this. I, for one, like the community sharing interesting ways to develop, design, etc. Much better for us.</comment>