Let's make a "type the code listings" book for kids. - <AUTHOR> http://github.com/napcs/programming_for_kids

<comment><USER2> Actually, that's precisely what this is for Python:

<http://inventwithpython.com/chapters/>

The programs in this book are actually modeled after such projects from magazines and books from the early 80's.

</comment><comment><AUTHOR> I'm hoping to get lots of people interested in helping out. I think this could be a lot of fun and a great way to show how fun programming could be. I enjoy teaching my daughter how to write little games, and I imagine others do too. I miss these old books and I think we should bring them back.

<comment><USER3> Great idea; I can contribute some Python if that's any use.

What's your plan r.e. organizing chapters? By language or by example?

<comment><AUTHOR> I was planning to work up a structure once I saw what we ended up with. I'll take whatever we can get for languages. If we end up with a bunch of ruby and a bunch of python, maybe we see if we can get one example of each. Or maybe we just split the book into parts.

<comment><USER4> I might add some Haskell.

<comment><AUTHOR> I think that'd be neat. And even neater if you could explain why you chose Haskell for your example over other languages.

One advantage of us doing this as a multilanguage book is we get to show how different languages solve different problems.

One disadvantage of that is it's a lot to absorb.

</comment></comment></comment></comment></comment><comment><USER5> I personally love Ruby but as a beginner language, I have found people find it a lot harder to understand than say Python, C or Basic. Ruby has a lot of what looks like "magic" syntax to an unfamiliar user. I would probably go with a different language.

Otherwise, very cool idea.

<comment><AUTHOR> We Rubyists tend to put on the wizards hat and wave the wand around. But Ruby can be procedural too, and a lot of times can look a bit like Basic. I like Chris Pine's book "Learn To Program" because it uses Ruby very simply to teach introductory programming.

I have much respect for Python, but don't know it well enough yet to be comfortable. Would kids be frustrated by the whitespace / indenting?

<comment><USER5> Yeah, that's a good point the whitespace thing would be very frustrating. I guess Ruby could definitely be written in an easy to understand way as long as it's kept to a strict definition of what should/shouldn't be used.

<comment><USER4> Why should the whitespace be frustrating? It was never an issue for me, or anyone I know who gave it a try.

The IDE that comes with Python (IDLE) is good enough to help you with the whitespace. And even in MS Notepad it should be fine. Closing parens without editor support is much more frustrating.

<comment><USER6> The only real time whitespace can get frustrating is if you happen to mix tabs and spaces in the same file. Unfortunately this is quite an easy mistake to make (depending on how your editor is set up) if you're new to programming and don't yet understand the difference between a bunch of whitespace character and a single tab character.

</comment></comment></comment></comment></comment><comment><USER2> Why not an environment where you're just a click or two away from browsing (editing, changing, and running) the source code of everything?

<http://www.squeak.org>

Edit: To encourage kids to tweak and program, make the source easy to get to and a breeze to modify. Forcing them to type The whole program to do this strikes me as a bit indirect. We did it in the early 80's because we had to. Often, there was no other way to get your hands on that particular program. Today's environment is vastly different.

<comment><USER7> I think you learn something by typing it in that you don't by scanning code on the screen. I learned a lot by typing in Applesoft Basic programs when I was 10. It's like the difference between learning a language by actively trying to speak it, vs. just reading.

<comment><USER2> That's Not the point. It's not the reading, or the typing in that's the key. It was the _tweaking_! Typing in source code gives you the freedom to tweak because, dammit, you typed that in in the first place! But being able to instantly change source and see the results of it instantly in the running system -- this is a much more immediate way of encouraging tweaking.

I'm saying, so long as you want to encourage X, why not directly take the steps to encourage X?

<comment><AUTHOR> I don't think you're wrong. But I think we need the examples before we can prove you're right. Nothing prevents anyone from taking this code and building a lab out of it as a secondary method of learning.

Of course, you're perfectly free to set up your own project using Squeak. I bet you'd get a lot of people onboard with that. Then you can prove me wrong :)

<comment><USER2> Again you're not quite understanding the point. Squeak _already is_ a massive project of the kind you're referring to, but substituting instant source access/change/immediate feedback for having kids type in code.

</comment></comment></comment></comment></comment><comment><USER8> I know there are a bunch of books like this (by a bunch like 4), but saw this one yesterday:

<http://msdn.microsoft.com/en-us/beginner/bb308756.aspx>

Languages aside, it's worth checking out how other people teach kids.

I remember typing in hundreds of lines of poorly visible code in the backs of magazines for the c64 probably 25 years ago.

Sounds great though.

<comment><USER9> I will always regret having typed in pages and pages of DATA to end up with a really rubbish side-scroller.

Let's not inflict this on another generation :)

<comment><USER10> I used to read hex-dumps over the phone with my buddy, complete with checksum in the 'pre-affordable-modem' days.

DATA statements aside, typing in reams of code from hard copy certainly ingrained the ability to predict what the code did long before finishing the typing in, and I'm sure that is something that comes in handy even today when scanning other peoples' code.

I think it is harder today to get started programming than it ever was in the past, the 'bar for entry' is no longer some crappy little game you can write in three days but some three-d studio produced glitzy epic adventure. No way 'block shoots block' is going to live up to that, even if you did write all of it yourself, and the 'enterprise' being the red block isn't much of a winner either.

Computers are no longer 'knowable', and this is another matter that needs addressing if we really want to lower the bar for understanding what goes on under the hood.

<comment><AUTHOR> BLock shoots block is just fine for a 4th grader - at least it is for my kid.

And I think computers are knowable. Some languages are not, but others are. Ruby has a REPL that's very good as a teaching tool. I've had a lot of luck teaching with that. C++ on the other hand, or even Java, not so much.

I know it's harder than it was, but we could change that as long as we don't decide to fail by defeating ourselves.

<comment><USER10> With knowable I mean that you could at some point in the past literally know each line of code present in the memory of your machine. That's no longer the case.

</comment></comment></comment></comment></comment><comment><USER11> I'm 32, does that count as a kid?

</comment><comment><USER12> My brother-in-law started something along these lines a while back: <http://cymonsgames.com/>

</comment><comment><USER13> Sounds like a great idea. A free rubyproblems.com for kids so to speak.</comment>


Aether – a P2P ephemeral clone of Reddit - <AUTHOR> https://getaether.net/docs/how_is_it_different_from/ <comment><AUTHOR> zeronet seems a imperfect but better option, zeronet doesn't have deduplication on files and it doesn't delete old content but the network effect matter

</comment><comment><USER2> There isn't a mobile version at the moment?</comment>


Curl doesn't spew binary anymore - <AUTHOR> https://daniel.haxx.se/blog/2017/06/17/curl-doesnt-spew-binary-anymore/ <comment><USER2> I just looked at the commit and I was surprised at how nice the code is! The relevant line to my question is:

      if(isatty && (outs->bytes < 2000) && terminal_binary_ok) {
        if(memchr(buffer, 0, bytes)) {

memchr() returns the first occurrence of the byte 0 (your second argument), or NULL.

So a few things:

* what if your output is more than 2000 bytes?

* what if your output is binary but doesn't contain a byte 0?

* what if your output is a normal UTF-8 string but contains a byte 0? ( see [https://stackoverflow.com/questions/6907297/can-utf-8-contai...](https://stackoverflow.com/questions/6907297/can-utf-8-contain-zero-byte) )

This is interesting to me as I am developing a tool that parses files in search for bugs and I need to ignore binary files. What I am doing right now: when checking a line, if it is not a valid UTF-8 string I skip the file. It's not really nice as I am doing this verification for every file's lines...

<comment><USER3> 1\. It is not sensible to check more than a small chunk of data, as it would result in significant performance penalties, both in high resource consumption (memory or temporary files) and in blocked pipeline (cURL streams data as it is received). Imagine `curl [http://somesite/10GBoftext](http://somesite/10GBoftext) | grep "rarely- occurring-prefix" | do-something-with-found-data`—with a full scan, curl would use 10GB of memory, checking every byte before it sent things to grep and do- something. Without a full scan, do-something processes data live, and curl uses negligible resources.

2\. Then the check yields a false negative, which is not a problem.

3\. Then your UTF-8 string is unprintable, and the check will yield a true positive. The UTF-8/ASCII NUL character is not printable, despite being valid.

If one only assumes ASCII/UTF-8/Shift-JIS/similar, then a blob containing a null byte is guaranteed to be unprintable, while a blob not containing a null byte may be printable. That's good enough for a warning, telling you that you're doing something that you might not have intended.

Given that UTF-8 has become standard, it means that you will never realistically get a false warning, but may still get bonkers output. You can always overrule if you have a fetish for UTF-32.

<comment><USER2> > 1\. It is not sensible to check more than a small chunk of data

You could just check the first X bytes. Also, I'm guessing curl doesn't print out to the terminal if the data is more than 2000 bytes anyway?

> 2\. Then the check yields a false negative, which is not a problem.

the binary will be printed on the screen, that's a problem

> 3\. Then your UTF-8 string is unprintable, and the check will yield a true > positive.

How is it that the zero byte is part of UTF-8 then?

<comment><USER4> >> 1\. It is not sensible to check more than a small chunk of data

> You could just check the first X bytes. Also, I'm guessing curl doesn't > print out to the terminal if the data is more than 2000 bytes anyway?

Why wouldn't it? 2000 bytes is just 25 lines by 80 characters.

<comment><USER2> right, it sounded bad for some reason!

</comment></comment></comment></comment></comment><comment><USER5> I think this is a bad idea. Trying to make programs intelligent and have them behave in unexpected ways usually is.

It will make curl fail if a 0 byte is outputted within the text. There are many reasons why this will happen. Software errors, UTF-Encoding, special use cases...

In fact, I run into this problem with grep from time to time and it is super annoying:

        > grep somefile.txt stuff
        Binary file somefile.txt matches

So this change makes the code base more complex and the behavior fuzzy.

I prefer elegant software that behaves predictably.

<comment><USER6> I am sympathetic to your comment because it feels like we are babying users. To me, this is no different than when FreeBSD and GNU modified the rm command to prevent people from shooting themselves in the foot.

<comment><USER7> I thought they changed it to prevent buggy scripts from executing rm with empty variables? That's not necessarily the fault of the user.

</comment></comment></comment><comment><USER8> How can a program determine whether its output is being piped to a file/program, or the terminal?

Edit: It would appear that the answer is `isatty()`

<comment><USER9> Came here to say this. I can imagine a lot of people instead of doing -o were just redirecting output... if this changes the behavior of that, then a lot of people are not going to be happy when a curl upgrade breaks scripts.

<comment><USER10> It won't because 'isatty' returns false for a pipe. So that should not break anything unless you plan on sending binary output to your terminal which is a bad idea anyway, but they allow you to override the default as per TFA.

<comment><USER3> You _can_ trick isatty, but only if you're very, _very_ set on doing so. It requires allocating a psuedo-TTY, and attaching it.

cURL already use isatty checks elsewhere, such as to determine if progress info should be printed (will only show if you're _not_ outputting to tty).

<comment><USER10> Sure, but that's _exactly_ what a pseudo-TTY is supposed to do, pretend it is a TTY when actually it is a pipe so isatty will return true.

So that's not so much tricking isatty as much as using the system in the way it is intended. If you do that without the required background information then you have only yourself to blame.

<comment><USER11> A pipe is different from a pseudo-TTY. Pseudo-TTYs are how all graphical terminals work, but all shells use simple pipes on redirection and pipe- composition. TTYs and pseudo-TTYs are supposed to be interactive, with a user sitting on the other end with a keyboard. Plenty of tools make their output different based on if they're outputting to a tty or not, e.g. ls and others do not colourise by default if not outputting to a tty, as colour control characters are usually not what you want dumped to a text file or piped to grep. I feel this change brings curl more in-line with other terminal programs that try to be good citizens.

<comment><USER10> Psuedo-TTY's come in pairs, one end for the application to connect to, the other for whatever is consuming the output or producing input to the application. So, yes, of course they are not pipes but they are similar in that you have two end-points. So pipes and pseudo-tty's have quite a bit in common, thinking of a pseudo-tty pair as a pipe that knows how to deal with a bunch of terminal specific ioctl calls is a pretty good approximation.

<comment><USER3> Considering it a pipe is a _very_ rough approximation, though. The only purpose of PTYs is to provide access to a TTY with all its bells and whistles (kernel provided line editing, yay!) in a world without hard terminals.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Hooray! I'm gonna go ahead and claim credit for the festure request (though I never attempted to implement it :)

[https://curl.haxx.se/mail/archive-2014-02/0032.html](https://curl.haxx.se/mail/archive-2014-02/0032.html)

</comment><comment><USER13> There are a number of download urls that are "one-time" use. Shouldn't this at least download the output to a /tmp file?

<comment><USER14> If you're relying on the previous behaviour of curl on your one-time URL, you're already in trouble, because it's been printed to a terminal and the real contents are probably irretrievable.

</comment></comment><comment><USER15> I have wondered if there are security hazards to piping binary to your terminal.

I guess what really bad things can happen (and no I'm not talking about blindly piping to a shell to eval)?

Sure it messes up the terminal of which I usually type clear and/or reset. If it's really bad I usually just kill the terminal.

<comment><USER16> There used to be some terminal emulators that supported "screen dump", where the scrollback buffer would be written to an arbitrary named file.

echo -e "\ec\n\e]55;/tmp/ouch.php\a"

I believe they've all removed that functionality by now, but there might be some older copies around here and there.

<comment><USER17> IIRC, another angle that has been proposed is to switch between the primary and secondary terminal buffers. This way, one could create a file that looks harmless when piped to the terminal but contains a hidden, malicious payload. The victim would, after manual inspection, finally pipe the file to a shell, where the payload would do something evil.

<comment><USER18> > The victim would, after manual inspection, finally pipe the file to a shell

Why would anyone do this? If I see some unknown, interesting file, I might run cat, head, tail, less or vim on it. If it's binary then maybe I'll use xxd. But it wouldn't even occur for me to pipe it to a shell.

<comment><USER19> As people tend to re-use shell commands, editing them as they go, I can totally see someone doing like curl XX | less and then curl XX | sh or something. If the download is relatively speedy.

You could argue this is one of the reasons less doesn't interpret control codes by default. As it would let applications hide stuff like that to redraw the screen.

</comment></comment></comment></comment></comment><comment><USER20> Checking for the NUL byte seems like a very arbitrary test. Shouldn't it be using isprint_l()? Isn't that, in fact, what isprint_l() is _for_?

</comment><comment><USER21> Great feature. HTTPie, a CLI HTTP client I created, has always had a similar one: No binary data in terminal output, and on top of that, you get to see the response headers by default as well.

[https://httpie.org/doc#binary-data](https://httpie.org/doc#binary-data)

</comment><comment><USER22> Why not check for ESC (0x1b, ^[) bytes instead? Without those, you can't mess up your terminal that badly.

</comment><comment><USER23> Now you can annoy curl users by putting null byte in the beginning of the document.

</comment><comment><USER24> There are some valid use cases here, I hope this will not affect users of wopr ([https://github.com/yaronn/wopr](https://github.com/yaronn/wopr)).

</comment><comment><USER25> Is there going to be a ~/.curlrc option so I can turn this off? Else I suppose I can add -o- to my curl alias.

<comment><USER26> You could simply write a wrapper that reads an options file.

In general, it's a bad idea to have a hidden state such as a configuration file. Imagine, for examples, scripts that expect the standard curl behaviour, but your configuration file changes that.

(Of course setting shell aliases has the same problem...)

<comment><USER27> Shell aliases do _not_ have that problem as they're generally used with interactive shells only. Non-interactive shells tend to read a different set of configuration files for that reason.

</comment></comment></comment><comment><USER28> I'd prefer they stop curl from detecting a pipe on STDOUT and assuming that the user must want download progress garbage. Why would I want it in a pipe any more than I'd want it standalone? Inconsistent behaviour violates POLS.

<comment><USER20> The GNU Coding Standards adresses this problem:

" _please don't make the behavior of a command-line program depend on the type of output device it gets as standard output or standard input._

[…]

 _There is an exception for programs whose output in certain cases is binary data. Sending such output to a terminal is useless and can cause trouble. If such a program normally sends its output to stdout, it should detect, in these cases, when the output is a terminal and give an error message instead. The -f option should override this exception, thus permitting the output to go to the terminal._ "¹

1\. [https://www.gnu.org/prep/standards/standards.html#User- Inter...](https://www.gnu.org/prep/standards/standards.html#User-Interfaces)

<comment><USER28> I don't know about the version of curl you use, but mine doesn't give download progress in binary format, and doesn't contain any content of the target you're curling.

        $ curl news.ycombinator.com > /dev/null
          % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                         Dload  Upload   Total   Spent    Left  Speed
        100   178    0   178    0     0    369      0 --:--:-- --:--:-- --:--:--   370

You have to add an extra arg to get rid of that progress meter.

<comment><USER18> The behavior doesn't exactly switch on pipe detection though. The progress bar consistently shows when outputting to a file.

      $ curl news.ycombinator.com -o /dev/null
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   178    0   178    0     0    948      0 --:--:-- --:--:-- --:--:--   951

I mean, it's effectively doing tty detection, but I think it's fair to argue a semantic difference, and it's very similar to how ls strips colors and disables listing format when piped, which is mentioned by the next paragraph in the coding standards.

 _Compatibility requires certain programs to depend on the type of output device. It would be disastrous if ls or sh did not do so in the way all users expect. In some of these cases, we supplement the program with a preferred alternate version that does not depend on the output device type. For example, we provide a dir program much like ls except that its default output format is always multi-column format._

</comment></comment></comment></comment><comment><USER29> should have used `-O - ` so the options is consistent with wget

<comment><USER30> `-O` is already used. `curl -O <URL>` is roughly equivalent to `wget <URL>`.

</comment></comment><comment><USER31> the fact that cURL is hosted on haxx.se always throws me. It makes me immediately associate haxx === hacking and I feel uncomfortable. This is honestly why I use other tools instead even though it's more an unconscious decision than a conscious one.

<comment><USER32> Yet you post on a site called Hacker News.

<comment><USER31> Ummm. You nailed me there.

<comment><USER19> And people wonder why integrity of the "news" media is important xD</comment></comment></comment></comment>


Fake polls are a real problem - <AUTHOR> https://fivethirtyeight.com/features/fake-polls-are-a-real-problem/ <comment><USER2> While it is hard to guess considering the ease of creating polls nowadays, as demonstrated in the article, I am unwilling to believe that the motive was actually greed and not just simple "trolling".

If Delphi Analytica was created "to move the betting markets", wouldn't this be quite a bit of risk for not enough payoff?

Of course this reasoning falls apart if you see it as a proof of concept, so my instincts might not be worth much in this case.

As an aside, I find this quite troubling (though it might be bias, because this sounds like something I have felt for quite some time without researching it):

"As Steve Berman, a writer at the conservative website The Resurgent who wrote a skeptical take on the poll, told me, 'Anyone in the entire political blogosphere is maybe 1 or 2 degrees of separation from anyone else. The trust network is fairly strong.' In other words, once a story appears in one place, it's likely to appear in many others because people believe a reputable website wouldn't get fooled by a fake poll."</comment>


Ask HN: App or service for linkable, "watch-later" video messages/screenshares? - <AUTHOR> There are plenty of options for making conference or video calls with a number of people. As someone who works remotely in a different timezone to others, I find myself regularly having to write long explanations of issues or features I'm developing to get feedback later in the day.
Ideally, I would love to be able to quickly and easily create a screenshare/video/mic recording of me explaining myself instead, that then gets automatically uploaded to a shareable link for the other person to consume later in the day.
Of course, I _could_ just record with Camtasia and upload to Dropbox or something but I'm wondering if there is a streamlined service that offers something like this? <comment><USER2> [https://www.vidyard.com/govideo/](https://www.vidyard.com/govideo/)

</comment><comment><USER3> I started working on a service like this, but more from the business website side: [https://vidleads.co](https://vidleads.co)

I've been meaning to redo it a bit, with a simple shareable link to record and share like you said. Maybe now would be a good time!</comment>


Show HN: Falco – A functional toolkit for building ASP.NET Core apps using F# - <AUTHOR> https://github.com/pimbrouwers <comment><AUTHOR> Falco is a toolkit for building functional-first, fast and fault-tolerant web applications using F#.

Built upon the high-performance primitives of ASP.NET Core. Optimized for building HTTP applications quickly. Seamlessly integrates with existing .NET Core middleware and frameworks.</comment>


Track on PubSubHubbub, with geolocation and more - <AUTHOR> http://blog.superfeedr.com/track-v2/

<comment><USER2> I still puke a little bit in my mouth whenever I read the name PubSubHubbub. Is there an award for "Worst Protocol Name Ever" I don't know about?

Don't get me wrong, I love the idea of pubsubhubbub, especially from a resource consumption POV, but the name? Never got it.

<comment><USER3> It rhymes 3 times! What's not to like?

<comment><USER4> The 4th 'ub', evidently.</comment></comment></comment>


Ask HN: Responsive framework or addon with good layout? - <AUTHOR>

I am trying to get better at frontend UI design.  I have been working with Foundation 5 framework for a while as I like the mobile first approach.  I like their grid, but it seems difficult to be able to place items within a container.   Is there another library or framework I can use with Foundation to provide better layout within containers?   I did not want to try to go full custom css as it is incredibly hard to support the different mobile browsers. <comment><USER2> Have you tried Twitter Bootstrap? It follows the "mobile first" philosophy that you're after, and it's also quite easy to disable responsiveness entirely, if needed. I'm mainly a back-end developer and I (passionately) hate doing front-end work, yet with Bootstrap I feel like it is taking a huge load off my shoulders. AFAIK it does a great job at supporting the various browsers, widths, orientation and so on, also comes with some boilerplate JS for stuff like highlighting a mandatory form field, handling modals, buttons etc...

</comment><comment><USER3> I would suggest you to check out Bootstrap. But if you need a more lightweight mobile-first solution, You can check out Cardinal Framework. There are also lot more available in this repo [https://github.com/moklick/frontend-stuff#ui- frameworks](https://github.com/moklick/frontend-stuff#ui-frameworks)

<comment><AUTHOR> I have tried bootstrap, but even like foundation, both frameworks seem heavy on size. Is there anything that is declarative, comes with a library, and compiles down to minimal css? the type of layout I am looking for would be like the list items on the mobile version of ranker.com they have video, buttons, and content all layed out nicely in a responsive box that works on major phone os's

</comment></comment><comment><AUTHOR> I think ideally, I would want something like an abstraction built upon something like Susy where I would not have to know as many css details [http://susy.oddbird.net/](http://susy.oddbird.net/)</comment>


Intel offered "reward" to Dutch researchers to downplay MDS vulnerability - <AUTHOR> https://www.techpowerup.com/255563/intel-tried-to-bribe-dutch-university-to-suppress-knowledge-of-mds-vulnerability <comment><USER2> Is this a bribe? A bug bounty is a standard program for lots of companies, we don't consider the bounty a bribe. I mean, you could bribe someone in this way but there needs to be some nefarious intent going on - just giving them money to delay announcement until you've fixed the bug seems like a fairly pure motive to me.

<comment><USER3> They offered them a lower bug bounty reward with a big "gift" on the side. This would mean Intel gets to report the bug as lower severity. And presumably the extra "gift" money, which raises the total paid above the max bounty they normally offer by $20,000, had some strings attached.

I've already read articles that some of the vulnerabilities were found more than a year ago. And as others reported similar exploits, they grouped them all together into 2 "teams" and made the PR release all at once. The only reason we're hearing anything now, is that I heard the team who found the first bug threatened to leak since it had been a whole year. The first bug was discovered a year and three days ago. If they didn't threaten to leak, god knows how long Intel would have spent collecting bugs.

This CPU "bug" is actually 4 different CVE's, some quite different from the others, and presumably discovered at various times over the past year.

Just scummy as hell by Intel. They #1 forced a bunch of different researchers who found different bugs to split the bounty, #2 aggregated the bugs rolling in for more than a year to minimize impact. That's on top of the attempted bribery and rumors that the microcode + patches do not fully mitigate leaks between hyper threads.

And for the argument that they didn't have enough time at one year... They had enough time to fix and release new silicon! Intel states that chips made in the last month are fixed at a hardware level. It's orders of magnitude harder to ship silicon than software, so my assumption is that the fixes for existing chips have been ready for a while. They've just been sitting, waiting

<comment><USER4> > #2 aggregated the bugs rolling in for more than a year to minimize impact.

When the impact is new microcode for every out-of-order CPU going back to Sandy Bridge that's not on its face entirely unreasonable. The date for the new microcode for my Ivy Bridge workstation I'm typing this on is 2019-02-13; if testing followed that.... Could even be they wanted to further delay release until they could do more testing.

> They had enough time to fix and release new silicon!

And properly test it?

</comment></comment></comment><comment><USER5> Tomorrow's story: "Intel execs discovered wiping their ass with retail CPUs before packaging. Company defends measure as 'giving things a personal touch'. Stock prices rise."</comment>


Why we stopped focusing on 66% of our customers - <AUTHOR> http://7shifts.com/why-we-stopped-focusing-on-66-percent-of-our-customers/

<comment><USER2> Side-thought: different tiered subscriptions. Restaurants as the base, best- value option with tiny businesses (dog walkers, etc.) and agency (design, architecture, etc. firms) as the higher tier.

You can adjust features, pricing, and marketing accordingly while not violating each other subset.

</comment><comment><USER3> It'd take a lot of convincing for me to turn a generalized app into something more specialized.

For this scheduling app, wouldn't it be possible to modularize features such that a "general purpose" platform might exist, with a "plugin" system, or maybe just child projects which inherit from the parent, to satisfy the needs of specific industries?

I guess initially one would focus on the restaurant app, but abandoning the larger market would just rub me the wrong way.

<comment><USER4> It would be possible to do that, yes. But we didn't want it to turn into a set of options/plugins for varying industries. It's also an issue of resources. We're a 3 person team and we need to focus our efforts accordingly. Deciding to do just restaurants has made it easier to prioritize and delegate tasks.

I understand it could rub you the wrong way to abandon other industries. Trust me, all of us shared the same feelings.

In short, the approach we decided on was to first dominate one industry, the restaurant industry. If we become successful at one, maybe then there is a possibility to look at others. But focusing on several industries will always leave us being the 3rd or 4th best at scheduling for that industry. It's hard and nearly impossible (given our size) to be the best for every industry, and we want to be the best.

<comment><USER3> I'd just be afraid of limiting growth. Maybe just keep that thought in the back of your mind as you dive into your niche?

I dunno, you've probably got way more specific knowledge that informed your decision, I don't mean to sound obstinate.

<comment><USER4> We understood we might be limiting ourselves in other industries, but it was also a contributing factor that restaurants make up a larger market.</comment></comment></comment></comment>


Patreon can't solve its porn pirate problem - <AUTHOR> https://arstechnica.com/gaming/2020/01/patreon-cant-solve-its-porn-pirate-problem/ <comment><USER2> When it comes to porn, pornhub and youporn's model reigns true. Whomever can scrape and offer up paid-content for free as long as possible while dodging/stretching C&D orders wins.</comment>


Organic Cat Litter Chief Suspect In Nuclear Waste Accident - <AUTHOR> http://www.npr.org/blogs/thetwo-way/2014/05/23/315279895/organic-kitty-litter-chief-suspect-in-nuclear-waste-accident <comment><USER2> God I read that title wrong.

I read it as

"Organic Cat Litter Chief" \- "Suspect in Nuclear Waste Accident"

As opposed to

"Organic Cat Litter" \- "Chief Suspect in Nuclear Waste Accident"

I kept wondering when the CEO of a Cat Litter company was going to be blamed for something.

<comment><USER3> "I misread X as Y" comments don't seem to be popular here, but I was tempted to post the same thing.

I read this headline exactly the same way as you, and I actually felt relieved to know that the cat litter CEO was not a suspect in this accident!

I think it's a lesson for headline writers: Sure, write your headline as terse and tight as you can make it. But at least re-read it a few times to make sure it isn't ambiguous.

Another way to put it: "What would Experts Exchange think of this headline?"

</comment></comment><comment><USER4> People laugh at the extreme detail the military uses to specify such item. I spent six years in USAF and I've groaned at some of it. But we damn sure never had this happen under SAC. And we were building nukes. Details matter.

<comment><AUTHOR> The SAC had plenty of nasty screw ups, including littering large areas of Spain and (iirc) Greenland with plutonium dust from nuclear weapons accidents. It's also pretty much dumb luck that we've never had an accidental detonation of an SAC-controlled nuclear weapon:

[http://www.amazon.com/Command-Control-Eric-Schlosser- ebook/d...](http://www.amazon.com/Command-Control-Eric-Schlosser- ebook/dp/B00C5R7F8G/)

<comment><USER4> Yeah, we had amazing accodents until they finally decided to stop flying them drop-ready. Bombing Franco's farmers was a major impetus towards that. But the lack of accidental detonation was not luck; they were crazy overbuilt.

<comment><AUTHOR> If you read the book, you might change your mind about that. It spends a lot of time documenting some really basic deficiencies -- bombs that could detonate if overheated or struck by a single projectile, for example. A large number of weapons were made with high explosives that weren't thermostable. Others could detonate if dropped from a few feet. There were many deployed ballistic missiles that were susceptible to lightning strikes. The arming switches in SAC aircraft were, for years, simple open-loop circuits that had a high probability of short-circuiting in an accident.

In fact, most of the book is about the attempts of the weapons labs to make the arsenal safer. Most of those attempts were rebuffed by the military. The SAC's strict policies definitely helped to prevent disaster, but if you read about some of the incidents, it's clear that there was a lot of stupid luck involved, too.

<comment><USER5> British strategic nuclear weapon designs used mechanical safeguards, including thousands of steel ball bearings poured in through a hole in the casing, which made the bomb safe to carry but had to be drained out before use [1].

BLUE PEACOCK, however, used chickens [2].

[1] [http://en.wikipedia.org/wiki/Violet_Club#Design_features](http://en.wikipedia.org/wiki/Violet_Club#Design_features)

[2] [http://en.wikipedia.org/wiki/Blue_Peacock#Chicken_power](http://en.wikipedia.org/wiki/Blue_Peacock#Chicken_power)

<comment><USER6> UK nukes used to use bicycle locks:

[http://news.bbc.co.uk/1/hi/7097101.stm](http://news.bbc.co.uk/1/hi/7097101.stm)

 _" The Bomb is actually armed by inserting a bicycle lock key into the arming switch and turning it through 90 degrees. There is no code which needs to be entered or dual key system to prevent a rogue individual from arming the Bomb."_

NB To this day the crews of UK Trident submarines can launch their weapons on their own without requiring any codes to be transmitted to activate the weapons.

<comment><USER7> _" To this day the crews of UK Trident submarines can launch their weapons on their own without requiring any codes to be transmitted to activate the weapons."_

Isn't this also the case with US Trident submarines? That is, codes transmitted to the vessel are used to authenticate launch instructions, not to enable the missiles to be armed. Otherwise the submarine would be unable to launch in the event that land-based communications systems were destroyed.

<comment><USER6> As far as I know, only the UK Tridents have this interesting arrangement. This link on Permissive Action Links suggests that US Trident submarines need to receive codes to unlock safes before they can launch:

 _" Instead of another party confirming a missile launch as in the case of land-based ICBMs, the set of keys is distributed among the key personnel on the submarine and are kept in safes (each of these crew members has access only to his keys), some of which are locked by combination locks. Nobody on board has the combination to open these safes - the unlock key comes as a part of the launch order from the higher authority._"

[http://en.wikipedia.org/wiki/Permissive_Action_Link](http://en.wikipedia.org/wiki/Permissive_Action_Link)

<comment><USER8> So they could theoretically drill/destroy/crack the safe in the case of an emergency where codes could not be transmitted.

That is why British submarines have letters of last resort, to be opened and followed if there are no communications.

[https://en.wikipedia.org/wiki/Letters_of_last_resort](https://en.wikipedia.org/wiki/Letters_of_last_resort)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> How is this possible?

To take a random example I'm familiar with, making small modifications outside certain small bounds requires a lot of paperwork and approval. This can be something as simple as adding a tow hook to an airplane known to be good for towing. If you're lucky and the modification has been done before and somebody went through the trouble of getting the modification certified, you can take advantage of the work they've already done, greatly reducing the trouble involved as long as you can get permission from whoever got it certified. If you're doing something totally new (or something other people have done, but nobody got it certified for general use) then you have to file a form describing what you're going to do, get it approved, do the work, get the result inspected....

All this even for small aircraft where you'd be very hard-pressed to use them to kill more than two people (including the pilot) even if for some reason you had a goal of maximizing deaths.

Yet, when handling _nuclear waste_ , apparently people can just randomly decide to completely change an important component used in the process?

Or was the change studied and approved by an engineer, but the problem was missed? The article certainly doesn't make it sound like this happened, but it could be an omission.

<comment><USER10> Bad instructions. Basicly someone said use brand X without specifying what about X you needed. So, someone used brand X with a different formula and never thought you needed to get approval because there was no change.

<comment><USER9> It still seems completely crazy that someone would write instructions that way in the first place. Surely you'd specify at least _something_ about the composition as well?

</comment></comment></comment><comment><USER11> I once talked to a scientist who worked on cat litter for a major corporation. It was surprisingly interesting to hear about the chemistry and geology and supply chain management of such a mundane substance. I guess the DOE scientists running this project were not aware of these subtle issues of chemistry and geology.

<comment><USER12> Isn't organic cat litter made from corn?

<comment><USER11> They were in the business of manufacturing non-organic cat litter, the kind made from a special type of clay.

<comment><USER13> The clay is not that special, it is called bentonite. You can order it by the pallet load, and it is a whole lot cheaper than cat litter. I'm surprised that the spec did not call for bentonite directly, and that no one in these comments has mentioned it either.

[http://en.wikipedia.org/wiki/Bentonite](http://en.wikipedia.org/wiki/Bentonite)

</comment></comment></comment></comment><comment><USER14> Why the hell they are writing a spec with a commercial product name rather than the material contained in it is beyond me. If the contractor knew they were looking for a certain kind of clay rather than cat litter, this would be nearly impossible.

<comment><USER15> The problem seems to be that they didn't know exactly what they looking for, or how to describe the set of acceptable clay-like substances.

This is an physical-science example of the "justification problem" \-- chemistry isn't computer science, we don't design all out components from the elemental level; we discover and hack molecules, and identify them by interpreting their behaviors (boiling point, what color smoke is produced when mixed with some other stuff, etc) , and then we slap on a label that we _hope_ is correct). It's all a very statistical science, not irrefutable logic.

[http://en.wikipedia.org/wiki/Regress_argument](http://en.wikipedia.org/wiki/Regress_argument)

<comment><USER14> _how to describe the set of acceptable clay-like substances._

Given the context, I would have hoped something involving a mass spectrometer or something similar rather than buying something purely on the basis that it is known to have the property of being suitable for cats to urinate into and then hoping that they don't ever change the mixture on any products in the range.

<comment><AUTHOR> I bet the thinking was something along the lines of _" kitty litter is an inert absorptive material"_, and nobody really thought much about the differences between _types_ of kitty litter, and whether or not they were truly inert.

</comment></comment></comment></comment><comment><USER16> I think this is still speculative though.

From what I understand from local papers it is also believed a piece of salt fell from the ceiling (waste is housed in an old salt mine).

<comment><AUTHOR> That's old information. This story is the current theory.

<comment><USER16> Oh. Do they have any evidence against the salt fall theory? My understanding is that no one has been back down the hole since the event.

<comment><AUTHOR> They've been inside the room that had the leak, and they have video of the ruptured drum. There were no problems with the mine walls, and the evidence suggests the damage was heat-related:

[http://www.wipp.energy.gov/wipprecovery/photo_video.html](http://www.wipp.energy.gov/wipprecovery/photo_video.html)

<comment><USER16> You are much more up to date than I am.

Thanks for the cool link. Interesting read.

</comment></comment></comment></comment></comment><comment><USER17> Hilarious - you can't make this stuff up. I thought we were told that organic == better. I can just see it happening:

Vendor: "For an extra 95 cents per pound I can get it in Organic".

DoE Supply Clerk smiles and thinks of cute kittens. :)

</comment><comment><USER18> The strangest thing about this is that the organic cat litters are quite a bit more expensive than clay. So it wasn't done to save money. What the reason possibly could have been I cannot fathom.

<comment><USER19> Perhaps the brand they had been using switched to organic?

I suppose it's also possible that someone just assumed organic == better, or there were both organic and non-organic versions of the same cat litter, and a mix-up resulted when the premium product came up first in their search results.

If they'd known what the litter would be used for, I would hope they'd have been more careful, but I don't know at what level in the supply chain the decision to switch was made.

</comment></comment><comment><USER20> Anyone else have a disturbing "Brawndo has got what plants crave" moment?

</comment><comment><USER21> _" How come nobody caught this and raised a red flag?" asks_

It looks like they caught it to me.

<comment><USER22> Catching it after it takes the entire facility out of commission doesn't really count as catching it, does it?</comment></comment>


AWS Security Primer - <AUTHOR> https://cloudonaut.io/aws-security-primer/ <comment><USER3> Such a shallow dive: there really needs to be a lot more ink spilled on this topic in great depth. I've worked extensively with AWS over the last 4 years, and I can barely wrap my head around the scope of managing security in AWS. We have an entire department dedicated to security in our company, and none of them are remotely close to being experts in AWS security either.

I'm starting to get curious if there even is an expert who could set up and maintain a bulletproof AWS Account. From the dev/admin accounts to API Gateway to Lambda to RDS and S3; there's just too much to be an expert on. And it's all handled differently (not to mention how many times it's changed in my mere 4 years of experience).

Instances get role data from the metadata service, but containers can't access that metadata and should access the local ECS agent instead (which has its own API). Lambdas must assume a role with a dedicated policy to even write logs, but setting up a scheduled lambda adds an entire different permission object (with its own policy) just to allow the cloudwatch alert mechanism to even trigger a lambda. DB access can be authenticated using roles, but you have to manually set up the users (and their DB permissions), and it doesn't work with every DB type. S3 buckets can get policies from both built-in bucket policies _and_ from users/roles, with inline or managed policies available for each. The API Gateway's authentication requires a Lambda function, but only passes through a single token and expects an IAM entity in response...

Even AWS' tutorials and built-in managed policies seem to throw their hands up in despair; throwing out wildcard permissions (like s3:*) left and right just to make things work.

No wonder people focus on their network and basic root account security - <USER2> frustrating and challenging as network security is, it is still a much more tractable problem.

<comment><USER4> > Instances get role data from the metadata service, but containers can't > access that metadata and should access the local ECS agent instead (which > has its own API).

Just a quick aside, but is this _can 't_ or _shouldn 't_? I'm 100% positive you can use something like instance profile credentials from within a container (which loads credentials from the instance metadata service).

I think I agree that there's definitely a lot of depth to topics that should be covered here, and whether you want to go down the rabbit hole will vary based on org size and features you're using.

I'd personally prefer: 1. deep-dives into best practices for each feature as opposed to an on the surface glance. 2\. enable it with examples. Include CloudFormation or Terraform scripts to set up each piece so that we actually build something. Documentation is important, but you can't learn without _doing_. 3\. test against the security you've put in place.

<comment><USER3> Technically, shouldn't. But in AWS' documentation for container roles, they have a note that explicitly suggests implementing a iptables rule (and even provides the iptables command) to prevent access to the instance's metadata.

[http://docs.aws.amazon.com/AmazonECS/latest/developerguide/t...](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task- iam-roles.html)

That said, this is another of those "more ink should be spilled" moments, since preventing access to the instance metadata is something that you SHOULD do from a security point of view.

<comment><USER4> I don't recall Task Roles being a thing when I started using EC2 Container Service. For container security and isolation, that makes a whole lot of sense.

</comment></comment></comment></comment><comment><USER5> I wonder at what point the complexity of interacting security systems hits dimishing returns? Not trying to be negative, I'm a fan of how much power AWS gives you. But seeing how many systems have interacting security implications laid out in a graph like that makes me curious how far you can take it before it becomes difficult to reason about. Maybe the systems are sufficiently isolated and well defined that it's not even an issue.

<comment><USER6> _> Not trying to be negative, I'm a fan of how much power AWS gives you._

I am.

I find AWS API incredibly baroque and has a lot of historic baggage. I suspect a lot of this complexity is a result of an accumulation of features made by multiple people in multiple teams over the years and inertia of customers relying on it, so there is (understandably) no will to change it.

<comment><USER7> Classic mistake. Except it's not really a mistake, but a conscious decision by whoever was in charge at the time (with the main focus probably being growing the company and not hurting current customers).

How do we fix that though? Standards seem like the only solution but they either don't move fast enough or the early birds (in this case amazon, but another prime example is microsoft) become so entrenched they set the standard themselves.

My own answer up until now has been to work in linux and open standards jobs (now kubernetes) but this requires increasing amounts of effort.

<comment><USER8> I'd say that the best way to "fix" it - is to have new iterations/versions of an entire region that comes online with an updated stance on all aspects of environment management: deployment/security/auth etc..

Let ___new_ __infra come up in the new region with auth-gateways to allow the new to talk to the old and vs versa...

maybe you put an S3 mirror of data from new-bucket-type to an old-bucket-type for RO data access from within the old region for data created in the new...

old users can make functional requests of the new api - but cannot manipulate anything directly...

Or some such model -- but role out wholly new regions and sunset old over time. (A new region can be us-east-3 next to us-east-2 and can sit in the same physical location to allow for in-house data transit on AWS' part, etc.)

</comment></comment></comment></comment><comment><USER9> I've always found AWS's security system pretty confusing, so I'm a big fan of this primer. There's such a huge number of stuff that it can difficult to even begin to know what to look for. From my limited experience, Google Cloud Platform seems to be much easier to setup.

What I'd really love to see an end-to-end example of a non-trivial production- ready project, with all its nitty-gritty details. I'd expect that having a sensible baseline you could look to for general guidance would help improve security and reduce risk.

</comment><comment><USER10> I found trying to manage and reason about AWS access control super confusing (especially across accounts), so I built a lightweight tool to dump and load IAM config to yaml files. [https://github.com/99designs/iamy](https://github.com/99designs/iamy)

It has recently started becoming popular quite organically, so I might just write a blog post on it soon.

<comment><USER11> are there any advantages over CloudFormation?

<comment><USER10> I'd say the biggest advantage is that it slots in easily to an existing environment that is not necessarily managed strictly.

I've found depending on how strict your change management policies are, IAM creds can collect cruft over time as people push new policies in ad-hoc. So iamy is handy for such a situation

\- iamy can sync in both directions - pull and push IAM config. So you can easily pull down the ad-hoc changes

\- In order to use CFN you need to have access, so there is a chicken-egg scenario if you want to manage ALL users in config

\- iamy gives you a nice execution plan of aws cli commands, CFN can be opaque

And iamy does ignore any resource managed by CFN, so it works well as complimentary tool.

<comment><USER11> I see. Nice to know about your tool!

</comment></comment></comment></comment><comment><USER12> AWS is so f-ing confusing sometimes.

<comment><USER13> Any aspect in particular? I'm always happy to pass feedback along to the teams.

<comment><USER14> The UI is confusing, hard to read and unapproachable for non-technical people. You guys should really hire some UI guru and get him to re-design and re-word the whole system and create an easy to start, plain english language tutorials.

<comment><USER13> Ok, good start, but pretend that I am dense and give me a specific example along the lines of "The W console makes it hard to do X because it says Y. Why not say Z instead?" Vector values for W, X, Y, and Z are acceptable.

<comment><USER15> Hey Jeff, long-term AWS fan and daily user of it here. One thing I see time and time again for new user confusion: the names given to AWS services.

It has always felt that AWS has been too playful with the naming of services, to the point of obfuscation. Sure, you and I know what EC2 and S3 are, and what an instance and a bucket are. But for new companies adopting AWS, I swear that a third of my time is translating AWS service names into industry terminology for them, and often here statements like:

\- "Why don't they just call it a virtual machine or cloud storage?"

\- "What the heck is an EBS or a Cognito?"

\- etc, etc

Also, the first run of the AWS console can be overwhelming when compared to that of Digital Ocean (though I know the two aren't really comparable in terms of breadth of services offered, but look how obvious DO's call to action is).

Just immediate thoughts that pop into my head.

[1] AWS web console: [http://imgur.com/GwAeBrC](http://imgur.com/GwAeBrC)

[2] Digital Ocean console: [http://imgur.com/a/cO3Kn](http://imgur.com/a/cO3Kn)

</comment></comment></comment></comment></comment><comment><USER16> Excellent! Pleased to see VPC Flow Logs included; they are underrated as a security tool and one big advantage AWS has over other providers.

At work I co-develop an open source Python library for reading VPC Flow Logs - it can be an easy way to get started analyzing them for security: [https://github.com/obsrvbl/flowlogs- reader](https://github.com/obsrvbl/flowlogs-reader)

</comment><comment><USER17> This is a great advertisement for Google Cloud. Google Cloud's security model is much simpler. For the 95% case, you can have different projects for each app and environment, and assign access permissions per project. Then you can gradually add in shared resource access when you need it. To get the same kind of isolation by default with AWS, you need to have multiple AWS accounts (AFAIK), which is a giant pain.

</comment><comment><USER18> Slightly off-topic: The Mindmap looks pretty cool. Does somebody know which technology he used for that?

<comment><USER9> I think the author used OmniGraffle [0]. If not, then the tool used is surprisingly similar.

[0] [https://www.omnigroup.com/omnigraffle/](https://www.omnigroup.com/omnigraffle/)

<comment><USER19> It _could_ be OmniGraffle, but it has had such a huge influence that lots of applications look graffle-y now.

</comment></comment></comment><comment><USER20> I find AWS security "primers" are usually quite brief - and necessarily so, because otherwise they wouldn't be a "primer". But that brevity leads to a common set of rules which, in the absence of a full explanation, lose something.

For example, just every AWS environment I look at, someone knew that should create an IAM account, and never use the root account. Which is why there is a root account that's never used, and one IAM account with "Administrator" permission that everyone shares.

If you ever propose we review it, someone will point me at an AWS security guide and say "it's fine, we're not using the root".

<comment><USER21> This is the problem with "knowledge by web article" in general, isn't it? Blindly following best practices, rather than developing any true understanding of the task at hand.

</comment></comment><comment><USER22> Great write up. I knew there was a lot, but visualizing really puts it into perspective, especially for the more niche services like cognito & IOT.

My current job has about 14 different AWS accounts, a few are prod, some are lab and others are meta accounts. I've been thinking about having a dedicated account just for security related stuff but I see the value in collect cloudtrail, config and other stuff but, I'm not 100% sure it's worth the effort to get setup right now. Thoughts?

<comment><USER11> Cloudtrail and config buckets should be in a separate account with no access at all (besides root) otherwise an attacker can delete the cloudtrail logs and you have no idea what he did</comment></comment>


Beehind the Curtain: Secrets of our Support Success - <AUTHOR> http://blog.beeminder.com/curtain/ <comment><AUTHOR> Author here. Quick summary of the customer support lessons discussed in the post:

        1. Be (really) informal
        2. Be grateful (even to jerks)
        3. Don't just offer help, ask for it
        4. Reply immediately
        5. Avoid going down rabbit holes

I think #3 is the most surprising. It was sort of an epiphany when we figured it out. You can bend over backwards offering help and it makes users feel guilty or suspicious and ignore you. If you ask _them_ for help then they respond effusively, and bend over backwards to help you.

So make explicit in your support replies that asking you questions is not a burden but a vital form of feedback.

</comment><comment><USER2> Great feedback on feedback. I'm a Beeminder customer and I can confirm that support really does run the way the author describes.

My general rule on contacting customer support: Don't.

Perhaps like Joel's Rules for software companies, there should be some kind of customer service certification. Oh well, I can dream, can't I?

See also: [http://xkcd.com/806/](http://xkcd.com/806/)

<comment><AUTHOR> Ha, yeah, that's the biggest secret to amazing customer support, for as long as you can handle it: have the founders do it.

We have a few non-founders helping us with support but they're quick to say "let me pull in the hackers/founders on this".

</comment></comment><comment><USER3> Almost signed off an email to the Beeminder support team with two kisses the other day.

(Not a joke! Fortunately, caught myself before pressing send.)

<comment><AUTHOR> By the "best-friend heuristic", as we say in the post, you should totally go with the kisses.

(I'm pretty sure we'd not have batted an eye at that. :) We're talking about emoticons, right?)</comment></comment>


Is China throttling Google.com? - <AUTHOR>

I do live in Shenzhen, and i noticed that in the past 2 days Google.com is getting seriously slow and unusable. Since it works quite perfectly with my VPN  located in USA, i am becoming quite concerned. Moreover Google.com.cn does work perfectly, and all the other foreign sites are at the average usual speed. My main concern is that for all of us, foreigners in China, Google is absolutely a must have, for me is even more, a survival tool. Can somebody in China confirm that this is actually happening ? <comment><AUTHOR> While registering my domain for Google apps for domains, i noticed that they do not accept business or domains (the domain is a .com registered on godaddy and hosted on rackspace slicehost) from China at the moment. I have got this as an error message "Google Apps does not currently support domains in this country."</comment>


How Amazon's EC2 Service Was Born - <AUTHOR> http://blog.layer8.net/2009/01/i-was-trying-to-avoid-this.html

<comment><USER3> Three small things that demonstrates how Bezos is an unique leader:

1) " _we presented the paper to bezos_ " -- Wow, engineers have direct access to the CEO.

2) "we presented the paper to bezos ( _he doesn't do slides_ )" -- Wow, a CEO that actually has some attention span

3) "we presented the paper to bezos (he doesn't do slides), _he liked a lot of it_ " -- Wow, a CEO who actually understands technology

<comment><USER4> All of those are true. The lack of powerpoint at Amazon is not a myth - <USER2> are the order of the day. This is more good than bad, but has some of both.

<comment><USER5> This is a great aspect of the culture there that has helped Amazon maintain its technical competitive edge.

</comment></comment></comment><comment><USER6> EC2 has been in operation for a few years now, and the price levels from the launch remain unchanged, despite the fact that their largest expenses are subject to Moore's law.

<comment><USER7> They have also added:

\- Elastic Block Storage

\- An SLA

\- Windows

\- Static (Elastic) IPs

\- New datacenters

\- Geographic targeting (Regions)

without raising the price.

<comment><USER8> And, the bandwidth prices have gone down a little.

</comment></comment></comment><comment><USER9> I enjoyed the story thanks for sharing, a couple things I didnt get is why the author "was trying to avoid this.." and why "after some exchanges its best to share"

\- I bet he feels some ownership, over the product.

\- The 2nd option is this is a resume` play, but probably not likely.

either way great story; although short - good luck with your other endeavors

<comment><USER10> After a project succeeds in a large company, people who were tangentially involved come out of the woodwork to claim credit. There is a natural human urge to debunk these claims, but often this just makes things worse if the credit-takers are politically astute.

<comment><USER4> A few things for context:

1) This came up b/c somebody else publicly described the author as the inventor of EC2, which created some unintended blowback;

2) The author is well-known in the ops community and still close to a number of people at Amazon, and has no personal or professional interest in hurting those relationships.

<comment><USER9> Thanks for the context; it helps a lot to know that this fellow was trying to deflect credit where it was due; Not sneak some where it wasn't.

</comment></comment></comment></comment><comment><USER11> It's a great service at a great price.

I do think they should have picked a different brand name than Amazon for it.

We're moving to EC2 at the moment and when explaining it to commercial people it's an unnecessary hurdle to also have to explain that Amazon do more than sell books and they really can be trusted to host infrastructure.

</comment><comment><USER12> I'm interested to hear what sort of products people are running on EC2. Anyone want to share their story?</comment>


Ask HN: What's your favorite bad startup idea? - <AUTHOR> I like coming up with bad startup ideas: they sound like something that could be real or funded but are actually terrible. Here's some of mine<p>* NapApp: AirBnB for naps. You don't do anything with your bed during the day, so why not rent it out to strangers hourly to take naps. NapApp comes with a NapMap for you to find the nearest bed * Audiogram: a completely audio-based social network. No visual interface. You can only interact with it via your voice and post audio clips (apparently something like this already exists) * Service-as—a-service (not my idea): church service in an app<p>Got any that you like? <comment><USER2> Paranoia - the app. You download this dodgy looking app and it it alerts you if another user of the app is within 25m of you. Thats literally all it does.

</comment><comment><USER3> I worked for a company where the guy in charge had some vague notion of what he wanted. He made the famous statement 'I do not know what I want but I will know it when I see it'. Hard to develop to that requirement. Needless to say it failed.

</comment><comment><USER4> Well, Yo app was an awful idea, funded with money even.

Several years ago, I've read in a newspaper in Barcelona about an european startups who rented private toilets ala airbnb so you can, well, you know what I mean. Toilets were rated by cleanness, location, etc. I lost track of that project.

</comment><comment><USER5> Smartphone handwarmer. The general idea is to overclock a phone until it frys, and utilize a key partnership with smart phone companies to generate revenue from the bump in device replacements.

<comment><USER2> I think someone already sold apple this idea for the more recent Macbook Pros, though they just fry the screen.

</comment></comment><comment><USER6> Let me generalize:

Typical "bad" or rather high-risk idea is when someone is coming up with "solution looking for a problem". It typically starts with: "Oh, I have this amazing idea about the great business... ". Countless millions lost this way.

On the opposite spectrum - typical high success rate idea is born via tight relationships where you already have customer with money ready to buy specific thing where you form startup to build it.

And then you retain ownership to rinse-repeat-resell.

</comment><comment><USER7> Your startup works mainly in Japan, as I read a couple of months ago, they rent cars to take a nap, instead of to drive to somewhere

However, you have to solve some obstacles, like "do people feel all right to let someone sleep in their bed? Or even maybe do sex with someone instead of just a nap?"

I think it's better to share nap cabins to users, some companies have started to build nap cabins which mostly use in hostels

</comment><comment><USER8> An idea that kicks in my mind is citizens band on the internet. You sign up and pick a location in a fictional world and start off with 1w of power and a small antenna. Pay to upgrade your rig and get better antenna. Complete with squelch and everything!

</comment><comment><USER8> So your idea is renting a bedroom out by the hour :-). Might be quite profitable.

</comment><comment><USER9> Gig economy for picking up dog poop on other people's property. At least two of these already exist, one of which was recently featured on Product Hunt. I can't wrap my head around it.

</comment><comment><USER10> Über, but for elevators

</comment><comment><USER11> I assume NapApp is kind of [https://globeliving.com/](https://globeliving.com/)

</comment><comment><USER12> A dating/carpool app. Your first date is the carpool.

</comment><comment><USER13> Shazam, but for food.

</comment><comment><USER14> An app called "Guy in the Hood" that's a literal take on Daymond John's refrain from Shark Tank . It's like TaskRabbit but it only summons guys from the hood.

</comment><comment><USER15> * Not Hotdog

* Seefood</comment>


Cherow ECMAparser 1.0 beta is out - <AUTHOR> Still in beta stage, but with improved performance.<p>URL: https://github.com/cherow/cherow <comment><USER2> This project looks really great and all, but one thing I've come to appreciate is portable language processing tools. Like this is an js parser in typescript so I have to have node installed to use it (I'm assuming). The trend is language y parser in language y. So I have to install language y environment to use it.

I guess I'm saying really portable language parsers would be c libs with wrappers for n languages, or language servers.

<comment><AUTHOR> Hi. You shouldn't need to have NodeJS installed to use it. Use the distro files and run it in the browser. The TypeScript is not needed for end-users. That something used during the dev process.

</comment></comment><comment><USER3> what's the usecases for this parser?

I'm mostly interested in writing a docstring document (like jsDoc) generator. So I care if this parser can keep comments. From the readme I saw it does. But from the demo page, I checked "attach comment", but I couldn't see comments in the parsed result.

<comment><AUTHOR> Hi. Usecases? Same as for Acorn, Esprima and other parsers. But the main goal with this one is to be as fast as possible, and optimized for all platforms including mobile and tablets.

Cherow collect comments. The version before v. 1.0 also kept comment or attached node directly on the AST itself. I removed it due to perf reasons and no one - I thought at least - was using it anymore. If that is something you would need, I can add it back. Shouldn't take long.

<comment><AUTHOR> Feel free to open an issue ticket on the GH repo so I can track it if you want the comment attachment code added back in.</comment></comment></comment>


A Step by Step Backpropagation Example - <AUTHOR> http://mattmazur.com/2015/03/17/a-step-by-step-backpropagation-example/ <comment><USER2> Every such example stops at vanilla backprop.

What I'd like to see (and which I think would be a lot more challenging) is: BPTT for a recurrent network. BP for an LSTM or GRU. Can someone do that?

</comment><comment><USER3> Backprop is fun. You may also enjoy a look at the generalization: reverse accumulation [http://www.win-vector.com/blog/2010/07/gradients-via- reverse...](http://www.win-vector.com/blog/2010/07/gradients-via-reverse- accumulation/) .</comment>


Ask HN: What do you recommend for a web development novice? - <AUTHOR>

My friend, an experienced software engineer, is extremely new to the world of web development. I am building him a list of resources, libraries, tools, workflows, tutorials, etc. to help him get up to speed. I would appreciate the recommendations and suggestions of the HN community. <comment><USER2> This is a good start: [http://rmurphey.com/blog/2012/04/12/a-baseline-for- front-end...](http://rmurphey.com/blog/2012/04/12/a-baseline-for-front-end- developers/)

All the links you'll ever need: [https://github.com/christopherscott/frontend- toolbox](https://github.com/christopherscott/frontend-toolbox) and [https://github.com/dypsilon/frontend-dev- bookmarks](https://github.com/dypsilon/frontend-dev-bookmarks)

<comment><AUTHOR> +1 on the frontend dev bookmarks, I remember seeing that a while back, but had completely forgotten about it! It is an incredible resource.

</comment></comment><comment><USER3> I'm also getting started. Is the MDN a good place to start?

[https://developer.mozilla.org/en- US/docs/Web](https://developer.mozilla.org/en-US/docs/Web)

<comment><AUTHOR> I have personally found their tutorials and HTML docs to be very useful.

</comment></comment><comment><USER4> Teaching myself, I found the following resources helpful:

* Michael Hartl's Rails Tutorial: [http://ruby.railstutorial.org/](http://ruby.railstutorial.org/)

* Steve Huffman's Web Development Class: [https://www.udacity.com/course/cs253](https://www.udacity.com/course/cs253)

* Balaji Srinivasan's Startup Engineering Class: [https://www.coursera.org/course/startup](https://www.coursera.org/course/startup)

</comment><comment><USER5> Unfortunately I can't contribute much, because I am largely in your friend's boat. Any chance of making whatever list of resources you compile public in a blogpost somewhere?

<comment><AUTHOR> That is exactly what I am hoping to do. I started with a google doc, but I am thinking of moving it over to github at some point.

What sorts of useful resources have you encountered? What sorts of things are lacking for your development process? These are ultimately the questions I want to help answer!

<comment><USER5> I'll try and answer these two, and lump everything else in a group ;)

1) What resources have I encountered (no particular order): \- O'Reilly's (oreilly.com) weekly specials on different topics is a good place to get ebooks for good value. \- Atlassian's software (Jira, Stash, etc) seem to be quite popular in the web development community, and may be well worth grabbing the free or once-off-$10 versions. \- IDE is a very personal choice, but coming from an embedded and toolkit background, I really, _really_ enjoy Jetbrains' IDEs. I've worked with Rubymine and PHPStorm - they're quick to learn, and pretty cheap for personal licenses (<$100). \- Depending on your friend's background, web development will have a very different terminology - wikipedia is your friend. \- Again, depending on his background, have him check out this list of books: [http://siliconangle.com/blog/2011/12/06/top-10-books-on- prog...](http://siliconangle.com/blog/2011/12/06/top-10-books-on-programming- according-to-stackoverflow-users/) . I've at least scanned through most of the list, and find it useful from a perspective perspective. \- Databases, databases, databases. Web apps are built on these. If he doesn't have a solid background, work on it. \- Continuous Integration, unit testing, etc - do not go without these (IMO, not even code review is as important as these). \- Does he development on Mac, Linux or Windows? Master whichever platform he is on (Mac and Linux seem to be the more powerful ones - Linux guy myself).

2) What sort of things am I lacking in my development process: \- My experience with interface design is minimal, but it seems to be a key component in web development. \- I have yet to look into 'you rub my back, I rub yours' setups, where I might do code for someone, and they might do UI design for me (as an example). \- RESTful API development - I have little experience, but this is a huge component of web development (along with plain old WSDL type APIs). \- Lacking enough knowledge of modern languages to make informed decisions on which language to tackle a problem with. Not a huge issue, ultimately, but would be nice to know more (I'm a C/C++ guy). \- Keeping on top of the tool of the week (either programming, or productivity, or whatever) is a chore. So many good tools abound for various scenarios, it's difficult to keep track.

3) I've found that putting together a setup at home or wherever that mimics a dev setup, will help a little on keeping everything together for you. A cheap machine running some combination of the following: \- VCS \- Wiki \- Issue tracking / Agile tracking \- CI / Automated build/test/deployment \- Code review tool \- Development site \- Whatever other tool he finds useful in his development workflow

The answer is a bit haphazard, but I hope it helps :)

</comment></comment></comment><comment><AUTHOR> Is it generally recommended to start off using some sort of CSS framework like Bootstrap ([http://getbootstrap.com/](http://getbootstrap.com/)) or Foundation ([http://foundation.zurb.com/](http://foundation.zurb.com/))?

<comment><USER6> Actually, I wouldn't recommend that at all. Well, if he is interested in learning fron-end dev I wouldn't recommend that. In my opinion, the best way to learn is to build something. If you want to suggest Bootstrap or Foundation than I would suggest he tries to build another Bootstrap/Foundation. Learn grids, learn CSS psuedo elements and media queries, learn HTML5 semantic markup etc. etc.

</comment></comment><comment><USER7> my excellent blog [http://eguneys.github.io](http://eguneys.github.io)</comment>


Microsoft Is Winning the Techlash - <AUTHOR> https://www.axios.com/microsoft-is-winning-the-techlash-4d16b1ba-2da5-4f9b-8fd2-d591b0a3b2ea.html <comment> d--b Microsoft doesn't get a bad rep like facebook or google, because their business model is not based on pushing ads onto their users and selling their users' data, which everybody hates.

Apple's bad rep is probably due to high pricing, tech lock-in, horrible apple store experience, bad behavior regarding right-to-repair, pretty bad software overall.

<comment><USER2> > Microsoft doesn't get a bad rep like facebook or google, because their > business model is not based on pushing ads onto their users and selling > their users' data, which everybody hates.

Microsoft has many business models and one of them is based on advertisements, example : LinkedIn.

<comment><AUTHOR> > Microsoft has many business models and one of them is based on > advertisements, example : LinkedIn.

LinkedIn make bank from selling Sales Navigator. Ads are a tiny proportion of their revenue.

<comment><USER3> I was surprised to see this is true about their advertising! While dated, their 2016 disclosures showed ads making up only 18% of revenue ($109mm)[1]. Which was only about 10% of the $1.6bn that Bing pulled in around that time[2].

Having managed ad campaigns on LinkedIn, that's both surprising and not. They have a horrifically high cost per click compared to other channels, but the results in B2B verticals were usually enough to warrant putting up with it. So it's surprising it was only pulling in around $100mm. But then, their self- service component didn't allow for accessing all of their inventory, and none of my clients wanted to go in with the commitments necessary for the high- touch placements. So that may have dampened demand a good bit.

That said, Sales Navigator (and premium subscriptions) is an equally small portion of revenue. 65% of their money came from their "talent solutions" recruiting features.

[1] [https://www.investopedia.com/ask/answers/120214/how-does- lin...](https://www.investopedia.com/ask/answers/120214/how-does-linkedin- lnkd-make-money.asp)

[2] [https://www.mediapost.com/publications/article/313837/micros...](https://www.mediapost.com/publications/article/313837/microsoft- revenue-from-bing-search-ads-rose-in-201.html)

</comment></comment></comment></comment><comment><USER4> ...says Axios, an outlet infamous for obsequious coverage of the wealthy and well-connected. In Tech, Microsoft is old money, thus this puff piece.

Just this year Microsoft's Outlook service had a massive breach, leaking ~800 million passwords. Their flagship product, Windows 10, is infamous for randomly blocking people from working. The recent October automatic update even went ahead and just deleted users' files. Remembebr Windows Phones? Remember Bing? MSN is still live... so I guess it outlasted Google Plus.

I guess since its efforts in social media are a whisper of a joke, that by default they're "winning" ? More likely it's just Axios being Axios.

meanwhile .. [https://www.forbes.com/powerful- brands/list/](https://www.forbes.com/powerful-brands/list/), [http://www.millwardbrown.com/brandz/rankings-and- reports/top...](http://www.millwardbrown.com/brandz/rankings-and-reports/top- us-brands/2019), and any other extant brand ranking shows Microsoft pretty far from the top

</comment><comment><USER5> The conclusion is contrary to the evidence presented.

> companies untouched by scandal — including Microsoft — > prospered in the > eyes of consumers

Except that Amazon, which _has_ gotten a bit of a black eye later (HQ2 + worker treatment + antitrust), has stayed steady near the very top of the cited poll. Apple, which has had few such problems, has sunk from near the top to #32. When you only have eight samples to begin with, and two strongly contradict your theory, your theory sucks. Microsoft in particular is doing relatively well for a variety of reasons, but not because of this one.

<comment> Funes- >Microsoft in particular is doing relatively well for a variety of reasons, but not because of this one.

Why exactly wouldn't Microsoft's newfound good reputation be included among those reasons? Your rebuttal would be just as unfounded as the theory you are dismissing. Perhaps it's not as determinant a factor as the author makes it out to be, but discarding it altogether doesn't look reasonable to me.

<comment><USER5> > Your rebuttal would be just as unfounded as the theory you are dismissing.

True enough, but that doesn't validate the higher-profile original either. Seems a bit "well actually" TBH.

<comment> Funes- >that doesn't validate the higher-profile original either.

You're right, it doesn't. I never said that, either.

>Seems a bit "well actually" TBH

I'm sorry if it came across that way, really. I like to be as precise as I can with everything I say, so it just came out that way naturally. Actually, one of the first replies I got here (not too long ago) was a similar kind of comment to the one we are discussing now. At first, my reaction was negative, as in "this guy is just trying to one-up me by nitpicking my comment"; then, I realized it was an opportunity to start to make myself as clear as possible whenever I wrote any other comments. Anyhow, I hope you can understand where I'm coming from.

</comment></comment></comment></comment><comment><USER6> I think the problem with Google is it can't decide if they are into software or into advertising.

Google had a big lead on Microsoft with their web based 'office like' products, but they just could not get the paying business customer.

Microsoft can see what Google is doing, quickly push out their 'Office 365' clone and without much effort find they have quickly become the biggest player in that field.

I think Google would have easily won that game it they could just convinced business they where more than just an advertising company.

I get the impression business is more than happy giving their data to Microsoft, while also paying for that privilege where as they are not so sure about trusting their data with Google.

<comment><USER7> I would love so much to pay for Google services if it meant disabling all of their ads and data tracking. But they're just not interested in that kind of business model.

<comment><USER8> If there's one uncomfortable thing Google has made painfully clear to all of us, it's that the vast majority of consumers just aren't interested in paying for things like email or search.

It isn't due to a lack of offerings. There are plenty of provides that will happily do so. Anyone who wants to can buy email from Google _today_! Yet in the face of this the vast majority of users choose not to pay for email.

My current operating hypothesis is that the vast majority of ordinary users value their privacy right up to the point where they have to put a price on it. At which point a handful of nerds (like us!) are willing to pay, but most people happily trade their privacy for services instead of involving money.

<comment><USER7> I pay for Fastmail and I get a relatively large amount of spam there. We self- host our email at work, and plenty of spam gets through there, too. I never see spam in the inbox on my gmail address, ever. Google's email is the best I've seen (though I admit I haven't used a lot). I use it because I want to use it, not because it is free.

I'm not sure what you mean by "buy email from google today." I don't want to "buy email," I want to pay them to not serve ads or track me when I use their services. That includes far more than email, I'm talking about the whole ecosystem like Android, Maps, Search and so on. Surely $120/year from me is worth far more than they're getting in ads, right? I dunno.

<comment><USER8> Personally, I suspect that $120/year from 10,000 people like us is not worth Google's time and effort.

I can also see the criticisms now: "privacy isn't a luxury only for rich people!".

</comment></comment></comment></comment></comment><comment><USER9> "Tech industry/company" is a useless term. Facebook and Google are ad networks, and it's advertising that's getting a backlash.

Microsoft has a much smaller ad business with Bing (although still 3x bigger than Twitter) so of course they don't get the same amount of backlash because of it. Apple is in a similar position.

</comment><comment><USER10> Really the whole "techlash" feels incredibly manufactured in the first place - I think the uniform shallowness of criticisms is part of its smell. I mean most content it shallow but you expect a "bell curve" of nuance between slogan repeaters and those pondering more in depth at the edges. Look at other movements and their diversity of ideas - even if mostly in agreement differing implementations tend to be proposed by some even if most parrot shallow slogans.

The selectivity also stinks. Comcast, a serial worst company winner infamous for poor service is left unmentioned while social media somehow qualifies as "a monopoly" and the equivalent of Store Brands in Amazon is somehow monopoly abuse?

<comment><USER9> Yes, the real backlash is people's trust in the media. Of course the media will never write about that.

<comment><USER11> Don't discount the gentrification issue. In places like Austin, San Fran, and West LA the "techlash" started when small businesses and non-tech workers could no longer afford to pay rent in their city, and their culture was pretty much replaced.

<comment><USER10> That is a separate issue and far more local.

For LA they were going wannabe terrorists about gentrification back in the the late 90s with the Yuppie Eradication Project - it seems nobody was sympathetic to them and who can blame them? I think most would rather have the most obnoxious yuppie stereotype than those idiot self-righteous vandals.

Gentrification seems to be a noisy minority issue - I hear far most people who would want gentrification.

Which I suppose points to another cultural divide. To suburbanites and even other major cities they look like huge spoiled brats - conplaining about things other areas would kill for, and already offer more for far less. I am aware of differing situations and needs but it seems that someone isn't being reasonable.

<comment><USER11> "Gentrification seems to be a noisy minority issue"

It does tend to affect minorities more. See Inglewood and Boyle Heights for recent examples.

Expensive gelato and coffee shops are not things these communities "would kill for".

I understand your point, but it does seem quite tone deaf.

It's not about "annoying yuppies" it's about family businesses and lifetime- long residents being pushed out due to rent increases.

</comment></comment></comment></comment></comment><comment><USER12> Apparently, they averaged about 300 interviews per company, then stack ranked on net favorability.

I'm not a social scientist, but that seems.. low? And while I'm sure the initial call list was demographically weighted, apparently they'd ask each respondent to talk about two companies they were more familiar with from the list of 100. That doesn't sound like the ~300 people rating each company had any proper demographic weighting at all.

Full report: [https://theharrispoll.com/HarrisPoll_Axios_MostVisible_2019....](https://theharrispoll.com/HarrisPoll_Axios_MostVisible_2019.pdf)

<comment><USER13> 300 people rating 2 of 100 companies does seem very sparse. Thanks for the link.

</comment></comment><comment><USER14> As an aside, FB's continued success, while having such a bad public image is astonishing.

They obviously have a moat, a very literal network effect. But, FB also has lots of competition (more than google, amzn, & msft anyway) and the type of product that should be substitutable.. with some combination of twitter- wechat-HN-or-whatnot. Social network, seems, at least to me, like something that lends to rising and waning popularity. They're not embedded in businesses or hard to turn off in any way.

It just seems that negative user opinion of FB should be a bigger deal than it would be for amazon of msft.

I dunno how to square this circle.

<comment><USER15> > As an aside, FB's continued success, while having such a bad public image is > astonishing.

The public image is a bunch of people who want them to be bad, not actual consumers. The media has narratives it drives and a bunch of nerds here hate them for legitimate reasons. The average consumer does not care and never will.

<comment><USER14> I disagree. The average FB user is opinionated about all sorts of things. I bet you if you polled random people on the street, they have an opinion on FB... and I bet it has gotten worse in the last few years.

</comment></comment></comment><comment><USER16> Although Microsoft has been very successful lately, I wish they hadn't given up on competing in some consumer areas such mobile. Now we are stuck with only Apple & Google.

<comment><USER17> I wonder if they wait for the right moment (e.g. when Android gets replaced with whatever Google tries to replace it with) for a new play on mobile or if they really are "done" with it.

<comment><USER18> I think there is a still a possibility that Microsoft expects the phone and PC markets to merge and hopes to be there with welcoming arms when it does, but I'm getting the impression they won't build new hardware to do it if they can't convince other manufacturers to join in.

</comment></comment></comment><comment><USER19> I just last week had to deal with customers that had locked-down computers stuck on IE11 and hit some JS that used unsupported features.

IE11 was released after the relevant features were in common use in the Javascript community, but Microsoft was still in its "the web is better with our proprietary extensions, trust us" mode so they aren't in IE11.

They can't upgrade their browser because IE11 is the last browser version Microsoft supports on their Microsoft operating system, because they want users to upgrade.

They can't use an alternative browser because they're in a security-sensitive industry with policies written in the Old Days when running third-party software was marketed as "dangerous", including by Microsoft.

They don't want to upgrade operating systems because that means a huge software spend to Microsoft, plus migrating all their other software, POS hardware, etc.

The point being, none of these are things Microsoft is doing _today_. But they're all decisions they made in the past, and the consequences of those decisions are _still_ making people's jobs harder.

<comment><USER20> Edge is MS's current browser... IE11 was an incremental release over IE10 and several years old at this point. Most browsers update very frequently. IE never did.

Maybe you need to look at whoever locked said computers down to ONLY support IE? Chrome and Firefox are both better options at this point. It really isn't MS's fault that an organization can't be bothered to update their software for what, 4 years now?

</comment></comment><comment><USER21> Microsoft is more B2B than B2C compared to the other companies, so it makes sense that they're barely ever in the news cycle. They've done a good job of creating separate identities for their Office, Azure and Xbox brands, so bad PR on the Xbox side won't adversely impact the company's reputation as a whole.

</comment><comment><USER22> The chart is very misleading. Instead of charting rank year on year, Axios should have charted the actual reputation, and then placed a few household names next to them so they're more comparable.

[https://theharrispoll.com/axios- harrispoll-100/](https://theharrispoll.com/axios-harrispoll-100/)

Facebook's score (58) is basically in the dumpster category, a notch behind Comcast (61.4), Bank of America (60.9), and Goldman Sachs (60), though still several notches ahead Trump Org (50.1), Philipp Morris (49.4), and the US government (48.6).

The other tech giants are within a few points of each other: Amazon gets 82.3, Microsoft 79.7, Netflix 77.3, Apple 76.4, and Google 75.4. Amazon is in the same category as Disney. The other 4 are comparable to the likes of Coca Cola, Procter and Gamble, Unilever, Nike, etc.

</comment><comment><USER23> "Microsoft lost on search because they were so distracted by getting sued by the government" is a dubious take I've never heard anywhere else.

</comment><comment><USER24> I was just musing about what makes a tech company more likeable.

Personally, I made money for years using Microsoft products, find Amazon quite useful (living in small towns) and just see Google as irritating. But then, if the internet were reduced to USENET, email, and maybe a curated list of serious websites like online banking, I'd be fine with it, and probably better off in some ways.

<comment><USER25> > Personally, I made money for years using Microsoft products, find Amazon > quite useful (living in small towns) and just see Google as irritating. But > then, if the internet were reduced to USENET, email, and maybe a curated > list of serious websites like online banking, I'd be fine with it, and > probably better off in some ways.

You're not alone in this thinking. The vast bulk of the Web is of marginal benefit, or harmful, and I think in the end it's going to contribute to taking us (humanity) to a very, very bad place.

</comment></comment><comment><USER26> The Axios Harris poll [1] as a general matter is pretty interesting. I am surprised at Amazon's position among the tech firms.

[1] [https://theharrispoll.com/axios- harrispoll-100/#2019-ranking...](https://theharrispoll.com/axios- harrispoll-100/#2019-rankings)

</comment><comment><USER27> Microsoft are selling an incredible suite of products and services. They are dependable, responsible and innovative. When I choose to use their platforms, I know they are taking me seriously, that they have a very long product support horizon, that they are embracing openness, have excellent documentation and integration with their tools (one fun exercise is debugging an Azure Function (their serverless lambdas) locally and seamless inside Visual Studio on your machine. Magical).

I would have thought they are a dying company just two years ago and today I have a completely opposite outlook of them.

<comment><USER27> This comment turned out an interesting experiment in internet crowd dynamics. I have over 40 upvotes at this point, but all the replies to my post have been more-or-less negative. My guess is that the people who are happy with Microsoft or generally agree can't be bothered to reply, while the few who've been burnt would take this as an opportunity to take out their anger (very justifiably so).

Most of us know internet opinions behave in this manner where you mostly get to hear discontent, but it's still fascinating to experience it first hand.

(I'm not in any way criticizing the replies to my post, which have been diligently written with real life examples and definitely given me some things to think about)

<comment><USER28> I've had similar experiences on HN, and funnily enough the last time was for a comment that was fairly supportive of Microsoft. I got absolutely _roasted_ in the comments, but received a ton of upvotes from the silent majority.

There are three areas I'd disagree with you though.

The first is Microsoft's Surface line of tablets and laptops. I literally cannot find a kind word to say about the (very expensive) Surface Book devices we bought en masse about 18 months ago. They are _awful_ [1] and we are already starting to phase them out as a result. It makes no sense because Microsoft can clearly do hardware well: for example, I have no complaints about my Xbox One X - it's all round great.

The second may substantially be connected to the first, and that's Windows 10. I increasingly hate using it because I find it slow, finicky, and unresponsive/a serious resource hog. So much of the time my laptop is running hot and draining its battery because Windows is doing _something or other_ not related to what I'm working on.

The third is Microsoft Teams. The functionality it offers is good and, for VOIP and video calls, it's probably second only to Zoom so does get a thumbs up from me there. However, it's painfully slow to switch views, doesn't support multiple windows (so you can't sensibly look at chat and wiki at the same time), takes an age to start up, and behaves like an absolute moron when it comes to switching networks or losing and regaining network connectivity (usually requires a restart of the app).

 _[1] Underpowered, overpriced, poor battery life, run very hot, ropey WiFi, poor speakers that are insufficiently loud, crappy trackpad, only a single display port built in, poorly designed /laid out ports, unreliable (and often weirdly slow) charging, drains battery within 12 - 18 hours whilst asleep, I could go on (and on). In short: DO NOT BUY UNLESS YOU HATE YOURSELF!_

<comment><USER29> Microsoft teams is featured packed. But some ui decisions and bugs won't let it be great. And the problems are not only on the desktop version. On android I receive a notification only to open the app and the message hasn't loaded yet, and doesn't load for at least 20 more seconds.

<comment><USER20> I have a morning meeting in teams that I often wind up calling into on my phone + bluetooth in my car... it often borks out and won't stay connected without force stopping the app. That's about my biggest complaint with teams... I also think the desktop version should use the material/android interface for starting a new thread... it's to easy to think you are replying but actually starting a new thread. Looking/finding old messages is pretty nasty/hard too...

</comment></comment></comment></comment></comment><comment><USER30> Maybe they have a higher reputation but that doesn't mean people like or will buy their consumer products. They still have a huge problem there.

</comment><comment><USER31> I really wish Microsoft would release a modern, capable smartphone. Not based on Android. Revive the windows phone UI, couple it to good hardware. Maybe partner with Samsung. A surface phone, so to speak. I'd buy it instantly. I don't care about apps. I care about a good browser, good screen, maybe whatsapp, long battery life.</comment>


Microsoft's robot editor confuses mixed-race Little Mix singers - <AUTHOR> https://www.theguardian.com/technology/2020/jun/09/microsofts-robot-journalist-confused-by-mixed-race-little-mix-singers <comment><AUTHOR> The whole article is hilarious but these latter 2 paragraphs especially:

> _In advance of the publication of this article, staff at MSN were told to > expect a negative article in the Guardian about alleged racist bias in the > artificial intelligence software that will soon take their jobs._

> _Because they are unable to stop the new robot editor selecting stories from > external news sites such as the Guardian, the remaining human staff have > been told to stay alert and delete a version of this article if the robot > decides it is of interest and automatically publishes it on MSN.com. They > have also been warned that even if they delete it, the robot editor may > overrule them and attempt to publish it again._

<comment><USER2> Just when you thought this timeline couldn't get any weirder...

</comment></comment><comment><USER3> So uh, why is this such a horrible mistake? Traditional media screws up things like this all the time.</comment>