Your company can increase voter turnout: make Election Day a company holiday - <AUTHOR> https://www.electionday.org/ <comment><USER2> I've voted twice in my life. The first time was in 2012, where I waited for over 2.5 HRS in pretty cold weather and saw dozens of folks leave the line because they had to go to work, school, or just couldn't wait that long because they had kids or were elderly.

The second time I voted was last year, since 2012 I've moved to Oregon. I got a voters pamphlet in the mail weeks before the election, and while we all knew who the presidential candidates where this pamphlet provided a great way to catch up on state and local races. I spent 2-3 days reading the pamphlet and researching the issues. I filled out a form within ~10 minutes and dropped it in the mail. It was great.

More states should move to vote by mail.

<comment><USER3> 2.5 hours long lines to vote would have been a major crisis in Norway. The longest I've ever waited was 20 minutes when I voted in city hall just after 4 pm when everyone got off work and voted on their way home. Even then there was an election official walking up and down the line warning about the waiting times and guiding people to to other places to vote.

Seriously, this is easily solvable with easy access to early voting, enough ballot places with enough election officials and enough voting booths.

<comment><USER4> What are you trying to do, give everybody in the USA a voice or something? Not in THIS lobby!

</comment></comment></comment><comment><USER5> I didn't know this was not already mandated by law. I wish I could say I'm surprised, but it seems to jive with the general theme of other US policies.

To contrast, in Canada:

"By law, eligible electors must have three consecutive hours to cast their vote on election day. If your hours of work do not allow for three consecutive hours to vote, your employer must give you time off.

Employers cannot impose a penalty or deduct pay from an employee who is taking time off to vote if required by the Canada Elections Act. An employee must be paid what he or she would have earned during the time allowed off for voting."

[Source] [http://www.elections.ca/content.aspx?section=vot&dir=faq&doc...](http://www.elections.ca/content.aspx?section=vot&dir=faq&document=faqvoting&lang=e#a9)

Edit: happy to see similar laws do exist for some states!

<comment><USER6> Unfortunately the UK is the same as the US in this regard. Elections are always held on a Thursday, and employers aren't required to give time off to vote.

<comment><USER7> In Australia, voting is always on a weekend, and is compulsory. Also, there are sausages in bread for sale

<comment><USER8> I'm proud of my democracy sausage but remain unconvinced that criminalising nonparticipation advances the ideals and outcomes of a government by the people. There are downsides too, most obviously when some crude federal politician stretches the Overton window in an attempt to sway reluctant voters.

<comment><USER9> But is it criminalised? At least in Brazil voting is compulsory but a failure to vote only gives you a VERY meager fine (something less than US$ 1, even for Brazil that is cheap) and if you haven't sorted that out the only penalty is not allowing you to request a new passport. Then you have to pay the fine and go on your merry way again.

It's mostly a deterrent by being annoying, paying the fine is a bit bureaucratic so people try to avoid it.

Not that Brazil is a beacon of democracy and good leadership but at least it's pretty sensible on the penalties you get for non-participation.

</comment></comment></comment></comment></comment><comment><USER10> PSA: For those of us in CA, fill out the form online at [http://registertovote.ca.gov](http://registertovote.ca.gov). If you don't have a CA driver's license print and mail the form. If you do have a CA identification the entire registration is handled electronically. The only requirement to be a resident is that you live in California with the intent to make it your home.

Once you're registered mail in the vote-by-mail form elections.cdn.sos.ca.gov/vote-by-mail/pdf/vote-by-mail-application.pdf.

From that point forward they will mail the ballot to your house anytime there is an election. Check the boxes and drop the pre-paid envelope in the mail. It really is very easy.

Often municipal elections are decided by narrow margins. If everyone working at startups in the bay area registered and started voting it could easily swing the outcome of various propositions, housing policy, etc.

We like to think our industry is non-political but as software eats the world we are only going to increasingly be involved in politics. Voting is the bare- minimum in civic duty. If we don't make our voices heard we'll keep getting restrictive zoning on the local level and DMCA/CFAA garbage on the national level.

<comment><USER11>
      The only requirement to be a resident is that you live in California with the intent to make it your home.

But to _register to vote_ in a state/Federal election, you must be a _citizen_. If you drill down to the FAQ, its opening page says:

"Who can register to vote? To register to vote in California, you must be:

A United States citizen and a resident of California, 18 years old or older on Election Day"

</comment></comment><comment><USER12> Which election day? The Sunday that I sit down at my leisure with the voting guide and fill out my ballot? Or maybe I'm busy on Sunday and do it Saturday. Or maybe I'm actually on the ball this year and do it a week early.

I've been trying to find downsides to mail-in voting since Washington implemented it. Haven't found any, but I'm open to ideas. Don't have a stamp? Fine drop it off at the drop-off box on the way to work. Can't even do that? I'm pretty sure the local $SENIOR_ORG will drive you if you call them.

Oh, and mail-in gets rid of the "day off work" problem, too.

<comment><USER13> The only downside that I'm aware of is that it makes certain kinds of systematic voter fraud possible. Specifically, selling your ballot becomes a trivial thing.

Currently, that practice is limited by in-person voting for a couple of reasons; first that you have to show up at the polling place and sign in the book, second is that there is no way for a third party to verifiably see that you have voted the correct way, much less fill out the ballot on your behalf.

While both of these can be worked around, it is at much higher cost in terms of the possibility of being caught.

How concerned we should be about this is a matter of opinion; there's not really a practical way to measure whether it makes a difference, since the fraud is so undetectable.

The other thing is that this does not solve the voter turnout problem -- Washington, Oregon, and Colorado all do well for voter turnout, but don't lead the pack compared to other states with in-person voting.

<comment><USER14> > does not solve the voter turnout problem

Refusing to vote is a perfectly valid choice in a democracy.

Politicians like to pretend that the 40-60% of the people who don't vote are not voting because they are stupid, ill-informed, or whatever, but the much more likely explanation is that this group recognizing (rightly) that voting is a waste of time in a political system as corrupt as the U.S. or the refuse to vote as a form of conscientious objection.

In reality the winner of every election in decades has been "none of the above."

<comment><USER13> I agree to a very large extent; I was just commenting on a response to an article about increasing voter turnout. The suggested approach (mail-in-only voting), while nice in many ways, does not (empirically) have that particular effect.

I think voter turnout has become the axis on which all modern (presidential) elections have hinged. Trump didn't beat Hillary in the rust belt by convincing hoards of Obama supporters to bot Republican. What the Obama voters did, though, was stay home. The numbers bear this out (although we don't have individual tallies) -- Trump didn't win any more votes in those states than Romney did in the last election. The same voters who pulled that lever came out and did the same thing they did in the last cycle.

That's also why the polls were so off -- they rely on "likely voter" models, not realizing that what they should be measuring is not who likely voters will vote for, but whether or not people will show up at the polls. Instead, they used "likely voter" criteria that they learned in the Obama election and gauged sentiment in that group.

<comment><USER14> > What the Obama voters did, though, was stay home

The group of Obama voters that declined to vote for Clinton was definitely large enough to lose her the election.

That sort of reinforces my point about role of refusing to vote in a democracy. The political power of those protest non-voters far exceeded the power of anyone who voted.

</comment></comment></comment></comment></comment><comment><USER15> Serious question: How does increasing voter turnout make anything better? Doesn't that just increase the likelihood of politicians using unscrupulous techniques to fool voters?

A huge problem is actively ignorant voters in my opinion, this would make the problem worse.

<comment><USER16> The current system appears to vastly under represent the young and poor and over represent the elderly. The politicians exist to represent everyone's interests so any statistical disconnect undermines the system.

<comment><USER15> Did Net neutrality not teach you anything? Open your eyes, politicians exist to represent special interests - if they're doing that with net neutrality, think of what they're doing in areas where people don't pay much attention.

</comment></comment></comment><comment><USER17> .. or just make all balloting mail in.

Though I think you'd see an increase in turnout if return postage was paid.

<comment><USER18> ... or lets realize its not 1950 and we could vote electronically.

<comment><USER19> Even if you can do it securely (I do all my taxes electronically, as is the case with all other contacts with public services and authorities), there are issues with elections.

E.g: someone cold drive around "helping" elderly people to e-vote. This type of thing has to be done "visibly" if you have to bus people to polls. Basically, if you want to cheat you have to do it in public.

Polling stations are a good invention. The ceremonial act of physically voting and seeing others vote also has value.

<comment><USER20> You can already do that with mail in voting. The problem with electronic voting is that it can be hacked at scale.

</comment></comment></comment></comment><comment><USER21> > More people would vote if Election Day were a holiday.

That's the premise. Do we know it's true?

If people are going to work, they're at least mobile that day. Give people a free day off and some percentage won't even put pants on that day.

There should be enough companies that already give a holiday for election day that the numbers on how it affects voter turnout should be available. But I didn't see that anywhere on the page.

My gut says that giving paid time to vote, rather than the whole day off, would be better for turnout. But that's just a guess. Show me the numbers.

<comment><USER22> I don't know the answer but in Israel election day is a holiday. The common stigma is that you vote in the morning and then have a barbeque in the afternoon. I don't know whether it would work the same way in the US, but that's how it is in one country.

</comment></comment><comment><USER23> Election day is a holiday in India and there is still pretty low voter turn out.

</comment><comment><USER24> We're tackling the most minor of symptoms. What US elections need is:

1\. Mandatory voting. I'm talking a small fine if you don't show up to a polling place and get your name checked off;

2\. Preferential voting. Vote for the candidates in the order you want. The one with the least primary votes gets eliminated and those votes get distributed to the second preferences. This continues until one candidate has 50.1% of the vote. This way you can vote for a third-party candidate without wasting your vote.

3\. Voting over a two day period, probably Saturday and Sunday. This will allow you to use a whole host of government buildings as polling places such as schools that are almost by definition widely geographically distributed;

4\. Zero electronic voting. None. Nada. Zilch. More, the standards need to be tightened to have high accuracy voting methods. Optically read ballots where you fill in a circle work wondrously well. Punch cards do not. See the Florida recount of 2000 if you want to see what happens with that;

5\. An end to politicizing the election process. It's incredibly dangerous. No more elections for a supervisor of elections or the like. Other countries seem to manage with an electoral commission. The US can too;

6\. An end to state governments controlling redistricting. The same electoral commission(s) should handle this.

Of course, none of this will actually happen.

EDIT: several commenters raised three points in particular.

1\. Mandatory voting. I come from Australia where we have mandatory voting. By "mandatory" it means you just have to show up to a polling place and get your name ruled out of a large file. It's slightly more tedious if you vote out of your registered district but only slightly.

There's nothing stopping you putting an empty ballot in the box or drawing a picture or just voting invalid. There is no free speech issue here.

I used to be against it until I came to the US to see what havoc voluntary voting wreaks.

The US has a long history of voter suppression because voting isn't mandatory. Getting out the vote is one thing. But the US in parts goes much further than this including:

\- Removing your vote if you're convicted of a felony. Why exactly?

\- Removing you from the electoral rolls if your name matches that of a felon on the other side of the country;

\- Sending mail to your registered address. If it's returned undeliverable, strike you off the rolls;

\- Making you wait hours to vote to discourage you from voting, particularly in areas heavily populated with those that might otherwise vote against you (in Australia it never took me more than about 5-10 minutes to vote).

People argue about the evils of having the uninformed vote but if Trump has taught us nothing it's that choosing to vote isn't exactly a recipe for informed voting either.

All of the above are a direct consequence of a politicized electioneering process made possible by non-mandatory voting.

2\. Electronic voting. This is a recipe for a foreign power or just a hacker to steal your election by modifying the results in a database rather than interfering with paper ballots that can be audited and recounted.

Sure you can ballot stuff with fake ballots but that's something that requires physical proximity and is far harder to do on the scale that large scale tampering with a database might mean.

Electronic voting is a wholly terrible idea with literally no upside.

3\. Mail in ballots. All in favour of it if it's like Oregon where you have the month before the election to send it in. It needs to be easy and flexible.

<comment><USER25> Mandatory voting is a violation of the First Amendment.

<comment><USER26> No, it isn't. It _might_ be unconstitutional _if_ mandatory voting required you to choose between a fixed number of candidates, but there's nothing stopping voters from putting whatever they please on their ballots.

You are legally compelled by the government to fill out tax paperwork every year. Being (much more lightly) compelled to fill out a ballot is no different.

<comment><USER27> You are only legally compelled by the government to fill out tax paperwork if you experience a taxable event in that year which would require you to fill out the form. If you do not have a taxable event (i.e., no income) you are not required to send any information to the government in relation to taxes.

[https://en.wikipedia.org/wiki/Compelled_speech](https://en.wikipedia.org/wiki/Compelled_speech)

EDIT: IANAL, please do not cite this as any legal justification in a court if you fail to file any form with a government.

<comment><USER26> The point is that the government can compel speech without endangering the first amendment. The IRS could decide tomorrow to mandate a form for those below the taxable level without running afoul of compulsion.

 _If_ your income is subject to taxation, you can't refuse to fill out the paperwork on the grounds that doing so lends legitimacy to an institution you don't support. The same should be the case for voting.

<comment><USER27> What would be the requirement to compel voting? Be of voting age population and be mentally sound? Sounds like a massive expansion of state power to force all people of a certain age and sound mind to do an action.

<comment><USER26> I'm not sure what you mean by the "requirement." In order to vote in the US, you have to be of voting age. Some states impose additional requirements, like not being a felon (which I think are wrong, but that's another story).

Mandatory voting would have the same requirements. Anybody who previously _could_ vote now _must_.

In terms of state power: it's not all that great of an expansion. If you make over the taxable limit, you pay federal taxes. If you own any sort of land, there's a good chance you pay local taxes on it. These sorts of compulsions apply to (equally?) large swathes of the population without necessitating a great deal of state power.

<comment><USER27> There is a massive difference between paying taxes when you choose to participate in an economy than having the government compel you to make a political statement. You choose to buy land which is protected by the state. You choose to buy things at the store. You choose to have an income. You can choose to not buy a house, you can choose to not work for an income.

The closest thing to compare compelling people to vote would be the draft.

<comment><USER28> You think people are less compelled to have an income than they are to vote if a small fine is levied? It doesn't make any sense. You put in a small fine for not voting, you make it clear that you can walk into a ballotbox and draw a huge x and stick it in the machine and you don't have to pay the fine and bada bing bada boom, we've got a lot more voters.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Largest employers in the USA:

      - United States Department of Defense : 3.2 million
      - Walmart                             : 2.3 million
      - United States Postal Service	: 574 thousand
      - Amazon                              : 541 thousand
      - Kroger	                        : 443 thousand
      - Yum! Brands	                        : 420 thousand
      - International Business Machines	: 414 thousand
      - The Home Depot	                : 406 thousand
      - McDonald's                          : 375 thousand
      - Berkshire Hathaway                  : 367 thousand
      - FedEx	                        : 335 thousand
      - United Parcel Service	        : 335 thousand
      - Target Corporation	                : 323 thousand

And so on with Walgreens, GE, Albertsons, Wells Fargo, AT&T, PepsiCo, Cognizant, Starbucks, Deloitte, J.P. Morgan Chase, Lowe's, TJX, Ernst & Young, and UnitedHealth Group.

......Does anyone else get the feeling that maybe this would have a biased impact?

<comment><USER30> I'm not sure I understand the implication. Can you be a bit more explicit?

<comment><USER29> For one thing, it allows large corporations to increase their influence, by helping people that are vested in protecting their interests vote for candidates who support those companies. If a large enough set of employees is in one area, that could swing a local election. Two, a lot of these employers would appear to employ people along a particular side of the political spectrum.

Combine these aspects with the fact that it would probably be _easier_ for these large companies to switch a current day off to election day, rather than small companies who may not be able to afford it, if they give days off at all. It could end up having decidedly biased impacts on what political party is in power, and what industries get more power.

</comment></comment></comment><comment><USER31> Trouble is, a lot of companies disallow election day requests for time off _specifically_ to disenfranchise their employees.

Yes it's quite illegal, but that doesn't matter if you can't get a lawyer to assert your rights, or don't have the bargaining power to get another job after they fire you for making a stink.

<comment><USER32> > Yes it's quite illegal

Is it?

<comment><USER33> Not op, but I did a search and couldn't find the correct query to confirm or deny. It _might_ not be illegal for businesses to refuse time off for voting in the US. (seems like a bad place to work, but I'm sure it happens.)

<comment><USER34> Reference for you: [https://www.nolo.com/legal-encyclopedia/taking-time-off- voti...](https://www.nolo.com/legal-encyclopedia/taking-time-off-voting- jury-29708.html)

</comment></comment></comment></comment><comment><USER35> Making election day a holiday is pointless. Poor people work on holidays.

What would actually be helpful is what a lot of states like Washington have done. Early voting, voting by mail, voting by drop off places.

</comment><comment><USER36> I question this validity a lot. Most people I know try to sync company holidays with their vacations.

<comment><USER37> The people using company holidays to coordinate vacations aren't the people the holiday is supposed to help.

There's a difference between "I decided to go to Cabo that day, so I didn't get to vote in person", and "the last three people who asked for some time to go vote were quickly fired for bullshit that everyone here knows was just because they wanted to go vote. Guess I'll just stop voting."

<comment><USER36> Based on the number of stores that are open on Thanksgiving, Black Friday, and states of emergency, I don't expect businesses that don't want people to vote to add a company holiday instead of 2 hours of flexibility.

[I doubt it's banks, government services, and companies that love to add extra holidays that people don't travel on holidays]

</comment></comment></comment><comment><USER38> Though a nice sentiment, such a holiday would be unnecessary and too complicated to implement. As other commenters point out, mail balloting is much easier and already implemented in many precincts. The US is a very large country, and there are elections all the time. Would people need a day off for school board elections? What about the recent Alabama special senate election? Restricting it to only presidential elections, or once yearly elections, would be impractical for the day to day democracy of our nation.

Perhaps compulsory voting would be a better idea? Though groups like the Amish and Jehovah's Witnesses would be dead set against such an idea, compulsory voting has good track records in places like Australia where there was much hand wringing over a low 91% turnout. However, many Australians point to the compulsory vote as a reason _why_ their parliaments are _bad_ , as it forces people with little to no interest to make a choice in an election.

[https://en.wikipedia.org/wiki/Elections_in_Australia](https://en.wikipedia.org/wiki/Elections_in_Australia)

</comment><comment><USER39> Nice idea but could you remove the mining script from the site. It's a great way to piss people off and keep them from sharing the site.

<comment><USER40> what script?

<comment><USER39> I had 100% cpu utilization a bit after I opened the link. I inspected it and found workers for coinhive.com. I closed the tab after that and cpu utilization dropped.

<comment><USER39> I reproduced it twice before I left the original comment. Now I'm not getting it anymore either. I reproduced it in Chrome and Firefox. My only extensions are adblock and privacy badger.

</comment></comment></comment></comment><comment><USER41> Just implement all vote by mail. Washington State did it a few years back and we haven't looked back.

</comment><comment><USER42> I've long thought we should eliminate Columbus day, and making election day a holiday.

<comment><USER43> Why eliminate a holiday? We have few enough of them as it is.

</comment></comment><comment><USER19> "Country" is misspelled in the title.

</comment><comment><USER44> In Norway we can vote in advance before the election, at a convenient time. Problem solved!

<comment><USER6> That's also common in the U.S., but it varies by state. 37 of the 50 states have early voting, while 13 have only election-day voting. Map here: [http://www.ncsl.org/research/elections-and- campaigns/absente...](http://www.ncsl.org/research/elections-and- campaigns/absentee-and-early-voting.aspx)

</comment></comment><comment><USER45> Why would our company do this when our company can vote with it's dollars thanks to Citizens United. They have a better way to shape policy than let its employees choose.

I'm being a little sarcastic but also speak with a tinge of truthfulness.

</comment><comment><USER46> Many countries have elections on Sundays to make it easier for most people to vote. Wouldn't advocating for moving the election day to Sunday be better alternative?

<comment><USER47> Overall, I'm in favor of this, but there may be unintended consequences. For one, having it on Sunday seems like it disproportionately disadvantages those that work in retail and food service, which tend to be lower wage earners, as those are the individuals that are more likely to have to work on Sunday. Additionally, it might make it more difficult for individuals with children -- Tuesday is a school day so there's free childcare. Though overall, I'd say the benefits outweigh the costs.

</comment></comment><comment><USER48> Turnout is incredibly unimportant.

[http://scorevoting.net/RelImport.html](http://scorevoting.net/RelImport.html)

</comment><comment><USER49> There's a list of people who choose not to vote that is published every year. Shame! (bell) Shame! (bell) Shame! (bell)

</comment><comment><USER19> 1\. Election on a Sunday. It's not controversial, it's bloody obvious. No one should even be able to find an argument against moving it.

2\. Automatic registration. Registration is just increasing the barrier to vote.

3\. Remove all disenfranchisement. All adult citizens have a vote. Pretending you can somehow forfeit that right in a democracy is laughable.

Now: there is one party that would rather not see either of these changes.

<comment><USER50> > 1\. Election on a Sunday. It's not controversial, it's bloody obvious. No > one should even be able to find an argument against moving it.

Christian churches are used in my area as polling places. I would hate to know how far I would have to drive if they would no longer be used. How about Saturday?

>2\. Automatic registration. Registration is just increasing the barrier to vote.

How do we "automatically" register someone? Location and age would be required. There is no system I am aware of which is automatically updated when a person moves. Requiring people to deal with state ids has already been decided as too onerous.

<comment><USER51> > How do we "automatically" register someone?

When they get their driver's license or state-issued ID. Don't make it an option, just do it. That would take care of most people, since they have a state-issued driver's license or ID. It's the photo ID most people in the United States use. (I didn't own a car for close to 20 years and still had a driver's license as a photo ID.)

Although I initially registered to vote by going to the county courthouse; when I recently moved (in state) and got a new driver's license, the system asked if I wanted to update my voter registration. Don't make it an option, just automatically do it.

That should take care of most people.

</comment></comment></comment><comment><USER52> Start a petition in your state to make it a holiday.

</comment><comment><USER53> why not change the voting day to Saturday/Sunday?

<comment><USER35> People still work on Saturdays and Sundays.

</comment></comment><comment><USER54> Why is voter turnout considered important?

</comment><comment><USER55> ... because filling out an absentee ballot is _so_ arduous.

<comment><USER56> Depending on your state it can require an hour drive to a polling place for the 4 hours it is open on a random Thursday to get the ballot and provide a valid reason (doctor's note) why you need an absentee ballot.

<comment><USER57> Honest question: where is this happening?

<comment><USER56> Mostly in the South where easy absentee ballots would interfere with the black voter suppression systems.

[https://www.vote.org/absentee-voting-rules/](https://www.vote.org/absentee- voting-rules/)

</comment></comment></comment></comment><comment><USER58> Be careful about going along with a secular government and giving your consent to it with a vote, for we are not to call anyone leader except the Messiah - see Matt 23:10 in the Aramaic. What you think is freedom from the creator's life-giving ways is a deceptive illusion from the Adversary. Reject it and vote for the Messiah by living righteously.</comment>


The Lean Startup Machine - <AUTHOR> http://theleanstartupmachine.com/

<comment><USER2> FYI

" Lean Startup Machine is a 54-hour startup weekend that conforms to Lean Startup principles, a method of using customer feedback to rapidly iterate your product to reach product/market fit. As well as being a crash course in LS principles, it provides the networking, resources, and incentives for projects to go from idea to launch. On Friday evening, the event commences with networking and pitches. Participants then select ideas and form teams to work on their project over the weekend. On Sunday, teams pitch the Minimum Viable Product they've created to a panel of well-known entrepreneurs for funding and mentorship. "

</comment><comment><USER3> w00t. Signed up. Let's rock this.</comment>


7 Healthy Alternatives to Coffee at Work - <AUTHOR> http://time.com/3507066/healthy-coffee-alternatives/

<comment><USER2> This article makes the case that coffee is "bad" for people due to sugar and caffeine. The sugar part I understand, but caffeine is found in teas as well, and the last I knew, it's impact on the body was only temporary. Outside of that, black coffee, from what the research I have read, is very healthy for a lot of people.</comment>


Ask HN: Why don't cloud file stores like Amazon S3 have query capability? - <AUTHOR>

So you have an Amazon S3 bucket with millions of items in it.
Seems logical there would be some sort of query language to identify files according to a range of criteria.
I wonder why there's no way to do so? <comment><USER2> There's no way to do so because that's not how the system is built. Queries require indexes, which require more I/O, some level of storage consistency across the system (so that the query can run against a single "snap" of the database rather than something that's constantly changing!), and a lot of other things that just aren't designed in S3.

A common pattern is to store bulk data in s3 but metadata (filenames, sizes, etc.) in a database for faster queries. If you need the ability to make arbitrary queries on the data itself, S3 isn't the product to use for this.

Data architecture is a fundamental part of your system; don't fuss over spending some time on it!

</comment><comment><USER3> Because that would be a database and would have database prices.

<comment><AUTHOR> I wouldn't mind that, it's not having any way to do queries that is frustrating.

<comment><USER4> Then you want to run ElasticMapReduce[1] against your S3 buckets.

[1] [http://aws.amazon.com/elasticmapreduce/](http://aws.amazon.com/elasticmapreduce/)</comment></comment></comment>


9 Things That Make Online Shops Successful - <AUTHOR> https://blog.paymill.com/9-things-make-online-shops-successful/

<comment><USER2> There is missing one more important factor - security of online shop, Still Google recommends for secure networks - [https://www.google.com/safetycenter/everyone/start/safe- netw...](https://www.google.com/safetycenter/everyone/start/safe-networks/)</comment>


Tech Firms Borrow Football Play to Increase Hiring of Women - <AUTHOR> http://www.wsj.com/articles/tech-firms-borrow-football-play-to-increase-hiring-of-women-1474963562 <comment><USER2> I've worked at many smaller firms and never noticed any bias. Most companies just want to hire the best person for the job, regardless of race or gender. I also never noticed any pay disparity.

I disagree with the idea that we need to specifically look at minorities or women during the interview process. This makes the process non-random and non- equal to everyone involved, by design.

If there aren't enough women and minorities getting their resumes into the hands of hiring managers and recruiters, we should figure out why. Are they interested in these jobs? Do they have the right experience and education? Are they actually submitting their resumes?

Giving a specific group of people an unfair advantage by design is never a good thing. I feel like we are now crossing over the line line into systemic racism and sexism toward anyone not a minority/woman and it's by definition, not equality.</comment>


Why the Brain Is So Noisy - <AUTHOR> http://m.nautil.us/issue/68/context/why-the-brain-is-so-noisy <comment><USER2> >You provide a certain input and you get a certain output. When you provide the same input again and again, you get the same output. This is very different in the brain. In the brain, even if you choose the exact same stimulus, the response varies from trial to trial.

>Where does this variable response in the brain come from?

>There are various hypotheses. There is, for example, unreliable synaptic transmission.

Maybe I am looking too much into a very simple example, but I disagree with it. The brain has recurrence and memory. The first time you show me something I react differently than the second time you show me it. Time has passed, my brain has acquired tons of feedback information, I have an idea of what it is before you show me again. If you have even the most simple models that incorporate memory (such as higher order Markov chains), they will react differently too.

</comment><comment><USER3> If there was no randomness, there would be no creativity.</comment>


The Frightening Power of Ransomware Done Right - <AUTHOR> http://nautil.us/issue/66/clockwork/the-100-million-bot-heist <comment><USER2> I've recently learned that OpenZFS has effective counter-measures for ransomware and data corruption in general. Quote from here [0]:

> As a copy-on-write file system, OpenZFS provides efficient and consistent > snapshots of your data at any given point in time. Each snapshot only > includes the precise delta of changes between any two points in time and can > be cloned to provide writable copies of any previous state without losing > the original copy. Snapshots also provide the basis of OpenZFS replication > or backing up of your data to local and remote systems. Because an OpenZFS > snapshot takes place at the block level of the file system, it is immune to > any file-level encryption by ransomware that occurs over it. A carefully- > planned snapshot, replication, retention, and restoration strategy can > provide the low-level isolation you need to enable your storage > infrastructure to quickly recover from ransomware attacks.

[0] [https://www.ixsystems.com/blog/combating- ransomware/](https://www.ixsystems.com/blog/combating-ransomware/)

<comment><USER3> I suppose that snapshotting will cause old versions of the data to be thrown away, once the old versions start taking up too much disk space. Then I suppose the ransomware can take advantage of this and simply perform so many writes that the unencrypted versions of the data are thrown away. And isn't this what happens anyway when a disk is nearly full and you start encrypting its contents?

<comment><USER4> It would be weird for a system to throw away its backups automatically at arbitrary times.

<comment><USER5> What would you have the software do when it runs out of space? IMO, not making new backups would be worse than deleting old ones.

<comment><USER6> It's actually not allowing you to write new data at all. So it prevents the user from assuming there is more space to store his data, as there is not sufficient space with his indicated/configured data retention wishes.

</comment></comment></comment></comment></comment><comment><USER7> _" If Bogachev had been more careful about not using his real name when registering for accounts, he might not now be the FBI's most wanted cybercriminal."_

I'm not sure he cared about being discovered given this information... _" Bogachev lives in the resort town of Anapa on the Black Sea, where Russian officials have declined for years to arrest him or extradite him to the United States. In fact, the Russian government has benefited from his criminal activity."_

Friends in high places never hurts, especially if they are corrupt. He basically gets to live life like a Bond villain so I'm reasonably confident he never intended to hide his name or activity for the long haul.

<comment><USER8> It still makes him 100% reliant on those friends, who you've already noted are corrupt. He's likely already been squeezed out of 99% of this money.

<comment><USER9> Quite possibly, but he's probably still a millionaire. Not a bad deal for him. He still gets to make millions and commit fraud scot free, with the protection of the Russian government. He also gets to have fun working on sophisticated malware and novel C2 infrastructure architectures, continuously honing his skills.

If I were him (and also had no morals) I'd probably be pretty happy with my life.

</comment></comment></comment><comment><USER5> Something I've long wondered about—shouldn't Ransomeware be relatively easy to detect with a heuristic? There aren't all that many† legitimate use cases for rewriting 30%+ of the data on your hard disk. Seems like a good time for the OS to pause the process and notify the user before continuing. If ZFS snapshots or similar are in use, there are even fewer cases where you'd want to rewrite 30% of data _and_ delete all snapshots.

† Note, "not many" ≠ zero. I realize this would sometimes result in false positives, but I imagine the trade-off would be worthwhile, _especially_ if the protection was user controlled.

<comment><USER10> Windows admins have been running heuristics with File Server Resource Manager for a few years. We had users disabled and SMB access immediately denied for users that created certain file types, and email alerts get sent. It was surprisingly effective.

</comment></comment><comment><USER11> An interesting read, thanks for sharing. At the end ransomware WannaCry was mentioned. Is it in any way related to Bogachev's operations or is it confirmed to be an effort by North Korea? The part where he uses his real name for a yahoo account does sound stupid, but maybe he really felt safe that Russian authorities won't cooperate with an international arrest order.

</comment><comment><USER12> Another thing to look at is dedupe percentage...if things all of a sudden stop compressing really well, it's an indicator of text files being converted to encrypted, random looking, noise.

</comment><comment><USER13> To know a bit more about one of the researchers see: [https://syssec.mistakenot.net/](https://syssec.mistakenot.net/)

He gave a lecture about it in one of the classes I followed at one point.

</comment><comment><USER14> > there was no way to predict which domains the DGA would come up with for any > given week.

Wouldn't there be a seed on each infected machine used to determine the current C&C domains to use? Why couldn't we predict them?

<comment> deft-code Why would taking down the C&C for one week kill the botnet? Or for that matter even a few months. I assume the bots can just keep trying to find the C&C until it finally gets through.

<comment><USER15> I don't think it did kill the botnet.

From the article: "on July 11, 2014, the Justice Department reported that the number of computers infected with GOZ malware had been reduced by 31 percent thanks to law enforcement intervention."

Also they were blocking the autogenerated domains on a weekly basis, but that would only work if the infected machine was in the US I believe.

</comment></comment></comment><comment><USER16> >spent lavishly on a fleet of luxury cars, two French villas, and a large yacht ... lives ... on the Black Sea, where Russian officials have declined for years to arrest him

It's a shame the Russians aren't a little more cooperative with stopping this kind of stuff.

<comment><USER17> Why would they? The RU government is likely directly involved with these kinds of attacks/campaigns

<comment><USER18> The article even mentions that allegedly the bot network was used to launch attacks beneficial to the Russian government.

If there is any criminal organization powerful enough in Russia, and their leaders haven't been assassinated or imprisoned, it's safe to assume they work closely with the government.

<comment><USER19> Obligatory: US/West is precisely the same.

</comment></comment></comment></comment><comment><USER20> I wish articles had dates on the byline

</comment><comment><USER15> Wouldn't they be able to trace who registered the C&C domain every week?</comment>


Are backticks (``) slower than other strings in JavaScript? - <AUTHOR> https://medium.com/javascript-in-plain-english/are-backticks-slower-than-other-strings-in-javascript-ce4abf9b9fa <comment><USER2> <1% difference is statistical noise</comment>


The One Million Project: Showcasing the power of the internet - <AUTHOR> http://theonemillion.com/ <comment><USER2> Hmm, what's to say that they haven't inflated their stat of how much has been donated in order to encourage more people to just give them money?

<comment><USER3> Wait you mean they're trying to manipulate us with "Social Proof"?

</comment></comment><comment><USER4> Wow, last time at least they were selling one pixel for 1$. Now world advances 1$ for nothing?

<http://www.milliondollarhomepage.com/>

</comment><comment><USER5> For some reason this doesn't sit well with me. We've seen the internet used for some pretty amazing charity purposes before but I feel like internet citizens have a limited interest in rallying together and doing so for its own sake will make it less likely to happen for other's sake.

</comment><comment><USER6> It's like the Million Dollar Homepage, except _more_ brazen.

The goal seems to be to raise a million dollars. The secondary goal seems to be to treat the Internet like a basket of schmucks.

My advice: save your money and give it to a good cause instead.

</comment><comment><USER7> I gotta get me one of these pages. I'm gonna call mine "The Ten Million Project".

</comment><comment><USER8> This is the worst thing I've seen all day.

</comment><comment><USER9> _There aren't any plans for the money, because this isn't about the money. It's about accomplishing a goal._

And that goal is "raise 1 million dollars". So yes, it's about the money, about nothing but.

</comment><comment><USER10> Would be clever if in return for your donation of $100 they let you set up a blank-slate mirror on the domain of your choice. I call therealtenmillionproject.com.

</comment><comment><USER11>
        How many would choose to give $25 instead?

If you want to do some good with $25: <http://kiva.org>

</comment><comment><USER12> If they released the code they used to make the page, basically for the stripe and social button integration, I'd probably donate.

</comment><comment><USER13> Like many (any?) new environments, the Internet is rife with fools and charlatans. They make an ecosystem, in their own way.

</comment><comment><AUTHOR> And now there seems to be a decent bit of actual happening now. People are really buying it?

</comment><comment><USER14> What if they donate all the money to the KKK or something?

</comment><comment><USER15> Absolutely. Fucking. Genius.

I wish I had thought of this.

</comment><comment><USER16> What the fuck?

</comment><comment><USER17> I'm in. $10.

<comment><USER14> I am also trying to make $1M for no reason, could you donate me $10?

<comment><USER17> That depends on the cause... What are you trying to prove?

My original comment was tongue-in-cheek. I am not going to donate any money to a (questionable) organization that's not going to publish what it is going to do with it.

I'd rather spend it on something more noble. Like giving it to a charity.

</comment></comment></comment><comment><USER18> wow, bold as hell and ballsy but cool idea...i want in

<comment><AUTHOR> Right? I'll be interested to see how far this goes. What the heck, I'm donating!

<comment><USER19> Yeah, I'm sure you are. :)

The sad thing is that this will probably work. He's not going to make a million bucks, but I'm sure the number of idiots who will donate will make it worth his while.</comment></comment></comment>


Ask HN: Traits and habits of A players - <AUTHOR>

I've recently noticed A players in general don't have Steam accounts.<p>What are some other variables I could look for to identify A players?  What have you noticed? <comment><USER2> Some indicators I've witnessed as a student: They started programming at an early age because they thought it was fun/interesting rather than thinking about a getting a job or making money. Have impressive side projects. Have competed and done well in algorithm competitions. Have full time software development experiences before starting university. High grades at an elite highschool. IQ above the rest. Educated and/or supportive parents or teachers.

<comment><USER3> I'd add "found programming so interesting they did not finish high school/college." The maximum level of education achieved by my team ranges from middle school diploma to PhD.

</comment></comment><comment><USER4> You might have to be domain specific.

I feel like people are A-players when the environment around them lets them shine. To date, I have not found a single person who hasn't impressed me in some specific domain. Of course, sometimes it takes me longer to figure out what domain a person is an "A-Player" in.

</comment><comment><USER5> Do you mean generically or engineers?

<comment><AUTHOR> engineers/programmers</comment></comment>


10 Scrappy Minimum Viable Products That Made It Big - <AUTHOR> http://torgronsund.com/2011/09/23/10-scrappy-minimum-viable-products-that-made-it/

<comment><USER2> 3/4ths of those sites aren't mvp, but just looked like crap because thats how sites looked at the time.

</comment><comment><USER3> Is that really what Groupon's site looked like in 2010? That looks more like the site pictured in the Internet Archive is just missing the correct CSS files.</comment>


Major Canadian ISP admits throttling World of Warcraft - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/03/oops-major-canadian-isp-admits-throttling-world-of-warcraft.ars <comment><USER2> Can anyone explain to me why Canada has such poor internet service? I kind of understand why countries like Australia and New Zealand don't have great internet plans, but Canada is right next to the US and yet has far worse service.

<comment><USER3> Canada is far less dense than even the United States and internet access is controlled by a duopoly, which is a bad combination for competition or affordable access.

<comment><USER4> Also the regulatory body (CRTC) thats is supposed to be watching over these companies is run entirely by ex-staff of said companies. So it's very similar to the big banks in the US (their negative actions don't have market repercussions because of their ability to dominate the market with the help of regulatory bodies).

</comment></comment></comment><comment><USER5> Interestingly WoW uses bit torrent to distribute patches to users, so its not uncommon to have P2P traffic occurring while playing WoW.

<comment><USER6> It's worth pointing out that "peer to peer" is a network protocol architecture, one that the Internet was designed for.

Technically it's unrelated to illicit file sharing, other than that game companies, free operating systems, and pirates all distribute large DVD-sized files and thus seek the most efficient way to do so.

<comment><USER7> Yes, but that doesn't stop the ISPs here from treating all P2P traffic with the same hammer. As far as they are concerned, P2P = bad for network, and so they throttle it.

<comment><USER8> ISPs (I work for one) dislike traffic, which heavily saturate channels. Total uplink capacity is comparable with total customer demand at peak hours. So, ISPs have to distinct between immediate (VoIP, gaming, SSH), normal priority (web browsing, email) and bulk (BitTorrent et al) cases. Although, throttling to pre-defined per-customer value seem like stupid idea, but putting them into different buckets is a must.

ISPs also dislike high-PPS low-packet-size (significantly lower than MTU) UDP traffic of uTorrent's uTP protocol, because it quite negatively affects the network hardware.

And, most important — ISPs, in fact, _love_ P2P traffic when it happens between their peers, because such traffic does not consume uplink channels. When it's legally possible — they endorse it (for example, by setting up gaming servers or introducing locally-hosted software-update mirrors), when it's a gray waters of file sharing — they just don't stick their nose in other's business (unless law enforcement requests them so). Of course that's unless they want to make customers dissatisfied their service as network connectivity providers.

<comment><USER9> >> "ISPs also dislike high-PPS low-packet-size"

This is presumably what was specifically causing the WoW throttling from the article.

>>"We recently introduced a software modification to solve the problems our customers are experiencing with World of Warcraft. However, there have been recent changes to the game, which has created new problems. A second software modification to address these new issues will not be ready until June."

I'm not 100% sure, but iirc the "recent changes" had to do with WoW changing the TCP ack frequency when running, more than doubling or tripling the total number of packets sent over any given period of play time. They turned this on with a recent patch, but hotfixed it off temporarily because, as you said: "it quite negatively affects the network hardware". People with crappy routers/modems were apparently having problems staying connected.

A blizzard dev writes more in detail about it here: [http://us.battle.net/wow/en/forum/topic/1965992365?page=15#2...](http://us.battle.net/wow/en/forum/topic/1965992365?page=15#287)

</comment></comment></comment></comment></comment><comment><USER10> If anyone's interested, this[1] paper highlights why P2P, especially in gaming applications, isn't going away any time soon. Unfortunately, P2P authors really need better systems to keep inter-AS traffic to a minimal level, but the current Internet wasn't really designed with that in mind. There are a number of different research efforts and fielded methods out right now, but none seem to have taken a really strong hold.

[1] <http://research.microsoft.com/pubs/72879/donnybrook.pdf>

</comment><comment><USER11> I keep reading too much from the unwashed masses about how this throttling works. ("They see the process that does P2P and throttle anything coming from the same process." - I do not and will never install ISP software on my systems.) Since the ISPs are not forthcoming with that information, could someone do an excellent writeup on the different throttling methods and then provide a left-field guess as to what these "access providers" are doing?

</comment><comment><USER12> Jeeze this is awful. If you're Blizzard and an ISP starts throttling your game, at least you have a little muscle to fight back (and even so their response is "oops, sorry, we'll try to have it fixed by June"). But if you're Random Web Startup that is dependent on P2P and your users have to deal with this I can't imagine there's much you can do. What a horrible barrier to entry.

</comment><comment><USER13> It must be noted that according to the article they are not throttling WoW specifically but are slowing down all P2P traffic.</comment>


An Overview of Bayesian Inference (2019) - <AUTHOR> https://jaydaigle.net/blog/overview-of-bayesian-inference/ <comment> ur-whale Slightly OT, but I wonder if anyone in the know could shed a light on where Baye's theorem is applied (if anywhere) in quantum mechanics?

In particular, has anyone tries to apply the bayesian framework to the whole "the wave collapses upon measurement" shebang?

<comment><USER2> "Quantum Bayesianism, or QBism as Fuchs now calls it, solves many of quantum theory's deepest mysteries. Take, for instance, the infamous "collapse of the wave function," wherein the quantum system inexplicably transitions from multiple simultaneous states to a single actuality. According to QBism, the wave function's "collapse" is simply the observer updating his or her beliefs after making a measurement."

[https://www.quantamagazine.org/quantum-bayesianism- explained...](https://www.quantamagazine.org/quantum-bayesianism-explained-by- its-founder-20150604/)

<comment><USER3> It's not that simple. When a measurement is done on a pure state (where the knowledge of the state is already as good as it gets) the observers are not just updating their beliefs, they are changing the system. On the other extreme, in some cases one may have measurements that improve our (imperfect) knowledge of the physical state without disturbing it.

"Quantum measurement is nothing more, and nothing less, than a refinement and a readjustment of one's initial state of belief. [...] Let us look at two limiting cases of efficient measurements. In the first, we imagine an observer whose initial belief structure ρ = |ψ⟩⟨ψ| is a maximally sharp state of belief. By this account, no measurement whatsoever can refine it. [...] The only state change that can come about from a measurement must be purely of the mental-readjustment sort: We learn nothing new; we just change what we can predict as a consequence of the side effects of our experimental intervention. That is to say, there is a sense in which the measurement is solely disturbance."

[https://www.perimeterinstitute.ca/personal/cfuchs/Oviedo.pdf](https://www.perimeterinstitute.ca/personal/cfuchs/Oviedo.pdf)</comment></comment></comment>


NC Republican Office Firebombed, 'Nazi' GOPers Threatened in Graffiti - <AUTHOR> http://www.nbcnews.com/news/us-news/nc-republican-office-firebombed-nazi-gopers-threatened-graffiti-n667316 <comment><USER2> > Republican presidential candidate Donald Trump weighed in as well, > describing those behind the incident as "animals representing Hillary > Clinton and Dems in North Carolina." (Authorities had not identified any > suspects.)

> They "firebombed our office in Orange County because we are winning," he > said on Twitter. (An NBC News/Wall Street Journal/Marist poll conducted last > week found Clinton leading Trump by four points in the state. Nationally, > Clinton leads Trump by 11 points, according to an NBC News/WSJ poll released > Sunday.)

Interesting to see the fact-checking done within the same paragraph.

</comment><comment><AUTHOR> An another one: Vandals throw bricks through windows at Delaware County Republican Party office ([http://fox59.com/2016/10/18/vandals-throw-bricks- through-win...](http://fox59.com/2016/10/18/vandals-throw-bricks-through- windows-at-delaware-county-republican-party-office/))</comment>


Iran fires satellite carrier into space - <AUTHOR> http://www.presstv.ir/detail.aspx?id=117739&sectionid=3510208

<comment><USER2> nice comments:

"Ingenuity is the trump card of jihad"

"iam very happy to see that islamic repuplic of iran has sucessfuly aqcired high tecnology, this the benefit of islam leadership of ayatullah allah,s peace and bless be upon him, really hewas a great man and you are a great nation."

"ALLAH IS GREAT."</comment>


Kullervo: Tolkien's fascination with Finland - <AUTHOR> http://www.bbc.com/news/magazine-34063157

<comment><USER2> I heard a synopsis of the book on BBC World News this morning. It's obviously a first novel ( _very_ different from LOTR) given the subject matter: familial murder and incest :/

<comment><USER3> But not different from the tale of Turin Turambar in "The Silmarillion" (as the article points out), or "The Children of Hurin" which is a longer version of the same story of Turin. The latter was published only recently in 2006.

<comment><USER2> What organization/corporation approves all of these releases? I'd imagine Tolkien's estate is extremely aggressive in preserving his legacy, especially if the new books are so different from what's made his novels loved by millions (billions?)

<comment><USER3> Actually J.R.R. Tolkien's son, Christopher Tolkien, is the executor of his estate and was editor who released both of those works [1]. But, yes, he wants to preserve his legacy, and unlike the recent films, he thinks the published books (even recent) do just that. [1] [http://www.worldcrunch.com/culture- society/my-father-039-s-q...](http://www.worldcrunch.com/culture-society/my- father-039-s-quot-eviscerated-quot-work-son-of-hobbit-scribe-j.r.r.-tolkien- finally-speaks-out/hobbit-silmarillion-lord-of-rings/c3s10299/#.Us2yxGRDulr)</comment></comment></comment></comment>


FREE BOOK: How To Use Psychology To Boost Website Conversion Rates - <AUTHOR> https://leanpub.com/psychologyconversionrates <comment><AUTHOR> Feel free to share any feedback on the contents!</comment>


Ask HN: How do you know when to quit the startup you founded? - <AUTHOR> My business partner and I started a B2B SaaS business about 8 years ago. I'm an engineer with an aptitude for development. Initially, we hired a dev shop to build a MVP, but after 2 years, I stepped in as the sole developer, while my partner worked on the sales / support side.
We've seen... moderate success. By moderate I mean we've always been cash-flow positive and our gross revenue grows by a modest percentage each year. I hear that 90% of SaaS businesses fail, so I guess our "not-failing" could be seen as success.
But it's not the "success" I'd hoped for. I'm in my late 30s now, but in a way, I'm still kind of subsidising the business, because my pay is probably 50% of the market rate for a developer with my experience. Obviously, we still can't afford to hire more developers, so it's just been me, coding away on my own, for years.
We have loyal customers, some who've been with us since the beginning. But our product is getting stale. To stay alive, we've added features to lure in new customers, and to keep them, we've made promises (I know, I know... two things you never do: allow feature-creep and promise features in the future). But don't judge - we did what we had to do to live another day!
Lately, the slog is just too much for me. My productivity is plummeting. I'm becoming irritable in and out of work. I'm probably a bit burned out.
I'm trying to decide which of three paths to take:
1) Stick it out, don't be a quitter, work harder, turn the business into what I want it to be.
2) Leave the business, find work as a developer for a larger company, grow, learn, etc. I like being a developer, but my business isn't going anywhere, so.. fail fast(er) and move on, right?
3) Leverage my entrepreneurial experience into a CTO role. I love the entrepreneurial aspect of my work, because businesses are systems, and making systems better is my jam. Maybe I should get an MBA and leave the coding behind me?
Advice welcome! <comment><USER2> Sit down with your business partner and tell them what you are feeling. Indicate you are burnt out/bored with the current situation and scale of revenue. You need significant change to occur in the future to remain engaged in the work. Give them time to think about this, they might come up with a plan for making a big change that you can both then can implement. If not, then at least they had some heads up that you were ready to move on and will not feel they were blindsided with your leaving.

An MBA will not suddenly give you more ideas on strategy. It will help fill in gaps in your knowledge about other areas of business. But they rarely actually teach you how to come up with a better/superior strategy.

</comment><comment><USER3> If you still like what you are doing and can cover all your expenses including savings then I would say continue.

But if it's a drag and you don't see it changing then it's time to try something else. Keep in mind that once you get a job you'll have to do what others want you to do. That can be hard for someone that has been his own boss for 8 years.

</comment><comment><USER4> The values and strategy of company don't reflect you and you are't growing.

Can you guys take another round of funding to go in a new and exciting direction? Can you split out a new venture/ business unit semi-autonymously without that funding?

An MBA could help you identify new/ exciting opportunities, but they are a dime a dozen plus you have founder experience.

<comment><USER5> I second this</comment></comment>


Firebug Plugin: Illuminations for Developers - <AUTHOR> http://www.sencha.com/blog/firebug-plugin-illuminations-for-developers/

<comment><USER2> This looks like a useful utility but also underscores a problem with Ext/Sencha. Namely that it is a tad overengineered and does not work well with other tools in the web development ecosystem. Ext's giant widget library creates and manages copious amounts of convoluted DOM nodes to provide desktop like components that never quite make it out of the uncanny valley.

If you were starting out with some plain semantic markup and adding interaction with jQuery (or Prototype or Mootools) you would do just fine using plain Firebug.

I am wary of tools that brag about solving problems they've caused in the first place.

<comment><AUTHOR> Well, first of all, this tool also works with Dojo Toolkit, SproutCore, YUI, Google Closure Library, qooXdoo, etc. The key take away is that if you are doing anything more than splashy webpages with animation, then you will need to work with a framework (like all of these) instead of a toolkit (like jQuery).

The same thing happened on the server side some time ago when people just wrote some html home pages with some scripting tags (aka PHP). Eventually, when you start to create something complex, people started using some "scripts" and then eventually started doing MVC and the like on the server. Keeping with PHP, this means that people started using Zend Framework, CodeIgnitor, CakePHP, Symphony, YII, etc.

Some people complained that it was too much for lowly HTML, but time and capabilities advanced anyhow. Now that time is coming to the client, thanks to faster browsers, and HTML5 local storage. And mobile. Latency and offline mean storing things locally, and that means business logic at the client.

Prepare to love our JS framework overlords.

To make this tool, I dealt with all the frameworks listed. All have some flaws. ExtJS has copious markup (and CSS), and some non-optimal layout choices. ExtJS4, which you can download a preview of, has dealt with them. I admit, there is some of my ideas in there they ran with. One I did not propose, but (like Closure) they are using in v4 is rendering based on browsers. Old browsers get the copious markup so a real and good looking UI will be possible. And where it can be done in CSS3 instead, they use far less markup. The fast browsers become even faster.

<comment><USER3> No, thank you.

I have to deal with ExtJS at my current job and I know I would never use this bloatware for any of my personal projects.

It is just bloat.

It tries to fool you by giving you a big library of pretty things that do nothing but blind your eyes from the real stuff that is going on. It was probably built by some people that don't understand the web, secretly hate it and need some desktop-programming abstractions to deal with it.

This approach has one limitation: as soon as you try to do something that the framework designers didn't plan for, you'll run into problems and have to write more work-around code than you would need in a straightforward manner.

Also, its documentation sucks:

\- it uses JavaScript where it isn't necessary, \- it works slow, \- it breaks normal browser navigation, \- it shows too much information on one page for the components that are already bloated.

Instead of doing something useful, the authors of this documentation chose to build something to show-off.

My advice: if you are building applications with dumb forms -- ExtJS is for you. If you want to build rich applications, customized to your user needs -- avoid it.

<comment><USER4> I can't agree with you more - on _every single point_.

Even dumb forms don't work right with ExtJS. One example: there is no sane (or even insane - but documented) way of setting a default option in a combobox, or disabling individual options. Really?!

Seriously if you feel you need to use some big desktop-in-the-browser framework, look at SproutCore, or YUI, or Dojo, or Cappuccino, or.... _anything_ else.

<comment><USER5> Wow you guys are seriously just haters who obviously have little (if any) real experience building commercial-grade rich internet applications.

If you go beyond a simple page you need a decent "heavyweight" framework, otherwise you just end up with a big ball of mud or writing your own. Extjs happens to work extremely well for experienced JS devs.

Illuminations is an outstanding plugin of serious pragmatic use. Its already paid for itself many times over in my work.

Oh and btw my forms work great - your obviously just a fool who blames the framework instead of your lack of ability which is the real cause.

<comment><USER6> > Wow you guys are seriously just haters who obviously have little (if any) > real experience building commercial-grade rich internet applications.

You just called a group of people haters because they didn't support your ideals. I think this speaks for itself.

What does commercial-grade mean to you? How many users does that mean? How many tested platforms?

Microsoft and Google uses jQuery and not ExtJS, is that commercial-gradish enough for you? or they probably have "little (if any) real experience" according to you.

> If you go beyond a simple page you need a decent "heavyweight" framework, > otherwise you just end up with a big ball of mud or writing your own.

This is a dubious claim, because:

\- other people may actually be good at writing their own stuff

\- ExtJS may not save you from writing custom stuff, because you may need stuff that aren't included

> Extjs happens to work extremely well for experienced JS devs.

> Illuminations is an outstanding plugin of serious pragmatic use.

Can you support these claims or you just wrote them down to justify your ideals?

> Oh and btw my forms work great - your obviously just a fool who blames the > framework instead of your lack of ability which is the real cause.

You are obviously someone engaged in a trollish behavior for some reason.

<comment><USER5> > You just called a group of people haters because they didn't support your > ideals.

No they are haters because they are spreading FUD about Ext.js with no true or substantial points to support their claims.

> What does commercial-grade mean to you? How many users does that mean? How > many tested platforms?

ONE of our apps has > 300k users. No major bugs or usability issues on production. And is tested on every browser with over 5% usage share (too many to list, the info is on the net anyway) on all the major platforms (Win, Lin, OSX).

> Microsoft and Google uses jQuery and not ExtJS

This is laughable. Microsoft and Google use jQuery for web _pages_. Not applications. Looks at Gmail and find jQuery there ???

> \- other people may actually be good at writing their own stuff

If they want to waste their time and be overtaken by the competition who are making better use of resources they are entitled to make that poor judgement.

> \- ExtJS may not save you from writing custom stuff, because you may need > stuff that aren't included

It takes less resources to extend Ext.js that is does to replicate it.

> Can you support these claims or you just wrote them down to justify your > ideals?

Having worked on RIA for over 6 years and having had Ext.js apps in production since Ext.js 2 my experience is that both Ext.js and illuminations work well. I'm not going to write a review and give you cypto certificates to login to apps that are not public. Its an observation from experience.

> You are obviously someone engaged in a trollish behavior for some reason.

Spreading FUD about a framework that is completely false is trollish behavior. I did not do that.

<comment><USER6> > No they are haters because they are spreading FUD about Ext.js with no true > or substantial points to support their claims.

Does you claiming the opposite make your comment valuable?

> This is laughable. Microsoft and Google use jQuery for web pages. Not > applications. Looks at Gmail and find jQuery there ???

Sorry, I can't take nobody seriously who uses meaningless buzzwords in this context. Your comment is laughable.

> If they want to waste their time and be overtaken by the competition who are > making better use of resources they are entitled to make that poor > judgement.

Again: poor assumption.

> It takes less resources to extend Ext.js that is does to replicate it.

What if the functionality inside Ext.js is not what you need? You can extend a hammer to make a tank, it's just not practical.

> Spreading FUD about a framework that is completely false is trollish > behavior. I did not do that.

Your 1 day old account and your tone suggest otherwise.</comment></comment></comment></comment></comment></comment></comment></comment>


Questionable Scribbler pen is back after getting booted from Kickstarter - <AUTHOR> http://drop-kicker.com/2014/08/scribble-pen-video-more-deceiving-than-originally-thought/

<comment><AUTHOR> Hackaday has been all over this.

They changed crowd fund sites to Tilt and have a new video.

See here: [http://hackaday.com/2014/09/04/scribble-and-the-failings- of-...](http://hackaday.com/2014/09/04/scribble-and-the-failings-of-tech- journalism/)

Original kickstart discussion [http://hackaday.com/2014/08/14/scribble-wait- kickstarter-is-...](http://hackaday.com/2014/08/14/scribble-wait-kickstarter- is-vetting-projects-now/)

And Tilt CEO is looking into them: [https://twitter.com/jjbeshara/status/507025228547903488](https://twitter.com/jjbeshara/status/507025228547903488)</comment>


Ask HN: What should I know about linear Algebra, and where will I use it? - <AUTHOR> People say that Linear Algebra is used all over machine learning, and other hot topics, but I rarely see actual case studies, or explanations of actual examples.
I'm pretty sure Linear Algebra isn't used in most web or CRUD applications, so where have you seen it in action?
What should I know about Linear Algebra? <comment><USER2> Google pagerank:

<http://www.ams.org/samplings/feature-column/fcarc-pagerank>

<comment><USER3> One of the best answers to "when while I ever use this stuff?" a teacher could provide, even when in high school.

</comment></comment><comment><USER4> Graphics. You'll see it especially in game development.

If you can comprehend thinking in multi dimensions you should be fine. Obviously you'll need to learn matrix arithmetic.

<comment><AUTHOR> How does Linear Algebra feature in game development? Can you provide a reference? My Google-fu must be lacking today ...

Thanks.

<comment><USER5> Say you know the coordinates of all the corners of a cube in three dimensions. If you wanted to move that cube to the side and turn it, you could first add some fixed number to all the x coordinates of every point, then do some trig to find the coordinates again after a rotation. Turns out you can produce the same output with fewer steps using matrix math. That is, you can produce a single matrix which is representative of the transform "move right m units and turn d degrees". And you can apply that transform matrix to any set of points you want.

At least, this is what I've gleaned so far as someone that doesn't really understand. I welcome corrections.

<comment><AUTHOR> That's the best answer I've had so far, but it seems like it's just talking about matrix operations. There doesn't really seem to be any "proper" Linear Algebra in here. Nothing about bases, change of bases, null spaces, proofs that all bases have the same size, eigen-values and eigen-vectors, none of the juicy stuff. Just matrix multiplication.

So I was wondering if the more advanced stuff is used, or if it really is just the dabbling in the shallows.

Thanks.

<comment><USER6> I wrote a short introduction to some of the projection math used in 3d graphics, which gets _slightly_ into it, though not into greatly juicy stuff: <http://www.kmjn.org/notes/3d_rendering_intro.html>

Beyond just matrix arithmetic, a change of basis is usually used in viewing, to change an x-y-z "world" coordinate space into a u-v-w camera-relative coordinate space (discussed in the "View space" section).

The homogeneous coordinates used to encode affine transforms into matrix multiplications also have a rigorous linear-algebra background, but admittedly they can be treated as just a strange hack (use a "dummy" 4th dimension for 3d coordinates) without really needing the theory.

</comment></comment></comment></comment></comment><comment><USER7> I'm using linear algebra in a CRUD app. In short, the app generates a lot of math problems. I use some of the more basic aspects of linear algebra to do this. Matrix equations, etc.. Linear algebra is used extensively in certain types of software like etap, pspice, etc.. Anything where systems can be represented by systems of equations will usually benefit from employing matrix operations.

</comment><comment><USER3> <http://en.wikipedia.org/wiki/Eigenface> comes to mind

also <http://en.wikipedia.org/wiki/Singular_value_decomposition> seems to pop up every couple of months or so in a "Oh they do that with SVD?" way</comment>


Stanford CS253: Web Security - <AUTHOR> https://cs253.stanford.edu <comment><USER2> I want to be careful throwing shade because I apparently know some people involved in this, and they are smarter than me, but this is pretty basic. Take a whack at the 2019 final exam for a flavor of where they're at.

The CORS content is solid. But the vulnerabilities themselves are dated. As a threshold concern, a 2020 web security class needs to be teaching about SSRF, the most important current web bug class. OAuth flows would be another thing I'd hope to see covered.

There's always going to be new stuff that can't be covered; I understand how these curricula work†, and don't expect HTTP Request Smuggling or DNS fingerprinting on the final. But system("cat ${input}")?

† _The network security course taught at major CS research universities was written at one place like 10 years ago and shared and handed down from semester to semester; I assume something similar happens here._

 _PS_

3 hours is a _bananas_ amount of time to get for this exam. We're speedrunning it on Slack and the median is closer to 15 minutes (albeit without writing careful answers). If this were a commuter school with students who don't come in knowing how to code, sure; but this is Stanford CS!

<comment><USER3> Sadly, this is the case at many major CS research universities. I'm working on my Master's in Cybersecurity at one of these universities and most of the papers we read are something the professor co-authored in '08 or '09\. Network security, and most security classes in general, are being taught 15 year old material.

> _† The network security course taught at major CS research universities was > written at one place like 10 years ago and shared and handed down from > semester to semester; I assume something similar happens here._

This couldn't ring more true, in my experience. Whats worse is that each year the material is lightly modified so that you're also dealing with 10 years of revisions creating an incoherent mess.

<comment><USER4> I'm speculating here but perhaps one factor that adds to this situation is that people who are good at the stuff taught in this course, and have skills that are up to date, will earn lots more working for a FAANG than in academia.

</comment></comment></comment><comment><USER5> If you are interested in learning web app security but can't get into Stanford, consider reading this book: [https://www.amazon.com/Web-Application- Security-Exploitation...](https://www.amazon.com/Web-Application-Security- Exploitation-Countermeasures-ebook/dp/B085FW7J86)

Covers just about everything a software engineer (or web developer) needs to learn in order to get into security.

<comment><USER6> The Web Application Hacker's Handbook is also practically a must-read for those in the field.

[https://www.amzn.com/B005LVQA9S/](https://www.amzn.com/B005LVQA9S/)

<comment><USER7> +1 for WAHH! It is quite good in that it covers everything and is very readable for a book on subject as this.

</comment></comment></comment><comment><USER8> Can someone explain me one thing?

>When accepting untrusted input from the user, we should escape it before it is added to thedatabase so that we can later use it without worrying about escaping.

I tend to believe that despite very popular saying `escape everything!!!` it isn't so practical

Let's say I have ASP.NET Core WebAPI which is using EF Core + Vuejs on frontend

I'm accepting user input which is being binded to model (class) without escaping and saving it straight to db (ofcs after basic validation like strings length and business logic)

I'm using parametrized queries, so I don't have to worry about about SQLi, then I'm returning that data as json and the client (frontend, vuejs) escapes it and renders as text.

If I escaped that data before e.g `Germany / Berlin / 15B` after escape it'd be `Germany \/ Berlin \/ 15B`

then it'd less practical to use thing kind of data because whenever you'd want to use it, then you'd have to take into account that there may be some "weird" characters.

So how it is? I tend to believe that sql parameters and escaping on client side should be done instead of escaping at the beginning

Also I tend to believe that SQLi should be non-existent problem nowadays(and before tbh) because it's always possible to compare ASTs. SQLi will always? modify AST, yea?

</comment><comment><USER9> Hey Feross, took this class in the fall and loved it! Highly recommended for anyone who wants to get the lay of the land in web security.

</comment><comment><USER10> Wasn't this just posted a few days ago? I went through some materials and it's top quality.

<comment><USER11> Looks like it was posted under "Stanford CS243: Web Security": [https://news.ycombinator.com/item?id=22642220](https://news.ycombinator.com/item?id=22642220)

<comment><USER12> Judging by points, this is a clear dupe. But there wasn't much discussion, so maybe we'll leave this up for a while to see if a meaningful discussion arises.

In a way, course pages aren't a great basis for an HN thread. They're a list of more specific topics, and lists don't work so well on HN, which itself is already a list. I think you can see this already in the comments here as well as in the previous thread: they tend to be generic (e.g. security in general) rather than diving into specifics where the real juice would be.

[https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20denominator%20list&sort=byDate&type=comment)

[https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20generic%20discussion&sort=byDate&type=comment)

</comment></comment></comment><comment><USER13> Is this an ongoing course or anyone can join and read the material at own pace?

</comment><comment><USER14> Real web security is fighting back against browsers as the OS and executing all arbitrary JS code like grandma opening every email attachment she gets.

<comment><USER15> Not gonna happen, the real web is all about running arbitrary JS code these days.

</comment></comment><comment><USER16> Thank you for your input everyone, a lot of great resources a student like myself appreciate.

</comment><comment><USER17> Ugh... any course that references Forbes clickbait articles is a no-go for me. Thanks, but no.</comment>


Vimium - the hacker's browser - <AUTHOR> http://vimium.github.io/

<comment><USER2> This is what I've been looking for, thanks a lot

</comment><comment><USER3> if you like vimium, you should be swooning over what pentadactyl can do

<comment><USER2> thank you also :)</comment></comment>


Submersible glider spent months collecting data on Atlantic waters - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2009/12/14/AR2009121402861.html?hpid=artslot

<comment><USER2> Three pages, no pictures.</comment>


Show HN: Essex – Docker Project Boilerplate - <AUTHOR> https://github.com/utensils/essex <comment><USER2> Essex is an English County, if anyone is wondering (and didn't know).</comment>


Transpile.js from Facebook/css-layout - <AUTHOR> https://github.com/facebook/css-layout/blob/master/src/transpile.js

<comment><AUTHOR> It's always a delight reading well-written code. I think this one fits the bill, so I'd like to share it here on HN.</comment>


There must be a better way to enforce password security... - <AUTHOR>

With all of this discussion of password security lately one question I have is why browsers send the contents of a "password" input in plain text at all. Why not have the browsers preform a preliminary one way hash before even sending the data to the server. True that this is definately not the entire answer to the password storage questions (I know Bcrypt, Bcrypt, Bcrypt) but it would at least be a step in the correct direction and if done properly it would probably eliminate the current epidemic of sites choosing to just store passwords in the clear. <comment><USER2> To avoid attackers sniffing something they can replay, you need to transmit `salted_hash (whatever_is_stored_in_database)`.

This still leaves the issue of setting your password in the first place. You have to transmit something an attacker could replay --- your only option for protecting it is tls. So you might as well use tls for protecting passwords when logging in as well, and then you don't need the browser to do anything clever with passwords.</comment>