Flash Drives for Freedom - <AUTHOR> http://www.flashdrivesforfreedom.org/ <comment><USER2> <cynical thought> If I wanted to try and exfiltrate IP or trade secrets, there are worse approaches than collecting a bunch of used thumbdrives "for a good cause", and promote the "cause" somewhere employees of the target company are known to read...</comment>


Ask HN: How do I increase the load speed of my blogger.com site? - <AUTHOR>

Ideally I would like to increase the speed without removing any gadgets but would like some recommendations on what to remove if that is the best way. Search always seems to be the slowest to load and I really don't want to remove that
Also would consider moving to Tumblr or Posturous if that would help
Ideally I'm looking for some code I can add or some sort of caching gadget
Http://www.Rakkhi.blogspot.com <comment><USER2> Addthis have an ajaxy JS snippet you can use. Might help a bit. Similarly, check for similar versions of any other widgets you have. Other than that maybe cut down the number of posts on the home page.

You could always self-host the blog on a fast server and store as many scripts locally as possible.

</comment><comment><USER3> Run Page Speed from Google and YSlow from Yahoo!. Both give recommendations about exactly what to do.

In many instances, it might be best to offload static content (CSS, images, JS, etc) to a CDN, say on a subdomain, and send proper cache headers.</comment>


Teagueduino: Arduino for design and education - <AUTHOR> http://www.teagueduino.org/ <comment><AUTHOR> Backed by 300+ supporters via Kickstarter, and the first round of kits just shipped yesterday. [http://www.kickstarter.com/projects/teague/teagueduino- learn...](http://www.kickstarter.com/projects/teague/teagueduino-learn-to- make/posts)

Should be interesting to see what people build. :)</comment>


Kubernetes/OpenShift Hype or Future - <AUTHOR> Hello together,
i am working in a 50 manstrong IT-Team at a german company. I started my career as linuxadmin 10 years ago and now i have the chance to switchover to k8s/ocp on the basis of a new project. Containertechnology is really new to me, but i like, at least what i have seen so far. The majority of my business colleagues believes that all the k8s and dockerstuff is just a hype, gone away in short time. I think the step in this direction is a revolution like going from baremetal to virtual machines. So, what do you think: K8s/OCP/Docker - Hype or Future?
kind regards<AUTHOR> <comment><USER2> Establish your requirements, research the pros and cons of this solution, weigh them against other solutions, have a dicussion with your team. The popularity of a solution should have no bearing on your decision other than support and community; ignore hype and focus on core value add (or lack of)

Kubernetes will not go away soon. You might see less articles on the front page of Hacker News as the honeymoon phase dies down. Eventually we will see the "why we switched away from kubernetes" articles. This happens with all big tech

At the end of the day if it was all "hype", it doesn't matter, as long as it works for your team</comment>


Hecat - <AUTHOR>

29 hours at Bayeshack working on a Gates foundation educator dataset and we have been able to come up with individual recommendations for educators!  #bayeshack #hecat
http://bit.ly/1xapWdu
Personalized tool recommendations for educators <comment><AUTHOR> Also see cpo.st/1H5EOOx for the science behind it</comment>


North Korea Did Not Hack Sony (DefCon Security) - <AUTHOR> http://www.thedailybeast.com/articles/2014/12/24/no-north-korea-didn-t-hack-sony.html?source=TDB&via=FB_Page

<comment><USER2> Short of hard evidence (that has certainly not been shared in any fashion by those claiming this hack has ties to North Korea) I'm much more inclined to believe that they had no involvement at all. It just doesn't add up for the reasons this article enumerates.

<comment><AUTHOR> Totally agree.. and Marc is one of the best security engineers I know. I think we are all just to embarrassed (including the President) to admit it.</comment></comment>


IT infrastructure strategies for startups - <AUTHOR>

If you have a bunch of developers and designers all hacking away on their laptops, what are the different options and pros/cons for backups, shared file storage, etc? Is it better to set up your own file servers, version control servers, email servers, implement backup strategies on your own servers, etc. or does it make more sense to use things such as Confluence to share knowledge and files, Dropbox, GitHub and so on? <comment><USER2> Build as little as you can get away with on your own. Focus on the core value of your business and not the incidentals, if you can help it. Use Dropbox or Box.net for file sharing, Github for version control, Google Apps for calendaring/email/contacts, and use S3 to backup your EC2 servers nightly. We also use the Github wiki for our various projects.

Of course, you can make your own choices in all of the above tech. I was just providing a list for the sake of examples. The point is, each of these things is the core value of these other businesses and they do them better than you will be able to. It's absolutely worth the small fees they charge to keep you focused on your core product.

<comment><USER3> And backup OFFSITE. S3 is onsite if you use EC2.

</comment></comment><comment><USER4> what I do for myself, is a local Synology NAS in RAID1 configuration for synchronizing all business documentation, such as offers, invoices, salary statements, etc.

Every night the NAS compresses and encrypts the whole archive and pushes a copy to a VPS at the provider site. This way I am sure I have a relatively recent off-site copy, and it is secured enough, so that even the VPS provider is unable to read it.

I use GoodSync for synchronizing my documents folder with the NAS. Also NAS is reachable from the public internet over HTTPS, and I can synchronize my files when I'm at the customer site.

Also I use another VPS (extremely cheap one from <http://www.buildyourvps.com/> \-- a bit slow, but fine for these needs) as my Git storage. I use Gitolite to organize my Git repositories, and basically create a new repository for every set of scripts or configuration files that I do for my clients.

For public and open-source code, I use Github.

A third VPS is used as a virtual PBX where I organize hotline service for those of my customers which need support with an SLA. You can see some technical details in my blog (<http://txlab.wordpress.com/tag/dvop-net/>). Also an instance of RT: Request Tracker is running on it.</comment>


Georgetown study: To succeed in America, it's better to be born rich than smart - <AUTHOR> https://www.cnbc.com/2019/05/29/study-to-succeed-in-america-its-better-to-be-born-rich-than-smart.html <comment><USER3> The article here is largely a statement of a tautology because it defines success as financial success.

If you're born with enough wealth, you have an income higher than those stated in the article from investments only; you've "succeeded" by their metric from birth.

At 1-2 orders of magnitude lower than that, you can afford to hold out for what is effectively an infinite period compared to a poor person and so never work a $20K job because it is actually beneath you - you don't need it - <USER2> would be a net negative over you continuing to study, network, search for other work, etc.

Of course a person with money is more likely to go to college - they're more likely to do pretty much anything they want to do, because they have money!

</comment><comment><USER4> Is that different anywhere else in the world? Unfortunately, having connections and existing resources has always been far more advantageous to people than talent alone (or any other factor).

<comment><USER5> In kind no, but in degree yes. The US has lower social mobility than many other 'western' countries.</comment></comment>


Amazon announces new Kindle Paperwhite - <AUTHOR> http://techcrunch.com/2015/06/17/kindle-announces-new-119-paperwhite-e-reader-with-a-font-thats-easy-on-the-eyes/#.ueknbe:0t2k

<comment><USER2> I wish so dearly they would allow ragged right text.</comment>


Making Swift code extensible through plugins - <AUTHOR> https://www.swiftbysundell.com/articles/making-swift-code-extensible-through-plugins/ <comment><USER2> I have to say, this was not the kind of plugin I was expecting. Although I am curious if anyone has started writing in-process dynamically loaded modules in Swift yet, now that the necessary groundwork has been put in place?

<comment><USER3> Wouldn't they be blocked from the App Store?

<comment><USER4> An iOS app can only execute code from within the app bundle. It's OK to dynamically load plugins that are shipped with the app, but the app cannot download and execute plugins at runtime. Additionally, programs written for Mac or Linux are of course not subject to this restriction.

<comment><USER5> Until they close that "hole" on osx too. Given the ever longer list of restrictions, like notarizations, on OSX in the name of security features.</comment></comment></comment></comment>


Beginners Strategy Guide to Start Selling and Make Money on Fiverr - <AUTHOR> https://medium.com/@JohnBeardslee/beginners-strategy-guide-to-start-selling-and-make-money-on-fiverr-1c341a3846bc <comment><USER2> " Don't sell gigs that will require days of work from you. Like "I will develop a full web application for you, for 5$" or super-tight schedule ones like "I'll illustrate and design a logo in 1 hour". "

I also made this mistake, but it was great learning experience. Even though my prices were the highest among similar offers, most of the buyers belived that they basically hire a full time Software Engineer for this money.</comment>


Handbrake 0.10.0 released - <AUTHOR> https://handbrake.fr/news.php?article=27 <comment><USER2> > In addition, we have added the FDK AAC encoder for Windows and Linux as a > optional compile-time option.

It's a shame that libfdk-aac is also GPL incompatible. It's hands down the best free AAC encoder, but a version of FFmpeg/libav/Handbrake that's compiled against it is not allowed to be distributed.

<comment><USER3> would distributing a shell script that automated that install/compile process be legal?

<comment><USER4> Yes it's called FreeBSD ports :-)

(Not sure if this is an option, but could be easily added)

</comment></comment></comment><comment><USER5> When I used Handbrake, I always had audio sync issues. I could never figure out what I was doing wrong. That was on Windows. Now that I'm on a Mac, perhaps it'll go better, though I don't have the need to use it much anymore.

<comment><USER6> I've never had any audio sync problems with Handbrake, then again I've never done anything 'exotic' (basically encode my dvd's to x264+audio passthrough) and everything has worked fine.

<comment><USER7> Back when you wanted to encode a DVD to the size of one (or maybe two) CDs, having audio-passthrough was not an option. You typically re-encoded the data from 384-448kbps (for AC3-surround) down to 128kbps stereo. For that you used MP3 audio.

I also recall the earlier Frauenhofer MP3 codecs incorrectly reported audible length of chunk-sizes (or something like that) causing incremental audio-skew and sync-issues with the corresponding video the longer into the movie you came.

It seemed impossible to fix and was terribly frustrating.

Eventually the tools caught up and patched up the data, or we got better tools (like lame) which didn't produce the faulty artefacts to begin with.

Maybe this is what he's talking about, as the Frauenhofer MP3-codec was very much a Windows-only thing.

</comment></comment></comment><comment><USER8> "QSV is only supported on Windows" "libav AAC encoder as the new default for Windows" "HandBrake now offers BiCubic scaling on Windows via OpenCL"

Sad that the Mac doesn't seem to get many of the goodies anymore.

<comment><USER9> OS X's built-in AAC encoder is the best available, so it doesn't need a replacement.

On the other hand, QSV is entirely outclassed by x264 quality-wise, and I could only recommend it for heat/battery power savings (useful for AirPlay Mirroring, not so much for DVD backups).

It is odd that OpenCL programs wouldn't work, but that can't be much more, uh, work.

I think the addition of NLMeans is interesting, since that filter is so slow I've only ever used it for photo processing.

<comment><USER10> The OpenCL code works on mac too, but it's not available in th e GUI due to a corner width/height case in which the downscale quality gets hideous. HandBrake has got no active developer working on the OpenCL code anymore, so it will stay as it is until someone comes and fixes it.

</comment></comment></comment><comment><USER11> While still waiting for Daala I've already started encoding my videos in H.265 separately from handbrake, using mplayer. It's been going very well, H.265 will be awesome once it really starts hitting the mainstream. The bitrates are magically small and x265 is pretty fast. mkv container and Opus audio.

<comment><USER12> I realise this is subjective but how's the quality of x265? What's the encoding speed like in comparison to x264?

<comment><USER13> It's good for bitrate starved files, but x264 is actually still more efficient for transparent encodes. x265 currently can't handle noise very well.

x265 is also much slower than x264, but it's getting faster all the time.

<comment><USER6> >It's good for bitrate starved files, but x264 is actually still more efficient for transparent encodes. x265 currently can't handle noise very well.

Yes this is my impression as well from the tests I've made.

>x265 is also much slower than x264, but it's getting faster all the time.

It will remain slower than x264 though, it uses more cpu consuming algorithms in order to cram out more 'quality per bit', that said it likely has a lot of performance improvements left to do.

<comment><USER14> >It will remain slower than x264 though, it uses more cpu consuming algorithms in order to cram out more 'quality per bit'

At an abstract level, HEVC is AVC + refinement + new algorithms.

Conforming bitstreams aren't required to use all or even most features, so in the long-term, I don't see why an HEVC encoder can't be a simple, straightforward superset of x264 (i.e. same speed for same quality).

<comment><USER6> Sure, but the whole point behind x265 is to provide better quality per bit than x264.

</comment></comment></comment></comment></comment></comment><comment><USER15> At times I do need an audio/video converter, and it is always a bit of a pain sifting trough all the dubious and low quality freeware programs. Although Handbrake is not really dubious, last time I tried it wasn't very user friendly or easy either. Anyone know why it seems to be hard to make a nice, easy 'convert arbitrary format to something commonplace' program? And since this gets upvoted, is Handbrake considered the current standard?

<comment><USER16> You could try just using ffmpeg (depending on your definition of easy). In most instances it will simply be a case of something like

      ffmpeg -i input -c:v libx264 -crf 20 -c:a libfdk_aac output.mkv

<comment><USER3> I second this, I bet most of those freeware programs are just shitty GUIs around ffmpeg anyway. I doubt the developers of those programs care about GPL violations either.

</comment></comment></comment><comment><USER17> Handbrake could really use some TLC on the GUI. It's so confusing (at least for me) that I was only using it in CLI mode. This ended up being a good thing : I made a script to only convert at night when electricity is cheaper.

</comment><comment><USER18> This is very interesting! I'm using AWS elastic transcoder, but this as an AMI could be cool too, any thoughts on going that way?

</comment><comment><USER19> Love the software.

However, still can't do batch convert on a OS? You can convert a whole folder with a few clicks in the Windows version.

<comment><USER20> Maybe I don't understand what you want to do, but for at least 3 years I've been able to load a video clip in, set up the settings, add to queue, load video, add to queue, repeat. Then process the whole queue overnight.

<comment><USER19> You can add the whole folder at once and use that "Add all titles to queue" button.

</comment></comment></comment><comment><USER21> HandBrake uses HTTPS, but Sourceforge doesn't...great.

<comment><USER22> [https://handbrake.fr/checksums.php](https://handbrake.fr/checksums.php)

<comment><USER23> This ~prevents people from modifying the binary that you download, but doesn't prevent them from knowing that you downloaded it.

<comment><USER24> You realize that HTTPS doesn't hide what sites you visit, of course?

<comment><USER25> But it hides the HTTP request itself - Sourceforge hosts thousands of different projects, if served over HTTPS it'd be considerably harder to tell which download had been requested.

<comment><USER26> I'm pretty sure an HTTPS GET request to http[s]://iweb.dl.sourceforge.net/project/handbrake/0.10.0/HandBrake-0.10.0-MacOSX.6_GUI_x86_64.dmg would be pretty easy to identify as a HandBrake download. The resource requested is not hidden.

<comment><USER27> > The resource requested is not hidden.

Your GET request, and the server's reply, is encrypted.

The _hostname_ of your request might leak in SNI, or if your DNS lookup was insecure.

It is also plausible that an eavesdropper could make a solid guess as to what you downloaded by counting bytes, but that's obviously not worth much.

<comment><USER28> _The hostname of your request might leak in SNI, or if your DNS lookup was insecure._

You don't need a DNS leak; if you aren't using SNI, the server(s) replying on that IP can only serve a single cert, so the snooper can usually find out the hostname by simply connecting to it and seeing what it gets.

The exception is if the site is behind something like Cloudflare, which stuff dozens or hundreds of hostnames in a single cert.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Hey guys, someone has a good list of presets to share?

<comment><USER30> You'll have to spend a great deal of time to beat the presets already used by Handbrake/x264, and you'll only be able to do it on a particular clip. There's a good article[1] on the presets and how they impact quality, which lead me to using slow or slower for pretty much everything.

[1] [http://www.videoquality.pl/preset-settings-x264-quality- comp...](http://www.videoquality.pl/preset-settings-x264-quality-compression- speed-test/)

</comment></comment><comment><USER31> VidCoder > Handbrake

<comment><USER32> "VidCoder is a DVD/Blu-ray ripping and video transcoding application for Windows. It uses HandBrake as its encoding engine." \-- 1st sentence on VidCoder's site

I think you mean VidCoder has a better interface for HandBrake on Windows then HandBrake? I haven't had any problems w/ HandBrake's UI on Windows, but I keep it pretty simple so maybe if you want to do more complex things VidCoder is better.

</comment></comment><comment><USER33> Still no opus?

</comment><comment><USER34> XMedia Recode [1] can do all this as well. Looks quite similar as well, by the way.

But of course, it's not open-source, while Handbrake is.

[1] [http://en.wikipedia.org/wiki/XMedia_Recode](http://en.wikipedia.org/wiki/XMedia_Recode)

<comment><USER15> Experts estimate that there are approximately millions [0] of AV converters around. At least, in my experience.

[0] not really</comment></comment>


Megaupload's Kim Schmitz arrested in Auckland (police statement) - <AUTHOR> http://www.3news.co.nz/Megauploads-Kim-Schmitz-arrested-in-Auckland-site-shut-down/tabid/311/articleID/240007/Default.aspx

<comment><AUTHOR> Just realized this might be geo-blocked to NZ only viewers, I know some video content is as part of their bandwidth agreements (I know the team there quite well). So sorry if it is.</comment>


Show HN: Shellshare – live terminal broadcasts with a single command - <AUTHOR> http://shellshare.net <comment><AUTHOR> Author here.

I've built shellshare.net because I often want to quickly show someone something on my terminal (a weird error, for example), but using tmux/screen is too involved (SSH keys, firewalls, NATs, ...).

I also found it useful to help debug some issue on a friend's computer. I'd ask them to broadcast their terminal on shellshare.net, and start debugging it passing commands through IM.

It doesn't save the broadcasts (for that, I recommend [http://asciinema.org](http://asciinema.org)), nor allows multiple people to control the terminal (as screen/tmux), but it fills a niche that, as far as I know, wasn't possible before.

Comments, suggestions, and pull requests are appreciated.

</comment><comment><USER2> Cool concept... The thing that I think developers will not like about this is the concept of running the result of the unencrypted http request into python. Would suggest enforcing SSL use as a safety precaution.</comment>


$50 comodo wildcard SSLs (while they last) - <AUTHOR> http://www.namecheap.com/promos/2012/black-friday-cyber-monday-deals.aspx <comment><USER2> Does anyone else feel like SSL certificates are a giant scam?

Companies like Microsoft are king-makers so they essentially get to pick and choose who gets to be a "trusted" certificate authority, and therefore we wind up with a competition-less market.

Many of these companies claim this excess cost (over the technical costs which are low) are the result of having to verify people are who they say they are. But in my experience, from buying certificates, certificate authorities never do this (or at least don't manually do it). In fact Amazon did far more verification when I signed up to AWS than any certificate authority ever has...

They also charge more for different kinds of certificates (e.g. like this "sale") even if their costs are identical. This is just a nonsense way to up- sell a product that already has a markup likely in the thousands of percentage.

Honestly any SSL certificate which costs more than $5~10 is a rip-off.

<comment><USER3> We need to replace certs with DANE

DANE is basically SSL authentication via the cert in DNS

Get rid of third parties.

<https://datatracker.ietf.org/wg/dane/charter/>

Problem is it needs DNSSEC, but we are going to need that sooner or later anyway.

<comment><USER4> In the meantime, for SSL on team projects which are not yet released-to-the- public, there is a web-of-trust certificate issuer called CAcert.org which can be installed on relevant machines and used. At one point they were trying to pass an audit and get into Firefox, so perhaps someday they can become a default for web browsers. If they cannot, then perhaps a sufficiently motivated group could set up a similar authority.

Ideally, the flow would be much simpler than even CACert has made it; you ask for a certificate for drostie.org, the CA does a WHOIS for the administrative contact for that domain; the CA sends an email to that domain name containing a link to confirm the request; if you visit the link then you can upload a public key and perhaps even generate a private key (via client-side javascript, of course -- you don't want to send such things to the server).

I don't know whether you could make it pass a security audit and get into major browsers -- but I like the idea that this could be much more user- friendly than it is.

</comment></comment></comment><comment><USER5> Before you jump at this, research the reputation of your SSL certificate provider.

<https://www.google.com/search?q=comodo+reputation>

$50 is a pretty good price, the nearest competitor is charging about double that. Still, if you are going for a wildcard SSL certificate (and you already need one even if you just want to respond to www.example.com and example.com using https) then likely the $50 is a rounding error on your annual expenses. It's good to be frugal, and if you feel that comodo is good enough for you then this is as cheap as it gets.

<comment><USER6> You don't need a wildcard for domain.com + www.domain.com. I've got several cheap (~$7) certificates that have both listed

<comment><USER7> The StartSSL free ones do this too, I have them on all my domains.

</comment></comment></comment><comment><USER8> In the olden days (circa 1995) there were precious few Cert providers (Verisign, Thawte, and few others) and they vetted you, because SSL certs are about trust, not about encryption. As a result, Certs were bloody expensive.

In order to get the cert for dsac.dla.mil (the computer shop inside the US Defense Logistics Agency) we provided reference to the act of Congres establishing the DLA, and then the command chain that proved that my boss had the rights/responsibility for the SSL cert for the domain.

The process could take weeks, but in the end you could trust that the server on the other end was who they claimed to be.

Fast forward tot he internet boom, and everybody needed a cert, and there folks realized that generating certs was physically easy, and could be lucrative, so they started selling cheaper and cheaper certs. but you can't vet an organization for 29.95, so that aspect of SSL Certs was conveniently forgotten as the masses rushed onto the web.

Everybody thinks SSL Certs are about the encryption. We know that the Cert only establishes the identity of the other party. The encryption is performed using a key which is shared after the cert is used to establish trust.

So now, people are starting to realize that cheap certs don't provide trust, and we're seeing $1500 vetted certs again, and browsers that change colors to signify trust levels.

However, to make this personal, I have a Comodo cert that I got for free with domain registration at namecheap, and a bunch of browsers don't want to trust it.

So I'm stuck between not having revenues to buy a super-cert, and having people refuse to use my app because their browser is saying my app's cert isn't trustworthy, and they aren't technical enough to override the warning.

So will these $50 wildcard certs fare any better?

<comment><USER9> _...and a bunch of browsers don't want to trust it._ This shouldn't be the case. My email is on my profile if you want to email me any details you can - I'll get this solved!

<comment><USER8> Thanks to nickf I learned that I'd omitted certs in the chain when I did the installation. all is well now. Thanks nickf!

</comment></comment></comment><comment><USER3> What about StartSSL at $60 for two years for wildcard and multiple domains?

<https://www.startssl.com/?app=40>

      Multiple Domains (UCC)
      Wild Card Capability

Supported by all modern browsers.

<comment><USER10> It would be nice if they had any sort of flexibility in their identity validation. Not all of us keep identification cards with addresses on them[0] or a telephone number billed in a traditional manner[1].

0 - United States Passport Card, for instance.

1 - VoIP.

<comment><USER11> If they cannot reach you by phone, they can send you a snail mail with some code printed on it that you have to enter into their admin interface. Admittedly they should tell you about that before you try to register (I discovered it after I already paid, but it just took a few days and all-in-one it wasn't too bad).

</comment></comment></comment><comment><USER12> All sold out now.

So frustrating to get to the end of your order to get the message that the coupon has expired.

<comment><AUTHOR> they run every 3 hours

</comment></comment><comment><AUTHOR> just got an essential SSL for $49.99 for a year, limit 10 per customer, half price. Also you can get an EV cert for $50-60.

<comment><AUTHOR> that is, a wildcard SSL

</comment></comment><comment><USER13> Andddddd it's gone..</comment>


AP and Princeton: Google tracks location of users even when they tell it not to - <AUTHOR> https://boingboing.net/2018/08/13/ap-and-princeton-university-g.html <comment><USER2> Original post here: [https://news.ycombinator.com/item?id=17749330](https://news.ycombinator.com/item?id=17749330)</comment>


Acid Attacks on the Rise in the U.K - <AUTHOR> http://www.npr.org/sections/parallels/2017/08/06/541209398/acid-attacks-on-the-rise-in-the-u-k <comment><USER2> A key question here is what has changed to make these attacks more prevalent. One possibility is it is related to immigration and changing demographics. The area with the most acid attacks by far, Newham ( [http://www.mirror.co.uk/news/uk-news/acid-attack-capital- bri...](http://www.mirror.co.uk/news/uk-news/acid-attack-capital-britain- revealed-10008792) ) is also very immigrant heavy ( [https://en.wikipedia.org/wiki/London_Borough_of_Newham#Demog...](https://en.wikipedia.org/wiki/London_Borough_of_Newham#Demography) ). In this NPR article, the example is of a guy with a white/British name attacking someone of middle eastern heritage -- but I know from experience on news coverage in my own region that NPR cannot be trusted on racial issues to select anecdotes that match the real patterns of behavior. Do any of the Brits here have any more insight on how immigration and changing demographics might be related to these attacks?

<comment><USER3> Something that is prevalent in the Middle East is now also prevalent in the place where large numbers of people from the Middle East have come to.

Something tells me its not a coincidence.

<comment><USER4> > _Something tells me its not a coincidence._

Yes, that something being racial prejudice. Sad to see this attitude rife on HN.

<comment><USER3> Pretending that cultural differences don't exist on this planet is just plain silly. It's sad to see this level of virtue signalling on HN.

<comment><USER3> >Jumping to conclusions that fit your anti-immigrant racial prejudice, pretending that it's actually about "cultural differences", complaining about "virtue signalling". It's like playing a game of alt-right bingo here.

You forgot to call me a "Nazi" and "bigot" and "facist" and all the other things you ANTIFA folks call those who have different opinions than yourselves.

<comment><USER4> Ah, shoehorning "antifa" into the conversation (with vague insinuations that anti-fascism is somehow a bad thing), that's another one.

How many more alt-right talking points can you squeeze out? Your reaction is so amusingly predictable, it's sad to see someone so programmed to dullness.

<comment><USER5> Would you please not create accounts to engage in political flamewar here, regardless of how bad another commenter may be behaving? I've banned this one. As the site guidelines explain ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)), the way to deal with egregious comments is not to feed them by responding in kind, but to flag them. In particularly bad cases you're welcome to email firstname.lastname@example.com. We value that sort of heads-up from users, because HN's firehose is much too large for us to see everything that goes on here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> > He says assailants use acid today for many of the same reasons as they did > in Victorian times:

Ok but there is a recent rise. Why the recent rise?

I heard that it's because guns are banned. But that didn't happen just in the last few years. So did acid become cheaper to purchase or gun and knifes got harsher penalties recently.

Wonder if there is sort of a copycat thing going on, people hear about it and some say "Oh my, how horrible" maybe the criminals are saying "Yeah, good idea, look how horrified everyone is. I know what I am using next time I am going on a rampage".

What about parts of UK. Where are these attacks happening? Financial district, suburbs, drug trafficking areas, maybe that might provide a hint on the underlying reason.

</comment><comment><USER7> it is interesting how this topic intersects with gun control and society at large. the solution to this acid attack problem is the same as the solution to a gun violence or knife violence problem: somehow reduce the number of violent nothing-to-lose people that are on the streets. and the number one way to do that is to structure society in a way that gives children a safe and productive environment, and in a way that makes good behaviour much more profitable than bad behaviour. with current public schools and current job prospects, it is no surprise that their society has come to the point of considering a ban on domestic drain cleaner. if you have a well structured society, then eventually it will be filled with good people. and a society full of good people has no need for bans on guns or draino. i think that we could come closer to that vision simply by reaching out to a child in your area and teaching them something.

<comment><USER8> Do you think that a well structured society has no need for a ban on nuclear weapons? If not, how do you draw the conclusion that such a ban is unneeded for guns?

<comment><USER7> this is an excellent observation and it is actually the point of nucleation from which my current point of view was spawned. one can imagine a kind of scale that could be used to rate an individual person. left to their own devices, in many, many different scenarios, what kind of behaviour does that person exhibit? maybe the scale could be non-violent to violent or un- productive to productive. it is tempting to abandon the idea of "rating" people because people are complex, and their behaviour changes depending on the situation and various other factors. but there are examples that show that such a scale is useful. but we all know, anecdotally, that people can be rated on such a scale. people who benefit from great parents and mentors, who had excellent educations, had excellent nutrition and so on, reside on the more positive end of the scale.

so the people are the building blocks from which a society is built. everything in that society is a function of the people. so it is possible to assess a given society on a similar scale to the people: a certain society that has a certain distribution of certain kinds of people will experience certain outcomes. let us imagine that we take a large sample of societies and subject them to this idea where everyone gets their own personal nuclear weapon. in fact, lets boil it down to its logical core: let us imagine that every single person in society is given a button. if they press the button, the entire society will be instantly destroyed. they are all aware of this when they get their button.

on one extreme side of the scale or spectrum, a society filled with extremely smart, well educated, well adjusted and emotionally healthy people who all have great jobs and lives, in other words a properly structured society filled with very good people, not a single instance of button pressing would occur. you could in fact give each person the power to end the world and the world would go on unharmed. this is the goal. it can never be achieved because sometimes people go insane or have a bad break up or what have you, but its no different than an electronic device trying to use power as efficiently as possible: electronics strive for zero power consumption and societies should strive to reach the point where the aforementioned scenario is possible.

now we look at the real world. we see that gun control, voting, and all kinds of other things are actually the same thing: different ways in which citizens are trusted or not trusted with power. we see that in a healthy democracy or republic, the vote is far more powerful than the gun. we see that any healthy democracy or republic _requires_ that its citizens are up to the task of handling power responsibly. and i think that if you agree with all the previous statements, you agree that much of the western world is in a lot of trouble right now. and say that without even the smallest shred of arrogance or snobbery.

so, this leads to a very interesting consideration of the limits of power that the citizens of the united states or the united kingdom might handle before something bad happened. and it is also fun to consider what the maximum amount of power the citizens are capable of handling after some kind of focused effort to make them ready. how much power could they handle if schools and jobs and everything were made better? what is the best outcome we might hope to achieve?

so the answer to your questions is that no, individuals probably shouldnt have nukes but they could probably handle some really dangerous stuff like chemical weapons or heavy machine guns if you just gave them the tools they need.

<comment><USER8> I agree with you to a degree. But I think a more useful way of thinking about it is through the lens of risk. Each citizen carries a risk of violence. Weapons multiply that violence, education and socialization reduce its probability. So we have an equation:

ExpectedHarm = P_incident * Harm

Weapons multiply harm, and education reduces P. Nuclear weapons cause ExpectedHarm to approach infinity almost regardless of P_incident, so they are out. But guns, knives, acid, and other weapons all sit along a continuum.

Increasing access to guns unquestionably increases ExpectedHarm (arguments like 'if everyone had guns, people would be well behaved' are, of course, ridiculous on their face), but there are social benefits to guns. Some people enjoy hunting, sport shooting, and carrying a gun makes many people 'feel' safer (which, though hard to quantify, remains a true social good, in some sense). Guns are also, to some degree, a check on government power. I don't particularly like the Bundy's position or what they stood for, but their access to guns is absolutely what gave them the power to make that stand. You can count this as a positive or negative depending on your perspective. I tend to count it as a positive even though most uses of it, like the Bundy's, I strongly disagree with.

And finally, there is the sort of 'constant' boost to the positive side you get from the general bias we ought to have against banning things (you may choose to set this to zero or negative if you hate freedom). So, the full equation is:

SocialGood + LibertarianBias - P_incident * Harm * BanEfficacy

If this expression is greater than zero, you should leave it alone. This does ignore some theoretical nonlinear terms (e.g. banning guns increases the probability of other forms of violence, or vice versa), but it more or less captures the idea. Depending on which values you input for various terms, you'll get a different answer.

All of that is to say that whether or not any given weapon ought to be legal should be evaluated according to a framework that looks something like the above.

<comment><USER7> right, but what is missing here is the observation that all the duties of a citizen also carry power to do harm. therefore, in order for society to prosper, its citizens must be able to handle guns and draino, because voting and going about their everyday lives have just as much potential to ruin things.

<comment><USER8> That's an interesting perspective, but I think those activities have fairly different risk profiles. Voting is a collective behavior and its harms are therefore smoothed through averaging. Gun violence isn't really like this. If 1% of the population votes in a crazy way, that's not such a big deal, but if 1% of the population engages in gun violence, that's an _enormous_ problem.

<comment><USER7> granted

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> If anyone wonders why, it is because the UK over here has a little legal loophole where carrying acid in any reasonable (non-truckload) amount is not in any way a criminal or incriminating act, where-as guns, knives, and loads of other things are.

What is sad is it's taking so long for policians to wake up and realise that some non-scientist carrying a huge jug of acid in a backpack is kinda obviously incriminating...

<comment><USER7> so carrying a shopping bag with domestic drain cleaner inside is obviously incriminating? and carrying a shopping bag with a new knife set is incriminating?

<comment><USER10> If you're young, in an area with frequent attacks, moving with a gang, and not on a trajectory from the store to the location of your claimed clogged drain, then yes, I'd say it's pretty incriminating.

Street officers are usually pretty experienced and capable of making a judgement whether this should be looked into further. If needed, the evidence and circumstances can be reviwed in court.

It's not an all or nothing situation. We're capable of nuance.

</comment></comment></comment><comment><USER11> > British retailers are now talking about licensing the purchase of sulfuric > acid.

Banning or controlling something that could be used as a weapon is not the solution. As has been already demonstrated by controlling firearms and knives, criminals will just find an alternative.

<comment><USER12> Really? I think making guns extremely hard to get has been pretty good for NYC.

<comment><USER13> I'd be more inclined to blame the reduction in violent crime in NYC on it's staggering large and well-equipped police force. If a criminal really wanted a gun in NYC, they probably aren't going to obtain one legally so making them harder to get only creates a minor inconvenience.

</comment></comment></comment><comment><USER14> Could people conceivably keep a package of baking soda or calcium carbonate with them? would that be an effective on-the-spot antidote? Hmm or maybe get to the nearest kiosk and get some alka seltzer...

<comment><USER15> Best thing would probably be a lot of water. Here's a video of someone willingly pouring 98% sulfuric acid onto their hand, they just wash it off: [https://youtu.be/XeVZQoJ5FdE?t=284](https://youtu.be/XeVZQoJ5FdE?t=284) . Plus, if someone pours a random liquid onto you, it's kind of hard to know if it's water, acid, lye...

<comment><USER16> I was about to say that adding water would be bad in the case of lye, but after some research it seems I was wrong. Probably watched/read "Fight Club" too often. Apparently using an acid like vinegar to neutralize lye is more painful than flushing with water and creates a lot of heat because of the strong reaction.[1,2] So the recommendation actually is to just flush with water for 15 minutes.[3]

[1][http://itonlyadds.blogspot.co.at/2012/08/on-chemical- burns-v...](http://itonlyadds.blogspot.co.at/2012/08/on-chemical-burns- vinegar-and-liquefied.html)

[2][https://www.soapqueen.com/bath-and-body-tutorials/tips- and-t...](https://www.soapqueen.com/bath-and-body-tutorials/tips-and- tricks/back-to-basics-lye-safety-guide/)

[3][http://www.certified-lye.com/MSDS-Lye.pdf](http://www.certified- lye.com/MSDS-Lye.pdf)

</comment></comment></comment><comment><USER17> There is a rich literature on culture-bound syndromes [0], but the same phenomenon is visible in certain criminal behaviors. To state it succinctly, crimes can be memes.

In the US, for instance, the school shooting is a meme: it's just what you do when you are massively angry at society and want to take revenge on it. Previously, "going postal" [1] was a meme amongst angry postal workers.

In Italy, several years ago, there was a string of incidents of rocks being thrown from highway overpasses, striking cars. The government reacted by numbering all overpasses to make reporting easier, but AFAIK what really kept it from becoming a meme was an informal agreement with the media to relegate such news to small articles in the inner pages. When this was done, the number of imitators quickly petered out, and the meme disappeared.

As for acid attacks, this is a meme that came from south-east Asia (e.g. Pakistan), where it was endemic a few decades ago. It spread to the UK due to its large population of immigrants from those countries, and for a while it was mostly confined within the Asian (in the UK sense) community, but it has now spread into the general population.

This is clearly an unpleasant observation, but it is quite obvious if you have paid attention to the crime news over the last few decades. I remember acid attacks in the UK making the international news when I was a child. Back then they followed what the NPR article calls the "global pattern" ("males attacking young women and girls, relating to rejected sexual advances or marriage proposals or dowry-related attacks"), and the attackers were not native Britons. But if we could look at detailed statistics for this crime, I bet we would see both an increase in prevalence, and an increase in the percentage of British perpetrators.

It is very tempting to ascribe these criminal memes to purely non-cultural factors, such as the availability of firearms in the US, and their limited availability in the UK, but it does not really work. School shootings were not always as prevalent in the US as they are now [2], nor is their prevalence proportional to that of guns across countries [3]; rocks and overpasses still exist in Italy [citation needed]; and the availability of acid in the UK has not increased relative to other cheap instruments of harm (e.g. knives, hammers), nor relative to other countries.

BTW, the fact that acid attacks existed in Victorian times (but how common were they?) has no bearing on any of this. A meme can die out in a place and later be reintroduced from another source, just as a living organism can (e.g. horses in America).

[0]: [https://en.wikipedia.org/wiki/Culture- bound_syndrome](https://en.wikipedia.org/wiki/Culture-bound_syndrome) [1]: [https://en.wikipedia.org/wiki/Going_postal](https://en.wikipedia.org/wiki/Going_postal) [2]: [https://en.wikipedia.org/wiki/School_shooting#cite_note- nyr2...](https://en.wikipedia.org/wiki/School_shooting#cite_note- nyr20151019-40) [3]: [http://www.cbc.ca/news/world/small-arms-survey- countries-wit...](http://www.cbc.ca/news/world/small-arms-survey-countries- with-the-most-guns-1.3392204)

</comment><comment><USER18> Why was this flagged?

</comment><comment><USER19> it is really sad that the first thing that comes up with this issue is, "omg immigrants are causing this" vs, why this crime is actually happening.

this article points to a case of someone who most likely isn't an immigrant yet that is the first thing people rush to.

edit: according to the wikipedia page, a disproportionate number of the attacks using acid are against women. why not talk about that instead?

<comment><USER10> Did you actually read the article? It says that _two-thirds of the victims in Britain are men while, globally, most are women_. It's not about women in the UK.

<comment><USER5> Would you please read the site guidelines and follow them when commenting here?

 _Please don 't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."_

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER10> I find it amusing that you didn't shorten this to _" The site guidelines mention that"_. If I would have written _Would you please read the article_ instead of asking if they had read it, would that be ok, or do you reserve that right to yourself only?

I will try to refrain from asking people if they have read anything. I've read the guidelines several times before, but this specific prohibition just slipped my mind. Your comment does feel effectively the same though.

<comment><USER5> Yes, moderation comments suck—to write as well as to read. If the community ever gets to the point of not needing them, it will be a dream come true.</comment></comment></comment></comment></comment>


Stellar Module Management – Install Your Node.js Modules Using IPFS - <AUTHOR> http://blog.daviddias.me/2015/12/08/stellar-module-management <comment><AUTHOR> Private NPM modules are probably a problem, but otherwise this sounds like it would solve the current NPM issues without requiring everybody to retool.

Looking forward to using this in company hackathons where we can then install dependencies from across the table instead of over the Internet.

</comment><comment><USER2> Cool. This is basicslly what I was talking avouy the other day in another thread. Initially I received a 0 score and then later it changed to 1. So I thought I was alone in thinking that way. Nice to see that I was not.</comment>


Become a ninja with Angular 2 – pay what you want ebook - <AUTHOR> https://books.ninja-squad.com/angular2 <comment><USER2> So passionately written book. I wanted to cry

</comment><comment><USER3> Fantastic ebook, highly recommended

</comment><comment><USER4> Amazing work!</comment>


Could Better Testing Practices Have Prevented the Healthcare.gov Defects? - <AUTHOR> http://blog.smartbear.com/quality-assurance/could-better-testing-practices-have-prevented-the-healthcare-gov-defects/ <comment><USER2> The site was designed for only 50,000 simultaneous users.

[http://www.usatoday.com/story/news/nation/2013/10/05/health-...](http://www.usatoday.com/story/news/nation/2013/10/05/health- care-website-repairs/2927597/)

Didn't that site cost millions to make?

Wait, is this blog entry trying to sell their own products?

This is a better round-up of stories about the website:

[http://www.theatlanticwire.com/politics/2013/10/obama- admini...](http://www.theatlanticwire.com/politics/2013/10/obama- administration-opens-about-exchange-glitches/70248/)

<comment><USER3> A bunch of other better articles on it have been posted to HN, but not upvoted enough to make the front page. I too find this surprising, this sort of highly visible large scale web app rollout failure seems like a topic HN would like.

Not sure why this one finally made it, heh.

<comment><USER4> Yeah, I've figured there'd be more here about it, but it's sort of like shooting fish in a barrel at this point. Plus... it will inevitably devolve in to politics. And lastly, it's not actually working yet. We don't have any postmortem about what's actually going wrong - maybe we'll get that soon (or never?)

</comment></comment></comment><comment><USER3> Sure, they could have been prevented. By spending more money. Isn't that always the answer?

Creating a website that can handle, well, nearly the entire country, out of the gate, is not trivial. (Facebook etc got to scale up to that level, they didn't need to do it out of the gate). But it also can be done.

How? Well, you hire real experts in doing this sort of thing. And you give them enough calendar time, and enough billable hours, to do it right. And you don't give them your own 'business requirements' which contradict their expertise on what's neccesary to make it work.

Obviously the government did not do one or more of those things, right?

(I will confess that my opinion is not high of the likely expertise level of typical IT government contracting firms.).

<comment><USER5> Your opinion shouldn't be high. There are talented IT people working at government contractors, but they aren't going to get put where they are needed, because the incentives for contractors are not performing the work at a top-notch level.

Gov't contracting is, in economic terms, a rent-seeking business. The best and brightest in a given contracting firm are dedicated to pursuing new work. I work for a contractor, and my fun IT projects are all proof of concept items. Stellar execution simply isn't rewarded. The gov't puts idiots in charge of things: not idiots in the sense that they aren't smart, but idiots in the sense that they have no expertise in anything. They are hired for paper qualifications (ever heard of a Project Management Professional cert? It's what they hire, and its useless), and the bright/motivated ones move on to interesting work, perhaps in other parts of the gov't, or the private sector. I built a great tool, using all open source technology for the gov't once. I built it in 3 weeks (it is now officially gov't owned software), and it replaced an $80K piece of software (commercial off the shelf) that was inadequate for the task. My reward was complaints that the security people weren't familiar with Postgres, and an immediate request to migrate to Oracle. There was no functional reason for this, but I complied after the gov't shelled out huge sums of money for Oracle license. Why? Because paper pushing idiots in the gov't are in charge of IT security, and their credentials for the job are based entirely on passing certification tests. Their entire incentivization at their job is to minimize their own workload, rather than maximize the happiness of their gov't customers.

Do you think anybody who could even guage whether proper testing was being performed or not was in charge of this project from the gov't level? Of course not. If they had, it would have been properly tested.

I'm mad as hell about this because I want the ACA to succeed. I don't think its ideal, but its vastly better than the existing system of hospitals as clinics for the uninsured hordes.

The Federal gov't has an awful hiring process, and until it is fixed, you are lucky to encounter competent and driven individuals within it. You are foolish to expect it.

<comment><USER6> _I 'm mad as hell about this because I want the ACA to succeed. I don't think its ideal, but its vastly better than the existing system of hospitals as clinics for the uninsured hordes._

I couldn't agree more. You only get one chance to make a first impression and they blew it. (sigh)

</comment></comment></comment><comment><USER7> [http://blog.netizencorp.com/2013/10/06/how-a-scrappy- startup...](http://blog.netizencorp.com/2013/10/06/how-a-scrappy-startup-in-a- dc-garage-revolutionized-healthcare-gov/)

"A scrappy little startup working out of a DC garage that completely influenced the course of how the web-facing portions of the Affordable Care Act were to be implemented"

<comment><USER8> STATIC site content. Not the part being hammered by people signing up. People keep confusing the two.

<comment><USER9> The plans should be static site content. You shouldn't have to initiate the sign-up process just to see what's available.

<comment><USER10> Seeing what's available without reliable information on your actual costs (including subsidies) doesn't accomplish much.

<comment><USER9> Premiums vary based on region, age, and smoking status. It's not so much information that you couldn't handle it with static pages.

Subsidy is based on income, and it's simple enough that NPR and others have already build subsidy calculators. Put that in javascript and you've still got static pages, running calculations client-side.

</comment></comment></comment></comment></comment><comment><USER11> I'm surprised the overall story of this implementation hasn't had more discussion on HN.

<comment><USER12> I think it would quickly decay into an unproductive, unpleasant political debate. I'm quite happy to not be seeing so much of it on here.

<comment><USER13> Weird. That never stops every other topic.

<comment><USER14> the difference is that there is a government shutdown involved, which is 100% pure politics, as opposed to topics like the NSA, which aren't necessarily politics, at least not obviously.

</comment></comment></comment></comment><comment><USER15> If anyone has seen my posts in the past, you'll know that I'm not a fan of the ACA, but disregarding that, let me be the first to say that this _probably_ isn't the fault (or, at least not solely the fault) of those building the web frontends.

In Maryland, our exchange website is poorly designed and written, just on the frontend (I obviously can't see the backend), but at the same time, all of the frontend issues could be fixed with a clever caching scheme.

Where the _real_ bottleneck almost certainly lies is when the system takes your user submitted data and has to post it into what is surely an old, legacy federal system so that it can verify your identity. That old legacy system may have seen upgrades in preparation for this, but probably not -- even so, there's simply no way to prepare for the onslaught of users accessing (indirectly) what was certain to have been an isolated, government-only database in the past.

<comment><USER16> > I obviously can't see the backend

You can't see what's running at the moment of course, but why shouldn't you expect to be able to see the source? Why are new government IT projects closed source?

<comment><USER15> Interesting you mention that. I saw this the other day, and was debating whether or not it was (at least the frontend of) the actual running site:

[https://github.com/CMSgov/healthcare.gov](https://github.com/CMSgov/healthcare.gov)

<comment><USER17> This is only the content site, not the marketplace. See: _" This project does not include any source code for the Federal Health Insurance Marketplace (the online systems located under www.healthcare.gov/marketplace."_

</comment></comment></comment></comment><comment><USER18> I'm surprised they don't have a separate system for their own staff to use when doing signups over the phone and in person. From all the articles it sounds like staff are going through the main healthcare.gov to attempt signups.

The biggest improvement they could make in the short term is setting up a light weight version so you can just enter the needed information to view your plans/options prior to the signup/verification process. Then once you've decided on a plan go into the signup process.

A lot of traffic is probably just people comparing prices, deductibles, etc putting unnecessary strain on the signup system.

It seems odd that you can't even view the log in page when you click log in on the home page.

Definitely looking forward to details about the site, backend, db, hosting, traffic, etc . . . once everything shakes out.

<comment><USER19> > _The biggest improvement they could make in the short term is setting up a > light weight version so you can just enter the needed information to view > your plans /options prior to the signup/verification process._

Washington's site did just that. Still blew up. For the first couple of days, just trying to get available plans didn't actually work.

There aren't that many websites out there that experience the kind of traffic levels the exchanges have. Those that do have mostly grown (if sometimes quite quickly) to those levels, not launched with them on day 1.

Competent people with prior experience scaling to these levels are (over-)employed with high compensation. They didn't work on these sites.

</comment></comment><comment><USER20> Setting aside the politics, I really don't think it could have been prevented.

The specs were not exactly realistic on number of users at a time. Heck, even Apple still gets slammed and they know its coming.

Plus, the experience just isn't in the DC contracting community. They can do websites, but not high availability transactional. If we were talking back- ends, then yes they have high transaction experience, but not with websites.

I will be expecting second (third?) day stories about bad data problems and failed transactions. This won't be a simple thing.

<comment><USER21> But isn't the DC contracting community involved in other high availability transactional systems? For example, isn't one of the ACH systems a government or pseduo-government system?

<comment><USER20> Oh yes they are, but not anything with a web-front end. They do really well with mainframe and back-end, just don't expect anything that has to touch a web stack.

</comment></comment></comment><comment><USER22> Regardless of any technological or architectural decisions, simple load testing before launch would have prevented this.

1\. Load test, discover issues. 2\. Fix issues. 3\. Repeat steps 1-2 until no more issues.

 _That_ is the flabbergasting part. Nobody actually tried applying real load to the system before release? It fell over so easily and quickly the only assumption is either no loadtesting was performed, the results were ignored, or massively incorrect load numbers were used (all of which are signs of incompetent mangement).

<comment><USER4> The official story right now is that they underestimated. Medicaid has had at max 30k users; they doubled the estimate for hc.gov, but instead of ~50k users they're seeing 250k. From what I'd read (in a story linked from this hn page) they did test for load, but nowhere near 200k users.

FWIW, I don't think the issues right now are load so much. I think there's some insanely bad logical pieces that are messing things up, and possibly have corrupted accounts that were created early on. I base this on a few things.

1\. The "username" requirements.

The username is case sensitive. Choose a username that is 6-74 characters long and must contain a lowercase or capital letter, a number, or one of these symbols _.@/-

Really? I know some systems use case-sensitive usernames, but given that you're already forcing some odd characters and whatnot in there, why not normalize to lowercase? This just feels like it's going to cause more support problems (mobile safari automatically uppercasing a username that should be lowercased, etc).

Also... the English description of that username is nowhere near intuitive. "A lowercase or capital letter". As opposed to what other kind of letter?

2\. Multiple accounts with a single email address.

I've been able to 'successfully' register multiple different username accounts with the same email address. When I do a password reset based on email (the couple times it worked) which username was I resetting the password for? I say 'successfully' because no login attempt has ever worked. And now trying to register yet another username with the same email address doesn't work, but the error message is so vague ("there was a problem" IIRC) that I can't tell if that was a factor or not.

OK... 2 things. That's about as far as I've been able to see in to the system so far, so that's all I can judge it on. But it seems that they've probably allowed some logical inconsistencies in my own signups that may be causing more problems now, and I don't think they are related to load.

Of course, I could be 100% wrong, but it doesn't feel like load is the culprit right now.

<comment><USER10> I immediately get an error page after logging and and trying to view plans. That could be load but it certainly feels like some kind of logical error to me.

<comment><USER4> Exactly. They've got the 'waiting room' technique to slow down apps/logins. The login process, once done, is quite fast in getting me to a blank page. ([https://www.healthcare.gov/marketplace/auth/userprofile](https://www.healthcare.gov/marketplace/auth/userprofile) page in question)

</comment></comment></comment></comment><comment><USER23> I've dealt with having to scale a site to millions of pageviews and honestly, if you've never had to deal with a traffic spike, you probably aren't going to build for the scale issues you will have.

For example, there is a lot of caching you just have to do. Tons of it. Cache as much as you can. Memcache and Varnish are your friends, use them as much as you can. Unfortunately, if Healthcare.gov was in a very write-heavy situation, they are somewhat limited in how much caching will help.

One thing they could have done that would have saved A TON of load is not require users to sign up before giving them a list of available plans. That whole part didn't need to be database driven at all. The data could have been stored in redis and they could have used javascript to filter it based on a form. That would have been ridiculously fast. They also could have prerendered all the plan list possibilities and stored those in varnish. That also would have been ridiculously fast. My guess is millions of people just wanted to check prices and eliminating the database load for those users would have probably kept things running fast and smooth.

Slow DB queries are the enemy and you don't realize how bad they are until you are at scale. Sure, it only takes a few seconds on your local machine, but multiply that times thousands of concurrent users and your DB gets swamped. If you are using an ORM, it is MUCH harder to track down where in your code that 3 way join that scans every record is happening. Ideally you'd be using straight SQL and maybe use comments to tag a query. Also tools like newrelic might help if only because many databases don't offer great visibility of performance data.

Sharding your database is something that is probably possible, and in the case of healthcare.gov, they probably could have had totally separate infrastructure on a per-state basis that would have made scaling a lot easier than putting everything on the same database. Also, put reporting and things that aren't mission critical on a slave database. The last thing you want is a reporting job bringing down the live site in the background.

Getting good hardware with fast IO is going to save a lot of developer time required to scale things. Using fast SSD's is probably the easiest win to speed up your database. Developer time costs a lot more than hardware and giving yourself cheap headroom up front gives you breathing room on launch.

Performance testing is also something worth doing, but the tricky part is until you roll out, it is hard to know exactly where the hotspots are going to be. In this case, new user signup would be the obvious place to test, so they probably should have tested up to the limits of their servers and tried to extrapolate an expected number of users and maybe increased that by 1.5x or something to have some leeway.

On a rollout where you don't know what you are getting into user wise, being on a cloud where you can scale out fast as demand requires is something worth doing. They could have saved a lot of bad press and headache by being on the cloud initially and migrating to less hardware after the initial peak died down.

There are a ton of little things like that you have to think about if you are dealing with massive scale. I don't know if the engineers building healthcare.gov had ever dealt with something like this before, but I'm sure they're learning these lessons now.

<comment><USER3> > if you've never had to deal with a traffic spike, you probably aren't going > to build for the scale issues you will have.

One question would be whether they hired people/firms who had had to deal with that level of scale before.

I'd assume not.

But apparently they hired someone who didn't even know enough to know that they were not qualified to do it.

<comment><USER24> One side effect of the complexity of government contracting processes (designed, in principle, to ensure that the government _doesn 't_ get taken advantage of by either internal or external actors) is that the people who get awarded government contracts are often the people with the most skill in negotiating the government contracting process, not the people with the most skill in the problem domain.

<comment><USER25> We know who built Healthcare.gov; it was Development Seed. There were a bunch of stories about it earlier this year. Development Seed also built and runs MapBox, so they should have some idea how to run a high volume web service.

<comment><USER26> And the front end built by Development Seed has had no problems. It's been the marketplace built by another contractor.

</comment></comment></comment></comment></comment><comment><AUTHOR> This post seems to have gotten buried very quickly (jumped from top 50 to #172 in a matter of minutes). Anyone have a reason why?</comment>


Chrome Remoting Is Live: It's A PC Remote Control - <AUTHOR> http://www.conceivablytech.com/9599/products/chrome-remoting-is-live-its-a-pc-remote-control

<comment><USER2> Googles obsession with running everything in the browser is getting ridiculous.</comment>


Why You Can't Work at Work (BigThink interview with @jasonfried)  - <AUTHOR> http://garrysub.posterous.com/why-you-cant-work-at-work-bigthink-interview <comment><USER2> Dupe.

<http://news.ycombinator.com/item?id=1227781></comment>


Easy way to build product tours with Bootstrap - <AUTHOR> http://sorich87.github.com/bootstrap-tour/index.html

<comment><USER3> I used this library to build the product tour for my app ( <http://www.thetaboard.com>). Was really easy to customize the color scheme and behavior--I think it took 2 hours to integrate it.

Adding a product tour really improved my "demo" to "sign up" conversion rate. Probably the single biggest conversion rate "win" I've had.

<comment><USER4> ThetaBoard looks like a Trello clone to me (caveat: Trello itself could be a clone of some other project).

<comment><USER3> Clone? No. Similar? Sure.

When Trello came out I had been working on ThetaBoard for a while. Both products draw heavily from some Kanban tools that have been around for years.

If Trello had been out earlier I might not have started my project. That being said, I'd argue that the UX/UI and aesthetics of the two apps are different. I'm going to be making some improvements this year that will differentiate a bit more. As long as people keep using it, I keep plugging away at it.

<comment><USER4> Hey I didn't mean any disrespect, I was just surprised by how similar it looks. I myself wondered what UI library they're using (if any). Anyway, I am using Trello (no reason in particular) for some projects, but I'll check ThetaBoard out. Good luck with it!

</comment></comment></comment></comment><comment><USER5> Also <https://github.com/jeff-optimizely/Guiders-JS> which I've had starred in Github for a while but not used

</comment><comment><USER6> I can imagine this being useful to explain how a "difficult" UI element works. It seems easy to set up, I like that.

The way it's used in this demo, though, I found it's very distracting from the actual content. All my attention went to the little popover, which resulted in not reading _any_ text on the page itself. I think this is partially because the popovers didn't point at anything directly.

</comment><comment><USER7> This looks useful, but I've got a suggestion from a cognitive ergonomics standpoint: smooth scrolling.

If a user clicks 'next' and the next step is not on the current screen, pretty much the best cue you can provide to build a contextual understanding of where this next step is on the page is easing into motion, then out of motion.

</comment><comment><USER8> How do you guys compare this solution with walkme or kera? Interested in your thoughts.

<http://www.walkme.com> <https://www.kera.io>

<comment><USER9> Kera's awesome; right now (at least, I got the email about this very recently) they're building presentations for you, for _free_ if you just make a little screencast of what you want. I don't have anything to use it with but it's the most streamlined/natural/intuitive experience I've seen yet.

<comment><USER8> That's so nice of you to say that! :)

</comment></comment></comment><comment><USER10> If you're building a product tour, consider making an animated GIF screencast to demo your use case.

Yesterday I wrote a tutorial on how to easily create one on OS X using just free tools: Quicktime Player, ffmpeg, and gifsicle.

<https://gist.github.com/4627207>

(Animated GIFs might also be useful for bug reports).

<comment><AUTHOR> For our company we experimented with using about a dozen animated GIFs - <USER2> found them to be a little hard to deal with. We replaced them with 2-3 short videos and were happier.

Now these product tours might be a good thing to add.

<comment><USER10> IMHO a 45-90 second video __done right __might the ideal medium for a product overview. But most are way longer, and suck, so I never click on them.

GIFs auto play, and so might be good medium to force a user to see a 7-15 second clip of how a feature works. Obviously you should ensure that only 1 is ever showed at a time.

I also find there's something hypnotic about a silently looping sped-up clip, though I don't know if this can be used to increase conversions. ;)

<comment><AUTHOR> Yeah, we did not like the autoplay part and the hypnotic effects.

</comment></comment></comment></comment><comment><USER11> It seems like the tooltips are pointing at nonrelevant locations. <http://screencast.com/t/oCGgYh9ytwMx>

Is this a flaw in the tool or this implementation? It doesn't seem to work well with different viewport sizes.

<comment><USER12> It's a flaw in the demo: that tooltip points to the h1 above which is 100% the page width even if there isn't much text there.

</comment></comment><comment><USER13> I found this tour a bit difficult to navigate. The tooltip moves to a different spot each time you click prev/next, making it hard to follow the whole tour. Perhaps navigation that stays in a fixed spot could make this easier to use.

</comment><comment><AUTHOR> There have been other tools that do this, but I like the simplicity and cleanliness of settings this one up.

I remember some of the other tools required a server access, which was great in that they allows us to do a lot of things, but as a potential user I needed to make sure that they have a business and would be around for when I needed it.

The problem that I have had with some of the jquery plugins that do similar is that I had to worry about customizing the plugins with my site's theme. With bootstrap plugins I hope that the plugins just look good with the bootstrap customizations that I have done.

</comment><comment><USER14> Very cool. I'm going try this out on a web app I'm currently developing (which happens to use Bootstrap). I would definitely prefer to implement popovers as opposed to a tutorial with lots of screenshots and whatnot.

</comment><comment><USER15> If people are interested, my product <http://overlay101.com> provides hosted product tours that requires far less Dev work than these js libraries.

</comment><comment><USER16> I love the idea and functionality, but I think the design could be clearer. I'm all for a simple, minimalistic style when it's meant to get out of the way. I find these popovers just too subtle. Jumping from one to the other, it doesn't catch my eye enough, and I have to actively search for the arrow. Maybe offer a theme that really pops, with some variation of the Yellow Fade Technique [<http://37signals.com/svn/archives/000558.php>]?

</comment><comment><USER17> Nicely done. Seems to be doing exactly the same as this one. Good for choice :).

<http://trentrichardson.com/Impromptu/> <https://github.com/trentrichardson/jQuery-Impromptu>

</comment><comment><USER18> The Foundation framework comes with a similar UI tour component. It does smooth scrolling when tour steps are off-screen and doesn't loose its position when resizing the window. <http://foundation.zurb.com/docs/joyride.php>

</comment><comment><USER19> Awesome tool. I remember seeing jquery plugins doing this. Would like to see a list of extensions like this.

</comment><comment><USER20> I always just rip through these things and then try to figure out how things work later. The trouble I've had with these is that it lacks context when I'm not actually trying to do the action it's calling for. I may not be the average user though.

</comment><comment><USER21> Please don't use this. Tooltip Tutorials are a user experience disaster. If you feel the urge to add this to your site - don't. Close your eyes and imagine Clippy. Breathe deeply and create a user interface that won't need this.

<comment> zupa-hu Please do use this. Tooltip tutorials are a user experience heaven. If you don't feel the urge to add this to your site - think again.

User interfaces are getting better - which means if your UI is good, it is different, thus it won't be intuitive to those who are trained to not expect it.

Often one has to choose to design a UI for the daily use vs. first a time usage. Better to put the clatter in the tooltips than to let them always be in your users way.

<comment><USER20> To be fair, isn't one of the things that sets apart a UI as "good" that it is, in fact, intuitive?

<comment><USER22> I agree. But sometimes, you just _can't_ make it easy enough for everybody. iPhoto for iPad is probably the nicest iPad app I've ever seen, and it has a tooltipy help system because it's humanely impossible to create something as powerful as iPhoto for iPad that's also _intuitive_.

Sometimes you need a gentle nudge in the right direction. Now, I personally dislike Metro very, very much. But the "charms" idea seems nice. How you tell the user (that's just started using Win8) how to activate a charm without a tooltip (or something similar)? Tell the user once (or twice), and only _after that_ it becomes intuitive.

</comment></comment></comment></comment><comment><USER23> lovely tool, i was about to subscribe to some tour generating app :)</comment>


Why do trolls go after feminists? - <AUTHOR> http://www.bbc.co.uk/news/blogs-trending-35009045 <comment><USER2> FWIW, trolls don't uniquely focus on feminists. Their emotional buttons are just so easy to find and push; when your advocacy === your emotional button, then you are broadcasting how to make you upset. If you are easily made upset, then you are self-primed for being trolled. So, if you don't like being trolled, then either hide your emotional buttons or change what happens when someone pushes those buttons.

The fact that feminists appear to be uniquely targeted by trolls is indeed the result of a societal structure, but it is not unique to feminists. Instead, feminists are just another set of humans who are louder when they get upset. People used to complain about so-called Soccer Moms being too easy to upset.

If you don't like the trolls, then don't feed them. I had thought that people had learned from the vi-vs-emacs flame wars how to avoid unproductive drama. Feminists spin their wheels by getting upset at trolls, just as vi users wasted their time getting mad when emacs users were not using vi.

<comment><USER3> Pretty much this 100%. It's not being a feminist or female specifically that makes you a target, it's being seen to respond poorly to attacks and trolling. If it's not feminists, then its furries, or otherkin, or bronies, or fanboys, or whoever else is seen as an easy target that responds poorly to criticism.

Ignore trolls, and they'll (eventually) ignore you. Keep responding and baiting them, and you're toast. Same thing goes if you run a community. Don't want trolls? Ban and move on. Don't turn it into a big dramatic deal and 'war on trolls'.

<comment><USER2> >Ban and move on.

This might have mixed results. Some trolls see getting banned as proof of successful trolling, whereupon trolling via another account might still be an option.

I think the users are the key to making trolls go away, because it is a social issue and not a mechanical issue. Put another way: you can't program away trolling, despite how fun XKCD's idea [0] might be to implement.

[0] [https://xkcd.com/810/](https://xkcd.com/810/)

</comment></comment></comment><comment><USER4> Article hits pretty close to the truth in that our societal structure is based around males being trained to be loud and space-demanding while females are trained to "deal with it"

<comment><USER5> I don't remember being "trained" to be loud and space-demanding? And I don't remember my wife being "trained" to deal with it.

Society is ever changing rubbery blob that's being melded into different shapes based on what people do, have done or will do.

You can't just go ahead and make large generalisations about men or women without any backlash, especially on the internet.

I'm sure if I made a comment saying all women should be/are xyz on twitter, I sure as hell would be trolled/attacked; it's what you as a person deals with it.

<comment><USER6> > I don't remember being "trained"

I see.

Do you remember being potty trained? Do you remember being trained on what things and behaviors are masculine and feminine? Because you were trained, and if you spend time around toddlers you can see them being trained on both.

You were also trained in the use of tens of thousands of words. Do you remember being trained on each one of them? I sure don't. Do you remember being trained on how to avoid collision on the sidewalk? On how to use a fork? On how to use your fingers to put things in your mouth?

Your memory of being trained on something isn't a good indicator of whether you were trained on it. A relatively small amount of what society trains people on is explicit, formal, and sufficient to cause episodic memory formation. Most of our learning is implicit.

> And I don't remember my wife being "trained"

Were you married when she was 2? Gender role training starts at least that early.

Regardless, if you look you can read plenty of actual stories from adult women on how they have been trained to deal with it, and how they're still being trained in that by being punished for breaking from it.

Clementine Ford has experienced exactly that kind of training, so if you wanted to learn something, you could start with her articles. Other good sources are Everyday Sexism, Project Unbreakable, or the autobiography of pretty much any pioneering woman. Madeleine Albright talks explicitly about this and how rising through the man's world of diplomacy forced her to cast off her training and adopt loud and space-demanding behaviors just to be heard.

<comment><USER7> I find this attitude pretty condescending. A broad gender statement like "boys are trained to be loud and space demanding" isn't honest in representing all boys.

<comment><USER6> > I find this attitude pretty condescending.

That's fair. When somebody leaps into a discussion without understanding the basics and acting in a way that is basically ignorant denial, I am ok with condescending to them.

The discussion of gender bias and gender equity is a rich and complicated subject. Here on HN, people are generally expected to know something before they open their mouths. I think my condescension here is about 1% of what somebody would get if they were ignorant about language design and still offering similarly bold opinions on languages that they've never used.

<comment><USER7> Can you really say that the parent comment lacks an understanding of the basics, or is somehow misinformed in their opinion? People aren't always going to agree with the things you say or the way that you choose to say them. That doesn't necessarily mean that they're wrong or ignorant.

<comment><USER8> Seeing "The discussion of gender bias and gender equity is a rich and complicated subject" statement with an attitude of "I know more than you despite me not possibly knowing anything of what you know of the topic" paints an interesting picture.

<comment><USER6> What I know of what he knows is what he said. In particular, the statement I addressed is one that no reasonable person would say if they had real knowledge of the topic.

If you can find some way to interpret him otherwise, I look forward to reading it.

<comment><USER8> That's the point, I'm not interpreting anything the person is saying. I'm commenting on you admitting the subject is complicated but you are somehow able to guess the knowledge of a person based on one statement you read on a website with little context.

<comment><USER6> Animal taxonomy is complicated, but if somebody says "bats are bugs" [1] it's fair to guess that they don't know much.

Try it yourself. Take any complicated domain that you know well. It's pretty easy to construct statements that make it clear that a speaker wouldn't know much.

[1] [http://www.gocomics.com/calvinandhobbes/1989/11/03](http://www.gocomics.com/calvinandhobbes/1989/11/03)

<comment><USER8> But, this game is easy. If I make ten statements about a particular topic, one of them is spectacularly wrong, the rest are spot on correct; by your logic I don't know much about the topic.

My point is, you are deciding something completely off little information and I'm only suggesting that your guess on this person is not as accurate as you may think it is. I do agree that there's a chance you are 100% correct on the matter, but I don't see how we can determine that.

[https://xkcd.com/386/](https://xkcd.com/386/)

Of course, I admit that cartoon may apply to myself in this context as well.

<comment><USER6> If that's your only point, then it's mostly not correct, and where it is correct is isn't interesting.

I'm not deciding anything irrevocably; if he had come back and started talking sense on the topic, I would have been happy to revise.

And yes, of course my picture based on a couple of paragraphs is incomplete. But that's true of any comment here. It's the commenter's job to make sure what they post is a reasonable representation of their views. Repliers reply to what was actually written, not the infinite penumbra of the possibility space of what could actually be going on.

Your standard of "100% correct" is a deeply weird one to apply to online discussion, especially since you clearly aren't applying it to your own comments. I may not know what martiuk knows, but you have no better idea of what I know. But here you are, sniping as if you do.

<comment><USER8> I'm glad you agree with me, although it is a strange "I'm not really wrong but you are because of claims you didn't make" way of doing it.

<comment><USER6> I'm glad you can parse "mostly not correct" as agreeing with you. That must really help minimize feelings of cognitive dissonance.

And yes, I'm critiquing what you implied because you initially weren't brave enough to say anything specific, just to raise a (false) contradiction and then call it "interesting" when you meant something other than interesting.

<comment><USER8> I'm glad you're glad, but now you're using big words and my lowly status as someone who doesn't understand complicated things as easily as you do is causing me to be confused.

You're critiquing, I'm critiquing, it's all good. Well, until you start arguing semantics over words I chose to use (and define them for me to boot), even though I was quite obvious in my initial statement, is clear evidence this is going nowhere.

Thanks, it has been enlightening.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Interesting that this question was asked in relation to GamerGate. When I researched _that_ , the major media was only reporting the feminists' side of things and the claims of abuse. It was _really hard_ to cut through the noise to figure out what the core dispute was. By the time I found a structured presentation of counterpoints...

[https://www.youtube.com/watch?v=GXZY6D2hFdo&app=desktop](https://www.youtube.com/watch?v=GXZY6D2hFdo&app=desktop)

...they suggested it was that a few women disrespected their market, trolled millions of people (including women gamers), made claims of abuse with feminist ideology, violated their own rules for money in design of their own games, and were possibly using the claims to get attention to their games. Never heard any of that in original reporting on major sites and that's why I was originally confused about why so much hate came their way.

Not saying this is true of anything referenced in the above article. Just telling readers to be aware that there's at least two trends going on:

1\. People, including & especially women, being harassed online with any number of bogus justifications covering up bullying. It's a larger problem & the justification (eg feminism) rarely is the real issue.

2\. A tiny portion of women, who may or may not represent most feminists, getting slammed online for using bullying and media manipulation to push their politics or products. I say media manipulation because I almost never see major media report calling it out even when it's obvious. Reporting is often one-sided, possibly due to risk of losing business if their image is seen as discriminating against women. I think one can argue against _specific women 's claims_ without hating on women in general.

So, we have two problems. One gets all the attention. Each time, the recipient of that abuse spins it as them being in a minority, having certain attributes, etc as evidence there's a large scale attack on those things. Reality is human nature is at work with any group competing with others and lack of accountability letting some be abusive. Certainly prejudices in there to combat but it really boils down to abusive people enabled by the Internet. Happens offline, too, as anyone who went to school, a bar, a football game... anything... should know.

Other problem we should watch out for and call out when we see it. That problem is not limited to feminist: any members of a group that can make itself look the underdog or target of abuse can use that as leverage in promoting politics or themselves. This happens across the board. Relevant to this thread, that many feminists do it certainly contributes to attacks on those individuals and might contribute to attacks on others posting similar idea. The troll throws them all in one mental category and attacks at the first sign of the same ideology in a new person.

So, that's my two cents on the problem.

<comment><USER3> GamerGate became what it did because the media grew utterly detached with their audience, and a couple of unfortunate events pushed it over the edge and broke the camel's back. You had a bunch of issues with poor journalism before (see, Doritosgate or something similar), a group that was more interested in pushing political beliefs that discussing games and a huge amount of resentment from the audience.

The fact the media covers this sort of stuff in such a biased and often hateful way is symbolic of a press that's become a clique and doesn't represent the population at large.

<comment><USER9> Great points. I agree.</comment></comment></comment>