How MySQL memory table saved the day - <AUTHOR> http://www.domcop.com/blog/how-mysql-memory-table-saved-the-day/?rid=hn <comment><USER3> 8 million records (at 7GB!) and it's slow means there is something seriously wrong with your schema. That table would entirely fit in InnoDB Buffer Pool on any modern hardware.

I want to see your slow query log.

<comment><AUTHOR> The domains table currently has 84 fields. We collect metrics from various sources, so reducing the number of fields is not feasible. All the field types are the smallest that we could use - e.g. tinyint(4) instead of an int etc.

Since there are so many fields with data from multiple sources, we have queries running searching on individual fields. Due to this we need to have many indexes. 4GB of the 8GB is the size of the index itself.

<comment><USER4> _The domains table currently has 84 fields._

Are you sure you've read up on your C. J. Date? I've had that once before: someone complaining that "queries take too much time" with a paltry single- digit-GB database. When I asked about the specifics, the only repeating reply was "we can't tell you". You don't mention anything of value, but querying a few million records can't possibly take a few minutes on the aging desktop computer I've bought seven years ago, much less on a modern server.

<comment><AUTHOR> I presume the reason it was slow was because the domains table was write heavy. There are multiple crons running in the background selecting data from the domains table, accessing external APIs and updating individual records.

Selects per hour: 37K Updates per hour: 170K

While the speed of selects or updates by the background crons was and is not important, the speed of selects run by the users on the same table was important. The easy solution was to cache the data so that the users could search domains at a good speed. The memory table just worked brilliantly as a cache.

(I'm no mysql guru and its my first project where MyIsam did not work for me, so I know I definitely could do a better job of optimizing the Innodb table and Innodb settings in my.cnf)

<comment><USER3> You claim not a MySQL guru, but are shooting down the majority opinion here that something major is wrong with the schema design. That's fine - use your in-memory table and then claim you need a NoSQL solution when your "big data" hits 10GB.

How's the disk io on that linode VPS?

<comment><AUTHOR> My apologies if I came across as if I was shooting down the opinions here.

</comment></comment></comment></comment></comment></comment><comment><USER5> Just a heads up: [http://dev.mysql.com/doc/refman/5.1/en/memory-storage- engine...](http://dev.mysql.com/doc/refman/5.1/en/memory-storage-engine.html)

The MEMORY storage engine (formerly known as HEAP) creates special-purpose tables with contents that are stored in memory. Because the data is vulnerable to crashes, hardware issues, or power outages, only use these tables as temporary work areas or read-only caches for data pulled from other tables.

</comment><comment><USER6> Or you could actually use something designed for indexing data and searches, like Elasticsearch or Solr.

Either solution would have no problem indexing all their data, rather than having to limit it to a subset to fit in a in-memory table.

<comment><USER7> Does Elasticsearch or Solr work with tabular data, can you search across multiple columns?

<comment><USER8> Lucene models documents as a collection of fields, each with a textual value.

[http://lucene.apache.org/core/4_0_0/core/org/apache/lucene/d...](http://lucene.apache.org/core/4_0_0/core/org/apache/lucene/document/Document.html)

At search time you can use the default field or specify the fields to be searched:

[http://lucene.apache.org/core/2_9_4/queryparsersyntax.html#F...](http://lucene.apache.org/core/2_9_4/queryparsersyntax.html#Fields)

</comment></comment></comment><comment><USER9> A better solution, is just to increase your innodb buffer size, you will get virtually same performance as the 'memory' table once all the data is in memory. Plus all the data will be persisted.

This is an old, but still very useful script for helping to suggest what settings to tweak: [https://github.com/major/MySQLTuner- perl](https://github.com/major/MySQLTuner-perl)

[http://dev.mysql.com/doc/refman/5.5/en/innodb-buffer- pool.ht...](http://dev.mysql.com/doc/refman/5.5/en/innodb-buffer-pool.html)

<comment><AUTHOR> Thanks for the link. Unfortunately, since there are 30 different columns that can be searched on, there are many indexes and the index size for the domains table itself is 4GB. I run this off a 2GB linode, so unless I add a lot more RAM, Innodb is not going to match the memory table speed.

<comment><USER10> I'm a little confused... the InnoDB table and memory table had the same data, but the InnoDB table was larger (at least twice as large, I presume)?

<comment><AUTHOR> The Innodb table right now has about 9 million records and is 8GB in size (4GB index size). The memory table has a subset of the same data - 1.2 million records and is 276MB in size.

<comment><USER10> It makes me curious what an apples-to-apples comparison would look like. What it you put the same subset in a separate innodb table and tune the memory settings so it's likely to stay resident?

<comment><AUTHOR> We had tried this before switching to the memory table. I cannot remember exact details, but the resulting innodb table was still too large - <USER2> around 1 GB and we did not want to add additional RAM.

Another issue with using a second Innodb table would be the load time. Every 3 hours we empty the memory table and load the subset from the innodb table (we actually use an MyIsam table in the middle.. but that's not important). Loading the table takes less than 10 seconds. If we had used an innodb table instead of a memory table, this load time would be significant.

</comment></comment></comment></comment></comment></comment><comment><USER11> I am always cautious of memory tables. They don't support transactions, for example, and don't work well multi user.

Really, the first stop is to use tokudb backend in mysql. If its still slow, and if you have a small subset that fits in ram, just put that straight into a hash table in app space.

<comment><USER12> As I understood it, the memory tables are read-only. They're like a cache. So transactions aren't needed.

<comment><USER11> Except for that awkward time when the tables are refreshed?

<comment><USER13> Could use two memory DBs and rotate them

</comment></comment></comment></comment><comment><USER14> We did something similar at work. We had to poll for changes in a table. So instead of polling the tables we added triggers to insert events to a MEMORY table and polled that table. It performs good enough for us.

</comment><comment><USER15> > Varchars take up the space for all the chars defined.

This only applies to memory tables. For non-memory tables, the size of varchar columns depends on the actual string size.

(edited. Thanks for correcting!)

<comment><AUTHOR> "MEMORY tables use a fixed-length row-storage format. Variable-length types such as VARCHAR are stored using a fixed length."

From - [http://dev.mysql.com/doc/refman/5.0/en/memory-storage- engine...](http://dev.mysql.com/doc/refman/5.0/en/memory-storage-engine.html)

I had no idea about this either....

</comment></comment><comment><USER16> What are some typical queries look like? Several minutes for searching 7M records doesn't sound right. Are the columns indexed properly?

<comment><USER12> I'm thinking that this could be a fairly easy problem and the RDBMS may be making it harder. This is probably a tricky indexing situation, so a lot of queries might be effectively unindexed. I'd like to see what the performance would be using really simple methods, like dumping it to a TSV file and doing regex searches with grep or awk. It might be surprisingly fast.

</comment></comment><comment><USER17> Haha. The Jon Snow meme got me in splits.

<comment><USER18> You're getting downvoted because this is not Reddit. Not that we dislike memes, we just like them on Reddit, and off HN.</comment></comment>


Some Foreign Telcos Reportedly Defied NSA Phone Spying Order - <AUTHOR> http://techcrunch.com/2013/06/14/some-foreign-telcos-reportedly-defied-nsa-phone-spying-order/

<comment><USER2> Great example why never to link to a techcrunch regurgitation of some story originally reported elsewhere.

[http://online.wsj.com/article_email/SB1000142412788732404950...](http://online.wsj.com/article_email/SB10001424127887324049504578543800240266368-lMyQjAxMTAzMDEwMzExNDMyWj.html)

The TC version fails basic reading comprehension. The US subsidiaries of the Telcos in question did not _defy_ NSA/FISA court orders - according to WSJ's reporting, their foreign ownership made it difficult for them to participate due to existing legal restrictions external to the companies themselves. Key WSJ paragraph:

 _Legal, practical and political obstacles are all possible reasons why the two firms are excluded from the NSA program. But current and former U.S. officials say the likely reasons are tied to their overseas ownership. Government requests for data, through special court orders sanctioned by the Foreign Intelligence Surveillance Act, are classified "top secret" and "noforn," spy-talk for "no foreign." That would prohibit some T-Mobile and Verizon owners from being aware of the programs._

<comment> enoch-root I'm suddenly reminded of Apple Ireland, the largest owner of Apple's non-US assets, and how Apple, last of the PRISM 9, was made to testify before Congress for tax avoidance.

It's probably just a coincidence.

<comment><USER3> This is the real method by which Team Government encourages compliance. It'd be a real shame to see that tax loophole that you rely on closed. Nice company you got there. Would be real upsetting if your new corporate headquarters construction were to be held up waiting for a permit.

Mobsters in worse suits.

</comment></comment></comment><comment><USER4> Maybe this is true, but T-Mobile USA does outsourced billing via AMDOCS so 100% of call metadata is leaked anyway.

<comment><USER5> I don't see tower/location info on my (VZW) cell bill... so maybe not all call metadata that the leaked Verizon Business warrant sucked up.

<comment><USER4> Possibly. I wouldn't count on it.</comment></comment></comment>


What happens after Yahoo acquires you - <AUTHOR> http://37signals.com/svn/posts/2777-what-happens-after-yahoo-acquires-you <comment><USER2> I once witnessed the moment when the messenger from the new management team comes over to explain to the brilliant engineers who built the company up from nothing about these "timesheets" they need to fill in, and how it's "really not a big deal". You could feel something dying over the course of the conversation. It was one of the most uncomfortable things I've ever seen, and I'm sure it's far worse if you are one of the original engineers.

Is it something every acquired company has to go through? Is there a right way to do this?

<comment><USER3> _Is there a right way to do this?_

Yes.

a. Make it a fully owned subsidiary.

b. Don't fuck with it.

<comment><USER4> Do you have some examples of where that has worked in the medium - long term? (i.e longer than the 2-3 year mark most of these founders have bailed out at)

I am guessing it can work but founders/entrepreneurs aren't necessarily the best managers and are likely to get bored and be looking for their next startup. As a new owner of a company it seems to make sense to transition the senior management to people who are more suited to managing and running a company rather than those who like building a company.

This goes two fold for those companies who have primarily technical founders who are _almost_ always unsuited for the roles in senior management.

<comment><USER5> Sure: IMDB, Audible, and Zappos.

Also, the issue isn't that the founders leave; it's that the energy does. Founders are always going to leave.

<comment><USER4> But isn't that the issue? The energy tends to come from the founders so how do you reliably transition away from the founders, whether it is without full company integration or not?

<comment><USER6> Regardless of whether you get acquired or not, if you build a company that won't persist without your individual presence, the process is still incomplete. (And what you really have is a vehicle for your individual talent.) Any company that's supposed to last more than a few years must be build so that it can handle key people leaving, because that's what people always do in the long term, one way or the other.

<comment><USER7> This reminds me of some quoted wisdom I heard back in the 80's about management styles and Star Trek: the difference between Picard and Kirk is that when Picard was away or taken over by an alien or what have you, the bridge crew could cope with the situation, while Kirk's absence meant that the Enterprise was utterly helpless.

If your team can't fight Romulans when you're down on the planet, you've failed as a manager, was the moral of the story.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> There are 2 companies which Yahoo! acquired:

1) Overture. If you look at the financial reports, nearly 50% of Yahoo's revenue is from search. They acquired Overture for ~1B

2) They acquired RocketMail (essentially Yahoo! mail). Most people I know, when they think of Yahoo, they think of Yahoo! mail.

So, while its easy to say they messed up many acquisitions (esp the infamous 3B offer for Broadcast.com), the 2 acquisitions they made is what keeps them "in the game" today. You win some acquisitions, you lose some. Just like investing, if you make few smart ones, it can easily pay off and create more value than the money spent on many failed ones. Same with Google - Youtube was handled very well, but many acquisitions are essentially just shut down or never integrated into other products(Dodgeball,Jaiku etc)

<comment> contol-m Actually Broadcast.com was a 5.7B deal, believe it or not.

</comment></comment><comment><USER9> Hmm, for some reason they forgot to include:

 _You sell your company for $50 million in Yahoo stock, which over the course of your two year tenure at Yahoo will see a tenfold increase in value up to $500 million and your team will use that wealth to go on to create a disruptive seed-stage funding group called Y Combinator._

Must have been an oversight. I can't imagine 37signals only telling half of these stories to make it better fit with their mantras.

<comment><USER10> Wow, did their stock actually 10x between when they got there and when they sold it?

<comment><USER9> I have no idea when the YC founders actually sold their Yahoo stock, but when Viaweb was bought, in an all stock deal, at the beginning of June 1998, YHOO was trading at $7/share. Two years later, around the time they left, it was at $70/share. I presume that both since the stock was skyrocketing and that because they had a vesting schedule that they still had a chunk of it when it hit that price.

[http://finance.yahoo.com/echarts?s=YHOO+Interactive#chart1:s...](http://finance.yahoo.com/echarts?s=YHOO+Interactive#chart1:symbol=yhoo;range=19960411,20110222;indicator=volume;charttype=line;crosshair=on;ohlcvalues=0;logscale=on)

</comment></comment></comment><comment><USER11> This article is mistitled. It should read 'What happens after _anyone_ acquires you'.

These anecdotes will sound familiar to many people who have been through an acquisition. Acquisitions are not something any company is naturally good at, and they inherently threaten the bureaucracy of the acquirer. Despite good intentions, the corporate immune system usually kills off the interloper before it becomes established. Not to mention that the founders and best employees usually bail within a couple of years.

<comment><USER12> Perhaps 'anyone but Cisco'. There is a company that has more successfully than most integrated a number of companies into its structucture. Perhaps the most amazing (for me at least) is Linksys, which I predicted would result in an epic failure and yet their market share, and competitiveness has recovered after the post acquisition noise.

I'd love to hear a Cisco Exec's opinion on their secret.

<comment><USER13> I used to work for Cisco at Linksys and this is far from truth. Although Linksys operated pretty much as their own division, Cisco EOLed a lot of successful Linksys products in the SMB market since they might compete with Cisco's. Also, Linksys had and still has a stronger brand presence among consumers which Cisco resented a bit. This led to a rather long brand transition that made things pretty difficult at Linksys' end. Lastly when Linksys needed the deep pockets of Cisco for breaking into new consumer product markets, Cisco was always hesitant despite successful market research and product development on Linksys' end.

Relatively, it's been better than most acquisitions but things are definitely not that rosy.

<comment><USER11> Interesting to hear from an insider. Cisco is very good at getting the media to write about how skilled they are with acquisitions. Do you think it's more marketing than reality?

<comment><USER13> Sad to say but they are better than most when it comes to acquisitions. I think that's more due to the fact that their acquisitions are usually strategically related to what they want to do.

The big exception has been Flip. Although they are a great company, their limelight was too short for a company like Cisco to get recurring growth over a long period with this push into the consumer space.

</comment></comment></comment></comment></comment><comment><USER14> I can't speak to the examples from 2005 or 2007 (or any others really), but I was part of the Associated Content acquisition process and am an engineer with Yahoo now.

For our group it has been a good thing and we are happy where we are. Our group's culture is the same, we are engaged in the larger company strategy, and are excited about the upcoming year. We have had a couple integration points take longer than expected but that's what happens when you go from 50 people to a company of thousands.

YMMV I guess.

</comment><comment><USER15> When Delicious was acquired, we desperately needed inverted indexes, which yahoo (eventually, slowly, painfully) did actually provide.

I do find the "there's no business model" talk in the comments pretty annoying. Of course we had one.

</comment><comment><USER16> So why does Yahoo buy these properties? While I'm sure we'd all like to think the decision makers at Yahoo since day 1 were all idiots who like to spend millions of dollars on companies and then let them die, but is there actually a rational reason?

Were they trying to keep them out of the hands of Google? Did they do it purely for the eyeballs and thought with no additional spending they'd get their money back out of the property in X months?

I just find it hard to believe they'd do the same thing over and over again for no reason, but to lose money.

<comment><USER17> The article ignores the stories that turn out differently. For example, I noticed whereonearth in the list of acquisitions. I happen to know that their technology was nearly immediately used to start making money for Yahoo (because I integrated it into parts of the ad serving systems). It also was probably behind the "platform technology that enabled things like geolocation open API" that Upcoming enjoyed.

The time cutoff also leaves out the Overture, Inktomi, Altavista trio which made a ton of money for Yahoo, let them build a search engine on par with Google, and fueled significant growth of the company.

Finally, the article also ignores the fact than many, many internally developed products (of any internet company) have a lifespan of under 5 years.

<comment><USER18> I am quoted in this article and I totally agree with you.

It has to do with the nature of the acquisition. As you say, WhereOnEarth was killer technology, easy to integrate into everything that Yahoo did.

The "Class of 2005" startups that Yahoo acquired were not about technology, they were about having a different relationship with the users and creating common resources (photo library, tagged URLs, event information...).

That's a much more problematic kind of innovation for a company like Yahoo. It was alien to how Yahoo worked, and for many groups it was even a kind of threat.

</comment></comment></comment><comment><USER19> The founders get to cash out is what I'm seeing. That's pretty nice, and may allow some of them to go on to better things.

For instance, I think YC is far cooler than Viaweb.

</comment><comment><AUTHOR> At the risk of preaching to the choir, here's some more input from another Yahoo acquiree - pg on 'What Happened to Yahoo' (Aug '10) <http://www.paulgraham.com/yahoo.html>

<comment><USER14> Sigh.

I work for Yahoo, after 6 years of ('failed') startup work. I respect YC and pg immensely.

However, linking to this article that is written in 2010 that references the mid-1990s (except for a single mention of Facebook in 2007) seems a bit weak.

It doesn't bother me that HN folks dismiss Yahoo as a company, so much as it does that HN folks ignore Yahoo engineering. Hadoop, WOEID, Pipes, etc.

For me as an engineer that has worked for a few startups and companies that hoped to be acquired, working for Yahoo is great because we are exposed to a lot of engineering work that is optimized for large scale. I'm sure Google and others are doing a great job of this as well, but why is it an either/or situation?

<comment><USER20> I don't think anyone who would care ignores Hadoop. It and Yahoo's involvement with it are very well known and credited.

WOEID seems pretty niche. I don't work with geo much, so I don't understand right away why I would want to use a WOEID over a simple lat/long. Who else uses WOEIDs, for instance?

Pipes would be approximately a billion times more interesting if it didn't have the commercial use restrictions and had a version I could get some kind of SLA for. If Yahoo is so proud of Pipes, why won't you let people build businesses on it? And why did you only post 2 blog updates about it in 2010?

</comment></comment></comment><comment><USER21> So what I'm getting out of this is that if your passionate about your company and its doing well, think twice before you decide to get bought out because its possible that life might not be better/greener for your company once your assimilated.

Reminds me of Brew Masters when the owner of Dogfish Head, Sam Calagione, mentioned that he had an offer to sell off his company for a nice amount but in the end he would still obsess about the fate of his company, and the name he built up for it, that it wasnt worth selling.

</comment><comment><USER22> So what do we do? Obviously this sucks, but how do we build a company and get investors liquidity without Sarbanes-Oxley-riddled IPOs or Yahoo-level- incompetent acquisitions?

Do we just keep being regular companies? Is there an alternative? How do we build things that matter (and require outside investment) and end in real change instead of just getting rich?

<comment><USER23> Apparently the very creative people at Goldman Sachs have some ideas.

</comment></comment><comment><USER24> I'm surprised this is a common scenario. I would think, due to the pervasiveness of the sunk-cost fallacy, that companies would stand behind their aquisitions to a fault even--just cause they spent so much money on them.

<comment><USER25> A buyer might think they're buying your users, or your technology. In either case, the possibility that these things can become devalued if not further invested in might (wrongly) never enter the thinking. If you don't change anything, how could the value of a user or a technology depreciate? (This is obviously wrong, I'm just trying to paint a possible line of reasoning.)

</comment></comment><comment><USER26> An awful lot of acquisitions end up this way, though. Consider the firms acquired by Amazon or Google or Microsoft. People remember IMDB and Alexa; Android and Youtube; Hotmail and Bungie... past that not so much.

</comment><comment><USER27> The article missed a pretty significant counterpoint, which I'm surprised wasn't mentioned here so far: Viaweb. As Yahoo Stores, it went to become a de- facto leader in online stores, which it's still is to this day.

</comment><comment><USER28> I think, once you're in the VC system, you have to compare an acquisition to what happens if you go through more funding rounds and lose control over your company that way. Many of the same symptoms.

</comment><comment><USER29> I've just joined Flickr but I'm finding it awkward in some places, and the 'community' (at least that of extension/tool developers) seems to have died in 2008 or so. The upload tools are atrocious, no reliable way to download stuff for backups, the UI is unpolished and doesn't seem to get updated much.

So, where do I go for online photo hosting / backup? Picasa / Web Albums isn't better, plus it's very desktop focused. Are there any modern offerings that can step into Flickr's shoes?

<comment><USER30> I use Shotwell to upload to Flickr and Picasa. So far, I am very happy with it.

It also keeps my photos happily organized.

</comment></comment><comment><USER25> It's all true, and Yahoo is probably one of the _better_ companies that could acquire you.

</comment><comment><USER31> It kinda makes you long for the days where the exit was a speculative IPO. At least some of the resources went to founders that way and they often retained a sizable chunk of equity (i.e. control of the product).

Related (Why Ten Million Dollar IPOs Matter): [http://www.urgentspeed.com/applied_disruption/2010/04/why- te...](http://www.urgentspeed.com/applied_disruption/2010/04/why-ten-million- dollar-ipos-matter.html)

</comment><comment><USER12> They forgot MusicMatch in 2007, there was a company that was on track to be iTunes became, except it ended up not going there.

</comment><comment><USER32> I think google has done a much better job of targeting services they know they can integrate into their core. Yahoo has really just had a bunch of different silos operating (for the most part) on their own.

When the founders lose their ability to control the product and their economic incentives, then they're really fked.

Facebook has integrated their acquisitions' technology in some cases, but it seems they're mostly in it for talent acquisitions. They've done a good job so far in retaining (they're still pre-IPO) but we'll see what happens when they get old and some new hotness appears at school (might take 10 yrs)

Scorecards:

[http://en.wikipedia.org/wiki/List_of_Yahoo!-owned_sites_and_...](http://en.wikipedia.org/wiki/List_of_Yahoo!-owned_sites_and_services)

<http://en.wikipedia.org/wiki/List_of_acquisitions_by_Google>

</comment><comment><USER33> If you're an employee it sucks.

If you're the initial owner you'll be happy to let Yahoo buy your product for multi-millions of dollars, and you'll be even happier to leave the company as quick as possible to start up your next app.

Its a pattern: sell, get out ASAP, start next project, (allude to what could have been).

</comment><comment><USER34> New companies get acquired. Old philosophies stay the same.

"But today it seems like the old is doing the plowing. Let's stop that. Let's build great companies that are here to fight, here to win, and here to stay until the next generation after us comes along and kicks all our asses. And again and again and again. That's how better happens."

[http://37signals.com/svn/posts/1927-the-next-generation- bend...](http://37signals.com/svn/posts/1927-the-next-generation-bends-over)

That quote is from nearly two years ago, but it's just as relevant today.

</comment><comment><USER35> You know what this whole article sounds exactly like to me? This sounds exactly like the major label record system of yore. Replace the instances of "internal executive champion" with "A&R guy" and "web service" with "band".

God knows how many absolutely awesome bands were signed to major labels over the decades by A&R that "got it" only to be left high and dry when that person was fired or moved somewhere else internally. Very little new under the sun, I suppose.

Great read.

</comment><comment><USER36> But Yahoo acquired these commpanies for cheap rate. I think other than flickr none of them had good model. Upcoming was aquired for only 1M? If it doesn't match the expectation, Yahoo will definitly won't sink millions more in it! Google aquired Youtube for more than 1.5 billion dollars so they paid attention. Someone should also research in to Google or Microsoft's small aquisitions.

</comment><comment><USER37> This is a very thorough analysis by 37signals. I wonder if they are being vetted by Yahoo, and decided to do some due diligence on the fate of prior acquisitions?

</comment><comment><USER38> Denial, Anger, Bargaining, Depression, Acceptance.

</comment><comment><USER39> You seriously weigh up how much the earn out is _really_ worth to you.

</comment><comment><USER40> Ouch. That's a pretty damning list Matt compiled.

</comment><comment><USER41> summary: hear about goose laying golden eggs; buy that goose; then kill it, forget about it or let it starve to death

</comment><comment><USER42> Do you start a startup incubator?</comment>


"Who cares if Erlang starts slowly?  It was designed to start once and never stop." - <AUTHOR> http://yarivsblog.com/articles/2007/11/17/erlang-quote-of-the-day/

<comment><USER2> Another interesting quote from the same message: "repeat after me: client = flash in the browser, server = erlang. Intermediate protocol = flash AMF"

Now that's opinionated software.

</comment><comment><USER3> I guess if you wanted to be snippy, you could say that Erlang isn't good at doing something it wasn't specifically designed for, which isn't a great feature for a language.

I actually like Erlang, and have used it professionally, but have a feeling that it's just not going to be a language that's used too much outside of its sweet spot.

<comment><AUTHOR> _you could say that Erlang isn't good at doing something it wasn't specifically designed for, which isn't a great feature for a language_

To be fair, slowness of startup time would be a criticism of the stock Erlang runtime, rather than of the language itself. As projects like Squeak, Rubinius, and the official Java VM have shown, this sort of speed issue can improve independently of the language semantics.

<comment><USER3> In the real world though, the current Erlang runtime is all we've got, so it's fair to talk about Erlang's startup time being slow.

The runtime has a lot of really good features, too - it's solid, pretty fast, and is very well tested.

</comment></comment></comment><comment><USER4> _"Dear Erlang I: X I like you. Really, I do. But until you can read lines of text out of a file and do basic pattern-matching against them acceptably fast (which most people would say is faster than Ruby), you're stuck in a niche; you're a thought experiment and a consciousness-raiser and an engineering showpiece, but you're not a general-purpose tool. Sorry."_

<http://www.tbray.org/ongoing/When/200x/2007/09/22/Erlang>

<comment><USER5> Erlang ended up outperforming Ruby by many orders of magnitude in the same benchmark. Read the final article.

<comment><USER4> By "many", do you mean, "one"?</comment></comment></comment>


Show HN: CurlHub, API Traffic Inspector - <AUTHOR> https://curlhub.io/ <comment><USER2> Not sure how this works exactly. The FAQ page mentions a proxy server. Do I have to route all API responses through the proxy server?

<comment><AUTHOR> You route all API requests through the proxy server.

So, say your API is `api.company.com`.

Instead of sending requests to `api.company.com`, you send them to `api- company-com-<BUCKET_NAME>.curlhub.io`.

That's all you have to do. CurlHub will proxy your request to `api.company.com` for you.

As long as your api server is public, and there is a configuration option to change the base domain of the API, it makes it super easy to inspect API requests.

</comment></comment><comment><USER3> Really clean, I can see this being super helpful for teams that work on microservices and need to debug or share examples.

</comment><comment><AUTHOR> I created CurlHub as a replacement for the original Runscope traffic inspector, which I loved, but is no longer available.

The biggest difference between the CurlHub and Runscope traffic inspectors, is that CurlHub saves the requests to your browser's localstorage, where Runscope saved them in one of their databases.

This means for CurlHub to log your requests, your browser has to be open.

The decision was made to use localstorage, due to GDPR. Storing random API response data, was not something I wanted to deal with.</comment>


Microsoft's Ballmer On Google Chrome OS: 'Who Knows What This Thing Is?' - <AUTHOR> http://paidcontent.org/article/419-microsofts-microsofts-ballmer-on-google-chrome-os-who-knows-what-this-t/ <comment><USER2> > the way IE works in totality with Windows

just doesn't get it / care</comment>


Ask HN: Seeking Investor or Cofounder? - <AUTHOR> Pitch it here... <comment><USER2> A crypto currency exchange where the coins remain on the customers device and the coins can be instantly withdrawn from the exchange with 0 fees and 0 confirmation wait times. Email me at my username @ yahoo . com if your interested.

</comment><comment><AUTHOR> AI startup. Train a bunch of people how to do stats and ML, then get acquired.</comment>


Ask HN: What are your favourite tools to work with? - <AUTHOR> Out of interest, what are your favourite tools to work with (on your server/desktop/phone etc...)? What do you use daily and what other tools come in handy for you from time to time. What could you not imagine living without?<p>And of course, always interesting to hear if there are any tools out there that you are looking for, but haven't found anything that fully fits your needs. <comment><USER2> I like pencil (or pen) and paper. Self-contained, portable, and broadly applicable to a variety of different problems.

<comment><USER3> Seconded, what you sacrifice in scalability, you gain in platform independence, 100% uptime, and low hardware failure rates.

<comment><USER4> How's their Canine Disaster Recovery policy now? It used to be _awful_ back in the day.

<comment><USER3> Yep elevated hardware is best practice solution for this issue. Also it has a known Feline attraction quality causing possible downtime due to sleeping cats.

</comment></comment></comment></comment><comment><USER5> Lenovo Thinkpad X1(1st gen) running ubuntu - my god this laptop is gorgeous. Best purchase I've ever made.

Emacs with org-mode for all the writing, notes, organizing information. I absolutely love this editor, makes you 100 times more productive, and also very fun to learn and use.

i3wm - brilliant window manager, after using it for a while it's hard to imagine using anything else.

draw.io - cool tool for drawing diagrams and organizing information. Helps me to think.

pelican - python markdown static website generator. I was looling for a perfect blogging tool for a long time and this is it.

iPad mini with only 4 apps installed:

\- Editorial - insanely good text editor. Supports markdown, python scripting with all kinds of extremely convenient automation, looks gorgeous. It blew my mind when I first installed it, after taking most of my notes on android I had no idea a text editor on a tablet can be that freakin good.

\- iThought - great mindmapping tool, for thinking and coming up with ideas.

\- Track & Share - super convenient habit tracking tool.

\- iBooks

Basically I don't use an iPad for anything but writiing, reading and thinking. Don't even use a browser, and it is mostly offline. Perfect distraction-free tool.

Also old second-hand Nexus 7 I bought very cheaply, for watching tv shows, youtube videos, and browsing HN/reddit. It is very helpful to have a device for all the time-wasting activities. Every time I want to do something dumb I use nexus, that way it's not hard to avoid doing pointless things on my Laptop/iPad, which makes them into perfect devices for focus and productivity, and it is always clear whether I'm doing something useful or screwing around.

</comment><comment><USER6> i3 Window Manager. I wish Apple would design a WM inspired by i3 but with the amount of polish they usually apply.

</comment><comment><USER7> Desktop:

-OSX (gestures and spaces work well, with a few niggles like OSX not showing the window when tabbing to a minimised window)

-TotalFinder (OSX finder enhancement, the visor lets you get a finder window with alt+`)

-TotalTerminal (OSX quake-style dropdown console terminal)

-Alfred (OSX fast-spotlight replacement with plugins)

Dev: -Gulp - great for frontend build once you know how everything works

</comment><comment><USER8> I always prototype stuff on paper with a pen; best way to use your entire desk(top) ;)

</comment><comment><USER9> Mitsubishi Uni-Ball pens

</comment><comment><USER10> My main toolbox is: Spotify, Intellij, Chrome, notepad and pen.

</comment><comment><USER11> IntelliJ.

The bash shell and the Unix command-line tools.

As others have said, pencil and paper.

</comment><comment><USER12> osx, vim, alfred, git, and vagrant pretty much do it for me. Pretty much all of those things run well on Linux, though, so I'm considering switching.

</comment><comment><USER13> vim

<comment><USER14> vim + tmux

</comment></comment><comment><USER15> notebook + pen, ssh, bash, Perl, Vim, IntelliJ, Eclipse, Firebug.

</comment><comment><USER16> c9.io

Can not imagine living without Spotify : )

<comment><USER12> You're the first person that I've ever heard of using a cloud dev environment for real work. Can you talk more about your experience and why/how you ended up with that solution?

<comment><USER16> Sure:

I think cloud dev ENV is the future, (You don't have to save your file on your laptop or dropbox, you got a Linux runing in the cloud(in c9.io, it's ubuntu 64 bit), and you can see your project running in the cloud.The most exciting thing is you can add your friends then coding/hacking together.)

<comment><USER17> Do any of the cloud environments allow an offline mode? e.g. for use on long flights

<comment><USER16> IMHO, Nope.

</comment></comment></comment></comment></comment><comment><USER18> Spacemacs

</comment><comment><USER19> vim sublime shell git

</comment><comment><USER20> guake</comment>


Asian-Americans and Competing Rationales for Affirmative Action in Higher Ed - <AUTHOR> http://volokh.com/2009/10/17/asian-american-applicants-and-competing-rationales-for-affirmative-action-in-higher-education/

<comment><USER2> "I think that private universities such as Princeton should be free to engage in whatever kind of affirmative action they want."

That may be the blogger's opinion, but that is not the law of the land. In fact, higher education institutions are prohibited from discrimination on the basis of race,

<http://www.ed.gov/policy/rights/guid/ocr/raceoverview.html>

and one student who filed a complaint

[http://www.ed.gov/about/offices/list/ocr/complaintprocess.ht...](http://www.ed.gov/about/offices/list/ocr/complaintprocess.html)

against Princeton under that process found that his complaint was broadened into a compliance review, which still hasn't been resolved as of the last press report on the review.

<http://www.dailyprincetonian.com/2008/09/08/21307/>

<comment><USER3> but the article said:

"the Supreme Court, in its 2003 decision in Grutter v. Bollinger ruled that diversity is a permissible objective for the use of racial preferences in admissions"

<comment><USER2> That's for a narrowly tailored program. An explicit quota would still be illegal (the Bakke decision was not overruled by Grutter) and a system of giving every minority applicant more points than other applicants would also be illegal under Gratz v. Bollinger, 539 U.S. 244 (2003) (decided the same day as Grutter v. Bollinger).</comment></comment></comment>


Apply HN: ATM – Making ads interesting and worth watching - <AUTHOR> Problems: Three major problems with commercial ads:
1) Most of the ads are ignored or just skipped 2) A tv channel or a broadcasting network gets to keep billions of dollars while consumers who are actually watching ads are left with nothing 3) Companies are spending those billions without consumers actually watching or retaining their ad.
Idea: ATM (Ad Triva Money) could solve all those three problems by creating trivia on commercial ads and passing on 80% of advertising revenue to consumers who answer trivia correctly. This makes watching ads interesting and fun, increases retention and provides financial benefit to the end user.
I know it might sound crazy but I would like to know your honest feedback regarding the idea. Do you think building such an app is even possible as most of the mobile advertising is now automated and generated through code?
Note: I am a solo founder with no technical skills (a major drawback) and have been trying to find a technical co-founder without any luck. Do you think it's better if I learn coding myself?
Any little feedback is greatly appreciated! Thanks a lot for your time! <comment><USER2> Google is already doing this for a while now. Instead of Ads they get feedback about products and services.

Why ask about Ads when you really want to know consumer's thoughts on products??

They decided to make this distinct (at-least from user's perspective) from AdWords/AdSense, which is an awesome idea. And you get play store credits for answers!

[https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.apps.paidtasks)

Free Advise: Coding doesn't solve any problem by itself. Business models do.

</comment><comment><USER3> Wow, kind of a crazy idea. I don't know how you get started on this. I do recommend learning to code yourself; at a very minimum, showing progress on learning to code will help you attract a technical cofounder.

How much money can I make for answering trivia correctly?

What is the history of trivia in advertising? I think it would be engaging, but I have never seen it (that I recall) on mainstream tv, so I can't imagine how I would react. Basically, why is nobody doing this already?

</comment><comment><USER4> It's always better if you learn coding yourself. Also hulu has trivia ads. what do you plan to do differently?</comment>


Switch to HTTPS Now, For Free - <AUTHOR> https://konklone.com/post/switch-to-https-now-for-free?hn <comment><USER2> I just recently enabled SSL on my business website. It was anything but simple.

First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses.

Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought a domain only certificate because their marketing was so confusing. Their friendly customer service walked me through a complicated process for changing my order.

To get the certificate issued, it took me a week to collect the documents they requested. I had to make sure my business was listed in the yellow pages, so they could send me an automatic phone call for verifying my number.

After every step in the process, they told me to log into their online management area, which was offline from time to time.

I had to confirm my email address by clicking a link about a dozen times. Half of the emails were missing the confirmation link.

Twice I got an email telling me my order will soon be processed, and nothing happened for two days. I had to open tickets in some online support area or send them emails to get them to continue processing.

All in all it took me a month to get SSL working. Now I understand why so many sites do not use HTTPS.

<comment><USER3> Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

<comment><USER4> > Business validation is optional and doesn't enhance the transport-layer > security benefits of using SSL.

Except that SSL isn't just about transport-layer security, it's also about identity. The entire model of SSL breaks down if anyone can buy a certificate for anything.

<comment><USER5> Which browser makes it clear to the user that some unknown organization has "verified" the business hosting the domain they are at? All a user sees is a little lock, no matter what cert you buy.

<comment><USER6> EV Certs show the company identity, which has been verified. Go to paypal for an example.

<comment><USER5> Where? Changing the color of the lock? That's the whole point, users have absolutely no idea that means anything, they can not differentiate between certs.

</comment></comment></comment></comment></comment></comment><comment><USER7> Make sure you do not use compression with SSL.

Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See...

SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: [http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1](http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1)

BREACH Attack (HTTP Compression): [http://breachattack.com](http://breachattack.com), [http://security.stackexchange.com/questions/39925/breach- a-n...](http://security.stackexchange.com/questions/39925/breach-a-new-attack- against-http-what-can-be-done)

CRIME Attack (SSL/TLS/SPDY Compression): [http://en.wikipedia.org/wiki/CRIME_(security_exploit)](http://en.wikipedia.org/wiki/CRIME_\(security_exploit\)), [http://security.stackexchange.com/questions/19911/crime- how-...](http://security.stackexchange.com/questions/19911/crime-how-to-beat- the-beast-successor)

<comment><USER8> SSL Labs does a great job of SSL testing domains and making recommendations: [https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com](https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com)

I developed my nginx config based on their recommendations: [https://gist.github.com/konklone/6532544](https://gist.github.com/konklone/6532544)

<comment><USER7> Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" ([http://colin.percival.usesthis.com](http://colin.percival.usesthis.com), [http://www.daemonology.net/blog/2009-09-28-securing- https.ht...](http://www.daemonology.net/blog/2009-09-28-securing-https.html)).

In his 2010 talk "Everything you need to know about cryptography in 1 hour" ([http://blip.tv/fosslc/everything-you-need-to-know-about- cryp...](http://blip.tv/fosslc/everything-you-need-to-know-about-cryptography- in-1-hour-3646795)), Colin also recommends limiting SSL use to a confined area.

Amazon does this.

For example, Amazon.com only uses only SSL when you log in, check out, or access "Your Account". Everywhere else Amazon.com uses HMAC request signatures over HTTP, similar to how AWS API requests are signed.

See "Signing AWS API Requests" ([http://docs.aws.amazon.com/general/latest/gr/signing_aws_api...](http://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html))

To Colin and the other security professionals on HN:

      * Is limiting SSL still recommended in spite of the trend toward Always-On-SSL?

      * What are the current best practices and tradeoff considerations of this approach?

<comment><USER9> > _In his 2010 talk "Everything you need to know about cryptography in 1 hour" > ([http://blip.tv/fosslc/everything-you-need-to-know-about- > cryp...](http://blip.tv/fosslc/everything-you-need-to-know-about-cryp...)), > Colin also recommends limiting SSL use to a confined area._

Doesn't this leave you vulnerable to session theft?

<comment><USER7> The session ID is encoded into each URL or Form, and the request is signed using an HMAC-SHA-256 signature.

<comment><USER7> UPDATE: Looking again at Amazon.com's current HTML, it does not appear that Amazon.com is securing all requests so it may be vulnerable.

</comment></comment></comment></comment></comment></comment><comment><USER10> Oh, the sweet irony -

> _SSL's not perfect, but we need to make surveillance as expensive as > possible_

immediately followed by -

> _And hey, bonus: more complete referrer information in Google Analytics_

Make up your mind already. Are you against the surveillance or for it? You can't really sit with one ass on two chairs.

      --

(edit) Point being is that if you are pulling the anti-surveillance card, then you shouldn't really be siphoning off your visitors data to Google.

<comment><USER11> I wouldn't exactly categorize "everyone can see your data" and "we can now track your movement on our own site" together.

The idea of surveillance, in this case, is that no 3rd parties can snoop on your data. If you are actively using a site, it should be under the assumption that they can and will track anything you do on their site.

<comment><USER10> > _no 3rd parties can snoop on your data_

And Google is what... ?

<comment><USER12> Someone you are willfully sending information about requests to? What's so hard to understand. Just because you let your doctor put his finger in your ass doesn't mean you want to let everyone...

<comment><USER10> Except with external analytics you are letting your doctor to finger other people's asses. See the difference?

</comment></comment></comment></comment></comment><comment><USER13> Summary: obtain a certificate from StartSSL. They provide free certificates as long as it is for an individual, not a company's website. Their process to get a cert is a little more difficult that the competition, but konklone.com provides a nice step-by-step guide.

<comment><USER14> Nope, you can use it for a company as well.

<comment><USER15> If you read their terms, and I have, you definitely can't use the free certs for shopping or banking sites. It's kind of vague as to whether you can use it for a commercial site that doesn't involve shopping or banking though.

<comment><USER14> I did read their terms, which is why I posted that. Nowhere does it say that you can't use the free certificate for a company. In fact if you read their FAQ ("The certificate is for my company, what shall I do?") it says "even in case he/she decides to obtain certification as an employee or representative of an organization". So it is specifically saying that you can use it for a company website.

Also it doesn't say in policy.pdf that you can't use it for banking. It just says you can't have a subdomain with the word "bank" or similar in it. So you could use the free certificate for an online bank, although it's probably not the best idea :)

Please don't downvote me just because you didn't read the terms properly. My comment above was correct.

<comment><USER16> @cpncrunch, you need to re-read section 220.127.116.11 of StartSSL's policy:

      Class 1 certificates are limited to client and server
      certificates, whereas the later is restricted in its usage for
      non-commercial purpose only. Subscribers MUST upgrade to Class
      2 or higher level for any domain and site of commercial nature,
      when using high-profile brands and names or if involved in
      obtaining or relaying sensitive information such as health
      records, financial details, personal information etc.

That said, if you're a business, you pay $60 to get verified for a year, and then you can create as many certificates as you want.

<comment><USER14> Ah, yes, you're correct. I guess their FAQ just needs clarified a bit.

</comment></comment></comment></comment></comment></comment><comment><USER17> One gotcha that these kinds of tutorials don't mention is that if your site might be blacklisted if google doesn't say it's been 100% clear of trojans for the past 90 days. I hit this on my domain when I accidentally had an .exe file in my static files. I've had to wait 3 months until I can get the certificate.

[http://safebrowsing.clients.google.com/safebrowsing/diagnost...](http://safebrowsing.clients.google.com/safebrowsing/diagnostic?hl=en- US&site=jlongster.com)

</comment><comment><USER18> Fun fact about Startcom (providers of StartSSL): they were the only certificate authority that the "Comodohacker" responsible for breaching Comodo, Diginotar, and others, was unable to hack. [1]

[1] [http://www.informationweek.com/security/attacks/how- startcom...](http://www.informationweek.com/security/attacks/how-startcom- foiled-comodohacker-4-lesso/231601037)

<comment><USER19> You probably meant to say that they are the only CA Comodohacker admitted attacking and failing to obtain any fraudulent certificates. Given that there are over 100 CAs, it's likely that the same person/organisation attempted attacking others and failed.

One interesting thing about that incident is that Startcom never released a report to state exactly what had happened, which is in contrast with some other hacking incidents they suffered. If what Comodhacker said was true (that he had been able to communicate with the NSM), then they definitely were hacked -- just not critically.

</comment></comment><comment><USER20> It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for said dedicated IP before you can set up SSL, generally.

I mean, we're not talking a huge amount of money. Webfaction is $5/month [1]. Still!

[1]: [https://www.webfaction.com/features](https://www.webfaction.com/features)

<comment><USER18> Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer _need_ to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopped charging me the extra $5/month automatically. Awesome!

A small fraction of Internet users on extremely out-of-date system cannot use SNI. If you need to support those users, you will still have to buy a dedicated IP address. I personally don't bother (if you're running IE 6 on Windows XP, you have bigger problems).

This is a great guide! I did the exact same thing several months ago and am very happy with the result. Enough with the excuses not to deploy SSL!

[1] [https://blog.webfaction.com/2011/12/server-name- indication-e...](https://blog.webfaction.com/2011/12/server-name-indication- enabled-on-all-servers/)

<comment><USER21> Almost 1 in 5 people on the web are still running Windows XP. No version of Internet Explorer on XP supports SNI. Neither does Safari on XP, the browser in Android 2.x, the BlackBerry browser or Opera Mobile before 10.1. It may be a minority of users, but it's not just "people who are still running IE6".

Pretty much everyone would love to use SNI; site owners wouldn't have to pay for extra IPs, hosting companies wouldn't have to worry about securing and allocating them just for SSL use, tons of IPv4 space could be put back into circulation, and CAs would be able to sell many more certs. Unfortunately the group that can't use it is too large to ignore, so none of that's happening.

<comment><USER18> I appreciate your detailed response! I should not have been so dismissive of those users. Still, I maintain that the "extra cost for a dedicated IP" is a poor excuse for not implementing SSL.

<comment><USER22> Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.

<comment><USER23> DigitalOcean is small... Windows Azure does not support multiple IPs except for hosted websites. Cloud Services or Virtual Machines get only one IP.

And dedicated IPs for websites are extremely expensive.

<comment><USER22> Further proving my point... Joyent is another example of a cloud provider which only gives you one IP address.

It doesn't need to be this way - Linode gives extra addresses for $1/month each (provided valid technical justification, such as the need to run HTTPS).

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Excellent guide but unfortunately StartSSL does not support all top-level domains. I went through the trouble of registering with StartSSL, they even issued a client certificate for my email account at .tk domain, but they refuse to issue SSL server certificates for any .tk domain.

Even though this is a perfectly legitimate top-level domain (yes I paid for a real .tk domain, and I fully control the DNS settings just as any other domain — it is not a free web-based redirect domain, which the Tokelau NIC also offers), StartSSL does not let you choose it when requesting a certificate. They have a drop-down of supported TLDs, but .tk is nowhere to be found (and you cannot edit the HTML to submit this domain anyways, it will be rejected by the server). Initially this appeared to be a simple omission, but investigating further revealed it was an intentional decision to not allow issuance of SSL certs to .tk due to "abuse".

Quite annoying to have purchased an apparently legitimate domain, only to discover it is considered "second-class" by certain online services. Now I am faced with a decision to buy another new domain at a more reputable TLD, switch all my servers and services over, or find another SSL issuer which supports .tk. CACert appears promising, also issuing certs for free, but sadly they are not widely accepted by browser vendors. A paid SSL authority would likely issue a cert for .tk, but at this point I'm inclined to not use SSL at all, or stick with my own self-signed certs (I mainly use my server for personal services, so wide accessibility is not a major concern, but having a "real" trusted cert would be nice).

Does anyone else have any experience with acquiring SSL certs for less popular TLDs? I picked .tk because a short and easily recognizable domain was available, got in before many of the better names were snatched up as in .com, etc, but perhaps giving in and buying a longer domain name at a popular TLD is worth it if it means StartSSL and other services will consider it more trustworthy.

<comment><USER25> .tk domains are probably restricted because they're free to register, thus are heavily associated with abuse. Abusive websites with certs that haven't been caught could be misleading to users. That's my guess, anyway.

</comment></comment><comment><USER26> Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise?

If not, than this is exactly what we need to establish HTTPS as the new standard.

<comment><USER27> There are some minor caveats, but nothing really worth worrying about. Most browsers accept StartCom certs these days, so that's not a concern unless you're supporting ancient systems. The big difference is in how much validation is done.

The cheap certs only offer domain verification; in other words, they verify that the person holding the certificate owns the domain in question. Typically via an automated email to one of the contact addresses associated with the domain. The catch here is that you're only allowed to fill out the CN= (domain) field in your cert; the others are blanked out. For what most people use SSL for, that's sufficient.

The more expensive certs will go a step further and verify the identity of the entity or person holding the certificate. This entails things like checking your articles of incorporation if your'e a business; things that tend to require a human operator at the CA reviewing your submission. In return, you get to fill out more fields in your certificate. However, nobody ever looks at the details for certs, so this is pretty much wasted money, IMHO.

The only point at which the more expensive certs get you something of value is:

1\. You pay to get a wildcard cert, which lets you use your cert on as many subdomains as you want. If you actually need it for technical reasons (e.g. you let users create their own subdomains), this might be worthwhile. Most folks won't need this.

2\. You pay to get an "Extended Validation" or "EV" cert, which gets you a little green box in the address bar with your company name. There's strict requirements on identity validation to get these, and it's supposed to engender more trust on the part of users. They're also very expensive. Personally, I suspect nobody really cares about these and it's just a racket for the CAs. But opinions vary.

<comment><USER28> The fact that EV certificates exist in the first place is an indication in my mind just how badly CAs messed up the certs originally. ("We need to sell more! Get rid of the checks")

It also drives me nuts that browsers still class self-signed certs below normal (non-ev) certs when they basically offer the same level of guarantees (in terms of "this person is who they claim to be")

<comment><USER19> You are wrong. Attacks against sites with self-signed certificates are trivial to execute (you just need to download the tools and learn how to run them) and can be fully automated. Obtaining fraudulent certificates is occasionally possible (getting more difficult every day), but it generally needs to be done one site at a time, and requires a _lot_ of resources.

That said, there are many ways in which browsers could improve the handling of self-signed certificates. For example, having a Convergence-like system to fall back to seems useful. Another possibility would be to use opportunistic encryption, where all access is encrypted even without a certificate. (This would defend only against passive attackers, but it's better than no encryption.)

</comment></comment></comment></comment><comment><USER29> If you don't have a dedicated IP for each domain, and if you need to support clients who can't use SNI (IE on Windows XP, Android 2.x, etc.), here's a simple solution:

Use a different port number.

[https://example-domain.com:12345/](https://example-domain.com:12345/) is a completely different website from [https://another-domain-on-same- ip:32412/](https://another-domain-on-same-ip:32412/).

No need for a dedicated IP address. No need for wildcard certs, SNI, or any of that fancy stuff. Sure, it's ugly. But it works with every browser (even IE6), and it's not like anybody is actually going to type that into an address bar. You'll be redirecting your HTTP website to your HTTPS website anyway, aren't you?

You can only have two of the following three: (1) shared IP, (2) pretty URLs, and (3) legacy client support. Choose which two you want to have.

<comment> mike-cardwell A lot of corporate networks only allow machines to connect outwards on a certain whitelisted range of ports, ie 80 and 443. A certificate warning for ancient clients because you're using SNI is a _much_ better failure mode than a connection error.

</comment></comment><comment><USER30> StartSSL has some complains in the past. See this (paid user, but why would they provide a free SSL ...?) [http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_sta...](http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_startcom_startssl_like_the_plague_)

</comment><comment><USER31> Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a _lot_ for SSL certs, and then this mysterious company with ties to Israel is handing them out for free?

I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying activity that makes PRISM look tame. Just curious what others think about this?

<comment><USER32> With StartCom, you just send them a CSR and they sign it. They don't get access to your key.

StartCom passed an outside audit and is included in most modern browsers by default, indicating that they at least trust StartCom.

They charge for the work they have to do. So, EV and identity validation cost money. Most "domain validated" certs are basically no work, as you can see from the incredibly cheap prices other SSL vendors offer them at.

<comment><USER33> Actually, the default is for StartCom to generate your private key for you. They do let you generate your own private key and just upload the CSR though.

</comment></comment></comment><comment><USER34> For another point of view...free is what you get [http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_sta...](http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_startcom_startssl_like_the_plague_)

<comment><USER35> I tend to take people that have a running douchey commentary with a grain of salt.

Plus he was going for validation, which isn't free and is a pretty obnoxious process regardless of who you go with.

</comment></comment><comment><USER36> I used this guide to help switch a site to HTTPS just last week. Very useful and super simple.

On issue I did run into (not relevant to the article but anyway) was that Heroku charges $20/month to use SSL on a custom domain.

<comment><USER37> I believe that's because Heroku's on AWS and using ELB, so they have to have an ELB just for you ($15/month).

</comment></comment><comment><USER38> Note that in addition to using it for your web site, you can also use this same certificate for e-mail, assuming you run your own mail server.

Long story short: I recently moved my e-mail from Google Apps to a machine under my control. As part of that project, I "redeemed" an unused SSL certificate I had purchased a while back for Postfix and Dovecot.

(While I paid for mine, you can use a self-signed one and most MTAs won't complain or refuse to deliver mail, if memory serves.)

</comment><comment><USER39> This is where domain registrars should give you a basic wildcard SSL cert for free when you register the domain. There is no reason why you should get that separately. The first registrar to realize that it is basically free to them to provide you the SSL cert and bundle the two things together wins.

I also wonder if advances in DNSSEC will help eliminate various SSL cert dealers: if you have a secure way to prove that example.com translates to a given IP, and DNSSEC could distribute the public cert for HTTPS in some standard manner, then CA's have no reason to exist anymore. See [http://blog.huque.com/2012/10/dnssec-and- certificates.html](http://blog.huque.com/2012/10/dnssec-and-certificates.html) for a decent discussion of this.

Edit: even better, if I could provide a secure way for you to communicate with my site over HTTPS without relying on a CA, I could also provide you my public GPG key securely. That way you know that email@example.com really has the certificate with ID DEADBEEF. Of course you don't know that I am Igor Partola is who claims to own igorpartola.com, but at least you can securely associate the email address with the GPG key, which is good enough if you, let's say, only know me as my online identity and only care to communicate with me about things related to that identity.

For example, if you found a project of mine on GitHub, and found a huge security flaw in it, you might want to securely email me an exploit and a patch without advertising the vulnerability to the world. It's good enough to have the email/GPG key association without needing to authenticate my real- life identity.

</comment><comment><USER40> I was under the impression the private key for authentication to the StartSSL site was generated in the browser with the keygen tag, not on the server…

<comment><USER41> It is. The website is wrong. Assuming your browser implements it securely, it's no less safe than generating it client-side with openssl.

<comment><USER8> Oh, whoops. Can you recommend how I should change the text? Anything you can link to to show me what you mean?

<comment><USER40> My understanding is that StartSSL will, by default, generate a TLS/SSL private key and public certificate pair for you server side. One can manually override by creating a private key locally and uploading a CSR.

The site authentication private key and the S/MIME private key, however, are always generated in the user's browser.

From my experience (on OS X), if you want maximum flexibility for selecting your S/MIME key size, the browser you should use is the last pre-Chromium release of Opera. It allowed me to select 4096-bit RSA private key and SHA-256 hash algorithm, whereas Firefox, Safari, and Chrome have no option greater than 2048 bits.

</comment></comment></comment></comment><comment><USER42> > And hey, bonus: more complete referrer information in Google Analytics

It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information".

Did anyone get lucky with getting 100% of google search keywords after switching to SSL?

<comment><USER43> What he meant was that Google Analytics will correctly identify visitors coming from a link on a SSL secured site (for example [https://news.ycombinator.com](https://news.ycombinator.com) ) if your set is SSL secured as well - all browsers strip the referrer header if they're going from an https page to an http one.

Google search queries/keywords are a different issue - Google is intentionally making it impossible to see most of those (presumably, they've got a plan about how to sell that information to marketers using Adwords…)

<comment><USER42> Many thanks for clearing that up! I had no idea browsers strip referrer headers with https->http navigation.

</comment></comment></comment><comment><USER9> Just going to throw out that if you use a Cloudflare business plan, you can just tick a couple of boxes and get SSL for free.

<comment><USER44> While I like Cloudflare, it's worth noting you give up true "end to end" encryption SSL normally provides. It's entirely possible for Cloudflare to allow others to eavesdrop on your traffic, and in fact I think the connections between Cloudflare and your servers are normally unencrypted.

Basically, using Cloudflare SSL is good for protecting your customers from eavesdroppers on WiFi, not so good for protecting against NSA surveillance. But it's probably better than nothing.

<comment><USER9> Whether the connection between you and Cloudflare is encrypted is up to you. It's right in the same box as the option to turn on encryption in the first place.

</comment></comment></comment><comment><USER45> In the switch to https everywhere, we have barely started. For every HN and wikipedia with https there are 20 websites without (and whether the ones that do https do really secure https is yet another question).

Somebody should go through the top 10k websites and make a list, then repeat every few months.

<comment><USER46> Note that Wikipedia supports HTTPS, but it is not the default (yet).

<comment><USER45> Funny, it is for me: any wikipedia page redirects to its https counterpart.

E.g. [http://en.wikipedia.org/wiki/Hacker_News](http://en.wikipedia.org/wiki/Hacker_News) redirects to [https://en.wikipedia.org/wiki/Hacker_News](https://en.wikipedia.org/wiki/Hacker_News) .

<comment><USER33> Do you have a user account at Wikipedia by any chance? They've been redirecting logged-in users to the SSL version for a while, and under some circumstances it also seems to redirect users who have been logged in but aren't right now.

<comment><USER45> I do indeed have a WP account. It redirects as well when I'm logged out.

</comment></comment></comment></comment></comment><comment><USER47> As I understand it, (correct me if I'm wrong), https has two parts:

1\. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating)

2\. Authentication: protects from MITM (e.g. someone changing the data en- route)

For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to having everyone use encryption.

Why isn't it possible to opt for only #1? It should be as simple as adding "Encrypt +All" to your apache settings.

<comment><USER48> You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.)

Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is _inherently_ being handed off through a number of intermediaries to an endpoint. If you don't know who the endpoint is, it doesn't do you any good to know that your connection is secure from you to the endpoint.

<comment><USER49> I agree and disagree. Not all adversaries have active intercept capabilities. Some are just passive. Defending against them isn't entirely pointless.

I really, really dislike the CA cabal. Self signed "encrypt only" certs combined with auto cert pinning in browsers would probably solve 99% of the problem.

<comment><USER50> What's a "just passive" adversary, other than a "potentially active adversary that chooses not to use the information they're collecting to leverage an active attack"?

Nobody likes the CA problem, but you can't handwave the problem away.

TACK (which provides auto-pinning) is hopefully going to be a solution to the lack of trustworthiness in CAs, but TACK's deployment model also presumes a CA infrastructure.

<comment><USER49> Well, more or less exactly what you said. An active attack is detectable, a passive one is not. There is no risk to me if I walk around with a wifi adapter in promiscuous mode just recording traffic. Actually doing a mitm exceeds my admittedly low risk tolerance.

</comment></comment></comment></comment></comment><comment><USER51> _And hey, bonus: more complete referrer information in Google Analytics for people visiting from sites already using HTTPS (like Hacker News)_

If I enable SSL on my website do you think I will be able to get the referring keyword from Google? Now that Google is making all searches secure about 80% of the searches show up as 'Keyword Unavailable'. [http://searchengineland.com/post-prism-google-secure- searche...](http://searchengineland.com/post-prism-google-secure- searches-172487)

</comment><comment><USER52> This is kind of glossing over the point. We all know SSL is good and should be used everywhere. But the simple fact is that to have a fully capable SSL server you need two things: A certificate and a unique IP. There are firms now offering free certificates, but not everyone has the choice to select them. And IP certainly aren't free on most hosts. Sure there are always solutions, like moving to a self hosted model and so on, but it is a significant inconvenience for most.

<comment><USER53> SSL/TLS is entirely a server/client exchange that has absolutely _nothing_ to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.

<comment><USER54> Mostly true now, but not historically true - until SNI [1] was rolled out widely, implementing SSL _absolutely_ required a dedicated IP. Short story shorter, the TLS handshake happens _before_ the Host: header exchange in HTTP; before SNI there wasn't any way for a host that responded to multiple names to identify which cert to use for the handshake.

[1] SNI - [http://en.wikipedia.org/wiki/Server_Name_Indication](http://en.wikipedia.org/wiki/Server_Name_Indication)

<comment><USER55> That's still not quite true -- subject alternative names allow you to put multiple domains on a single certificate. That does raise trust issues if you're doing shared hosting, but it should be fine if you run all of the sites and don't mind them being obviously linked.

</comment></comment></comment></comment><comment><USER56> Using HTTPS everywhere doesn't really help much. It doesn't help at all if the surveillers either have your cert or access to decrypted traffic inside the firewall. Any PII being sent over the wire should most definitely be encrypted, but encrypting my access to a news site isn't really hiding anything. The requested URL still need to be unencrypted, you'd just be encrypting content that is already availble unencrypted.

<comment><USER21> > The requested URL still need to be unencrypted

The SSL connection is set up before the HTTP request is sent; that's why the dedicated IP per domain is required, since the domain (Host header) is part of the request as well. The URL you're accessing is not sent in the clear.

<comment><USER57> Partly. On a modern system with SNI the hostname is sent in the clear. This removes the requirement for a dedicated IP per domain with SSL for those users, but until SNI everywhere you still need one.

</comment></comment></comment><comment><USER58> Don't forget to enable ssl stapling which is now available in both nginx and apache and supported in firefox 25 and newest Chrome.

</comment><comment><USER46> You can also get free SSL certificates from LOLroot CA!

[http://lolroot.ca/](http://lolroot.ca/)

<comment><USER59> That's dumb.

If you're going to install a new root certificate on all your client machines, you could just as well generate your own CA inside your organization and do the same thing without trusting some third party.

(Edit: I think I've been trolled.)

<comment><USER60> Ya Think?

"Self-signed certs as a service! IN THE CLOUD! Need Support for your self- signed cert? 5k/year - 1 (800) 555 - 5549"

I wonder if they have an affiliate program

<comment><USER33> They've got something better - anyone can download a copy of the signing key and set up their own unofficial LOLroot affiliate.

</comment></comment></comment></comment><comment><USER61> StartSSL offer a great service.

If you'd rather use the Java Keytool to manage your certs, I wrote up this guide on making it work with StartSSL. [https://buddycloud.org/wiki/buddycloud_SSL_setup](https://buddycloud.org/wiki/buddycloud_SSL_setup)

Should just be a copy paste, wait, paste, export job.

</comment><comment><USER62> When it's harder to get SSL working than to install debian stable on a machine, I'd say SSL is too hard.

<comment><USER63> This is mostly the fault of the SSL certificate providers, which vary in complexity between the obnoxious GoDaddy and even more obtuse and impossible to deal with.

Compounding this, the configuration file formats for each web server platform vary wildly, selecting the correct format and installing it properly can be tricky.

Making matters worse, it's very easy to set up something that looks like it's working, but is actually broken on some subset of the browsers out there.

These problems can be solved with better standards, better documentation, testing tools, and most of all, providers that actually care about the user experience they're selling.

<comment><USER62> Can't the providers be disposed of, and replaced with an open-source automated system?

<comment><USER63> It's not that they need to be open-source or not, it's that their user interface is absolutely awful.

You can set up your own CA but you can't sign for domains unless you're in the proper chain. The ones holding the keys for these are the big providers.

</comment></comment></comment></comment><comment><USER64> > As you can see, StartSSL will believe you own the domain if you control > webmaster@, postmaster@, or hostmaster@ with the domain name

I see a potential vuln here for free e-mail services. If one manages to register one of those addresses he can create a trusted certificate and use it for MITM.

<comment><USER65> Several paid-for certificates from a few CAs do just the same. If you're paying $0 for a certificate, don't expect more than ~$0 worth of identity checks!

It also highlights a critical SSL issue; there's really little strength in the concept of a certificate _proving_ the identity of anyone.

</comment></comment><comment><USER66> On a side note, which cert provider you go with can dramatically effect your latency times.

In testing, we found that DigiCert was 50-100ms faster on queries than our existing GoDaddy certificate, based on the location of their CA hosts.

The improved response time resulted in a 15% increase in traffic on our API.

</comment><comment><USER67> This isn't strictly related to this post, but I've always thought that the idea of paying a fee for SSL certificates was a bad one. Time spent buying and setting up an SSL certificate would be better spent making your site available as a Tor hidden service.

<comment><USER68> I'd rather disconnect my web server, it'd take less effort and receive the same number of visitants.

</comment></comment><comment><USER69> Globe SSL [https://globessl.com/](https://globessl.com/) has domain validated certs at $24 per 3 years.

I've been using these since 2011 (starting with one year certs before switching to 3 years later) with no problems.

</comment><comment><USER70> Because certs are so easy to get, it's better to use fingerprint identification for sites, to make sure it's right one. That's what I've been doing for ages, with https, and smtps. I'll be blogging about it soon.

</comment><comment><USER71> Been wanting this for a long time but didn't know of a free vendor and didn't seem worth paying for (just for my personal use)... now I got it working on everything but OSX, it just does not seem to want to accept the cert.

</comment><comment><USER72> Why r u decrypting your private encrypted key? To use for csr request? Can't u do car request with private encrypted key? And why point nginx/apache/watevr at the decrypted private key? Sounds unsecure?

</comment><comment><USER73> If you host with SingleHop, they allow generation of unlimited SSL certificates. [1]

[1] Ex: [https://ianthedeveloper.com](https://ianthedeveloper.com)

</comment><comment><USER74> If browsers got fixed to not freak out on self-signed certificates, this wouldn't even be an issue, HTTPS could be a default.

<comment><USER75> Sort of. You actually do need to know when a certificate is self-signed because it means the connection isn't _authenticated_ even if it's _encrypted_.

But what they ought to do is to accept the self-signed certificate, show something other than the usual lock icon but do the encryption anyway, and then freak out if the certificate changes before it expires.

<comment><USER74> The point is, sometimes you just don't care about authority, you just care about the encryption.

HTTPS with self-signed certificates is better than moving plaintext over the wire, in the same way PGP is better than moving plaintext over the wire. It doesn't matter that you don't have a "trusted" peer to tell you this PGP signer is who it says it is. As long as you can trust you acquired his key in a secure way (e.g., out-of-band), it's better than the alternative.

Plus, MITM concerns over self-signed certs are moot. This vulnerability exists at the DNS level anyway.

</comment></comment></comment><comment><USER76> Is it irony that Safari considers his $0 certificate unsafe, or did he simply get what he paid for?

<comment><USER77> Safari (wel, the OSX Keychain) doesn't include StartCOM in it's Truststore -- which I'm pretty OK with. I revoke it from all my trsutstores

<comment><USER78> (a) That's not my experience. This site of mine is secured with a StartCom cert, and Safari has always been perfectly happy with it: [https://mappiness.me](https://mappiness.me)

(b) Why? I understood they were among the better providers.

<comment><USER76> > This site of mine is secured with a StartCom cert, and Safari has always > been perfectly happy with it: [https://mappiness.me](https://mappiness.me)

My Safari can't verify the identity of that website. This is Safari 5.1.7.

<comment><USER78> Interesting, and a bit concerning. I just checked it on a friend's MacBook too, and that worked (Safari 6.0.5). Perhaps there's been a change at some point?

</comment></comment></comment></comment></comment><comment><USER79> Thank you so much for sharing this!!</comment>


Gmail adds video chat for Linux - <AUTHOR> http://gmailblog.blogspot.com/2010/08/use-linux-now-you-can-video-chat-too.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+OfficialGmailBlog+(Gmail+Blog)

<comment><USER2> This package installs a cron job that affects how apt functions on your system. You're basically giving google root on your machine.

<comment><USER3> Yeah, a closed source application installed as root, with the express purpose of accessing your webcam and microphone. What could go wrong?

<comment><USER4> Here's the header of the /etc/crontab.daily/google-talkplugin file. I'm not that ninja with my cron-tabbing, but doesn't this do exactly what it says?

<http://pastebin.com/4etPxNWC>

<comment><USER2> Yes, and it's pretty much harmless in itself, but since when does installing one package (esp. from a third party with no verification beforehand) install a new apt key into your keyring (thus allowing all packages signed by that key, no matter what they are) and reconfigure the package manager itself? It's ludicrous.

<comment> mkr-hn It's probably a mistake, and they'll put some prompts and options in once they realize Linux users don't like giving root so freely.

They're probably accustomed to trusting their own software with root, so didn't even think about it.

<comment><USER5> It's not a mistake: the development deb for Chrome did exactly this - installed the repository key and a cron job to "protect" the apt-sources entry. Of course it's not really doing this secretly, in that you can read about it in the post-install script before you run dpkg, but I agree it doesn't feel right.

Also, can't this be said of any package you install through the package manager? If you install it as root, then in principle you're giving root access to whatever is in the package. If you don't like it, there's always a way to run it with ordinary permissions (but the extra fiddling to get that working may be hairy) or under mandatory access control (definitely hairy).

</comment></comment></comment></comment></comment></comment><comment><USER6> Video chat via Google credentials has already been working for some time using the Empathy messaging client, without the need for a dedicated one.

<comment><USER7> Unless I'm mistaken it's not a dedicated client. It's a dedicated web plugin that enables video chat within your browser at gmail.com.

</comment></comment><comment><USER8> Does anyone know why this took so long?

</comment><comment><USER9> Tried it out and works very well on first run. Installed the .deb package and restarted Chrome.

</comment><comment><USER10> I cant quite tell from the posts, but with gears they got to experiment with creating new web standards through a plugin, have they tried to do that with this and html5 devices? that would be awesome news.

<comment><USER11> How would you go about accessing the mic and cam with html5?

<comment><USER10> Its very barebones, but <http://dev.w3.org/html5/html-device/> is in the works, google could / hopefully have made progress towards making that more solid.

<comment><USER12> They are working on it but it's still a long way to go. html5-device depends on other standards that don't even exists yet (as you can read on your own link).

<comment><USER10> yeh thats pretty much what I said, thats why I was asking if anyone knew if this work made its way into contributing to the standard?

</comment></comment></comment></comment></comment><comment><USER13> Cool. What codecs and streaming protocol do they use?

<comment><USER14> I think everything runs over XMPP just like Google talk.

</comment></comment><comment><USER15> Doesn't work for me - crashes every time I try to start a video call.

Problem reported to google, will see what happens.</comment>


Show HN: A smut friendly dating site - <AUTHOR> https://pawno.xyz/ <comment><USER2> Creative :)

I would make the 'show more' button on categories stand out more.. I can imagine many people getting stuck on that page not finding ones to like and clicking away...

I would have a use for the voting on a feed of pics, videos and streams like this if you would offer the voting source up or be willing to mod, I could put a hundred bucks on it.

Would be cool to connect this with something like the 'match me buddypress plugin' ( [https://wordpress.org/plugins/match-me-for- buddypress/](https://wordpress.org/plugins/match-me-for-buddypress/) ) (or similar) -

I imagine you could throw it a list / feed of just about anything.. songs / genres.. fashions / styles..

could be used to fill out profiles with feeds / lists more visual rather trying to get people to fill in detailed profiles while they rush to get into using a social network.

A secondary layer to enhance buddypress and similar profiles - I'd use it on adultsOnlySpace - I added some interests checkboxes there not too long ago, but the older profiles, most have not gone back to the selection options to update profile.. and I have not made search by kink a thing that is easy to find / use like this system makes it.

does the system include what to do when vids are taken away... still give a vote for something in that category or tags maybe?

phub is notorious for having videos disappear - and if many have been removed, then matching if based on specific video which no longer exists on older profiles would not work well. however the system could keep a list of tags and categories that were associated with the vid when it existed and match on that.

/random thoughts before coffee

<comment><AUTHOR> Thank you for taking the time to write such a detailed response!

We see some unexplained drop at the tags screen, not sure what to do about this since the numbers are pretty low so far... hopefully we get featured somewhere and see some actual traffic.

While I'm on the subject of traffic, I feel an urge to share that running a campaign for such a site is a nightmare. Our ads keep getting rejected and the average cost-per-click is around $0.5usd. Alas, we're not too experienced with advertising.

I'll read more about buddypress (or similar, since our stack is mostly Javascript), but it seems interesting!

Regarding Pornhub, we hope they're chill about us embedding their content, after all it's still their iframe and they can place whatever ads they want there. If not we'll remove it immediately, after all there are many other sources of content.

<comment><USER2> your tag screen might be displaying what is most popular at the phub.. (not 100% sure) - but there are plenty of non-mainstream terms in there, and many that will make people queezy and click away.. When you get mainstream traffic you would keep more if you moved a bunch of those tag terms off the first view.. no matter how popular [insert-taboo-term-here] is on phub - for your visitors, it may not be helpful in finding a match, and may be something you would not want to admit to a match or a web site..

'getting rejected' \- welcome to adult - we've been rejected by mainstream portals and payment processors and more for some time now.. and even those places that welcome you today or once did (cough ehem, tumblr) - don't count on them for the future (ggl censors more and more ) -

I think it's important for adult stuff to make profiles everywhere possible so that people will be able to search for you via other means when you are kicked from place-A - they can know to look for you at place B (twitter)

phub and similar have always been chill about embeddding - it gets them more ads running and data on users.. but their videos get taken down a lot by copyright and other means on a regular basis..

some sites we had vids embedded for a couple years, 80% were replaced with 'this video no longer avail.." screens, which did still play ads for them :))

your ad dollars will probably go further on places like phub and similar (trafficjunky, etc), which I imagine will be much cheaper. Every time we tried G-ads they burned money fast and no one came back that clicked.. ymmv

</comment></comment></comment><comment><USER3> Interesting idea. I wonder when Pornhub would start complaining that you're using their assets. Also, most of the clips were not displayed for me in Firefox on Linux, or only half was shown. In Chromium the clips worked but the rating buttons were weird.

Also, the profile of the pretty girl I "matched" with looks nice, but I'd bet it's fake. Didn't try a reverse image search on her profile pic though.

<comment><AUTHOR> I'm pretty sure I know who you're talking about (we don't have that many users right now) and she's pretty awesome! She is one of our first users, very active on the site and even contacted us a few times through it :)

</comment></comment><comment><USER4> This site will have even fewer women and more fake profiles than normal sites

</comment><comment><USER5> Is this NSFW? I'm afraid to click.

<comment><AUTHOR> To some extent, yeah...</comment></comment>


Ask HN: Is there ANY way to delete my Dropbox account? - <AUTHOR> . <comment><USER2> Is this a free account? They may be more cooperative if you tell them you are trying to log in to become a paid member. Also, it's a long shot but you know the phone numbers maybe contact the new owners of those numbers and see if they could give you the code.</comment>


Is open source anti-American? - <AUTHOR> http://blogs.zdnet.com/open-source/?p=2173

<comment><USER2> No</comment>


Cher Wang, the most powerful female tech executive you've never heard of - <AUTHOR> http://www.nytimes.com/2008/10/27/technology/companies/27wang.html?_r=1&oref=slogin <comment><USER2> > you've never heard of

We've heard about her alright. Just as much as we've heard about the CEOs of Asus, Hynix, Toyota, Lenovo, and Haier. Cultural, perhaps?

</comment><comment><USER3> Goddamn it, why do we still feel the need to emphasize "the most powerful FEMALE" executive bit? Isn't it enough to recognize that she's damn powerful without taking her out of the general pool of executives and thereby not comparing her to male executives?

</comment><comment><USER4> Remember girls, you too can be empowered to be the daughter of one of the richest men in the world. Grrlpower!

<comment><USER2> It is one thing to have access to large resources, but quite another to be able to use large resources effectively. Wang has proven herself capable in her own right. Headstart or not, she deserves much respect and inspires many.

Her (late) father has quite an amazing story himself. If you count Cher as continuing his legacy, it is the result of two generations of rags-to-riches hard work.

<comment><USER5> I'm sorry, i've never been inspired by anyone that turned some millions into billions. Her story is no different than that of Donald Trump.

edit: Donald Trump, sans the outsize hyperbolic attitude.

<comment><USER2> Fair point, but perhaps approach it from a different perspective. Her father did not even complete grade school, but built a highly respected empire in a field most people would not think much about. He lives frugally and champions diligence. His children (and children-in-law) also live by admirable principles.

As a legacy, it is grounded in good principles. You take and you give back. The wealth follows, but is secondary. It is inspiring to see leaders in this class, no matter if they accumulate millions or billions.

The hyperbolic attitude, I think, makes a world of difference, and makes a terrible comparison.

<comment><USER5> Ok point taken. But Fred Trump was similar to her father, i don't think he went to college.

Perhaps i am inspired by people that are successful, but much more by people like Mark Cuban, who came from nothing. Much harder and merits much, much more respect.

</comment></comment></comment></comment></comment><comment><USER6> I wish the NY times wouldn't make me login so I wouldn't have to use BugMeNot every single time. At least there's an ff plugin.

<comment><USER7> If NYT makes you login, clear your cookies. Easy peasy.

<comment><USER8> That's what I always do. I wonder if you could make a browser plugin that just did this automatically. Can plugins clear cookies?

<comment><USER9> Have you tried blocking cookies from NY Times completely in the Prefs -> Privacy -> "Exceptions" area. Also, there is <https://addons.mozilla.org/en- US/firefox/addon/1243> \- which does the same thing as adding to Exceptions, but with a different way of adding sites to the rules afaik.

Also, there's the whole "Private Browsing..." mode in Safari, but I couldn't find something similar last time I hunted for something along those lines in Firefox built in.

<comment><USER8> I think I tried it and the NYT refused to show me pages.

</comment></comment></comment></comment></comment><comment><USER10> "HTC had strong engineers developing notebooks, said Mr. Chen. But it was a volatile business with lots of competitors. She saw that clearly and pushed for the other instead."

I'm curious as to how she decided cell phones over notebooks. Cell phones seem to be uber-competitive, too.

<comment><USER11> Perhaps not in 1987?

<comment><USER12> The article says 1997.</comment></comment></comment>