An empirical comparison of C, C++, Java, Perl, Python, Rexx, and Tcl - <AUTHOR> http://page.mi.fu-berlin.de/prechelt/Biblio/jccpprt_computer2000.pdf

<comment><USER2> While this article is 10 years old, it contains a few very good points -- I've referenced it many times over the last 8 years. Specifically:

\-- Scripting languages relative run time and memory consumption overhead will often be acceptable and they may offer significant advantages with respect to programmer productivity.

\-- For all program aspects investigated, the performance variability due to different programmers is on average about as large or even larger than the variability due to different languages.

</comment><comment><USER3> I've always kind of felt that any claim to empiricity in programming language comparison will be fatally undermined by a focus on only one task. The choice of task itself is very opinionated in a way that makes it difficult to apply the conclusions of this study more broadly.

<comment><USER4> FTA: "It must be emphasized that the results are valid for the phone code problem only; generalizing to different application domains would be haphazard"

</comment></comment><comment><USER5> should maybe note that this was written 10 years ago.

<comment><USER6> That's bound to throw off the Java and Python numbers quite a bit. JDK 1.2.1 was problematic, and I think a lot of its poor performance there could probably be fixed with no more than a simple recompile. The past 10 years have also seen a wide diversification of Python implementations, including IronPython, Jython and the JIT-based interpreters. It would be very interesting to compare the performance of the same programs across platform implementations to try to knock down the variations and get to the effects of the choice of language itself.

<comment><USER7> Both of those languages have seen vast improvements in speed throughout the past ten years. Java 1.4.2 was immensely faster than any previous Java implementation. I would be very interested in seeing this study redone with the newest Java, Python, Ruby, and something Lispy.

</comment></comment></comment><comment><USER8> Indeed; for some aspects of the study ten years ago was a different epoch.

</comment><comment><USER9> I've seen so many benchmark comparisons that only focus on conciseness (that too involving lines of code), and speed. Yeah, they all re-affirm what is already known - C is fast, python/ruby is concise, C#/Java is somewhere in between and there are the ones which do well in both - haskell, clojure, etc. (And then there's APL)

All the benchmarks are algorithm and processor intensive, while quite a few applications are idling most of the time. How about a comparison regarding the standard libraries, ease of debugging, external tools, code readability, available support, external libraries, etc. In short - developer productivity.

I'm not saying performance is not important - it is quite critical, but there are other things code does as well (At least most of my code is mundane, and is just calling APIs, updating files, serializing objects, etc. Nothing too fancy.) </rant>

<comment><USER10> And your rant is relevant to this paper precisely how? As the paper also covers time to implement and memory use it, it doesn't fall into the category you complain about.

<comment><USER9> I guess it's rather off-topic from the paper's content. I apologize for that.

</comment></comment></comment><comment><USER11> In many respects, TCL is dead at this point ... there is still a lot of legacy use for it but few new users in comparison to Python, Ruby, etc. Rexx is dead outside of IBM shops, and was ever since Amiga and OS/2 died.

<comment><USER12> It's written "Tcl", not "TCL". This has been true for at least 10 years, as the article nicely demonstrates.

Nitpicking aside, I agree that it's not real lively, but I don't think I'd call it 'dead' quite yet either, as there is still a fair amount of active development, and anything that widely used doesn't just up and go away from one day to the next. They even published a new Tcl book recently:-)

[http://journal.dedasys.com/2009/09/15/tcl-and-the-tk- toolkit...](http://journal.dedasys.com/2009/09/15/tcl-and-the-tk-toolkit-2nd- edition)

</comment></comment><comment><USER13> One section of the paper describes which algorithms the programers used. It appears that the solutions in scripting languages made heavy use of associative arrays, so the results might change if you swapped Tcl's hashing algorithm for Perl's.

The algorithms described don't seem very clever. I expect you could do much better by splitting the input number into digraphs or trigraphs, sorting those by frequency in the dictionary, and matching the rarest ones first.

</comment><comment><USER14> It's always nice to see papers published by my profs on HN. I would not have looked at those on my own.

</comment><comment><USER15> Am I the only one tired of mathematical tests? I'd rather see a test comparing the relative speed and scalability of various web app implementations.

And don't give me that line about scaling not mattering, I have to cope with a cantankerous server and database at work, I know full well what my problem sets are.</comment>


It's Settled: Silicon Valley Is Dying. So What's Next? - <AUTHOR> http://www.psmag.com/navigation/business-economics/legacy-economy-silicon-valley-dying-detroit-74001/ <comment><USER2> I don't usually defend the Valley when articles like this come up, because as a tech employee I like having the ability to work anywhere and the concentration of tech in the valley is counter to that.

That said, the main arguments here are are 1. wages are too high and 2. rent is too high.

Given that both of these are set by the market, this smacks of "nobody goes there anymore, it's too crowded"

<comment> rkuykendall-com "No one in New York drove. There was too much traffic."

-Fry, Futurama

</comment></comment><comment><USER3> _Newark is an instructive geography. The ambitious head to New York or San Francisco out of tradition. For the same reason, they avoid Newark. It's off the map..._

That's not why people avoid Newark. Plenty of people are moving to Jersey City and Hoboken which have the same "bridge&tunnel" stigma.

People avoid Newark due to legitimate fear of being robbed, raped or murdered.

<comment><USER4> Newark is fine if you live in Ironbound. I lived there in Newark for 6 months and it was the best 6 months I had in 26 years living in/around New York City.

Would live there again in a heartbeat.

Artists have moved to Newark. All of those old warehouses were converted to lofts and sold in < 2 years.

<comment><USER3> Good to know. If I return to the US I'll take a look.

</comment></comment></comment><comment><USER5> Seems specious to me. SV is a centre for innovation because of two major things: Funding and Talent. So firstly, it's unlikely that any VC's are going to move out because their personal rents are too high, while there's still the high concentration of talented people in the area. They might branch out to other locations, but personal choices over where to live are usually about far more than just money. So the Funding is unlikely to relocate.

It's possible they might start encouraging businesses to move further afield to increase their survivability, but ultimately a lot of founders will take <$30k salary when starting a company and accept any hardship in order to succeed. So suggesting that corporate finances at startups are suffering because of high rent is also a shaky premise. There may be a few borderline companies that fail "just before" they "would've made it big", but that'll be true at any burn rate.

If anything, investors probably like high rents because it forces higher burn rates and hence encourages startups to generate revenue or flip quickly. Either of which is preferable to a long, drawn out investment with no end in sight.

It's not like Detroit where a combination of cheaper manufacturing elsewhere and a _lack of demand_ for US cars, led to necessary relocation/offshoring/downsizing.

I can't see there ever being a lack of demand for what SV produces. Businesses. Unless people start running out of ideas in and of themselves, I can't see how it'll die any time soon.

<comment><USER6> _So the Funding is unlikely to relocate._

I agree.

 _ultimately a lot of founders will take <$30k salary when starting a company and accept any hardship in order to succeed. So suggesting that corporate finances at startups are suffering because of high rent is also a shaky premise._

Most of those people have no other options. You don't want to fund people (in general; obviously there are outliers with 150+ IQs and fucked-up careers, I was one and, who knows, may be one in the future) who don't have other options. You want to fund people who could actually get the $250k hedge fund quant jobs. They'll come down to a savings-neutral (with no children) $125k, but not $30k. Not in the Valley.

The people who'll take $30k in the Valley are (a) rich kids with parental sources, and (b) the truly desperate. Founders are not an exception.

 _If anything, investors probably like high rents because it forces higher burn rates and hence encourages startups to generate revenue or flip quickly._

True, but the real reason VCs want to stay in one area (and keep their companies there) is that the collusion among VCs would be dangerous and possibly legally hazardous if it happened on paper instead of through a mouth- to-mouth social network.

 _I can 't see there ever being a lack of demand for what SV produces. Businesses._

The whole country produces businesses: restaurants, cleaning companies, indie bookstores. Most HNers find those lines of work uninspiring-- and starting one of those is way riskier to one's tech career than working at Google. Oh, and those businesses tend to get crushed by big corporations (see: WalMart) and landlords and changing trends.

So, there's no lack of businesses being generated in the US. What there is a lack of is _inspiring_ and truly innovative businesses, but SV is no longer producing inspiring companies, so what use is it?

<comment><USER7> >Most of those people have no other options. You don't want to fund people (in general; obviously there are outliers with 150+ IQs and fucked-up careers, I was one and, who knows, may be one in the future) who don't have other options.

[http://www.paulgraham.com/marginal.html](http://www.paulgraham.com/marginal.html)

<comment><USER6> I don't disagree. The problem is that the incapable and highly capable (who both fail in typical, micromanaged, closed-allocation type environments) get lumped together and there are fewer of the latter. The profiling (see: job- hopper stigma) really hurts those of us who've had a lot of failures or mistakes but have good reasons.

If you really need A+ players (not just the A- and B+ players who become executives) this costs you. But VC-istan is just another version of the corporate ladder and most of these VC-funded startups don't _need_ outlier excellence, so a person like me might not be worth the trouble.

VC culture is about commoditizing founders and companies (and especially engineers) and it has worked at creating a world in which A+ players (the people who originally built SV because they didn't fit anywhere else) aren't really needed.

</comment></comment></comment></comment><comment><USER8> The author may have a point about Silicon Valley driving out employees, or deterring potential ones.

I looked into moving there, for the opportunity. I networked. I had (I flatter myself perhaps) the right skill set for my niche.

I looked at the cost of living.

I've got kids, two dogs. For any kind of a reasonable non-sh*tty living situation I'd double my living expenses, plus a two-hour commute.

I moved to Nashville instead.

<comment><USER9> Sure, but one result of that is that in SV, networking is less important. You can email your resume to a recruiter at any funded company, they'll fly you out for an interview, nobody is expected to know anything about you other than what they can discern in an interview. You'll get 5 to 10 thousand dollars in relocation/sign-on bonus. And the salaries are significantly higher than in Tennessee.

And then you can start networking.

<comment><USER10> Salaries are higher in SV, but you'll have more disposable income in Nashville, and probably a more comfortable home. Also, the local politics and culture are different. As much as it may surprise the people who do like it, some people don't like the way California operates.

</comment></comment></comment><comment><USER11> Boomer fodder, all the memes are at least a decade or two out of date. The great lakes area is not the rust belt, it rusted and blew away in my grandfathers generation half a century ago. Innovation economy is not CRUD apps with quirky marketing, at least not since '95\. The general idea of the article is more or less correct. I checked the byline and its only four hours old although it sounds much more ancient.

I am strongly biased because I don't like articles about this topic, the vultures should stay away. Yeah, you'll all freeze in the snow, so best not come here. Nope we don't have any money or quality of life, I advise staying away, LOL.

Given that immense level of bias my evaluation of the style and memes of the article might be tainted.

<comment><USER12> > I am strongly biased because I don't like articles about this topic, the > vultures should stay away. Yeah, you'll all freeze in the snow, so best not > come here. Nope we don't have any money or quality of life, I advise staying > away, LOL.

Ah, if only that worked. Austin, Dallas, Seattle, Portland, Nashville, Kansas City...all of their residents have said the same thing and the "vultures" keep on coming. It's the circle of life, my friend.

</comment></comment><comment><USER13> There's a bigger, MUCH bigger, point to be made about geography and finding other creative people than this article, with its glib, provably inaccurate quoting (1) can make.

The big picture is that there are always under-stated, inexpensive places where you can get creative work done which are outside the major, known centers (SV, NYC, LA, etc.). They are tricky to find because they don't have metrics like insane rent, barking realtors, etc. to mark them.

For example, everyone (including me) used to laugh at Kansas City. Then I met a world-traveling DJ who told me KC was one of the hippest places, where the "kids" where the most into the music than anywhere else.

But beware: places that become symbolically cool and ideal attract posers. In contrast, there are people who evaluate tons of metrics to choose where to live and work. I suggest evaluating towns on the quality of their makerspaces as one useful feature. Tech accelerator programs' presence is another signal.

Another town I'm hearing is great to work in is Boulder.

(1) I just googlemapsed Newark to Manhattan (mid-town). It's 17 miles, 30 minutes best case, 45 in 10:00am weekday traffic.

<comment><USER14> > I just googlemapsed Newark to Manhattan (mid-town). It's 17 miles, 30 > minutes best case, 45 in 10:00am weekday traffic.

Its also $140/month, which is on top of the MTA fare unless you work within walking distance of Penn Station.

</comment></comment><comment><USER15> My best guess is that SV has jumped the shark. "Dying" is probably an adjective too far. Microsoft is "dying". Still might have another 40 years of profitability left in it, though, and if that's dying, dying looks pretty good.

SV is not going to be replaced anytime soon. Rather, what's happening is that there are a thousand small places that each will amount to about 1% of SV. In the aggregate, that means that SV will have a smaller piece of the pie. Due to location and network effects, though, I don't think any of that's going to be clear for some time.

California is busy re-engineering its society. Good for them. But hell if I'll work there, and hell if I'd try to launch a startup there. I love the folks in SV and am terribly jealous of all the cool stuff going on. Having said that, it's simply not worth the effort to fool around with all the obstacles in place. And more are on the way. Sure, it's still great and awesome for those that win the SV beauty contest, but not so much for us little fry. That's what "jumping the shark" looks like.

</comment><comment><USER16> Anyone else getting annoyed by these YAASVAs (Yet Another Anti-Silicon Valley Article)?

<comment><USER6> I get annoyed by the lack of understanding.

Most of the anti-SV crowd _want_ the VC funding and the same essential culture. They just want to move it to another place in the country. That would be a marginal improvement-- and massively beneficial to me as a 30-year-old who'd be able to get in on the ground level and buy housing-- but it wouldn't fix the underlying problem. It's like a revolution where the people revolting want the same damn system but with themselves on top.

You can't have it both ways. Silicon Valley is defective _because of_ its culture. If you copy the VC feudalism and the California softie NIMBYism somewhere else, that place will become just as broken in a matter of a few years (assuming that copy operation is successful, which it almost certainly won't be).

<comment><USER10> Not quite. What _I_ want is to be able to easily find a new job on the strength of my skills and aptitude rather than my social connections, without having to move my entire household. _Again_. I want to be able to work with both younger people and older people, with managers that used to do what I do, even if they weren't as good at it. And I want a 40-hour work week or less.

That isn't exactly a tall order. It is possible to find companies that do treat employees like people with lives outside the office. Larger and more dysfunctional companies apparently like to swallow them whole, digest them, and crap out the useless cost centers. It would be nice to not have to uproot and relocate every time that happens.

<comment><USER6> I agree with everything you just said.

Do you think the existence you described is the norm in the Valley? Or elsewhere? Or nowhere?

I guess I'm cynical, but my sense is that most people bashing the Valley are advocating for making that same VC culture more geographically available. Obviously, there are people like you and me who have more insight into the problem.

<comment><USER10> No, I don't. I have worked for a few companies that were good, and a few that were bad. I very much prefer the former, but every single one of those jobs were purchased by a bad company and subsequently piped to /dev/screw-you-buddy .

If I were in SV, I could probably jump right into another similar job without too much disruption. But I wasn't. Two of the three times, I had to move to a different state of the US to even come close to what I had before. And where I am now is mired in endemic mismanagement thanks to all the military-industrial complex money flowing through the streets. Since companies don't seem to have any inkling of loyalty to employees any more, I need to find my job security in the ability to quickly find a new and similar job on short notice. That is a poor substitute for just one company that does not have its head up its own backside, but those seem increasingly hard to find.

<comment><USER6> I hear you loud and clear. Also, I think a major factor pushing people into the star cities is the two-career family. It's a good thing, but it tends to push people into a small number of locations that become extremely expensive.

Now there's an argument that could go into the affordable housing debate. "If you don't support real estate reform, you're a sexist."

I agree that good corporate cultures seem to get driven out by bad ones. It's like a Gresham's Law.

* And where I am now is mired in endemic mismanagement thanks to all the military-industrial complex money flowing through the streets.*

Now I'm curious. What part of the country do you live in?

</comment></comment></comment></comment></comment></comment><comment><USER17> I have been in the valley for a quarter of a century. It has never been so vibrant. Here are some links to prove the point:

[http://www.jointventure.org/images/stories/pdf/index2014.pdf](http://www.jointventure.org/images/stories/pdf/index2014.pdf)

[http://www.siliconvalley.com/sv150/ci_23055045/sv150-searcha...](http://www.siliconvalley.com/sv150/ci_23055045/sv150-searchable- database-silicon-valley- top-150-companies-2013?appSession=73888879390976&RecordID=&PageID=2&PrevPageID=2&cbNewPageSize=250&)

[http://www.bizjournals.com/sanjose/news/2013/12/24/the- years...](http://www.bizjournals.com/sanjose/news/2013/12/24/the-years- biggest-commerical-real.html?page=all)

[http://www.forbes.com/sites/joelkotkin/2013/05/06/americas-b...](http://www.forbes.com/sites/joelkotkin/2013/05/06/americas- best-cities-for-jobs-2013/)

[http://news.stanford.edu/news/2013/march/applications-set- re...](http://news.stanford.edu/news/2013/march/applications-set- record-032913.html)

</comment><comment><USER18> Why is it when an article is written talking about the downfall of Silicon Valley, or talking about other great tech oriented cities, that Chicago is hardly ever mentioned. Chicago is the third largest city in the country with a booming tech culture here.

<comment><USER12> I don't mean to sound flippant but is there any city of greater than, let's say, 100,000 people that's located in the United States that people would not say has "a booming tech culture?" Numerous posts on HN talk up, in alphabetical order: Atlanta, Austin, Chicago, Dallas, Detroit (yes, really), Fort Worth, Houston, Kansas City, Las Vegas, Nashville, Orlando, Pittsburgh, Portland, San Antonio, Seattle, and I'm sure I missed a few.

Simply put, I'd like to know the inverse, if nothing but sheer inquisitiveness: Let's say you either hate technology startups and want nothing to do with them, or you love them and want to make the biggest career mistake ever. What city do you choose?

</comment></comment><comment><USER19> I just choose not to move to SF in part due to the high prices, a high wage doesn't mean that it compensates for it properly.

</comment><comment><USER20> I wouldn't be surprised to see Detroit & co rise again, if only because of the dirt cheap price of housing.

<comment><USER21> I would, because the infrastructure is crumbling, the tax base to fix it is non-existent, and the bureaucracy running the city is overbearing and corrupt. Detroit is still in the early stages of a death spiral, and it would take something mind bendingly huge to snap out of it.

Detroit is going to stand as the lesson to all cities in North America.

<comment><USER22> Mind-bendingly huge like the mayor forcibly removing the elected city officials and installing emergency city managers to cut down on the corruption and bureaucracy? Mind-bendingly huge like the largest US city to ever successfully declare bankruptcy ($18.5 billion in debt)?

Because that's what happened. Now we wait to see if it works.

<comment><USER12> > the mayor forcibly removing the elected city officials and installing > emergency city managers

The Detroit emergency financial manager was appointed by Michigan Governor Rick Scott against the loud and outspoken wishes of the citizens and elected officials of the City of Detroit.

[http://www.nytimes.com/2013/03/02/us/michigan-appoints- emerg...](http://www.nytimes.com/2013/03/02/us/michigan-appoints-emergency- manager-for-detroit.html)

<comment><USER22> Rick Snyder, and I'm not sure if you're trying to say something beyond what I was saying.

 __edit - sorry, I guess I wrote mayor instead of governor. Thanks for the correction.

</comment></comment></comment></comment></comment><comment><USER23> "Silicon Valley is dying because it's too crowded."

Wait, what?

<comment><USER10> Haven't you ever played Conway's Life? Cells that are surrounded die. Cells that are isolated die. Cells that have neighbors and room to grow multiply.

<comment><USER23> Sure. But that assumes you don't have space to go. If SF is too crowded, people will move out until it's not that much.

Calling this "dying" is a little too much in my opinion.

</comment></comment></comment><comment><USER24> It's Settled: Journalism Is Dying. So What's Next?

</comment><comment><USER6> I'm not sure there is a "next", at least not in the U.S. I think the Boomers and the venture capitalists have pulled the ladder up for good.

Silicon Valley dying (and slowly) does _not_ mean that a B-list city will replace it. I wish it were otherwise, because we have a lot of infrastructure and a hell of a lot of talent that's still in the B-list cities. However, I don't see much hope for most of those places. I wish I were wrong about that, but when the spirit is crushed it takes a long time for it to come back.

Corporate America "proper" (i.e. Fortune 500s outside of banking and elite startups) is in decline, because most corporations don't exist for any purpose other than their own mindless growth at this point. Talented people don't give a shit about the default corporate mission (make rich people richer) and move through them seeking their own career goals, not caring (and why should they?) what really happens to the firms as they go. The end result of this is documented by the "Gervais Principle" analysis of Venkatesh Rao, and I continued the analysis in the "Gervais / MacLeod" series on my blog.

The "big reveal" for those of us who came of age in the past 10 years is that VC-funded "startups" are just an outgrowth, and an especially dysfunctional one, of this uninspiring system. VC-istan isn't an alternative to corporate serfdom. It's a newer and generally worse form of it: shittier benefits, less investment in employees, faster firing, worse career paths, more ageism and sexism and classism. I would actually prefer the old corporate system (with at least _some_ investment in the employee's career) seen in larger banks and hedge funds, but after having worked in tech (where most jobs become pointless after a few months, thanks to constant reorgs and broken promises) for 8 years, I've had "too many" jobs and the hedge funds aren't really an option anymore.

The big problem with the VCs is that they play _outside of_ companies in ways that would be illegal if their interactions were more documented. They collude. Even if you refuse to take VC funding, they can still destroy you by funding your competition. What they really are is a social network designed for insider trading of marginal, non-public microcaps. One of the reasons why they prefer to fund companies in their geographic areas (and, also, why VCs outside of the Valley and New York will never really matter) is that much of their collusion would be legally dangerous to them if it happened in writing, rather than informally and socially within a closed network of people they trust.

Here's why I think the future outlook is grim. The Soviet system destroyed the entrepreneurial spirit of several countries for generations. (The reason Russian business is so tightly intertwined with crime is that the people who retained that know-how were the black-marketeers.) It didn't spring back in a year or even ten, and it wasn't without some nasty conflicts even 20+ years after the Soviet system was formally gone.

The American corporate system, culminating in the VC-funded clusterfuck we see every day in Valleywag, has had similar effects. Although its decline is evident, peoples' spirits have been so thoroughly crushed that I don't see a replacement coming for at least a generation.</comment>


Why I don't use the GPL - <AUTHOR> http://www.kaybee.org/~kirk/GPL.html <comment><USER2> While I respect the author's choice, I have to disagree over the point about people contributing to the codebase.

I've spent the past two years reverse engineering products _built on Linux_ with no source code or build chain available. Last week I spent two days breaking into an embedded Linux device that runs alongside entire families of motherboards using an almost completely open stack with no attribution, no contribution and no source code release. The authors (both the OEM and the motherboard manufacturer) as far as I can tell do not contribute to any of the projects I've identified on the board from their official email addresses or in a professional capacity.

When you start looking at MiFi hotspots it's even worse. I did a talk last year at BlackHat EU on one example[1] where I finally managed to get the developers to fess up the source.

[1] - [http://media.blackhat.com/bh-eu-12/Lord/bh-eu-12-Lord- Hotspo...](http://media.blackhat.com/bh-eu-12/Lord/bh-eu-12-Lord-Hotspot- Slides.pdf)

<comment><USER3> For those interested in seeing the BlackHat video presentation by Steve Lord (hn:iuguy):

[https://www.blackhat.com/html/bh-eu-12/bh- eu-12-archives.htm...](https://www.blackhat.com/html/bh-eu-12/bh- eu-12-archives.html#lord)

At the time the idea of "required sharing" was put forward by RMS (1985 or so), it was a serious improvement over the status quo of proprietary software protected by confusing licensing terms.

Trying to redefine the terms "free," "freedom," and "liberty" to mean "restricted," "required," and "threat of legal harm" is dishonest rhetoric. The GNU/FSF should be more honest and direct by clearly describing their license as "sharing required."

The existence of a commonly used "sharing required" licenses like the GPL, and LGPL, and LLGPL, and ... has been beneficial in a lot of different ways. The primary way it has been beneficial over the years has been in how it very successfully nudges reluctant industry players towards releasing source code. The _requirement_ of sharing has shown industry the advantages of sharing code when they were previously fixated on the competitive advantages of not releasing code.

In the early days, the older BSD/MIT/ISC/PublicDomain licenses (well, public domain is not formally a license but you get the point), were insufficient to convince industry players to give up the competitive advantages of proprietary licenses and closed source software for the competitive advantages of collaboration through open source.

Times have changed, but not much. Licenses on open source code are still violated constantly by closed source vendors. It's not just a GPL problem; there's tons of proprietary closed source programs out there that fail to live up to either the "attribution" clause or the old "advertising" clause of the BSD-ish licenses. It really doesn't matter if your license of choice has an inherited "sharing required" clause, since it will still get lifted and incorporated into closed source, proprietary programs. Unless you have tons of time and money to waste in chasing the violators, your preferred license terms really don't matter.

The most interesting thing about violations of open source licenses is the reverse engineering perspective. When you're able to identify the misused open source code within an executable binary, you can then use fingerprinting of the open source to better understand the closed source binaries. If you're curious about this kind of identification and program understanding in reverse engineering, you should look into the FLIRT and FLARE features of the IDA Pro disassembler.

<comment><USER2> > The most interesting thing about violations of open source licenses is the > reverse engineering perspective. When you're able to identify the misused > open source code within an executable binary, you can then use > fingerprinting of the open source to better understand the closed source > binaries. If you're curious about this kind of identification and program > understanding in reverse engineering, you should look into the FLIRT and > FLARE features of the IDA Pro disassembler.

For Linux-based devices more often than not they use a uImage loader with one of 3 filesystems (JFFS2, Squashfs, CramFS), so once you've got around whatever encryption or encapsulation's in the image (I typically generate a picture graphing bytes to spot entropy, a technique I shamelessly stole from Don A. Bailey) you can normally run something like binwalk[1] to identify the filesystems and dd them out using a small shell script. I typically mount each resulting image and extract the contents then unmount. You can usually spot the open source bits by looking at binary names, strings and the way they're linked.

Most Linux-based devices use common distros based on SBCs with uClibc and are either ARM or MIPS based. I'm slightly biased towards ARM because of the hotspot work but there's a lot of broadcom SBCs out there running *wrt variants.

If anyone's interested, I'll be at #44Café[2] this tuesday talking about breaking into onboard BMCs used for IPMI-based management. Again, GPL violations ahoy.

[1] - <https://code.google.com/p/binwalk/> [2] - <http://44con.com/44cafe>

<comment><USER3> Thanks for the 44con invite. It looks like fun, but I'm nowhere near there. Also, your BlackHat presentation was excellent, and surprisingly, I'm actually planing on watching it again to lift the details.

I'm curious if you've touched any of the Verizon "MiFi" devices?

I've started mildly poking at a MiFi4620LE (4G LTE "jetpack") recently, but not very seriously --It's not mine personally and its on a corporate account so I've been promised (read: threatened) to not mess with it too much. ;-)

It's extremely fast but the double (p)NAT'ing is annoying i.e. it provides access to client devices via NAT to priv address space, but it's upstream interface is also NAT'ed by the carrier and in priv address space.

So far I've figured out how to talk to it over USB, but I want to get it into "stupid" mode and talk directly to its internal modem. I want it to just be a dumb modem with a public address(es). I'm fairly sure there's a way to do it, but I just need to figure out how to do it. If I can get at the serial port, then it's game over.

<comment><USER2> The MiFi4620LE is actually from the Novatel 4620L family and looks similar from what I can discern to the Novatel 3352 that I have.

Novatel are horrible to deal with. They close their platform, don't release any firmware updates whatsoever and ship broken kit based almost entirely on open source software while never releasing the source they're legally obliged to provide. You need to avoid these guys if possible.

The double NATing might be the 4G network. It's not uncommon to go from RFC1918 (you to device) to P2P device - mobile infrastructure to RFC1918 to boundary and onto the Internet.

If you take the case apart you should find a set of 5 blobs or holes usually in a row that might indicate a JTAG interface, and with a bit of kit you should be able to get your serial port. I've not looked at my 3352 yet because the case doesn't come apart easily and I've mainly been playing with a much more hackable TP-Link device (the WR-703N).

If it's like the 3352 it'll run a custom 'MifiOS' that has a ton of useless little api calls to feed javascript widgets on the web interface for things like geolocation and other pointless things.

</comment></comment></comment></comment></comment><comment> kostya-kow In a sense, GPL is not free. It is free as in "freedom for society," but it is not free in a selfish, individualistic way. It does _not_ give you freedom to not respect other people's freedom.

By using GPL, you sacrifice some of your personal freedom for the good of society.

But this is sometimes necessary for progress.

>A majority of companies have already decided that their product will be closed-source before they even started designing it.

Such a close-minded company does not deserve to benefit from FLOSS Software. If more organizations release their code under GPL, it will give this group of organizations an advantage over the once who prefer closed source license.

You can also just dual-license it, and give the companies that want to use your software in closed-source programs a chance to pay you money.

>If a closed-source company decides it could use some open-source code in its product, it will do one of two things (if the code is licensed under the GPL):

>1\. Use the open-source code and not tell anybody

>2\. Write their own code from scratch

If an essential library/framework this company wants to use is licensed under GPL, they may reconsider their decision to release software under closed- source license. And if they are so stubborn as to not even consider using FLOSS Software, then they do not deserve to exist. Newer, more innovative companies will take their place, leveraging the benefits of FLOSS.

I also think Linux's popularity over BSD kernels is a great example of why GPL is far better than all the permissive OSS licenses.

<comment><USER4> They might reconsider the licensing, OTOH it would be just as likely that this would create a market for companies to sell proprietary friendly libraries for the sorts of things that are typically available under MIT/BSD etc today.

The risk would be that such a market would tempt talent away from the open source ecosystem.

</comment></comment><comment><USER5> _I have, however, come to the conclusion that software licensed under the GPL is far from "free software"._

Not to take on OP himself, but this kind of semantic argument gets tiring.

Free Software is a name for a concept that essentially means, "all software that gives the user the four freedoms state in its definition." The whole discussion around what it means for software to really be Free is a pointless red herring.

</comment><comment><USER6> I have thought for a while that the FSF made a miscalculation with the GPL. The focus of the GPL is very much on the source code itself, as though having it was everything. I think that was a reasonable assumption to make at the time, but I don't think it reflects the current reality.

In reality, the code itself is somewhat of a liability -- a source of bugs and a time sink when you try to make modifications. What you really want is the end product and the flexibility to modify and improve it. To have the end product you don't need the source at all, and to modify and improve it the source is (nearly) necessary but not sufficient.

That has a few implications. One is that companies don't want to be burdened with source code. They would prefer to share the burden with other users, as long as they aren't giving away any competitive advantage they have. Win-win: they keep the ability to improve and modify it as they need, but unload much of the maintenance cost.

The GPL avoids a problem where people take an open source project and try to drive it away with a closed-source product that is a little better. But that doesn't really happen as far as I can see -- usually, releasing a closed- source product based on an open source project is good for both.

</comment><comment><USER7> "The company is much more likely to work with the open-source developers"

This is an understatement. When you work with an open-source third-party library/module in a commercial company, it is much easier for the company to submit bugfix patches to the open source developers. The company probably has access to a wider range of data (including proprietary client data that can't be released) but which will highlight hard to find bugs. The code is open source so it can debug the problem itself. But even if it is MIT/BSD/Apache/etc, it makes more sense for the company to send back the patches to be integrated. Otherwise, it has to maintain an unreleased patch- list and re-apply it with every version update. If it does not apply cleanly, it has to spend resources to update the patch to the changes in the new version. It's developer time the company can use for better things.

Knowing this is one more reason I am also more likely to choose code released under a permissive license than under GPL. I figure all things being equal, it is probably better tested, better code.

<comment> kostya-kow >The code is open source so it can debug the problem itself. But even if it is MIT/BSD/Apache/etc, it makes more sense for the company to send back the patches to be integrated. Otherwise, it has to maintain an unreleased patch- list and re-apply it with every version update. If it does not apply cleanly, it has to spend resources to update the patch to the changes in the new version. It's developer time the company can use for better things.

It would be much easier for those companies to contribute upstream, instead of abusing loopholes in GPL.

</comment></comment><comment><USER8> The reasons cited in the article are exactly why I release software under wtfpl using a moniker.

Any of my code that I deem worthy of ridicule by the software community should be as easy to use and modify as possible. The only way that I've found for the purist in me to be satisfied is to allow complete freedom in the usage of code that I produce.

</comment><comment><USER9> As a copyright owner of source code,its important to know there are two kind of users of your code,"end users" and "distributors".

Any person who get the restrictions of the GPL is,by definition,"a distributor" and GPL does not exist to protect and serve their interests and that is why "distributors" complain about it.

If you are primary customer is "end users",then GPL is the right license for you,if your primary customer is "distributors",then BSD type of a license is a proper license.There is a reason why both licenses exist,they serve different purposes.

You changing from GPL to BSD type license could be an indication of you changing who your primary audience is.

</comment><comment><USER10> What I don't like about GPL is that nobody can define "link" without implementation detail.

I think there is no difference between linked modules and modules which are connected by TCP/IP.

<comment><USER11> While you may think so, GPL is based on copyright, and it's what the copyright law and courts say which count. Linked modules contain code covered under copyright and hence is regulated by the GPL. A connection via TCP/IP does not.

It would be odd indeed to connect to Facebook's web site via TCP/IP, and claim that the Facebook system and my TCP client code are all part of one system, so Facebook has violated my copyright.

<comment><USER3> If you're curious about the legal side of linking in non-C languages, the following legal analysis of the LLGPL (Lisp Lesser GNU Public License) is an interesting read:

<http://www.ifosslr.org/ifosslr/article/view/75/146>

</comment></comment></comment><comment><USER12> There was an good discussion on this topic earlier today, but somehow it disappeared from the front page of HN:

<https://news.ycombinator.com/item?id=5580972>

</comment><comment><USER13> I learned not much new from this. People have made this claim for years. The author isn't some visionary for figuring this out, and I assume he doesn't think he is. The point about financial benefit was interesting, however.

<comment><USER14> > People have made this claim for years.

Indeed, and this was published in the Linux Journal in 2002. It is an old boring argument, it even includes the words "I'm not just trying to start a holy war here", echoing the famous cut and paste Slashdot troll. Georgecmu, who has over 6500 karma and who's been here quite a few years, knows exactly what he's doing: trolling (and I have flagged this submission as it's so obvious).

The Free Software Foundation is not half as dogmatic as people think either. They have released software under MIT, and have a huge list of licences they consider to be free. Pick the one that works for you.

<comment><USER5> Stallman himself has advocated for non-copyleft free licenses when he considered they would increase the total user freedom (particularly, by helping Ogg take on MP3).

<https://lwn.net/2001/0301/a/rms-ov-license.php3>

</comment></comment></comment><comment><USER15> People have different viewpoints of what freedom means.

I am not against the GPL but I haven't used it on anything for 11 years and would be less inclined to use a product if it is GPL and I'm thinking about modifying it.

</comment><comment><USER16> 3\. Offer proprietary licences to companies who wants to use it in a proprietary product. The x264 devs makes money on their GPL licenced code this way for example.</comment>


Adware vendors buy Chrome Extensions to send ad- and malware-filled updates - <AUTHOR> http://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/? <comment><USER3> I was thinking about this just the other day. The movement towards auto- update-everything is a massive security breech. Browser extensions are a prime example. So much of what we do is centered around the browser, and yet we allow essentially random pieces of code complete access to all that activity. Even worse, this code is allowed to download and run new versions without any user interaction. Needless to say, the potential for harm here cannot be understated.

Auto updating anything but the most critical and most trusted software is absolutely bone-headed and we're going to look back and wonder how we could be so stupid.

<comment><USER4> If a piece of software can connect to the internet, it can implement its own autoupdate. For extensions it would be trivial. People even commonly did it with Greasemonkey scripts.

The reason Chrome includes this functionality is because the hand-rolled solutions people come up with frequently have security problems.

Also, auto update gives good developers a way to fix their own security bugs when they are discovered.

<comment><USER3> We should be asking ourselves why we allow extensions with so much power and no meaningful security model. Auto update is a misfeature if I've ever seen one (again for anything but the most critical pieces of software).

<comment><USER4> Autoupdate is not a "feature", it's a consequence of Turing completeness combined with network access. Any platform that has these two properties has autoupdate, and there's no technical way to prevent it.

The autoupdate feature exposed to Chrome extensions is not there to make autoupdate possible, it's there to prevent developers from shooting themselves in the foot by implementing their own autoupdate insecurely. It's similar to a platform providing crypto libraries rather than letting developers implement crypto themselves.

The only way to try and prevent software from autoupdating is with manual review, which is what Apple does with iOS. However that has a whole other host of problems.

As for security model: I don't know how to measure "meaningful", but Chrome extensions have the most fine-grained security model of any extension platform. In fact, it is more fine-grained than most general purpose software platforms:

[http://developer.chrome.com/extensions/permission_warnings.h...](http://developer.chrome.com/extensions/permission_warnings.html)

The problem that started this thread is real, but it is not solved by disabling autoupdate (which is impossible) or adding more "security model" to the platform.

In fact the problem is very deep: How do you balance the desire to allow flexible software on your platform (adblocking, network stack interjection, manipulation of the user interface, etc), with the desire to limit the potential harm malicious actors can do? These two goals are in conflict. Existing best answers that humanity has come up with include some combination of "manual or automated review", "social signals" (stars, reviews from your network, etc), "blacklisting", "controlling access to the platform" (iOS apps can only be deployed in large numbers through the store), and "limit the power of the platform where possible with clever user interfaces" (the file upload button in HTML is a classic example).

<comment><USER3> I can't help but roll my eyes at these "turing completeness" arguments. The obvious way to prevent auto updating is to simply disallow an extension from modifying its own storage and to prevent it from running any code it manages to download. We don't operate on abstract turing machines, we can impose whatever limits we want on the code we allow to run. Now, I'm not saying this is easy to accomplish, but impossible it is not. If Google can manage to allow machine code downloaded over the internet to run securely like it claims, I'm sure it can handle a little javascript.

<comment><USER4> "The obvious way to prevent auto updating is to simply disallow an extension from modifying its own storage and to prevent it from running any code it manages to download."

You can remove eval() (In fact eval() is disallowed in Chrome extensions, for different reasons).

But how do you prevent an extension from including an interpreter for some other language and simply downloading and interpreting code in that language? This isn't crazy. It's common for games to include interpreters, for example.

Including an interpreter for a simple language is just one step in complexity beyond downloading configuration files. Is downloading configuration files that change the behavior of the code forbidden in your proposed system too? How is that accomplished?

"If Google can manage to allow machine code downloaded over the internet to run securely like it claims, I'm sure it can handle a little javascript."

NaCL has the same properties I'm describing. NaCL enforces a sandbox on what a hunk of code has access to; it doesn't enforce that that code won't change its behavior over time, possibly in response to data from the network. That is not possible to do.

<comment><USER3> What you say is certainly true in general, but it doesn't take into account the threat model of a supposed malicious extension. The threat model here is that someone decides to significantly alter the behavior of an extension _after it gains traction and a certain level of trust_. For this to work would require the extension to include an interpreter or some other mechanism from the start. They would essentially have to think "if this gains traction I may want to start silently injecting ads/stealing information, so why don't I include this interpreter in it now just in case". While possible, it isn't very likely.

The other problem with the security model is that all extensions are seemingly created equal. I would think that a large majority of extensions do not require access to any external resources besides the ones downloaded from the webpage itself. Think of a youtube downloader, flashblock, etc. These types of extensions should have a different security model that is constrained to restrict any web request calls besides to the domain of the page and perhaps any domains that page calls (to take into account cdns). These types of extensions shouldn't need any consideration of security implications to install. There's no reason why a youtube downloader should have the potential to steal my passwords down the line. More involved extensions that would require generic http requests could have the warning about data access.

I see in your profile that you know a thing or two about chrome extensions, so I will defer to your expertise on whats possible. It just seems like with the proper constraints for different levels of access one can have much greater security than we have now just treating all extensions the same.

<comment><USER4> If we didn't provide an autoupdate mechanism, then developers would just implement their own. Frequently, these handrolled systems would have security flaws. We have an existence proof of this: it happened in the Greasemonkey ecosystem.

We might propose that we could prevent these hand-rolled systems by restricting eval(). Well, we already restrict eval for different reasons. What we see is a lot of people working around the restriction by injecting code into websites (!!).

My bet is that basically any significantly sized extension would implement a workaround for any autoupdate restriction we tried to employ. Developers really like the ability to update their product, and the workarounds are not that hard. And these workarounds would be worse than the original problem - that sometimes good people turn bad.

It would also destroy the value that autoupdate provides which you are forgetting about: most of the time it is used by good people to do good things. We frequently find extensions with security problems, tell the author, and then they fix and push them to users. Without autoupdate this wouldn't be possible.

===

As for your proposal for how to restrict the levels of access extensions have... As I said above, we do this kind of thing already. You can read all about it here: [http://developer.chrome.com/extensions/permission_warnings.h...](http://developer.chrome.com/extensions/permission_warnings.html). We have a very granular security system.

For example, it has been always been possible to write a youtube downloader Chrome extension that only has access to youtube.com.

Flashblock would theoretically be possible with the upcoming declarativeWebRequest API ([http://developer.chrome.com/extensions/declarativeWebRequest...](http://developer.chrome.com/extensions/declarativeWebRequest.html)).

However designing the right APIs that have narrow risk, yet are flexible enough for developers to want to use remains a difficult problem that is unsolved except in specific cases.

<comment><USER3> Thanks for the info. I had no idea chrome had that, I don't think I recall installing an extension that DIDNT give me a warning about access. It seems like developers just stick to the more unrestricted system out of convenience or narcissism ("must phone home my youtube downloader, for science!"). There's definitely something out of whack here if developers won't use the restricted access when their extension fits nicely within that model. It would be nice if it could be shown that extensions are penalized in terms of downloads by requiring unnecessary access. As it is I've stopped using all extensions in chrome except adblock.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation.

Not to mention we need better and finer grained permissions for extensions in general, now that we use so many web apps with crucial data.

<comment><USER6> I achieve this by having multiple users in Chrome. My main user is signed into my google account and has no extensions installed and all plugins disabled, I only access gmail and google services with it.

My second user account is logged into basic services like HN, reddit, amazon and has only adblock and disconnect installed.

A third user is not logged in anywhere and has adblock and a half-dozen other extensions installed including UA switcher. No plugins installed and cookies + cache cleared every day.

4th user has all the anonimity extensions installed and has privoxy + tor set as the proxy

I use Facebook in a completely different browser again, YouTube and video watching in yet another and development in chromium.

7 or 8 different cookie stores, and a throwaway temp email account associated with the 3rd and 4th user for signing up to services.

Start out by creating a separate user for browsing sites and eventually develop your own way to split up your web browsing profiles.

This can get a bit messy when you try and access from tablet or mobikle , but I'd rather not have a single large profile and a huge exploit surface and sacrifice browsing history and remembering passwords.

<comment><USER7> What exactly are you trying to achieve with that, if I may ask?

<comment><USER8> What exactly are companies trying to achieve with very precise, self-healing tracking methods?

<comment><USER7> Serve you more relevant ads? I don't really know. Which companies do you mean anyway? And what are these self-healing tracking methods?

</comment></comment></comment></comment></comment><comment><USER9> From the comments:

      It sounds like Google needs to flag ownership changes and NOTIFY USERS about them
      before the next auto-update of that extension.

      </comment><comment></comment><comment>
      NoteBuddy has been transferred from Joe Garage to Russian Mafia LLC.
      Do you want to keep this extension enabled?
      [ Da ] [ Nyet ]
      </comment><comment>-----

      - <USER2>

While this may seem like the most convenient step, it's actually not that simple either. The majority of users don't want to be notified of too many things and more notices may just be ignored. This is especially true of users with many extensions. As an alternative, it's possible to put extensions into a probationary period (I don't know if they already do this) when it's first created or the ownership has changed.

Extensions are reaching the wild-west of Play and no one's happy about that except malware/adware authors. If Google continues to serve more free users than their quality capacity (already a problem with every other service they offer), it won't be long before people move on.

And they will move on. Contrary to what most people believe, no one rules one domain forever. Whether it's the big iron of IBM, telecom of Bell, OS of Microsoft or the services of Google. Someone else will eventually wrestle in on your domain.

</comment><comment><USER10> This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto- updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If I had to pick the one most annoying thing about running Windows, that would be it. The biggest appeal to me of Chromebooks is silent auto-update of everything. Don't bug me about updates, just make everything always run the latest, most feature-filled and bug-fixed versions.

I'd lean towards using a finer-grained permission model for extensions, and javascript in general. As far as I know, most extensions now can only request permissions to run arbitrary JS on every page you visit, and send arbitrary AJAX to any URL. Perhaps we could do a better job of locking that down. Have no such thing as a permission to AJAX any URL, but instead make AJAXing any particular TLD a new permission. Maybe we can also only allow access to DOM elements originating from particular domains. Then you could keep auto-update, but require a new user authorization for any new URL/domain access that an extension needs. It'd probably get pretty complex, but I think we could put together something reasonable. But then the other problem is the pile of plugins out there already with those arbitrary permissions. Maybe you could let them stay, but not allow any updates without switching to the new permission model?

<comment><USER11> Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating _but_ with some kind of human quality assurance. Two systems that manage to pull that off from very different cultural/economic starting points are Apple's app store, and Debian's software repository.

The Google model of an auto-updating but un-QA'd app store doesn't work for me, because it combines two things I really don't see as compatible: 1) low- friction updates; and 2) installation of arbitrary un-reviewed code from the internet. If you're going to do #2, then I _want_ the friction of downloading a new executable. I want to go to a website, see if the company still exists, read the release notes, generally be cautious about installation of random executables off the internet. But if you're going to do #1, then since the updates are supposed to apply without significant review by me, _someone else_ has to be vetting what goes into the repository for at least minimal non- evilness standards.

<comment><USER12> This is what happens with AMO-hosted Firefox extensions. Whenever the extension author pushes out an update, it first has to go through review as described at [https://addons.mozilla.org/en- US/developers/docs/policies/re...](https://addons.mozilla.org/en- US/developers/docs/policies/reviews)

</comment></comment></comment><comment><USER13> I had similar problem few days ago ...

I'm using "Super Awesome New Tab Page" for Chrome, and since few days ago random ads started popping on youtube, ebay, dx.com, amazon etc ... Took me ~30 mins to figure out which extension it was, and removed it... They also injected <script> tags to ALL websites I visited (that loaded external JS), tracking my history and they could easily put any form/input logging and silently insert keylogger into my Chrome if they wanted. I have reported the extension then, but nothing happened yet.

Link: [https://chrome.google.com/webstore/detail/awesome-new-tab- pa...](https://chrome.google.com/webstore/detail/awesome-new-tab- page/mgmiemnjjchgkmgbeljfocdjjnpjnmcg/reviews)

</comment><comment><USER14> That shouldn't come as a surprise to anyone who has an app on any app store. I get at least two emails per week from some shady advertiser that wants to place ads, add notifications, gather user data or some else equally awful.

I had at least one app where I didn't pay close enough attention to the permissions it required upfront and at some point it started injecting ads into random pages (it was a stopwatch, by the way). I guess the only way to effectively counter this is a better permission system.

<comment><USER15> While the app developers may not be surprised, I strongly suspect the overwhelming majority of app _users_ are.

And for Google to allow this to happen is unconscionable.

</comment></comment><comment><USER16> I was contacted and offered some payments to start including some sort of ads in my Chrome extension. As I understood it, it would inject ads and/or replace links on web pages with affiliate links.

I declined their offer.

<comment><USER9> That's just creepy. Replacing page content, unless ad/spam blocking or specifically user-selected filtering, is completely unethical and totally falls under malware in my book.

Good on you for turning that down. You've saved your users a lot of aggravation.

<comment><USER15> If you think about it: as formulated, virtually _all_ present Web advertising works via content injection. You're just (nominally) limiting who gets to insert content.

</comment></comment></comment><comment><USER17> First, Chrome needs to alert the user before updating an addon that has changed owners, and the default should be "do not update". This change should be pretty uncontroversial.

Second, Google needs to modify their policy towards Chrome addons to disallow ad injections and all user tracking.

There should be a clear demarcation between addons and "apps" in the Chrome store. Apps can be legitimately supported by ads. Addons shouldn't be.

</comment><comment><USER18> Going through the few extensions that got caught doing this, I've noticed a commonality: Ecosia. This 'charity' is paying app developers to install adware.

</comment><comment><USER19> I think Google are already taking steps to address this.

* [http://blog.chromium.org/2013/12/keeping-chrome-extensions-s...](http://blog.chromium.org/2013/12/keeping-chrome-extensions-simple.html)

</comment><comment><USER20> It's not just a DOM change problem. What if an extension change owner and start sending pairs (domain/user's credentials) to someone else? What if one buy an extension to get bank sites accesses?

<comment><USER21> What's surprising is that extensions are by default not "Allowed in incognito", however they are allowed when using HTTPS and there is no option to disable them there.

<comment><USER22> if adblock didn't work on https that'd be one way to see it massively deployed ;)

</comment></comment></comment><comment><USER23> I would like it if the browser's DOM view would highlight changes made by an extension (at least directly; if the user injects JavaScript, it might be easier to just show that JavaScript rather than the changes that that code made to the DOM.) Also, it should log it (although this may create security concerns) so that one could occasionally look over what their extensions are doing.

Similarly, there should be a log for AJAX requests made by the extension directly.

</comment><comment><USER24> I wouldn't be surprised if some of the instances of this happening was the result of the original extension writer trying to boost his bottom line. (And not the work of shady malware marketers).

It's easy to convince yourself you have been cheated when you know your extension has over 1M+ downloads and you only have ~!$100 sent to your donation button.

<comment><USER25> I forked an extension released under MIT license because of this -- original author pushing shady updates.

After I re-released it on the Chrome Store, now I get emails trying to buy "my" extension from me.

<comment><USER26> That sounds like a fine grey-hat tactic. Fork existing extensions, generate several thousand fake installs. Then sell to the first bidder. Rinse & Repeat and you'll make a profit and turn the market for second hand extensions into a market for lemons.

If it happened enough the buyers would start being more cautious. The bar for minimal installs will go up and more proof will be expected. Soon enough the buyer's intentions will be clear to any extension owner.

<comment><USER21> I wouldn't be so optimistic.

> The bar for minimal installs will go up and more proof will be expected.

 _Or_ the Store would be flooded with infected cloned extensions that some idiots will install anyway.

> Soon enough the buyer's intentions will be clear to any extension owner.

That's not the problem: developers could trivially be informed of this risk when they submit their extension on the Store.

</comment></comment></comment></comment><comment><USER27> I have the feeling that every "good" message about Chrome is followed by a disastrous one. This time it was the funky "audio feature" on tabs, followed by this. Chrome developed a scary creativity with good and evil stuff. I used Chrome once because everybody was telling me how fast it is. It wasn't. People just couldn't add all the processes properly. Since then it was a roller coaster I won't jump on anymore. I use Opera as an reference alternative to FF.

btw: my parents end up with Chrome every time I come by on the Windows. Installed through some update (Java maybe?). Is there any way to block this without taking all installation rights from them?

<comment><USER28> > my parents end up with Chrome every time I come by on the Windows. Installed > through some update

My guess would be the tooltip-like thing that Google puts on its search page telling them to "make the web better with Chrome." I've never clicked on the thing, but it probably changes your default browser and installs a bunch of shortcuts.

</comment></comment><comment><USER29> I've been informed that Chrom Extension advertising malware is a highly efficient and key source of money laundering. The market size of this is only limited by Google Chrome users. This is just the tip of that iceberg.

</comment><comment><USER30> I created an extension for Facebook that had 30k active users. I sold it after I was contacted like this. I was suspicious immediately from the outset about who the buyer was, but I figured I'd sell anyway as it took me about an hour to write. Strangely the app was deleted from the store within an hour of my purchase and has yet to re-appear: [https://chrome.google.com/webstore/detail/facebook-chat- fix/...](https://chrome.google.com/webstore/detail/facebook-chat- fix/ojeeafjafadjmbpojlogpipohgkpplkk)

</comment><comment><USER31> How about a little 'Stranger Danger' prevention as well?

Don't run extensions from sources you don't trust in a browser profile you need to trust.

I have one profile for development and one for browsing. development browser can get any old extension but the normal browser gets extensions from known, trusted companies like Google and LastPass.

</comment><comment><USER32> OT: Honey developers (a popular Chrome extension ~ 700k user) was approached by malware companies and are doing AMA on reddit

[http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the...](http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the_developers_of_a_popular_chrome/)

</comment><comment><USER23> The browser (or an extension if possible) should include a list of extensions sorted by when they were last added/updated.

Beyond helping determine why you're now seeing extra ads, this could help debug why certain sites are no longer working.

</comment><comment><USER33> It's surprising there are still people foolish enough to believe Google cared about privacy when their business model depends on monetizing people trading their life's intimate details for services.

</comment><comment><USER34> Obligatory note: Another example of why we should only run Free Software and only from trusted sources. Users of Trisquel or gNewSense never have problems like this.

<comment><USER35> Obligatory response that not everyone has time or training to examine code for problems. Google is a trusted source.

<comment><USER36> >Google is a trusted source

Hardly, if this kind of thing is allowed in their marketplace.

<comment><USER35> You're missing the point. Google and Apple are trusted sources in the real world. In the real world, people say things like "I have an Android" and advertisements say "Get a free Android with contract" If the distinction there is lost, I don't think you can expect the general consumer to know that Google isn't a "trusted source" by the definition of FSF advocates, right? Nor, I would contest, that they need to.

>Hardly, if this kind of thing is allowed in their marketplace.

They'll move on this just like they started actively patrolling the Play Store for malware. Because they are a trusted source, even if they aren't an FSF definition of trusted source.

</comment></comment></comment></comment><comment><USER37> While on the subject of Chrome Extensions,could someone explain why? the React: Dev tools extension has Incognito mode.

</comment><comment><USER38> Being the solution to the problems you create.

</comment><comment><USER39> auto updating the extensions is not a good idea.

</comment><comment><USER40> Why use any extensions _ever_?

<comment><USER41> Because extensions can provide useful functionality that's not provided by the browser. For instance, ad blocking or developer tools.

<comment><USER40> Chromium has all the dev tools I need OOTB. Adblock? Perhaps one risk I'll take on extensions. What else? Nothing. Unnecessary shit for people who want to configure every detail but can't be bothered to hack it themselves with uzbl or one of its equivalents.

</comment></comment></comment><comment><USER42> Hey Google, knock it the fuck off.

</comment><comment><USER43> There is an easy solution:

Follow [http://superuser.com/questions/290280/how-to-download- chrome...](http://superuser.com/questions/290280/how-to-download-chrome- extensions-for-installing-in-another-computer) in order to download the crx file manually.

Then unzip it and vet it manually to be clean.

Copy it in a folder, enable extension developer mode in Chrome and install the local copy of the extension.

No autoupdate, everything's fine.

Unfortunately Google plans to disallow local extensions, which is a major disaster and very evil: [http://thenextweb.com/google/2013/11/07/google-block- local-c...](http://thenextweb.com/google/2013/11/07/google-block-local-chrome- extensions-windows-starting-january-limit-installs-chrome-web-store/)

What happened to that?

<comment><USER44> I mistakenly installed a Minecraft modloader for my son without checking it out first. It silently installed a couple of local Chrome extensions that injected ads in every page. It would reinstall them (again, silently) every time you deleted them. It wasn't detected by Microsoft Defender or Avast until I ran Malwarebytes which took care of the problem.

So, pardon my french, but no freaking way do I want any local Chrome extensions allowed by default anymore.

For extensions from the Chrome store, perhaps Chrome should make updates more like on Android, where you are notified and can click for more info.

<comment><USER45> If you are running arbitrary code on your box, then local installed Chrome extensions aren't the real problem now, are they?

That code could, I dunno, run a local HTTP/S proxy (install a trusted cert) and MiTM your HTTP requests and inject ads that way. Or about a million other things.

And it's funny Chrome is trying to prevent apps from doing that, when they themselves do the same thing: In Windows, pinning to the taskbar is supposed to be user-only. But Chrome circumvents that and pins anyways, actively avoiding user preference. (And they drop an icon on the desktop, without asking.)</comment></comment></comment>


Judgement: A managerial quality that is hard to define but important to possess - <AUTHOR> https://www.economist.com/business/2020/07/18/a-question-of-judgment <comment><AUTHOR> [https://archive.vn/XdhlV](https://archive.vn/XdhlV)</comment>


GitHub new UI for repositories. More round and code is not in the center - <AUTHOR> https://imgur.com/a/939oZRy <comment><AUTHOR> Why from all the positions possible, they had to put the Sidebar to the right? In the PR Sidebar in the right is ok, because all the items are actions, but in the landing page, it feels awkward</comment>


Can one get good at programming while working as a programmer full time? - <AUTHOR> My weird question needs context.Here's my story. I learned how to program early in high school and made some interesting things, like a parser that turned text files into text-based adventure games and a framework for making tile-based games like chess, go, and nethack. When I was 15 though, I turned away from programming and went into physics in math because while I found programming to be "fun", I thought science was more fufilling.
In college, I majored in math and physics and went hardcore into wannabe academic mode, but in my senior year I realized that I actually like programming more. Fortunatly, I had enough CS classes "just for fun" racked up that I'm going to be escaping college with a degree in CS. I'm not a good programmer yet. I have OK fundementals, I know what I need to do to get better, and I know that im smart and motivated, but im just not good yet. The coolest thing I ever wrote in my life is the parser I mentioned above.
I have a job lined up at Bloomberg. Im going to be an overworked software grunt at a second tier firm. Im unsure if it'll be possible to learn all the things im interested in while working at such a place, get good, get recognized, and then move on to doing startups or working at microgooglezon. It seems to me like everyone I know who is good at code got good by the time they were my age, in the bastion of infinite free time known as college and high school. Input? Advice? <comment><USER2> I was just like you, only I was just lazy in college and high school.

Now, I take the train to work, and try to keep up a github streak with projects and learnings. I suggest you download SICP, and try to get done one exercise a day. If there is too much reading to finish in one day (I only spend about 25 minutes a day) then type up the sample code and a paragraph about what you read, and commit that.

The streak is a powerful motivator.

[https://github.com/steveshogren](https://github.com/steveshogren)

The trick here is SICP is easy to start and stop, and by chapter 4 you'll have a huge amount of general purpose programming skills. Don't let the lisp scare you, SICP is the best JavaScript/PHP/Java/C#/Python/Ruby book I've ever read (assuming you already know the syntax of those). Once you've put some good milage on that, you can mix in other great books too. The goal here is to build up your skills slowly over years, not cram over weeks. Just like lifting weights or becoming a world class musician, becoming a world class developer takes dedicated time and deliberate practice.

I've been sailing the good ship Github Streak for 300+ days, and in just that time I feel like I've doubled my skills and speed. The best part? It's not just SICP, I've done a half dozen great books in that time (25 minutes a day * 300+ days adds up fast) and I have no intention of stopping.

Message me if you have any questions, I'm always happy to help a fellow person on the journey to being a better developer.

I wrote up a longer form here: [http://deliberate- software.com/streaks/](http://deliberate-software.com/streaks/)

<comment><USER3> I'm curious, you ended a 330-day streak two days ago. Did you intentionally end the streak, or did something keep you from committing? Or maybe you commit locally and just haven't pushed the last few days' work?

I think the decision to end a streak can be as important as the decision to start a streak. Consistent work is good, but work out of a sense of obligation can hinder progress. I accidentally broke a streak a while back, and it was really freeing to not feel like I had to make a commit every day.

<comment><USER2> I haven't pushed. That is the benefit/detriment to coding on the train: no internet. Right now the streak is still valuable and not oppressive. As long as I'm taking the train to work and have a working laptop it's not hard to keep up, perhaps if things change I'll consider ending it.

I think there is some obligation, but usually I only feel that about the book or project, not the streak. I did about a month solid of SICP, and last week started to feel a little burnt out, so I started a "for fun" project to help take the edge off. I'll do that to "recharge" until I'm feeling more energy to tackle the next minor section of SICP.

</comment></comment></comment><comment><USER4> Something I feel that has somehow not yet been addressed by this thread is surroundings.

I initially came to CS with an undergraduate degree in a humanity, this has (despite some years of good achievement) left me with with a constant fear of being left behind in irrelevancy. This has made me always look at my current employment as wondering if it furthers my CS narrative.

Thankfully for the time being unemployment in CS is pretty low. Treat your new job as a chance to harden some of the skills you have been learning. But the most important thing you can do is find the next RIGHT job, I have found that the most consistent way to improve your skill set is to work places where you feel like you are the dumbest person in the room and wonder why they gave you a chance. When you don't feel that way any more, it may be time to leave (assuming learning and growth is your number one priority).

Ultimately what that rambling paragraph gets at is... if you aren't learning from your job then you are losing out and you should leave.

Think about working actors in Hollywood these are the actors you recognize in almost every movie that are constantly recast to play basically the same character in a story. At some point in their careers they got type cast and the only way that they can continue to make money is to work as much as possible. If your goal is to continually grow as a programmer you have to figure out how to be the A list actor who is always surprising people. Developing a narrative that showcases your intelligence and adaptability is the most important thing you can do right now.

<comment><USER2> This is really good advice! For my first three jobs, I ended up leaving just as I started to feel a deep mastery, roughly two years in. All were really different and I felt like I had to scramble just to not get "caught" in how unprepared I was. Every one of my jobs since has been like that, each one a big move up in complexity, pay, and skill of my teammates.

As soon as you are the best developer on your team, chances are you'll get comfortable and stop growing. I think the most important skill I have right now is a powerful flexibility that comes from a broad set of experiences working in a variety of languages, frameworks, and domains. In six years I've written and maintained code professionally in: Perl, Java, PHP, Python, Ruby, VB6, VB.NET, C#, and F#. And I've worked in banking, educational kids games, magazine printing and sales, event tracking, and school financial aid.

It's easy to think you're flexible and adaptable if you've only ever learned one language and you are comfortable where you are. I've known and hired developers who were supremely confident in their adaptability (but only had a lot of experience in one place) who, upon moving from a "level 1" job in x language to a "level 2" job in y were broadsided with things as simple as syntax, in some cases quitting to go somewhere else to make less! Or like one guy I worked with, he loved Python and would constantly talk up how great it was and better than .NET. I finally said, "great, I love Python, let's do something in it!" We got about twenty minutes in when he realized Python is duck typed and decided Python sucked.

The problem with both of them is they'd really only ever worked in one language doing things one way for the same amount of time I'd worked three different jobs, and they didn't know how to adapt and be uncomfortable.

</comment></comment><comment><USER5> The thing is, "everyone you know who is good at code" is mostly people your age. So, yeah, they got good by the time they were your age. But that's just an artifact of the sample set.

No offense, but those people who are your age who you think are good, well, they mostly aren't that good yet. They may be good enough to hack something out for a startup. The startup may even take off. But for building maintainable code that can sustain a company for the long haul, they probably need to learn a few more things...

<comment><AUTHOR> This...makes a lot of sense. I'm not sure why the idea didn't occur to me before--I guess its hard to reason logically when you're disturbed by something emotionally sometimes :P. Thanks.

</comment></comment><comment><USER6> First off, programming is a Red Queen Race. Anyone deciding "I'm good at programming _now_, it's going to stay like this forever" is sorely mistaken. Without continuous improvement, programming skills are at least _stagnating_ \- not good when the rest of the universe is _evolving_. So, "getting good at 18" is no guarantee of anything.

Also, there isn't a programmer encompassing _everything_ \- so I'd suggest, in your free time (of which you may have less, I admit), starting a hobby project (or joining a project) which would be radically different from what you're doing as a job. E.g. doing web frontend coding? Try low-level hardware systems (Raspberry Pi), or image detection, or emulation of ancient systems, or perhaps something integrated into RL ("Internet of things").

<comment><USER2> I totally agree, you can't just set a goal and aim for that, chances are by the time you're there, everyone will be racing off to the next thing. Better to setup a habit of constant improvement, and soon you'll be the one leading the pack.

</comment></comment><comment><USER7> At least you have "cool" degrees, if you were a business mayor, it would be even worse. I am not sure what are your expectations workwise in startups world, but so far I could easily talk to (even advise) most of the programmers I met (and I am a business mayor). So, my guess, but it's a well thought guess, is that you are already a top choice by raw skill, however, the chance that somebody will trust you with quality programming work without a github or a programming/CS background are very slim.

This is rather ironic given the focus on skill that this industry seems to have. On another note, the fact that you (and me) have no github profile with at least a good polished project under the belt might imply lack of motivation/interest.

</comment><comment><USER8> Change your attitude about the job you're going into. I guarantee you can learn plenty working at Bloomberg. Based on what they sell I'd guess they put a huge emphasis on reliability. They probably also maintain a lot of legacy code. This stuff may not be sexy but you can build important skills working on it. There will be good programmers at your new workplace. Work hard and learn from them.

</comment><comment><USER9> One of my favorite essays from HN:

[http://sivers.org/below-average](http://sivers.org/below-average)</comment>


How Vitamin C May Help Cancer Treatments Work Better - <AUTHOR> http://time.com/4718630/vitamin-c-cancer-treatment-chemotherapy/ <comment><USER2> DrWhitaker.com states, "… vitamin C is a potent antioxidant that has the power to boost immune function, increase resistance to infection, and protect against a wide range of diseases. But there's an entirely different and largely unknown role of vitamin C, and that is its ability—when administered in very high doses by intravenous (IV) infusions—to kill cancer cells. … Best of all—and unlike virtually all conventional chemotherapy drugs that destroy cancer cells—it is selectively toxic. No matter how high the concentration, vitamin C does not harm healthy cells."

Dr. Whitaker continues:

"The only way to get blood levels of vitamin C to the concentrations required to kill cancer cells is to administer it intravenously. … For example, 10 g of IV vitamin C raises blood levels 25 times higher than the same dose taken orally, and this increases up to 70-fold as doses get larger."</comment>


Ask HN: What companies were rejected from YC and became successsful? - <AUTHOR>

Some of us will get rejected by YC in a few weeks. Here's a thread to help you keep yourself in the game despite a rejection.
Successful is a relative term, but basically I mean they raised capital, had an exit, or are making significant profit.
If you could write what kind of success they received, that would be awesome as well.
Some examples I found
Storenvy - Raised 1.5 m
SendGrid - Went through TechStars after rejection. 21.6 million series B. <comment><USER2> That's a really good question...

But Y Combinator isn't really about looking for successful companies. They're looking for rockstar founders, probably destined for success, that when put together will create "scenius" (i.e. An awesome geeky fraternity).

</comment><comment><USER3> There are some more here: [http://www.quora.com/Y-Combinator/What-are-some- successful-s...](http://www.quora.com/Y-Combinator/What-are-some-successful- startups-that-were-rejected-by-Y-Combinator/)</comment>


Scientists find mysterious galaxies that don't have any dark matter - <AUTHOR> https://www.mnn.com/earth-matters/space/stories/scientists-find-myserious-galaxies-dont-have-any-dark-matter <comment><AUTHOR> Nature Astronomy paper: [https://www.nature.com/articles/s41550-019-0930-9](https://www.nature.com/articles/s41550-019-0930-9)</comment>


Ask HN: Balancing interviewing and day job? - <AUTHOR> I'm currently working as a software engineer, and I'm looking for a new role at a new company.  I've reached the later stages of interviewing with multiple companies, and every single company wants an on-site interview for 4-5 hours.
How are you supposed to manage that with a full time job?  Vacation days? Sick days? Flexing your hours?
I'm sure there are multiple ways to do so, but I'd love to hear some advice from those of you who have been through the process. <comment><USER2> Well, if you've got multiple companies, explain the problem to each of them. The one with the best answer for how they will work with you is the one who gets first crack at interviewing you. The rest get in line.

<comment><USER3> This may be good advice. But what if one of them is "big advertising tech company" and you have meta-reasons for wanting to work for them (future signalling for example) but they ain't too accommodating on the interview side of thigns.

<comment><USER4> Your reasoning about this company may be a wishful thinking.

<comment><USER3> This is not about the company so much as the street cred of having worked for them

<comment><USER5> There are plenty of jobs that don't require Google on the resume.

</comment></comment></comment></comment></comment><comment><USER6> Sick days, doctor's appointments, car repairs, waiting for the cable guy. Virtually any excuse will work.

<comment><USER7> in regards to sick time keep in mind that you do not have to tell your employer any health related information

</comment></comment><comment><USER8> What really gets me is the time it takes to do the interview.

I get needing 2-3 to confirm prowess and answer all of the logistics of the working relationship, but it seems like there is waste somewhere.

I'm probably just impatient, but I'd welcome feedback on if that's just a Me thing or if most people find nearly half a day spent interviewing to get old pretty fast.

<comment><USER9> No, it's not just you. Spending half a day to interview because some higher up wanted "top tech talent" is beyond ridiculous. (Not average people that can still do the job, oh no, it HAS to be "TOP tech talent".) There is no reason why the interview should take more than 2-3 hours (and that's on the extreme side) where everyone involved just sits in the same room and takes notes.

<comment><USER10> The bigger issue is what happens when someone commits terrible code and makes bad architectural decisions. Firing someone is hard, but firing code that is in active use is even harder and in some cases not possible.

<comment><USER9> True. I have had cases where prior poor judgement has placed whoever I was working for in a hard spot.

</comment></comment></comment></comment><comment><USER11> I "worked from home" a lot while interviewing.

Additional reasons I did't go in included having errands to run and not feeling well. Depends on your current job though, my employer at the time had, and probably still does, a very lax time off policy. It was enough to drop a message in a public channel saying you wouldn't be in that day due to an appointment.

</comment><comment><USER12> > I've reached the later stages of interviewing with multiple companies...

Force rank the opportunities. ONLY invest your time in the top 2-3 that you're serious about.

<comment><USER13> I would argue you'd be better off interviewing first with the companies you want to work for the least. This way you can use them as "warm ups." You're more likely to mess up your first interview than the later ones.

That said, if they're all final rounds this advice might not apply.

</comment></comment><comment><USER9> Take a day off. Fake car trouble, coughing, something.

If you have multiple interviews, try to schedule them consecutively (one per day) so your current boss will think that you just have a cold that you don't want to spread around the office.

</comment><comment><USER13> They're going to call your employer for a reference anyway. Why bother hiding it if you're already at final round? Just take the days off as vacation days and if anyone asks where you are, tell them you're interviewing for other companies. Your boss will find out very soon anyway. It might even lead to an offer for a raise.

You're not a slave. You have every right to interview wherever you want and whenever you want.

<comment><USER14> > Why bother hiding it if you're already at final round?

You may not get the job.

A good manager, absolutely have the chat. There are also managers that would take something like this personally and make it into an issue. e.g what if you are simultaneously looking for internal promotion and some manager decides this makes you look like a flight risk for the new role or any other number of scenarios.

</comment></comment><comment><USER15> Ask if you can break the onsite into 2 days. Then just make some excuse to leave early for the day.

</comment><comment><USER16> work from home</comment>


9Gag "Repost Machine" Explained - <AUTHOR> http://www.reddit.com/r/4chan/comments/zacju/9gag_repost_machine_explained/

<comment><USER2> I wonder if YC has any thoughts on this.</comment>


Samtrosku specification - <AUTHOR> http://mw.lojban.org/papri/samtrosku_specification <comment><USER2> ...what.

This is something I posted to the Lojban wiki, like, 12 years ago.

It was dramatically underspecified.</comment>


Noogler Orientation: My first 3 days at Google - <AUTHOR> http://blogs.cs.st-andrews.ac.uk/jws7/2012/06/07/noogler-orientation-my-first-3-days/

<comment><USER2> Is a 10.5 hour work day normal at Google? These seem like startup/finance hours. I hope the author is getting paid well.

<comment><AUTHOR> Reasonably normal. I spent 1.5 hours at the gym & had 3 meals at the office. So more like 8 - 8.5 hours of actual work. Google also pay well - which as an intern seems like a bonus.</comment></comment>


Why the Midwest Is About to Become America's Next Silicon Valley - <AUTHOR> http://www.forbes.com/sites/petertaylor/2016/11/07/why-the-midwest-is-about-to-become-americas-next-silicon-valley/ <comment><USER2> I wish someone would invent a device that would allow me to roll my eyes even harder at these X is the next Silicon Valley stories.

"The Midwest and Ohio in particular has always had three things going for it in terms of business climate: a cheap, close supply of energy, access to transportation, and a highly trained work force."

And yet the technologically inclined flee for the coasts, where life is expensive. The next Silicon Valley isn't going to be in Nevada, Arizona, Ohio, Kansas; it's probably not going to be in Illinois. It's going to be somewhere with high amenity value to highly productive technical people; i.e., a big international city.

<comment><USER3> Cleveland, Ohioan here. Just about every tech company requires, and will enforce to the fullest extent, non-competes. We're no where close to being the next silicon valley.

EDIT: typo :(

<comment><AUTHOR> Let's assume, "Just about every tech company requires, and will enforce to the fullest extent, non-competes," is true.

Why does that mean, the Midwest/Ohio is "no where close to being the next silicone valley." The "e" in "silicone" is yours.

Non-competes are flimsy at best and it really comes down to your ability to litigate.

<comment><USER3> My admittedly anecdotal evidence is I know very talented people that have left the region to avoid litigation from their former employers and start their own ventures or advance their careers. Perhaps you have a lawyer that can compete with a corporate legal team, most of us do not.

Also, we can't even type "silicon" properly :D

My non-anecdotal evidence: [https://techcrunch.com/2016/02/18/silicon-valley- keeps-winni...](https://techcrunch.com/2016/02/18/silicon-valley-keeps- winning-because-non-competes-limit-innovation/)

[http://www.bloomberg.com/news/articles/2015-03-17/silicon- va...](http://www.bloomberg.com/news/articles/2015-03-17/silicon-valley-is- the-world-s-innovation-capital-because-of-a-technicality)

<comment><AUTHOR> I understand and empathize if you or your associates have been run out of town as a result of a non-compete. We are probably on the same side in a discussion about non-competes. Thank you for the references, the TC piece in particular. I wasn't aware of that part of CA law.

The Midwest in general, and Ohio in particular, has some great institutions that attract great talent from around the world, i.e. The Cleveland Clinic. The region/Ohio also educates some of the top talent.

While I'm not convinced they will be a viable competitor to Silicon Valley, it is possible. The region's ability to retain talent is the most critical component. Non-competes can make that more difficult. I don't think non- competes alone preclude the region from competing with SV.

I'm from Ohio, I live in California, and I would put a higher priority on weather than non-competes.

<comment><USER3> I kind of fired off my initial comment and should have maybe thought it through a little more, non competes are one of many reasons holding this region back. Our very risk averse investment culture is probably the biggest one actually (example: [http://www.crainscleveland.com/article/20160204/NEWS/1602099...](http://www.crainscleveland.com/article/20160204/NEWS/160209904/sad- truth-leaving-ohio-helped-phenom-get-into-500-startups)).

And of course as you said, our brutal, brutal winters.

I was more agreeing with knoepfle's comment in rolling my eyes every time one of these articles pops up and gets shared all over my twitter, linkedin and facebook feeds. There's many reasons a lot of our talent flees the west coast or Chicago or NYC, and we'd rather read these fluff pieces instead of acknowledging and trying to fix the issues that would keep them here.

</comment></comment></comment></comment></comment></comment><comment><USER4> There won't be another SV just like there won't be another NYC for Finance in the US - they become monuments and the skills gradually disperse till it just becomes what everyone does (FL, NC, NJ have seen significant uptick in finance from NYC).

The next X is going to be a field currently undervalued, it'll be small companies because the initial opportunities are too small, they'll likely be in an area that is balanced to low cost-proximity to market (if applicable) (does anyone remember what a ghetto Palo Alto and Milpitas was a few decades ago?), and it'll be largely unregulated (that comes after when the big boys want to shut the door behind them).

I'm thinking this next wave could be a few things, but summed up by machine intelligence - machine learning underpinned by IoT, alt energy, energy storage, next gen comms, etc. Or it's local maxima and time for a WWIII board clearing.

</comment><comment><USER5> One California is more than enough. Please don't come and corrupt the midwest as well. :)

</comment><comment><USER6> I would have expected it to be in Chattanooga, TN... not Ohio.</comment>


Big brother untangles baby babble - <AUTHOR> http://newsvote.bbc.co.uk/2/hi/science/nature/8127804.stm

<comment><USER2> This is interesting, although it's news from back in 2009.</comment>