Why Stack Overflow Sucks and Participating There is Impossible - <AUTHOR> http://goofygrin.wordpress.com/2011/02/01/why-stackoverflow-sucks-and-participating-there-is-impossible/ <comment><USER2> Let me add some perspective as a relatively highly ranked user (cletus) on SO.

I've seen this kind of post before and frankly it's annoying. The typical template is "I tried to answer 2 questions and didn't get 1000 points so it sucks" or some variation revolving around faster answerers or whatever.

Rather than being a problem, SO is a superb solution for the person asking the question because they do get fast answers.

Compare this to forums or mailing lists which I _abhor_ as a means of asking programming questions. You'll often get no replies or useless replies (eg a bunch of people who don't understand the problem telling you that you shouldn't be doing that or asking you why) or the right answer might be buried on page 17 when the thread descended into an OT discussion on page 7.

There are certainly low-hanging fruit on SO (reputation wise) and people do compete for those. In my case, I used SO to learn things because of the quick feedback loop you got when you said something demonstrably wrong.

Now I barely go there because whether there's something to answer or not is pretty random and I really don't have time for the waiting game anymore. Other priorities now.

But to complain about a system where there are _too many people answering questions_ is, to be perfectly blunt, ridiculous and narcissistic ("what about me?" rather than what about the asker).

Also, the questions are, for me anyway, a lot less interesting. For a lot of topics, they've now been covered. New questions are rarer and cover increasingly edgier cases. So you're reliant on new languages, tools and problems, which doesn't seem to come at the same pace the earlier questions did, which were basically backfill.

Let me also say that there is an art to answering questions on SO. The OP bemoans the quick answer getting the points while you write a thoughtful answer. My response? To paraphrase Steve Jobs, "he's doing it wrong". SO teaches you this.

If the question can be answered in one line, this is what you do. If more comments will add to the value of the answer, explain deeper issues or perhaps help in cases not necessarily directly relevant to the OP but possibly relevant more generally, then you edit your answer as you go, adding as necessary.

And if you think you can't write thoughtful answers on SO, you obviously haven't looked at some of the great answers that are there.

<comment><USER3> I agree with what you're saying, but I don't think it addresses the post. It's certainly true that Stack Overflow is the best place to get answers to programming questions and I won't dispute that. Here, though, is what I think the problem is. I think it mirrors the OP's problem.

Stack Overflow became and is the best place to get answers to programming problems because of the community it has been able to build. There are always competent people ready to provide an answer and they do it quickly. However, the problem is that the community is difficult to participate in. You need rep to do anything and you don't get rep until you do something. You also need to compete with a lot of other people in order to contribute usefully, which makes the barrier even higher. Ultimately, this undermines the community, which is what makes Stack Overflow good.

You can say that these effects can be ignored because answers are still given and you'd be right. But the difficulties do exist. I have enough rep on SO now to do most things (maybe not down-voting), but it was hard to get, so I can attest to what the OP was saying. I can only imagine it's harder now after the community has grown and rep inflation has kicked in.

<comment><USER4> Exactly. The OP's point is that it's hard to get over the initial rep hurdle so that you can participate.

This prompts the idea: is there some sort of way that new users could quickly and reliably gain a minimum amount of rep by doing a bit of maintenance on the site? Say, flagging spam or suggesting correction which must be approved by someone with lots of rep? If this is possible, why don't more people know about it.

<comment><USER5> The 'initial rep hurdle' is so low that any dimwit -- pardon my French -- can overcome it... As some others have pointed out, too easily actually, judging from the number of bad answers from people with a few K of rep.

<comment><USER6> I don't care to participate in SO often. I don't have high rep.

I _can_ provide insight.

every once in a while I find somewhere that I can provide some value or insight, whether via editing an answer with a url that's out of date, a comment expanding on the answer, etc... and it seems like I never can.

I don't care to jump through the hurdles to get to that point. I didn't come there to ask a question. I didn't come there to sift through questions to answer.

I came looking for something. I stumbled upon something where I could provide value and was shut down because I have better things to do with my time than to jump through hoops.

It's fine for the power users who want the world to see their rep, or the people trolling for questions regarding their pet projects. It sucks for the casual user.

So, yes, in theory the rep hurdle is quite low. I've just got better things to do with my time. -- Which I already wasted trying to help someone in the first place.

<comment><USER5> You do realize that they can't just grant anyone the right to edit questions or answers and that they don't have magical insight into your abilities? I don't know how you propose to solve the problem of automatically allowing those that have ability to bear responsibility, but I don't think there is any site that does it better than SO.

      It sucks for the casual user.

I'm a casual user (I have 1.5K rep and subscribed reasonably early, so we're talking about 10 decent answers per year) and I don't think so.

      Which I already wasted trying to help someone in the
      first place.

Then SO is not for you, because SO only makes sense if its users want to help others, for whatever reason. I personally like trying to explain something clearly and concisely and I like solving the problems that are sometimes posed. I answer questions for my own good, but it is gratifying that someone else also profits.

<comment><USER7> I see your point, but I really don't think that 1.5k rep qualifies as casual in the context of the discussion.

<comment><USER5> I have answered 76 in two years and 4 months (and posed 5). Let's be generous and say that's 1 answer every week. Is that not 'casual use'?

<comment><USER7> Over a sustained 2.5 year period, not really. I mean what percentile of activity/reputation do you think you'd be in for all members in that period? I'd guess well over 50... perhaps 75 or 80?

Programming is my full time job and I ask questions on SO somewhat regularly when I get stumped, and occasionally peruse for questions I can answer, but I don't make any efforts in particular to raise my rep for its own sake, and I just reached 100 rep after being a member for a year. I feel like I fit into the 'casual user' camp that he's referring to in the OP since I'm still pretty limited in my participation even though I FEEL like a somewhat invested member of the community. But I don't think these issues would really apply to you at your level of activity (and kudos to you for that, btw :) ).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> The thing is StackOverflow really really works. If I search Google for a programming query I nearly always find links to useful information on SO, if not the precise answer.

(I've even found my own answers via Google when I have forgotten how to do something)

That is SO's first and foremost use case. And I reiterate - it works extremely well.

The community features are secondary to that (it's not Quora), and there are thousands of users who will tell you that it is not 'impossible' to use.

<comment><USER9> I've found plenty of helpful information on StackOverflow via Google as well, but I definitely would _not_ say that it "really really works."

I've asked two questions (C#/.NET so there's a large pool of potential answerers) and neither question ever got the answer it deserved, even though both got answers from genuine experts (Jon Skeet and Eric Lippert). I found the answer to my first question on some MSDN blog after I asked on StackOverflow, the second question is still unresolved.

<comment><USER8> Maybe my enthusiasm for the quality of StackOverflow results in Google is because I remember the pre-SO days of scrolling through experts-exchange's hideous site and fictional paywall for a low quality answer in a tiny font.

<comment><USER10> Me too; though I also thought that experts-exchange was a good idea at the time, including its concept of an economic reward system (in fact, I got a wonderfully helpful answer on that forum). Yet, it turned out to have problems, which lead to SO with an even better, karma/game mechanics reward system.

And now, some people experience problems with SO. This opens an opportunity for something even better than SO. I wonder what that would be?

</comment></comment></comment></comment><comment><USER11> It sounds like this guy wants to participate in StackOverflow just to be there rather than because he finds it a useful tool for his own work. I'm glad there are hurdles for people who are just there to "get a good rep" rather than there to support their real work.

A (hopefully) more common workflow would look something like this:

\- a developer googles a problem, the StackOverflow answer floats to the top, and he notices this is a particularly good answer. \- this keeps happening, and the developer gets impressed

then one of two things happens (or both):

\- he googles a question, and finds an old question without a great answer, and adds an answer. Yes, old questions don't get as many upvotes on their answers, but they do get upvoted, and at 10 points an upvote, it doesn't take long to get to 50.

\- he googles a question and doesn't find an answer, so he posts a question

Neither of these require any rep, and you only have to do it once or twice with a good question or answer to get to the magical 50 karma. And 50 karma is the only milestone that matters on StackOverflow, in my opinion.

<comment><USER11> Heh, in the time it took to create this comment, this post went from 1 comment to 15 comments, making mine less relevant, meaning I'll get fewer upvotes.

And as far as I'm concerned, gaming Hacker News to get karma is much more useful than gaming Stack Overflow. 500 karma is required to downvote, and it takes a long time to hit 500 karma.

Of course, now that I have the 500 I rarely downvote. I wish I would have known that earlier. :)

In my opinion, PG should adopt the Stack Overflow downvoting rule (you lose karma for downvoting), and lower the required threshold. It's hard to tell if downvoting is being used more for good than evil, but it's definitely used to express opinion more often than it should be.

</comment></comment><comment><USER12> To me, the #1 problem with Stack Overflow is the number of plain _bad answers_ that are given and often accepted. CSS question? Here's someone's un- researched and invalid first guess, that doen't work in practice. +10 karma and accepted.

Hard question? Here's some loser's gut feeling of "can't be done" in exchange for +2 karma, and then a knowledgeable follow-up a day later from someone who has actually been there, done that, and figured it out.

Example: Someone with 82k karma posts a non-answer rudely telling me I should be using another technology altogether, a cheap and worthless move that earned +2 karma: [http://stackoverflow.com/questions/4696128/bash-script- deter...](http://stackoverflow.com/questions/4696128/bash-script-determine-if- file-modified/4696145#4696145)

So often it's apparent people are just throwing best-guess answers out there for karma, and this is hugely unhelpful. There should be a large penalty for stating incorrect guesses as fact.

It's to the point where _I instantly mistrust any answer from someone with over 10k reputation_ as I learned there is a good chance they are just shooting from the hip for karma.

<comment><USER13> You pointed out yourself in the comments to that answer that rsync was helpful, but that you didn't like the rude tone. The answer you accepted also agreed that you should use rsync until you edited the question to add more details. Now it's cheap and worthless?

The system seems to work. The top-voted answer is the one you accepted.

<comment><USER12> I was being generous, as rsync could be a useful suggestion to other visitors to the page, but it absolutely doesn't answer the question that was asked. The top-voted answer, to the contrary, was edited to be genuinely helpful and an accurate answer, and deserves those upvotes. Also keep in mind that the page is getting activity because it's linked from this discussion, so some karma changes have been triggered just now.

</comment></comment></comment><comment><USER14> It's definitely true that there are a lot of people waiting for new questions so they can pounce with a quick answer and get a few upvotes. However, there's also a large backlog of unanswered questions as well (<http://stackoverflow.com/unanswered>) that are very much in need of a "thoughtful, correctly documented" answer. And while it's unfortunate that legitimate brand-new users are unable to post comments, the reason behind the rep threshold was to reduce spam on the site. Commenting requires 50 reputation, or about 5 upvotes on an answer/10 upvotes on a question (both of which can be easily accomplished in an hour or two) - just high enough to deter spam.

<comment><USER15> I simply do not understand this ego thing with "points".

A million points gets you what? An award for most wasted time?

I wish HN had an option to turn off points on an account, I can't even block it with adblock because there's no element id.

There's more to life than meaningless "points".

<comment><USER16> I think in the specific case of StackOverflow, having a lot of points is something that indicates to potential employers that you are a useful/knowledgable candidate. And it's not just a vague signifier - they can actually go and look at your answers and see what you're about.

<comment><USER11> Yes, but quality matters almost as much as quantity. I'd rather hire somebody who got 1000 karma through 10 questions/answers than somebody who got 2000 karma through 100.

Although quantity is important too -- even if it's not a definitive answer, a partial answer is better than no answer to the questioner. It's just that when I'm hiring, those definitive answers really indicate somebody who knows what they're doing.

[edit: answering here because there are several good responses, who are all right. The most important thing to do as a potential important employer is to read a few answers rather than just blindingly accepting the karma. You can't do that for everybody, but you can do it for your shortlist.]

<comment><USER17> I'm not sure that high karma answers indicate anything other than that the candidate is answering basic questions. Correct answers to obscure or deep questions won't be trafficked as much and won't collect upboats. You should look at something else, say the answer:question karma ratio, unless you're looking for someone to answer the phones.

</comment></comment></comment></comment></comment><comment><USER18> I don't really agree here.. While I do have my own gripes with Stack Overflow, I don't think this is the biggest issue. It took me two days of casual browsing/asking/answering to get a reputation of about 50 or so and another few weeks to get into the hundreds. -- Keep in mind I'm not a super genius expert or anything, I just asked a few questions and contributed a few answers in areas I was knowledgeable about. It's not that hard.

The only major broken part (IMO) of SO is that the SE network is becoming so disjointed and your rep doesn't transfer between sites.

<comment><USER14> If you have more than 200 rep on SE site A, you can associate that account with your account on SE site B and get a 100 rep bonus on site B. This lets users that are already familiar with the system comment and vote up on any site without having to have gained rep first.

<comment><USER18> Oh cool.. I didn't realize that! I have about 250 now, but haven't ventured out of SO in a while. Thanks for the tip!

</comment></comment></comment><comment><USER19> I asked two questions, one about C and one about Objective C. I got answers to both, relatively quickly. The answers worked.

But, in the C question, I provided some more information by adding a comment instead of editing my post. Result? Comment deleted with a snotty note. In the Objective C question, I called the language "Objective C" instead of "Objective-C". Result? My question edited to fit someone else's idea of good style: <http://stackoverflow.com/posts/2669817/revisions>

It's that last one that really gets me. Someone with more karma gets to put words in my mouth? And my name gets left on the edited post? Wow. Done.

I get why they allow it, they want the site to be more searchable. And in a way I'm glad, because I get a lot from reading answers to things other people ask, but I will never again write anything there myself.

<comment><USER20> Clarity is a good thing, and uniformity and standards definitely help with that. Looking at the revision page you linked, I don't see anything there that's offensive. I may have made similar edits myself had I seen it (at least, if it were a question in an area I'm familiar with).

Keep in mind that StackOverflow isn't just about answering your question; it's about providing a large searchable knowledge-base so others with similar questions can easily find ready-made answers.

Like it or not, collaborative editing of this kind is a cornerstone of the site, and is explicitly addressed as part of the FAQ[1].

[1] <http://stackoverflow.com/faq#editing>

<comment><USER19> Clarity from changing "Objective C" to "Objective-C", whatever. The rest of the changes didn't add clarity, they were totally stylistic.

People are not computers, and we're touchy about stuff we write. If you want to add a tag to my question to make it more searchable, fine. If you want to let me know I have a typo, or used the wrong word or something, whatever. Just editing someone's question, especially for subjective writing style, comes across as rude.

If it's not supposed to, or if the rest of that community doesn't mind, I'm happy for them. But it's not for me, and it's not for a lot of other people either. So, I agree with the OP.

<comment><USER21> FWIW, I agree with you here. The other style changes were pointless (the "If I'm.." to "For example, if I'm.." nonsense). You can always roll back a change to your own question though. In the editor's defence, a lot of low-rep users post really unreadable questions. Maybe he saw you had less than a few hundred points and got a bit trigger happy.

<comment><USER19> I would roll it back, if I cared at all about the site. This all happened about a year ago, I'm only pointing it out now because it's relevant to this thread.

It's a really poorly-thought-out feature: new users who can't write coherently get taught that they don't have to, because someone will come along and fix it for them; new users who can write are more likely to be annoyed by other people playing copyeditor on their posts. Guess which group sticks around?

</comment></comment></comment></comment></comment><comment><USER22> "Rep grinds" (see how MMO-speak has influenced us?) on non-gaming web sites may be becoming the norm. You grind out some rep, and get privileges based on that rep. One can argue that this serves as an effective barrier to keep out would-be posters of bad content and discussion, but as we can see it also screws with "legit" posters. Determined individuals will figure out how to work the game to their advantage, both for good and bad.

<comment><USER23> What game and what advantage? It's a Q/A site. The only way you are going to game the system is if you ask clearly delineated questions and provide thoughtful and clear answers.

<comment><USER24> A few techniques:

Form a cabal of vote sharers, who always vote for each other's posts. Post a bunch of semi-plausible content once a day and you'll have tons of karma in no time.

Post quick responses that have little insight. You'll always get votes for being first.

Post LOTS of trivial questions. More people will upvote than will downvote on the whole.

<comment><USER23> All the things you mentioned requires a lot of effort. In fact it's more effort than just actually providing one or two good answers and questions a day. Also, I have never seen any of the popular answers get answers that are not really close to the mark. Even the unpopular ones always get good answers that float to the top. Organizing a cabal of voters and then monitoring new questions within your area of expertise just so you can post semi-plausible answers to move up the ranks is borderline psychotic and I have yet to encounter these people on SO.

</comment></comment></comment></comment><comment><USER25> Personally I haven't gotten involved in SO precisely because of this. I don't feel the prize is worth the amount of effort that I'd put into playing the game.

However, plenty of people do feel that it's worth it, and certainly the barrier to entry keeps out (some of) the griefers that inevitably show up in online communities.

<comment><USER26> The prize is the satisfaction you get from helping other people with a great answer. The reputation is window dressing. If you think of rep as the end goal, then of course it is not worth your time. If you enjoy answering people's questions, then it probably is worth your time.

<comment><USER25> There are a lot of social things to do on the web, and probably I should be doing less of them and more real work

For me, participating on SO is like the Weather Channel. I've got another other things I could be doing rather than waiting for "Weather on the 8s" to come around.

</comment></comment></comment><comment><USER27> I've never seen stackoverflow as a race to get the most rep possible. Reputation is just a "bonus", not a prerequisite to participate in the website. I like stackoverflow the way it is

<comment><USER28> During the development of Stack Overflow, Joel and Jeff talked about the answers staying up-to-date in a wiki-like fashion. I think what the author means is that in order to participate in this - i.e. edit and improve an existing answer - you have to have a certain amount of rep.

It's quite likely that a user Googling for their particular issue might find an incomplete or out-of-date answer on Stack Overflow. When they finally solve it they are unable to improve the existing entry, which is unfortunate as for many "long tail" problems they are best placed to contribute.

<comment><USER14> This used to be true, but there's a feature currently in testing that will allow _anyone_ (even someone coming from Google) to propose an edit to a post. This edit proposal can be approved either by a moderator or several users with sufficient rep. Hopefully this will make Stack Overflow more wiki-like and help solve the problem with answers getting out of date.

<comment><USER29> This sounds similar to how Discogs has implemented quality ratings (via votes) for arbitrarily edited content, in between full editorial control and open wiki.

</comment></comment></comment></comment><comment><USER30> I totally disagree with this blog posting, but here's a situation that I feel SO could do better.

I wish there were a feature whereby as a question-asker, you could say "I've dutifully read all the provided responses, and none of them answers my question. Marking this as 'unsolved'".

And then the "unsolved" questions would not count against your percentage in "accept rate". When new answers come in, you'd need to go back and re-evaluate whether or not the new responses answer your question or not.

The original idea of publishing askers' accept ratio is to encourage people to "give credit where credit is due". But it also has the unfortunate side effect of encouraging people to accept sub-par answers at times.

Apart from that I love the site, and hope Jeff makes a bundle (or at least a happy existence) from it.

</comment><comment><USER31> _"So if you're knowledgeable enough to provide a counterpoint to someone else's poor answer, you have to post it as a new answer… and then you get down voted (lose rep!) for adding a new answer versus just commenting on the original, flawed answer."_

Never happened to me. Sometimes I even noticed that the author had deleted the original wrong answer and left a positive comment on mine.

<comment><USER32> Yep, also if you just have 1 reputation getting downvoted doesn't cost you anything, you stay at 1. So it doesn't hurt in the least even if this did occur, which I haven't seen myself, either. I often see that SO users will be helpful to new users who seem to be trying to be helpful.

</comment></comment><comment><USER33> "Nobody goes there anymore, it's too crowded."

</comment><comment><USER34> That's why I try to avoid StackOverflow as much as possible when I can ask my question on a smaller StackExchange site such as <http://askubuntu.com> or <http://programmers.stackexchange.com>. The quality of answers on smaller SE sites is usually 10x higher.

</comment><comment><USER35> Rep whoring? Q&A sites are there to help out not to give you points and stroke your ego.

I think if SO is hindering you into getting a good rep, probably you don't have enough domain knowledge.

PS: I've been there since the beginning and I still got 114 rep. I love the place because it has gotten me solutions at times without even asking.

<comment><USER36> I agree. I enjoy that you get answered so quickly and if you are rep whore, you can just ask good questions, they get up-voted and you get points. But I really don't see any point, it's a serious Q&A site.

</comment></comment><comment><USER37> While I actually can empathize with the author on wanting to help out, he's really making stackoverflow sound awesome - knowledgeable people are falling all over themselves to answer your question, and don't worry about being a freeloader, they already have too much free labor going into the answers.

</comment><comment><USER38> Please stop saying that StackOverflow is 'broke.' The word you're looking for is _broken._ StackOverflow's overflowing stack of cash is doing quite well, actually.

Other than that admittedly nitpicky detail, the article is accurate and provides insight on a problem that I, too, have experienced. However, I don't think that StackOverflow is _broken_ , I just think it's overcrowded. And for a question-and-answer style website, isn't that a good thing?

</comment><comment><USER39> A lot of people are dogging acconrad, but I have to agree with him. I was having a problem with rails, and I found the answer on stackoverflow. The right answer had no upvotes, so I figured I would upvote it; this way the original "asker" would know it is the right answer. However, it said I didn't have enough rep to upvote... I'm sure he'll figure it out but this would save him from checking the other "solutions".

<comment><USER40> The weird thing is how it doesn't tell you that you can't upvote until you try to do it.

<comment><USER13> It tells you in the FAQ. <http://stackoverflow.com/faq#reputation>

<comment><USER40> I meant that it is surprising that they don't hide the controls that you can't use.

</comment></comment></comment></comment><comment><USER41> Is Stack Overflow a game in which the goal is to get the most reputation and badges?

Or are you using it as a tool to discover solutions to programming problems?

Or Both?

<comment><USER42> Any community where you get "points" of any kind becomes a game, which eventually becomes more important than the community itself.

</comment></comment><comment><USER43> I completely disagree with both the premise and conclusion of this blog post.

I'm a complete coding noob (<http://www.7bks.com/blog/179001>) and along the way to learning programming have relied on StackOverflow for about 10 questions.

For every single one I have received complete, thorough, helpful and patient answers. In short, I could not be happier with SO. As a beginner it's been a phenomenal resource both for searching and for answering specific issues.

The post makes the point that newbies can't answer questions - and for me this is one of the reasons the quality of the site is so high. If you let anyone answer then you don't know how good quality the response is. As a beginner how am I to know if a given answer is correct?

Of course, any community site still has problems like this and SO is not immune to it but IMHO this is one of the ways they keep the quality bar higher than any other Q&A platform out there.

</comment><comment><USER44> "but you quickly realize that every question that's not some vague, poorly worded, open ended impossibility has already got 10 answers"

Exactly :) Stackoverflow has built-in breaks to control growth. Maybe HN could benefit from this ;)

</comment><comment><USER45> I agree 100%. I was in SO early (the beta) and still encountered this. Not only that, but a quick/early bad answer would tend to do better long-term than a later but correct answer.

Given this (and I'm no stranger to accumulating high levels of karma/followers/whatever by natural participation on sites) I only use Stack Overflow as a user now and rarely answer anything. It works great for that and I can sift through the answers and pick the one that works best while ignoring the score. It's clearly not for me in terms of participating fully but I can live with that.

</comment><comment><USER26> I would encourage anyone who is interested about the thinking behind Stack Overflow, reputation, money, question and answer sites, badges, commenting, wiki, etc, to go back and listen to the early Stack Overflow podcasts. You will get an hour by hour insight into their thinking behind certain features of the site and will see that there are some very good reasons (and to be honest, some not) for some things being the way they are.

<http://blog.stackoverflow.com/category/podcasts/>

</comment><comment><USER46> Or you could just ask questions. I don't write too many answers on Stack Overflow either but I usually do get a good answer to my programming/Ubuntu issues.

I would actually argue that Stack Overflow works great. This article is an excellent example of how their badge system creates a strong desire in their user-base to contribute answers to and participate in the site. Maybe I'm just weird because I could care less about karma and just want to get my questions answered (by the karma obsessed trolling the new questions list :).

</comment><comment><USER47> Is rep important enough to warrant a blog post complaining you cant get enough?

Man, money is too hard to get. I wish this damned CEO wasn't getting a 600k salary + bonuses. Blog post upcoming.

<comment><USER48> He's not complaining that he can't get enough rep, he's complaining that he can't contribute without it.

</comment></comment><comment><USER49> You are concerning yourself with increasing a meaningless stored value on a website on the internet that, chances are, you'll move on from in a relatively short period of time. Take a second to think about that. That applies to here and all other social-voting websites. It's an unnecessary worry. Focus on things that matter.

</comment><comment><USER50> Who cares?

If I hit a wall while working on a problem, I toss into the gladiator pit known as Stack Overflow, and after it has been mawed to pieces by a bunch of brilliant people, I stop by and get my answer and can continue whatever I was doing. Usually this all happens in the time it takes for me to get some coffee and maybe take a short walk.

It is a beacon of hope and joy to someone who has wasted too much time in the past trying to find the answers to hard problems.

So they are at each-others' throats trying to out answer other users so they can increment up a point counter. Gamefication is a great motivator, and I am happy that I don't have to use the typical motivators of begging, pleading, or -ugh- paying for quality technical support.

Emotional reactions to the competitiveness is the success of a very well designed game that has the outcome of great answers to problems that are typically hard to find.

</comment><comment><USER51> I think the poster makes a good point. In the early days of SO, as in any QA site, there were a surplus of questions and a dearth of answers. It would've been suicidal to obstruct people from providing answers, so the bar was set low there. Comments on the other hand are less valuable early on, so there was no reason to encourage them.

Fast forward to today, and now there are a critical mass of people willing--- even eager---to answer questions, so that every new question has a surplus of answers, many of them wrong. SO might well improve their signal/noise ratio by reversing their policy and requiring higher karma for answers than they do for commenting. As the poster points out, a newb is unlikely to come up with an answer not already posted, but nonetheless might have some unique experience or insight on that answer that could be helpful.

</comment><comment><USER52> I went through a short period where I really cared about what my profile looked like there. I don't know why I ever felt that way. I think my top voted answer is telling someone what I thought important concepts in C to communicate to students are. I don't think that says anything about me positive or negative to be honest.

If you look around the top contributors to the python tag you'll realize there is a lot of room for people to submit good, thoughtful answers. If you take the time to write something good then it will get voted up and if that's what you want you'll be all set.

It seems like no worse of a way to spend your time than anything save perhaps reading a good technical book and let's face it there aren't very many of those.

</comment><comment><USER53> The other bad thing about SO is that when a question has some answers, even if they are not really right, nobody really pays attention to the question anymore.

So it feels like questions that move down in the queue with a few proposed answers are basically dead.

</comment><comment><USER54> Headline is misleading - the real complaint isn't that participating is impossible, it's that reputation is hard to earn. In SO's nascent days, you could earn rep simply by showing up and answering questions. Now that it's popular, if you want to gain rep, you have to muscle your way in using methods like the author describes.

I find it amusing that SO's creators chose the term "reputation" for their participation points, as opposed to "karma" or something else, because in this aspect it's pretty similar to real-life reputation. When supply is high, it's hard to gain reputation without gaming the system. That's not SO, that's life.

</comment><comment><USER55> Am I the only person that doesn't get this whole Stack / Quora thing? Why does anyone care about points?

Don't get me wrong - I love the fact that there's a place I can go to ask a question and get it answered by knowledgeable people. But what does that have to do with points? If people want to help each other, then great. If not, then don't.

Newsgroups used to fill this role quite well without points, but came with all sorts of negatives (as detailed above). The benefit of the Stack / Quora stuff is that you don't have to wade through irrelevant stuff to find what you need. but points?

<comment><USER23> The voting is a crude proxy for correctness. I say crude because sometimes the first few answers get way too many votes for simply being the first but over time the correct answers float to the top.

</comment></comment><comment><USER56> The information on Stack Overflow is fantastic, but I just don't want to be a leach. And contributing something useful _is_ challenging. Maybe I just don't have anything wonderful enough to say.

</comment><comment><AUTHOR> I'd like to point out that while I definitely did not write this post, I did feel it easy to relate, because it seems hard at this point to gain reputation without gaming the system a bit. But there are so many ways to get involved...I think the best seems to be being knowledgeable in a very specific area of expertise - answering C# questions is really tough, but if you know Heroku, there are so many more questions there without answers that you can really gobble up quite a bit of reputation by knowing something niche.

<comment><USER57> All the while one does not / is not able to answer questions, he can learn from the answers that have already been submitted, no reputation gained but knowledge (I have heard people compiling e-books on the best posts from Stackoverflow). I call that a step forward.

</comment></comment><comment><USER58> This post appears to be written from the perspective that the goal of Stack Overflow is to gain points, when I believe the goal of Stack Overflow is to answer questions.

</comment><comment><USER59> Stack-overflow is amazingly effective, especially when one considers the alternatives like those countless forgettable websites heavily laden with front-and-center ads, and the ones that have nag screens that block responses to answers until you "sign up", and the ones with clueless dilettantes fumbling in the dark.

My only concern is that I think the exchange community might get fractured/diluted if there are too many separate stack exchange sites.

</comment><comment><USER24> I've never liked karma systems.

On the surface it seems to make sense: People who are helpful/insightful get lots of karma. In practice, it fails on two fronts:

First, karma systems in and of themselves work based on popularity, under the mistaken idea that popularity = correctness/insightfulness/suitability. Quite often, the most insightful or thought provoking ideas are unpopular (or speaking the truth is unpopular). What you get is a system that automatically filters out the ideas that the majority are unconfortable with, and so you end up with an echo chamber which doesn't admit new ideas.

Second, the policies formed around the karma system grow biased AGAINST new users over time, which leads to community stagnation:

The initial couple of years are great. The early adopters are all eager to participate in meaningful ways, and build a thriving, vibrant community.

Then the gamers join in. They learn how to game the system to gain points. They do this just to show that they can. Closely related, the karma whores move in. Their sole goal is to gain points for self-worth. The community is meaningless; points are everything.

As the gamer's techniques become more widly known, the spammers move in, automating the techniques to promote their spam, and the cat-and-mouse game begins, usually at the expense of making things more difficult for the users. These measures are almost always done with consideration of the already established user base, using them to determine what a "normal, real" user is like.

Once you hit this point, it starts to become prohibitively expensive for a new user to join in, thanks to the biased notion of a "normal user". Stack Overflow is a prime example of this, where you have to jump through all sorts of crazy hoops just to be able to even comment or _gasp_ edit your own question because upon re-reading, you decide it's not as clear as it could be.

And so you complain. But people don't like complainers, so they all jump on you and say "It's not so bad! I went through the red tape and so should you!" and "If you don't like the red tape, there's no place for you here!"

There's a word for this: Bureaucracy.

As a service provider, you should be doing everything in your power to make things MORE accessible to new users, not LESS accessible. You should be ENCOURAGING participation, not throwing hurdles in their way. New users are fickle. Their first experience on your site will largely shape their perception of it forever. Start them off with a bad experience and they'll refuse to participate. Rampant bureaucracy is a sign of severe failure in the system.

</comment><comment><USER60> The right question is as important as the right answer.

The easiest entry is to ask a good question. The next time you run into a poorly documented problem, do some research, and eventually work out an answer, reformulate it as the question you wish Stack Overflow contained and ask it. You can always comment on things in your own question so you can guide the answers if they are going wrong.

• Two question up votes and you can vote things up.

• Five and you can comment anywhere

<comment><USER61> Or you can just answer your own question, which is completely acceptable behavior in SO.

</comment></comment><comment><USER62> SO is optimized for _askers_ , not for _answerers_ and intentionally so! The whole goal of the website is to make asking questions simple, finding related questions (reasonably) simple, and getting good answers quickly. As you can see from profiles of some users, some people exchanged their books for SO (why look it up - just ask). True, the rep game is a tough one, but so is life, so get over it.

</comment><comment><USER63> In this article you say that you are <strike>a pretty and smart</strike> "a pretty smart guy". Then you are definitely welcome at SO.

NOT participating in SO is neither a solution to your problem nor a decision that a pretty smart guy would take.

Give it a shot buddy! and I am sure you will NOT write an article about how awesome SO is because you won't find the words to describe SO awesomeness.

</comment><comment><USER29> "Impossible" seems exaggerated. Somehow, in an article decrying rep-whoring, the OP decided that title-whoring was OK.

</comment><comment><USER64> I thought the same thing when I joined SO a few months ago, and agreed with a lot of what was written in the blog post.

But, then I decided to give SO another chance just now. I posted two answers and in ten minutes got enough upvotes to get me out of the 15-rep new-user jail.

So consider my mind changed and I don't see what the big problem is, now.

</comment><comment><USER65> > Edit: closing comments since I'm tired of moderating (and I didn't delete > any but the obvious spam). Thanks for letting me vent.

It is ironic to hear it from a guy who complains that he can't comment without enough reputation points on a site visited by millions.

</comment><comment><USER66> I believe SO is designed so that new users ask questions. Then after getting a few rep points from questions they can contribute back with answers or comments (my preferred input).

</comment><comment><USER67> I Disagree badly... It's a wonderful environment for developers. I personnaly love it and I only have 101 points. that doesn't keep me from doing a thing there.

Really bad, bad article.

</comment><comment><USER68> Do programming language designers look for repetetive questions on SO and improve their languages so those questions wont come up in future?

</comment><comment><USER69> Maybe not from his perspective, but from the perspective of those asking questions and looking for answers, it works pretty well.

</comment><comment><USER70> I frequent the sister site Super User, I had no problem in getting rep points, so far I am at over 8K in less than 8 months. No these are not forums and you will be berated for not following the proper order of things. If you can't compete stay off the site, its not for everybody like a forum is.

</comment><comment><USER71> Any Q&A site that discourages potentially useful answers is doing it wrong.

As it happens, I've come up with an algorithm that would solve the most common problems with Q&A sites (included the ones cited in this article) and am in the process of building a prototype.

</comment><comment><USER72> Why not to try a new site for programmers <http://tagmask.com>. It provides the ability to filter out content according your preferences and looks really good. Have you checked it out?

</comment><comment><USER20> What a terrible article. I'm sorry for the rant, but this really pissed me off.

Admittedly, I don't participate in StackOverflow that much right now - I sort of go through an ebb and flow where I get really gung ho about answering questions, then it sort of wears off for a while - but this guy sounds a lot like he wants to game the system, and is only in it for the points.

I'm not trying to put words in Jeff/Joel's mouth, but I think the "answer before you comment" system is constructed the way it is so that noise can be reduced. By that, I mean that the system wants you to actually contribute something to the site to get used to how it works before you can "join the discussion". Comments aren't downvotable, presumably because they don't want to silence dissenting opinions in a discussion, and the average comment doesn't get upvoted at all. If anyone could just walk in off the street and leave a comment, you would end up with a bunch of "YouTube comments" being left by random passersby.

For a newbie, your only way to contribute to a question is to write an answer. Answering has a different social contract than does commenting. When you answer a question, you are expected to provide, well, an answer! If your answer is incorrect, then it will be downvoted to distinguish good information from misinformation. Downvoting is a way of saying "this content is harmful", and this is a perfectly valid response to a bad answer, but not a valid response to a bad opinion (i.e. a comment you disagree with).

If the OP provided _answers_ on StackOverflow and was downvoted, then his answer most likely was simply wrong. I haven't seen many, if any, correct answers with negative scores on StackOverflow. The system tends to be fairly self-correcting in that respect. If someone is downvoted wrongly, there is more often than not another user who will upvote the answer back to zero. If the OP is simply lamenting that he isn't receiving upvotes (in contrast to the idea that he's being downvoted, which is a separate concept), then maybe his answer simply isn't as good as he thinks it is, and the "flawed answer" he wants to comment on simply isn't that flawed.

If the flawed answer is indeed flawed, then there is no harm in adding a new answer. Simply write your own detailed answer and include evidence explicitly proving that the current top voted answer is incorrect. When you post an answer, the site will kick the question back to the front page of the site, so you should get the opportunity for your "correct" answer to get exposure, and if it's any good, it should get upvotes.

What I take the most issue with in this article, however, is the OP's lament that any question he wants to answer is already answered. _That's the whole point of the site!_ If the question is already answered, then the system is working. The site doesn't exist for answerers to get points; it exists for askers to get answers to their questions. If a question gets a lot of responses, that is a Good Thing.

Now, OP used to have a valid point about having a lot of "in progress" answers being posted. This was the so-called "Fastest Gun in the West" problem, and was solved by modifying the site to display same-scored answers in a randomized order. At this point, an "in progress" answer which doesn't yet provide enough value shouldn't have any upvotes, and therefore a new answer would have the same opportunity to be viewed as that answer. If you get your answer into a steady-state first, then you will get upvotes and you will get views. If someone else does, and gets upvoted, then at least the asker will get a proper answer to their question. If you're complaining about other people giving "minimum viable answers" which nonetheless help the asker, then you're probably just "rep whoring".

For my part, I tend to answer questions in the same way. I'll quickly add an answer which provides a technically correct answer that at least gives the asker enough to finish the answer on their own (for example, "This can be accomplished using the some_function function" is enough of a hint that it's useful - the asker can look up the some_function documentation and learn for themselves). Once that answer is in place, I'll go back and edit the answer to include links to the documentation (I'll usually save at this point), then add a thorough explanation of how the answer works and how to use it.

I've been commended by askers and other users for my in-depth answers to questions, and I've even beaten the "horde of already submitted answers" due to my quality. O a few occasions, I've come to a question that already had 5+ answers with "minimal correct answers", some of which have upvotes, and have written an answer with a lot of detail which ended up either the highest voted, or accepted by the asker (or both).

Basically what I'm saying is that if you're only trying to be a "rep whore" then yes, the system is against you, but that's a Good Thing. If you're in it to actually help people, then taking the time to write a detailed, quality answer is the best way to go, and it'll often net you points to boot.

<comment><USER12> xatax, I just recognized your name from an incorrect answer you provided on StackOverflow that nevertheless was accepted ([http://stackoverflow.com/questions/4435906/print-when- textar...](http://stackoverflow.com/questions/4435906/print-when-textarea-has- overflow/4435958#4435958)). You made assumptions and then adopted your self- confessed strategy of "quickly add[ing] an answer which …gives the asker enough to finish the answer on their own," but failed to understand the problem inherent in the question. _You_ seem to be "rep whoring" and part of the problem on Stack Overflow. How dare you just write a wall of text to dismiss as "terrible" someone's critique of SO.

<comment><USER26> Well then why don't you provide the correct answer with the right assumptions?

<comment><USER12> I did, you should have checked. I even made a public test-case to illustrate why naïve solutions don't work: <http://dl.dropbox.com/u/105727/web/print_textarea.html> _Edited to avoid sarcasm_

<comment><USER58> I downvoted you for being sarcastic, and because I was discouraged by the tone you used in this SO comment:

      Gordon, you downvoted my answer and left a misleading comment because you
      assumed that a user wouldn't edit the textarea? For shame. Your solution is
      not "pure CSS" but rather uses PHP to duplicate a textarea and then
      hopes that the user doesn't its content before printing.

Please chill out, dude. There is absolutely no reason for a discussion involving Javascript and print stylesheets to require usage of the term " _For shame_."

To phrase it differently: Try to avoid being the guy from this Xkcd. <http://xkcd.com/386/>

<comment><USER12> Fair enough. Sometimes I do feel like that guy.

<comment><USER58> It's OK. We're all that guy sometimes. All we can do is watch out for it and adjust accordingly.

</comment></comment></comment></comment></comment></comment></comment><comment><USER73> "The point system is all wrong!"

Epic fail at life.

</comment><comment><USER23> There is nothing sucky about the stackexchange sites. They are designed to be useful and growing repositories of frequent question and answers. The whole rep/voting thing is just a gaming layer on top to make the process of participation a little more fun but if you just focus on the gaming aspect and take it way too seriously like this guy then you miss out completely.

<comment><USER18> While it may seem like just a gaming aspect, there are a lot of benefits as you gain more reputation on the site. Unlike many "points systems", SE actually allows you to become essentially a moderator of the site as you gain reputation. Once you've hit a certain mark you can edit, close, delete, etc. I think it's brilliant.

<comment><USER23> The old forums had the same system so there is nothing new or brilliant going on here, the stackexchange sites just measure things in terms of reputation/votes and the old forums did something similar with posts/replies. The only innovation I see is the automation of how promotion happens in terms of votes/rep.

<comment><USER74> In other words ... the autopromotion happens to people who provide quality contributions rather than those who add to the noise?

And you don't see how that's significantly better?

</comment></comment></comment></comment><comment><USER75> No matter what others say, but SO is awesome. I have got nearly instant responses. Only once I had to pay someone on freelancer to solve my jquery issue. It is like having SO community helping me in my development.

I know it is tempting to gain reputation points by answering simple questions.

Simple questions will have tons of responses. Instead try to pick the tough ones and answer them.

</comment><comment><USER76> Why <noun> sucks, and <false hyperbole></comment>


11/11/11: The Date Which Most Closely Resembles Corduroy, Ever - <AUTHOR> http://corduroyclub.com/meetings

<comment><USER2> Missed it by 900 years unfortunately, but that's cool because an even more corduroyish date is coming in 9100 years.</comment>


What happened to the snoopers' charter? - <AUTHOR> http://www.bbc.co.uk/news/uk-politics-31121071

<comment><USER2> For those in the UK, the Open Rights Group (ORG) worked very hard to bring this backdoor bill the attention it needed. Please support them. [https://www.openrightsgroup.org/](https://www.openrightsgroup.org/)

<comment><USER3> I followed the creation of ORG through the pages of NTK.

Looking back it makes me realise how much I miss NTK. Even though back then I wasn't working in the tech industry I felt a lot more connected to UK scene than I do now.

<comment><USER4> Those were the days. NTK.net "Nasty. British. Short".

I just realised that AnnoNTK [1] seems to have stopped too.

[1] [http://boingboing.net/2012/05/26/anno-ntk-get-a-fifteen- year...](http://boingboing.net/2012/05/26/anno-ntk-get-a-fifteen-year-o.html)

</comment></comment></comment><comment><USER5> The logic of these (unelected) representatives boggles the mind.

"What, they asked, if there was a Paris-style attack in this country, which was later found to have been preventable, if they had had these powers?"

This reasoning could be used to justify just about any law! Leaving aside the fact the French police already have powers of these nature.

<comment><USER6> My answer to these kinds of questions is always the same: you prosecute the crime and move on. You do not succumb to fear and loathing and pass some ill- considered bill that is acrimonious to liberty or modern social norms re: democracy or (online) security.</comment></comment>


Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection - <AUTHOR> https://thehackerblog.com/keeping-positive-obtaining-arbitrary-wildcard-ssl-certificates-from-comodo-via-dangling-markup-injection/index.html <comment><USER2> The timeline looks awesome:

      June 4th, 2016 – Emailed email@example.com and reached out on Twitter to @Comodo_SSL.
      ...
      July 25th, 2016 – Robin from Comodo confirms a fix has be put in place.

50+ days! Funny that the entity in question is the biggest CA.

That said, one should never click on links and buttons in emails. It's more comforting to be able to copy a link instead.

<comment><USER3> I wouldn't even copy links. Too many unicode shenanigans and other URL display problems out there.

I made an exception for sites I was going to immediately use 1Password's autofill with, trusting its URL validation to save me from fakes. I hadn't considered that merely loading a malicious URL could cause trouble. I think I'll have to reconsider my policy on that.

<comment><USER4> I don't even open links from emails anymore, just login to the company's dashboard and find it instead. :/

<comment><USER5> That's how I handle phone calls, too. For example, if I get a call from a bank then as soon as they begin asking for personal information I inform them that I'll have to call them back. I do this even if I was _expecting_ a call from them.

I've never had a representative balk at this, but many times they'll give me a number and extension to call. But that would defeat the whole purpose. I tell them that I need a published number that I can independently confirm. Usually they just say it's fine to go ahead and use the number on their website.

None of this is foolproof. My confirmation of a phone number is usually rather cursory--a quick Google search comparing results with what I find on the company's website. But infosec crimes are becoming increasingly common and I'd rather not be the low-hanging fruit.

<comment><USER6> I heard of an attack that causes even calling back to fail. Because with some phone providers, when you hang up, it doesn't actually hang up. So you dial the new number thinking you are making a new call, but you are actually on the same call and they just play ringing sound effects for you, and have a new person "answer".

<comment><USER4> Can you provide more details? I haven't heard of this one and hope to educate myself better if it really is possible.

<comment><USER7> This is a potential concern with traditional analog POTS. There isn't an explicit signal to end the call on the analog side. Some switches take longer than others to detect when your phone goes on-hook and end the call. If yours takes a long time, then on the plus side, you can hang up one phone, walk to the other side of your house and pick up the other to continue a call, but on the minus side, an attacker could play a dial tone at you and trick you.

This can happen with connections between switches too, potentially; but modern (like 1980s modern) out of band signaling techniques on trunks generally prevents this type of thing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> What's particularly terrible about problems like this is an organization with absolutely no relationship with Comodo is vulnerable. The CA system is so horribly broken.

<comment><USER9> Here is a graph of CA authorities. Who do you trust? [https://notary.icsi.berkeley.edu/trust- tree/](https://notary.icsi.berkeley.edu/trust-tree/)

See also Comodo vs Letsencrypt. [https://letsencrypt.org/2016/06/23/defending- our-brand.html](https://letsencrypt.org/2016/06/23/defending-our-brand.html)

<comment><USER10> Funny to see the giant swirl that is DFN with all its individual children.

(DFN is the "Deutsche Forschungsnetz" ("German research network"), and it gives out sub-CAs to the individual member institutions. Which apparently is an uncommon practice)

<comment><USER11> I talked to the CA guys at my university once and they don't have access to the keys. They do identity verification and send the documents onwards to some other CA folks at DFN for the actual signing. Makes the whole thing rather pointless imho.

<comment><USER12> Of course, this remind me of the ANSSI fiasco in late 2013 where one of the intermediates was used for MITM. From [https://bugzilla.mozilla.org/show_bug.cgi?id=693450#c29](https://bugzilla.mozilla.org/show_bug.cgi?id=693450#c29) : "I received email from the CA representative that said that the decision to include this root IGC/A 4096 SHA2 is discontinued (reason is the complexity of the operation and the associated costs)."

</comment></comment></comment></comment></comment><comment><USER13> To somewhat avoid email-based attacks like this, I asked my email client to show me the text instead of html email when both are provided. It's pretty clear to me that not that many people do this... many major websites send me emails where the text version is empty, truncated, completely different content, or a message like "Your email client is misconfigured, it should be showing you the html version".

<comment><USER14> I have mutt configured to open the html email in lynx and dump the text. Lynx is a terminal browser and does not support images and does not execute javascript. Prior to configuring mutt this way, I frequently encountered the kind of bad content you talk about in mail, but now I get the content and can still feel safe. I am still vulnerable to HTML parsing bugs in lynx, but I don't think the risk of anyone targeting lynx is all that big.

To read and send mail, I ssh to my mail server and use mutt there. For the most part it works great, except when I receive links I need to visit longer than about 70 characters because then I have to copy the URL in parts rather than all at once due to the plus signs inserted by mutt to indicate that the line continues.

<comment><USER13> I'm a mutt user, too. I think

set markers=no

in your ~/.muttrc will get rid of the plus signs.

<comment><USER14> That removed the plus signs. Thanks! :)

</comment></comment></comment></comment><comment><USER15> Incompetence, from top to bottom. If you are in a position to deny them money you owe it to the internet to divest asap.

<comment><USER16> I did exactly that - went with Let's encrypt for my latest site and ditched them for good.

</comment></comment><comment><USER17> > _Peeking at the above raw email we notice that the HTML is not properly > being escaped._

While I don't believe the author is mistaken that he successfully injected HTML into the email, the email snippet quoted in the article _is_ properly escaped, because none is needed, because the email is not HTML:

      Content-Type: text/plain; charset=UTF-8
      Content-Transfer-Encoding: 8bit

      [ snip ]
      Subject:

Injection Test

This order was placed by

This is correct for plain text as
 has no special meaning. That said, this is a multipart/alternative email:

      Content-Type: multipart/alternative; boundary="(AlternativeBoundary)"

"multipart" meaning the email contains multiple parts, "alternative" indicating that they're the same semantic things, but alternate representations of it. We're looking at the plain text representation, when we should be looking at the HTML representation.

(These are so email clients that don't support HTML — or are configured to ignore — can fall back on something.)

<comment><USER18> Oops you're right, I snipped the wrote part of the actual email I received. There's an HTML block below the text/plain block :) nice catch! I'll update it shortly.

</comment></comment><comment><USER19> This is so bad. I used to think a while back that SSL pinning was over the top. It looks like we as an industry need to move to SSL pinning asap wholesale.

<comment><USER20> The problem with pinning, as I understand it, is that it prevents me from being able to see traffic from my own computer (via HTTPS proxy). Pinning is fine as long as I can turn it off, but I don't want to completely lose the ability to audit the traffic coming off my computer, phone, etc. Related is the recent supposed change in Android disabling the ability to add a trusted root certificate, that also screws the ability to audit.

<comment><USER21> For better and for worse, installing a private root in most browsers causes pinning to be disabled (for certs signed by that root?).

<comment><USER22> From what I can tell from my former employers HTTPS MITM was that websites with certificate pinning turned on had to be exempted from the TLS proxy, otherwise browsers would throw pinning errors.

<comment><USER23> "Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. "Data loss prevention" appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning."

[https://www.chromium.org/Home/chromium-security/security- faq...](https://www.chromium.org/Home/chromium-security/security-faq#TOC-How- does-key-pinning-interact-with-local-proxies-and-filters-)

</comment></comment></comment></comment></comment><comment><USER24> A very obvious mitigation to this and similar issues seem to be to forbid HTML in domain validation emails. I don't see a reason not to do this and I totally expect that Comodo is not the only CA having such issues.

</comment><comment><USER25> Another day, another CA problem.

I'm almost desensitized to it at this point. Despite the fact that these problems are potentially Web-breaking.

</comment><comment><USER26> Wow, this attack was XSS 101.

And it could have been mitigated with _anti_ -XSS 101: rejecting all form posts containing angle-brackets.

<comment><USER27> This is insufficient to prevent XSS, or DMI -the de facto anti-XSS is contextual (generally HTML) encoding, and it is the only proper mitigation. Blacklisting specific characters such as angle brackets is not safe, and will end in tears.

<comment><USER26> Yes, blacklisting is insufficient in general. But it covers many cases, including the one here. Contextual encoding must be done each and every place you emit user input into HTML, and it's easy to screw this up. Character blacklisting provides an extra layer of protection.

Unless you're intending for your user to post HTML, or math inequalities, or diff patches - there's no reason to allow angle brackets on a form post.

<comment><USER27> > Yes, blacklisting is insufficient in general. But it covers many cases, > including the one here. Contextual encoding must be done each and every > place you emit user input into HTML, and it's easy to screw this up.

Blacklists are only acceptable if you do it in addition to contextual encoding wherever you emit user controlled data, and even then a much stronger protection would be to whitelist acceptable characters. Either way, contextual encoding whenever you emit user data is the only real protection. --And even then it's not a good fallback protection, a strong Content-Security-Policy should be your fallback protection.

> Unless you're intending for your user to post HTML, or math inequalities, or > diff patches - there's no reason to allow angle brackets on a form post.

Form posts are not the only vector for XSS, any HTTP request can be potentially exploited to perform XSS (and any part of an HTTP request), doesn't matter if it's a Form, an AJAX request, an HTTP header value, or a GET parameter, they're all potential attack vectors.

</comment></comment></comment></comment><comment><USER28> Why does the title specifically mean wildcard SSL certificates?

<comment><USER29> I think the author is using "wildcard" in general sense of "any value you fancy" rather than a "wildcard certificate".</comment></comment>


Show HN: Not BASIC – though strongly inspired by it - <AUTHOR> https://nbasic.net/ide/ <comment><USER2> This is cool! I'd love an immutable/functional version of this (I believe it can be about as simple).

Also, could work better on mobile...

<comment><AUTHOR> Thanks. Functional/immutable - that would not be BASIC like anymore. Mobile and programming - a challenging thing.</comment></comment>


Apple Sues Qualcomm for $1B, Alleging Extortion - <AUTHOR> http://www.forbes.com/sites/aarontilley/2017/01/20/apple-sues-qualcomm-for-1-billion-over-royalties/#6c5085775bc4 <comment><USER2> For years Apple has insisted on charging royalties for app features they have nothing to do with. When I make my app better and raise the price of my app, a bigger fee goes to Apple.

Now all of a sudden, Apple finds royalties oppressive?

I am sick of large corporations getting better treatment than consumers. If consumers can't sue pharmacy companies for using patents to set a high price for a life saving drug, then neither should Apple be able to sue Qualcomm for using patents to set a high price for CDMA chips not available elsewhere.

Billion dollar corporations should be left to their own negotiations without government interference and allowed to screw over each other (as long as they follow the law). The government should instead focus on stopping these same corporations from screwing over consumers and small businesses.

<comment><USER3> It costs money to charge users credit cards. If your app is $1, and you were handling the credit cards yourself, that could easily be $0.30 (and increases for higher prices). Apple gets better pricing than that obviously.. but they also have to maintain the servers that handle/store the credit card data, etc.

And they have to review your app.. which has a real labor cost.

If your app is $50, I could understand the outrage over the price.. but most apps are a dollar or two, and sell little to nothing.. the profits on that have to be insignificant or nonexistent.

<comment><USER4> > It costs money to charge users credit cards. If your app is $1, and you were > handling the credit cards yourself, that could easily be $0.30 (and > increases for higher prices). Apple gets better pricing than that > obviously.. but they also have to maintain the servers that handle/store the > credit card data, etc.

Credit card processors charge in the ballpark of $.30/transaction + 3%. And Apple could make a single credit card charge totaling every purchase through Apple for the month, which would make the fixed portion a fraction of what the credit card companies charge. If Apple was charging $.10 + 3% or 5% there would be hardly any objection.

And at Apple's scale, all the rest of that stuff costs them something like a penny per transaction.

> And they have to review your app.. which has a real labor cost.

I'm happy to do that part myself, or go price shopping for reviewers on the open market. How do I do that?

> If your app is $50, I could understand the outrage over the price.. but most > apps are a dollar or two, and sell little to nothing..

And yet they charge the same percentage for the $50 app, which is _why_ you don't see many of those on iOS -- the people who would make $50 apps make them for PCs instead because Dell doesn't demand a third of their revenue.

> the profits on that have to be insignificant or nonexistent.

If the profits are so low, why don't they leave the market and let some other saps compete to provide app stores?

</comment></comment></comment><comment><USER5> FTC complaint against Qualcomm [https://www.ftc.gov/system/files/documents/cases/170117qualc...](https://www.ftc.gov/system/files/documents/cases/170117qualcomm_redacted_complaint.pdf)

Apple vs Qualcomm [https://regmedia.co.uk/2017/01/20/apple_v_qualcomm.pdf](https://regmedia.co.uk/2017/01/20/apple_v_qualcomm.pdf) from [https://www.theregister.co.uk/2017/01/21/apple_sues_qualcomm...](https://www.theregister.co.uk/2017/01/21/apple_sues_qualcomm_for_royalty_gouge/)

</comment><comment><USER6> From my understanding almost every phone with CDMA uses a Qualcomm chip.

So why was CDMA adopted if there was only one supplier of the technology?

Telco's and manufacturers hate to have one supplier of anything, because it means the supplier can haul them over a barrel. Sounds like Apple's complaint is that they overpaid Qualcomm for CDMA components (among other things) after they introduced a CDMA iPhone.

So why was CDMA adopted at all if Qualcomm controls the patents and (seemingly) is the sole/dominant supplier of CDMA modems?

CDMA doesn't seem to be better than GSM in any technical respect.

<comment><USER7> It's a bit complicated, but I'll try to address the issues.

First, let's say that you want to make an isosceles triangle on a sheet of paper with the base parallel with the bottom of the page (as part of a triangle standard). Nokia owns a patent on lines being parallel to a side of the page. Ericsson owns a patent on figures with two sides of equal length. Qualcomm owns a patent on angles less than 90-degrees. In order to make your triangle, you need all three patents. You can't just go to Nokia and say, "wonderful, you own one of the patents and I want to make a triangle according to this standard and I'm going to compare your bid against the bids of Qualcomm and Ericsson." Nope, you need a license from all three.

Now, they've agreed to license the technology under FRAND (fair, reasonable, and non-discriminatory) terms. But what does that mean? The idea is that the patents of these three companies are all needed by the standard. If I want to implement that standard, I shouldn't get a license from Nokia and Ericsson for their patents and then during negotiations with Qualcomm be told that they want 99% of all my profits. That would mean the standard would go nowhere because people would be holding it hostage. The idea is that none of the patent holders should be able to exercise market power due to its patents being used as part of the standard.

But given that some patents are more valuable to a standard than others, how do we know which ones should cost what? We don't. Therein lies the problem. Most of the time, companies like Apple negotiate bilateral agreements with companies like Nokia, Ericsson, and Qualcomm. The only thing keeping those three in check is the specter of court action - court action that might look very unfavorably upon them.

But we still don't have a great definition of how exactly FRAND licensing should work. Ultimately, I think this is a new challenge for the world that we're trying to figure out.

\--

Now, on to CDMA. CDMA is a standard and while Qualcomm is often thought of as the owner, the case is actually that it owns a high share of standard- essential patents on 2G CDMA. They own a smaller share of 3G CDMA patents and an even smaller share of LTE patents (to the point that they aren't the #1 holder of LTE IP).

Qualcomm has committed to FRAND licensing on its standard-essential patents for CDMA. As such, CDMA isn't really single source - Qualcomm doesn't even own all the IP for CDMA.

But the FTC is alleging that despite Qualcomm's FRAND commitment, it isn't licensing its standard-essential patents to competing baseband developers. The FTC is also alleging that Qualcomm is getting paid a lot more in royalties than OEMs have to pay other holders of equivalent standards-essential patents.

\--

Let's say that consumers need a BLT sandwich to use mobile networks. I own a patent on bacon, you own a patent on lettuce, and someone else owns a patent on tomatoes. I say that bacon is really the hero of the sandwich and demand 3x more for my patent. Is that reasonable? Maybe. I decide that I won't license bacon to anyone unless they're willing to let me manufacture the sandwich on my bread (bread having no patent). I'm capturing a lot of money for my bread business, but I'd committed not to exercise market power like that when the standard agreed to use my patent. But I am. You want a BLT, you're going to need to buy it from me as I manufacture it using my bread.

More, let's say that it's 1901 and I'm the only company that makes non-stale bread. Your customers don't want stale bread - at least not the rich ones where you earn your money. So, I tell you that if you buy bread from other companies for your peasant BLTs, you'll have to pay me extra money for all those peasant BLTs or I'll stop giving you my bread for your rich customers. Maybe the other companies could make non-stale bread with capital investment, but if I raise the cost of their bread enough, you're not going to give them bread orders. Which means my bread will keep getting better while their bread doesn't improve.

Ultimately, the FTC is alleging that Qualcomm agreed that CDMA and other standards would be standards and wouldn't be single-sourced, but now Qualcomm is wielding its patents to try and make it single-sourced.

\--

But this really isn't about CDMA even. The FTC complaint goes into how Qualcomm basically supplies all the premium LTE basebands. Part of this is because of Qualcomm's practice of "no license-no chips". If you want Qualcomm chips (which you're going to need for any premium LTE device), you need to pay Qualcomm a license fee for non-premium baseband chipsets you get from other companies. That differs substantially from the agreements that all the other holders of standards-essential patents are enforcing. Normally, if I create anti-Qualcomm to create baseband chips and license the patents from Qualcomm, the people I sell the baseband chips to don't need a license from Qualcomm (just as you don't pay Qualcomm a license on top of paying Apple for your iPhone).

The FTC is noting that Qualcomm's "no license-no chips" policy has meant that OEMs can't challenge Qualcomm in court which means that Qualcomm can charge higher royalties than its IP should command since there isn't the judicial threat. Losing access to Qualcomm's baseband processors during the fight would basically doom a mobile company.

\--

Qualcomm has been using this as leverage. They make the best basebands and a company like Apple or Samsung or HTC need access to those basebands for their premium, profit-making products. If they can make competitive basebands less price competitive by demanding royalties on those chips from Apple/Samsung/HTC, then their baseband is "Total Patent Cost + Chip Manufacture + Markup" while competitors cost is "Total Patent Cost + Chip Manufacture + Markup + Cost of Qualcomm's Patents Again".

So, in theory: Qualcomm has chips people need. If you want a Qualcomm chip, you must agree to pay Qualcomm royalties on any competing chips you buy making the competing chips less economically viable. This means that a company like Apple can't give a big contract to a competitor that gives that competitor the chance to invest in their chips and potentially make them as good as Qualcomm's. Which means that a company like Apple continues to be reliant on Qualcomm. Which means they can put the onerous "no license-no chips" term in their contract that requires royalties on purchases of competing chips. . .which means the competing chips don't get the investment to become as good as Qualcomm chips. . .which means Apple continues to be reliant on Qualcomm chips.

\--

Hopefully that cleared up some of the issue. Qualcomm found itself with the best basebands and to make sure that competitors couldn't invest and become as good, they made sure that OEMs couldn't buy competing chips under threat of losing access to Qualcomm's chips (unless double royalties were paid). This also meant that Qualcomm could punch up the amount that royalties cost for their patents because no one wanted to lose access to their chips while their chips are the best. But their chips will always be the best if no one can give contracts to a competitor without having to double-pay royalties. It's a vicious cycle.

\--

As an aside, CDMA definitely had advantages over GSM. 2G CDMA had much better voice capacity. 1xRTT was a lot faster than GPRS. EV-DO was way ahead of EDGE and faster to market than UMTS. It was also a lot easier to deploy than UMTS. UMTS meant clearing 10MHz of spectrum (and carriers back then often only had 20-50MHz so it meant clearing a lot of space on an already congested network). UMTS, as a voice and data protocol, meant you had to have enough reliability to support voice without too many faults or customers would get annoyed so you had to wait longer before you could launch it. EV-DO only required 2.5MHz of spectrum which was a lot easier to clear out. As a data-only layer, you could launch it without worrying as much about it being unreliable since it wouldn't drop calls.

CDMA definitely had advantages - heck, there's a reason why UMTS was based on CDMA technology.

But CDMA specifically is a bit of a red herring here, in my opinion. Qualcomm found itself in a position where it had standard-essential patents for LTE and the best basebands. If you wanted their basebands, you had to agree that you'd pay double royalties on competing basebands that you purchased. You had to agree to that because you needed the best basebands for your flagship products. Given the inflated prices and lackluster performance of competitors, why not source everything from Qualcomm down the product line? Of course, that's a vicious cycle since no one will get good if no one buys their stuff to given them the money to put into R&D.

"Oh, I see you need our best-of-class basebands. . .It would be a shame if there were a supply disruption because you didn't agree to our terms. You don't think it's fair that we ask for double royalties when you buy competing basebands? Well, don't use ours! Oh, right, you can't make that decision. So pay up and don't use our competition, you hear?"

That sounds ridiculous, but the FTC complaint literally says "On some occasions, Qualcomm has induced certain OEMs to accept its preferred license terms using both the "stick" of threatened supply disruption and [redacted]".

\--

Anyway, excellent questions and I hope this clarified some.

<comment><USER8> > Let's say that consumers need a BLT sandwich to use mobile networks.

Haha, yes! BLTDRM? The world needs more BLT sandwich requirements :)

Thanks for taking the time to write up such a great response. Not being very familiar with this topic, your simple examples made this much more approachable and were a joy to read.

</comment></comment></comment><comment><USER9> Qualcomm's response: [https://news.ycombinator.com/item?id=13449956](https://news.ycombinator.com/item?id=13449956)

<comment><USER10> Nokia sued Qualcomm back in the day when they were the biggest mobile manufacturer. [http://www.nytimes.com/2008/07/24/technology/24qualcomm.html](http://www.nytimes.com/2008/07/24/technology/24qualcomm.html) Look where they are now...

Apple needs to win with technology and innovation, not lawyers

<comment><USER11> I don't believe Nokia suing Qualcomm had anything to do with the demise of their mobile devices unit. You'll also be hard pressed to find any analysis of the Nokia meltdown that would suggest this, though I'm happy to be proven wrong.

The article you've linked also notes that Qualcomm and Nokia already had a prior agreement, but once it expired couldn't agree and ended up in court. That's not what is going on between Apple and Qualcomm.

</comment></comment></comment><comment><USER12> Will be very interesting to find out where the truth lays. Reading this, it very much looks like Apple is in the right, but I'm sure the truth will be much more in the middle.

</comment><comment><USER13> Steve Jobs would never have allowed this to happen. R.I.P. :(

</comment><comment><USER14> Can we please stop posting this ad-blocker blocked shit? Thanks.

<comment><USER15> I am still able to read the article - uBlock, chrome, windows 10 all updated to the latest. What are you using to block ads?</comment></comment>


Why I Am Not An Integrated Information Theorist (or, The Unconscious Expander) - <AUTHOR> http://www.scottaaronson.com/blog/?p=1799

<comment><USER2> I appreciate the notion of a "pretty-hard" problem of consciousness; it nicely captures what people in the field, philosophers and scientists alike, are _actually_ looking for.

His counterarguments appear sound, especially the technical concerns. (That's not particularly exciting, though: formalisations of philosophical arguments often crumble under the mathematician's lens. Even the best ones!) They're not exactly new, I'd say, but their rigour is refreshing. My key problem with the overall approach remains the shitty test set we have for any theory of consciousness. It ultimately consists of two elements. If we're being generous, there's three. Namely, almost everyone except for the philosophical extremist agrees that we are conscious and that a stone isn't. IIT works quite well for these cases. Some people would include, say, a cat as a conscious being while maintaining that its "level" of consciousness is reduced. This boils down to

      C_stone < [C_cat <] C_human

which isn't much. There's no real hope for extending it. Any other cases like the ones Aaronson discusses are ones for which we don't even have strong intuitions. Sure, we'd like to think that none of the entities he describes are in fact conscious. But if that's the bullet I have to bite in order to get a decent theory of consciousness, then I might be OK with that.

<comment><USER3> There is little doubt that the cat is conscious, and the idea that consciousness is a gradient with more than one dimension is not really in dispute. In fact, you can build a very simple gradient model by observing nothing but humans: a human baby is scarcely conscious at all, a toddler is pretty much on par with the cat, and a grown human has a higher level still. The reason why we think this is true is based on at least two things: awareness and meta-awareness (which includes the ability to reason about one's own existence as well as the world in general).

The cat and the toddler are clearly conscious in the sense that they do have a recognizable life experience. They don't just react to the environment, they make models of it, and they have a limited ability to abstract observations. They experience life, and they have complex dreams and emotions. However, they still lack a deeper understanding of causalities, and they can grasp the subjective realities of other beings only on an instinctive level. Adult humans are less limited in this regard, but it's easy to imagine hypothetical beings who perform better still.

That's bad news for the validity of consciousness as a concept, since it seems to be interlinked with intelligence, which itself is a fuzzy idea at best.

So these observations amount to the position that "consciousness" isn't a fundamental property at all, it's the result of other processes and it can come in different flavors. Likewise, the concept of "intelligence" is similarly flawed. In both, we tend to make the mistake of looking at them as simple scalar values. They're not. They're a name we give for a collection of different capabilities. As such, I believe a mathematical model of consciousness is actually pretty unscientific, since consciousness is not an objective property. It's an artificial label we're obsessed with.

<comment><USER2> That's not the notion of consciousness we're dealing with when talking about the "hard" problem of consciousness. You're describing its psycho-functional interpretation: the ability to see yourself as a "self".

Qualia are a largely orthogonal issue. Specifically, it's imaginable that an entity we'd consider unintelligent has a rich and detailed subjective internal life.

<comment><USER4> > Specifically, it's imaginable that an entity we'd consider unintelligent has > a rich and detailed subjective internal life.

Yes, just as its possible that an entity we'd consider intelligent _doesn 't_, but since it's subjective, its not subject to empirical -- and, hence, scientific -- verification. Anything we are going to say objectively on issues _related to_ consciousness isn't going to address that, because that's a question outside the scope of science.

<comment><USER5> It's ontologically subjective but epistemologically objective, in the sense that we can ask questions and observe behavior. Pain is a good example.

</comment></comment></comment></comment></comment><comment><USER6> I'd argue that the author's views are too concerned with intuition. If we reduce consciousness to a scale rather than a binary property; of course a thermostat is somewhere on the scale, it simply has such a small value that it's not worth considering - leading to our philosophical intuition. There's nothing magical about our level of consciousness; as unintuitive as that may be. Aaronson argues that the model must yield to our intuition, but if the model is consistent and explains our observations, our intuition should yield to it. - the obvious analog here being quantum mechanics

In regards to saying "both that the Hard Problem is meaningless, and that progress in neuroscience will soon solve the problem if it hasn't already," neuroscientists and mathematicians too often overlook the Turing test here. It's consistent (if not accurate) to say that the "Hard Problem" is ill- defined, but maintain that we've clearly solved it if we can comprehensively beat the Turing test. That's what the Turing test was designed for, knowing that we've created a conscious machine because it's indistinguishable from a human; even if we can't decide on what consciousness is.

</comment><comment><USER7> I have had the fortune of working on this IIT right after my IIT :). I worked on implementing the research software used by Giulio Tononi and his research team. I added a visualizer in OpenGL, and optimized the calculations for calculating integrated information.

</comment><comment><USER8> Pretty dense article for what seems to be a really daffy definition of consciousness, so maybe someone can summarize? It seems to just be the difference between systems thinking and reductionism, but why would any irreducible concept be evidence of consciousness? Why on earth would that idea make any more sense than, say, a math problem that is too hard for a 4th- grader being evidence of consciousness? Or a locked machine, or a patented process, etc? There's nothing intrinsically special about an irreducible process other than it being irreducible - it's not like it's mystical or anything.

<comment><USER9> Close. Aaronson's most devastating argument (he offers two more) is that Tonini's \Phi or "integrated information" of an input-output system (function), under a reasonable operationalization as a measure of how correlated subsets of inputs are with subsets of outputs, is just not good measure of "consciousness" because, as it happens, large families of rather mundane systems that one wouldn't think as "conscious" in fact have _provably large_ "integrated information" or \Phi by design --such as Reed-Solomon codes, for instance.

Put in another way, if Tonini were right then your (say) portable DVD player ought to be "conscious" because, surprisingly, the amount of "integrated information" achieved by the scratch- and skip-tolerant error-correcting code it uses internally has to be _huge_ in order for it to work. But that is _prima facie_ ridiculous; so either we are wrong and the DVD player is in fact "conscious" or, more likely, Tononi's proposed definition of consciousness is lacking.

Again as I said Aaronson makes two other points, but I think this one alone is the most conclusive.

<comment><USER10> It's not _prima facie_ ridiculous that the DVD player might be conscious, as let's assume it _is_ prima facie ridiculous - then it would be prima facie ridiculuos in 1969 with a tape player, in 1979 with a VCR, in 1989 with a CD- ROM drive, 1999 with a DVD-ROM drive, in 2009 with a Blu-RAY drive, in 2019 with x, in 2029 with y, and there is no reason it shouldn't still be prima facie ridiculous even if at some point along the way the thing happens to be conscious as a side-effect, without this being necessarily visible in its outputs. So you can't just call it prima facie ridiculous and be done with it - you need some other argument.

</comment></comment></comment><comment><USER11> I wanted to like this, but IIT just seems like a lot of hand-waving.

 _" to hypothesize that a physical system is "conscious" if and only if it has a large value of Φ"_

By this measure, would a long mathematical proof or an orchestral symphony be conscious? If so, how does this actually help us understand how subjectivity relates (or doesn't) to all this?

[1] [http://en.wikipedia.org/wiki/List_of_long_proofs](http://en.wikipedia.org/wiki/List_of_long_proofs)</comment>


Ask HN: Which VPN service do you use? - <AUTHOR> Why did you end up choosing it over the others? <comment><USER2> Depends on the use you are going to make.

A self-hosted VPN (5 USD VPS running a VPN server and socks5/http proxy) is cheaper. The exit IP address most likely is NOT blacklisted by IP-sensible services (e.g. PayPal). But you get one country, one IP and belongs to you.

A professional VPN service will give you access through many countries (40-70 or more), the exit point is 'shared' and many VPN providers (e.g. TorGuard) do not keep logs. Or at least that's what their TOS says.

</comment><comment><USER3> F-Secure's FreedomeVPN has a great reputation and blocks tracking plus harmful websites. Works on Mac and iOS devices.

<comment><USER4> And Android and Windows.

</comment></comment><comment><USER5> I've been using SurfEasy and it has been good for me so far. Nice OS X app, easy to toggle countries. It does get autodisabled when you use any sort of torrent app as they want to ensure nobody comes after them for assisting illegal piracy activities, but I actually don't mind that at all.

</comment><comment><USER6> Self-hosted OpenVPN server on a cheap VPS in whichever country I want/need it. Simple to setup, full control, and the cost of the VPS is lower than most paid services (and can be used for hosting other stuff too if I want).

<comment><USER7> Same here but in a Docker container ^^

<comment><USER6> Yep same here actually. Docker certainly helps with the "simple to setup" bit, along with a script I wrote - [http://github.com/lukebennett/ovpn](http://github.com/lukebennett/ovpn)

<comment><USER8> Do you have any guide on setting something like yours?

<comment><USER6> Keep meaning to write a blog post, one day I'll get round to it :)

My setup is based on docker-openvpn[0] which has quite a detailed readme, along with a Digital Ocean community tutorial[1]. My script basically wraps up some of the config and makes the various commands a bit easier to remember.

[0] [https://github.com/kylemanna/docker- openvpn](https://github.com/kylemanna/docker-openvpn)

[1] [https://www.digitalocean.com/community/tutorials/how-to- run-...](https://www.digitalocean.com/community/tutorials/how-to-run-openvpn- in-a-docker-container-on-ubuntu-14-04)</comment></comment></comment></comment></comment>


Dutch startup plans first 3D printed steel bridge to span Amsterdam canal - <AUTHOR> http://www.theguardian.com/technology/2015/jun/17/dutch-startup-plans-first-3d-printed-steel-bridge-to-span-amsterdam-canal <comment><USER2> Discussed a few days ago at [https://news.ycombinator.com/item?id=9715888](https://news.ycombinator.com/item?id=9715888), but this story keeps getting reposted, so perhaps most people didn't see it.</comment>