The problem with Amazon's load balancing (ELB) - <AUTHOR> http://leadthinking.com/226-the-problem-with-amazons-load-balancing

<comment><USER2> The title of this post should be "The problem with DNS". It's really the lack of mapping the root domain to a CNAME that is the issue.

Amazon chose to do load balancing with layer 4, no sessions, and using low TTLs on CNAME records. This minimal feature set allows them to make the service highly scalable and fault tolerant. Add more features, and it could become brittle.

If you build your app or site around naked domains, expect layer 7 support, or want session persistence, ELB isn't going to work for you very well. On the other hand, if you build around the set of features they provide, it's likely to be exactly what you need.

Of course this leaves the issue with someone typing in your naked domain and getting redirected. I'd point out that this can be solved by using an elastic (static) IP and always making sure you have that IP address up on a box. If it's not mapped (and monitoring fails) then bring up a new box and assign it to that box. Only do 302s on that box to keep things simple.

Alternately you could use something like UltraDNS, which will monitor boxes for you, and switchero DNS on failures.

</comment><comment><USER3> Amazon designed and implemented AWS for their own use, and it is not always a good fit for outside developers. But sometimes it is.

AWS is very good for offloading non-time critical calculations, backup storage using S3, etc. AWS may not be the best choice for primary hosting, and as usual requirements analysis is required.

The DNS problem that the article mentions is not a problem for Amazon hosting their own applications but can be a problem for external users.</comment>


Google Employees Should Be "Pissed Off" Their Leadership Is Misleading Congress - <AUTHOR> https://twitter.com/randfish/status/1159174025949564928 <comment><USER2> I think Google made the right choice for themselves avoiding directly answering the question because you'll get absolutely nowhere with a "yes, but this is meaningfully inaccurate characterization of how the search space works." Nobody will hear anything except the yes on the various blogspam sites and Google's eventual long-form defense/rebuttal/explanation of the report will get lost on page 2 of their own searches for the story.

This is what you're supposed to do in law and PR. You never accept the premise of the question, which in this case is that the percentage of searches without a click or clicks to Google owned properties is a meaningful metric. If you answer at all you lose.

</comment><comment><AUTHOR> Compiled here: [https://threader.app/thread/1159174025949564928](https://threader.app/thread/1159174025949564928)

</comment><comment><USER3> What is a zero click search? How can 48% of search be answered without a click? Are we talking about searches that use the currency converter widget, calculator widget, the movie list widget, etc. Do these compromise 48% of all search?

<comment><USER4> sometimes theres enough info on the results page to answer your search query.

google does a lot more than simply find you a website

</comment></comment><comment><USER5> What protections would an Google employee have for calling out Google here? Does an employee get whistleblower protection for reporting that their employer lied to Congress or any other branch / department of some branch of government?

<comment><USER6> Problem is that Google didn't lie, they did what politicians do, they deflected the question. They gave an answer, but that answer was entirely random and had nothing to do with the question. We call this waffle.

<comment><USER5> How does the government get a corporation to give a truthful answer to a question?

<comment><USER6> In court, under oath is my guess? How does the electorate of a country get their own government to give a truthful answer? Unfortunately there isn't many ways to really get a straight answer from anyone these days. You can sue someone for something at which point there is something at stake, until then nobody has a reason to be honest if it could hurt their career/business/{insert whatever thing here}. :/

</comment></comment></comment></comment><comment><USER7> No employee should be pissed off. It's a job not a religious calling.

<comment><USER8> I respectfully disagree: it's important that an employee assesses whether her or his employer's actions align with their own moral compass and belief system.

Without this check we'd surely leave ourselves open to a society where people 'just doing their job' can do some pretty heinous things. This doesn't imply you treat it like a religious calling. Just that you give it due consideration

<comment><USER7> I disagree. I've worked/create gambling sites, pro-gay, religious sites and those all conflict with each other. I'm not really for or against their mission and nor should I be.</comment></comment></comment>


How the Internet Turned Bad - <AUTHOR> https://hackernoon.com/how-the-internet-turned-bad-b85b079ac45f <comment><USER2> There are many more facets to the internet now, than there were in 1999, prior to the dotcom boom and subsequent crash, when visions of a future with no downsides prevailed.

The only real problem the internet had to deal with at the time was spam and indexing.

Broadband didn't exist, so video didn't exist, high resolution touchscreens didn't exist, so smartphones didn't exist, and most importantly nothing was secured, and almost everyone (in the civilian, commercial sectors (†) was (often, willfully) naive to the cold hard facts which outlined why security is important.

Security, of course, has been the real cross-cutting driver of change. It took about a decade for serious malicious behavior to materialize in full, but it really ramped up after file sharing threatened old media, and was retaliated against, in the form of spiking peer-to-peer file shares with poisoned files. Then other actors appeared, and branched into spyware and identity theft, and more.

Security is hard, and people have pretty much been herded into the handful of large walled gardens, because no one has the energy to fight a fight that can kill industrialized nations. After all, information security is what killed the Axis powers, with the compromise of Enigma and Purple during World War II. [0,1] Are regular people supposed to succeed where armies have failed?

[0] [https://en.wikipedia.org/wiki/Enigma_machine](https://en.wikipedia.org/wiki/Enigma_machine)

[1] [https://en.wikipedia.org/wiki/Purple_code](https://en.wikipedia.org/wiki/Purple_code)

(†) We know that non-civilian actors knew better all along. This is why Pretty Good Privacy had been banned as a munition even in 1993.

[https://en.wikipedia.org/wiki/Pretty_Good_Privacy#History](https://en.wikipedia.org/wiki/Pretty_Good_Privacy#History)</comment>


Node.js is Cancer - <AUTHOR> http://teddziuba.com/2011/10/node-js-is-cancer.html <comment><USER2> Reading back through some of the author's other posts, I see a common theme:

Author picks out a software developer whom he considers is Doing It Wrong (TM), and tells them they're Doing It Wrong (TM).

The author seems to think that the world would be a better place without Node.JS, evented IO and server-side JavaScript, and rather than putting together a concise (or coherent) argument about the pros/cons, he decides to go after Ryan Dahl himself. I'm tired of the number of S and F-bomb dropping, rockstar programmer mentality-wielding morons who clog up the innovation space, and have nothing to contribute but FUD and nay-saying.

We're developers. We create. We find itches and scratch them. Node.JS is the result of Dahl scratching his itch, and a lot of us see merit in the project. Some very smart people (I'm tipping my cap to the people at Joyent, here) are actively addressing Node's rougher edges, so we'll see constant improvement. It's still relatively young (especially compared to the holy UNIX), and so what if it doesn't solve all of your problems; there's room for everyone to play in the web server scene, even JavaScript.

</comment><comment><USER3> I've said it before and I'll say it again: While liking Ted's writing is a matter of taste, he makes good points.

You probably shouldn't be trying to beat nginx or apache with node.js. That is a solid point. A couple years ago, I would have said you probably shouldn't try to beat Apache. I'm not saying it can't be beat; I'm saying you're not Igor Sysoev.

Javascript probably isn't the best language for an important scalable application on the server. It's getting better. But there's a reason Google and friends have to make some serious improvements. Don't get me wrong, I Love Javascript. It's one of my favorite scripting languages.

I love PHP as well (another language Ted just took a stab at). But I won't pretend PHP will some day be the best way to make an Android app. Sure, if someone added a PHP interpreter to Android, I might consider prototyping with it. But when it's time to shoot for production, it's going to be Java. Obviously.

Our languages are tools. Ted happens to think Javascript is the wrong tool - and in most cases outside of the browser - he's probably right. I'm using it for a pretty large project right now. I have pull requests to a few npm modules and few new npm modules to add, and a few thousand lines of code tying them all together.

But once our concept is proven, I assure you, Node will probably be the first thing to go. Not from my toolbox, just from the project that will have already outgrown it. It's not the right tool for the job when we scale beyond a couple servers. But for right now, while figuring out what goes where and why, there is none better.

<comment><USER4> So what's stopping you putting nginx in front of node?

If you're worried about the maturity of its library, availability of good developers, or just that JS is an ugly language (and Coffee-script is too boutique), or Java is just faster, that's a good reason. Though there are lots of people who use the slow and ugly PHP (which seems to get good milage - Facebook and Wikipedia are doing OK with it).

I don't like JS, so I wouldn't use Node, but that doesn't mean it's crap.

</comment></comment><comment><USER5> Ok, I also cringed when reading the original post by Ryan Dahl bashing UNIX for its "complexity". I simply assumed that he had had a bad day. But this reply is simply mean and almost reeks of character assassination (very ad- hominem). "cancer", he "wrote code unchecked for years", "braindead"...

Yes, an async framework is not the panacea for everything. That has been known for a long time with similar frameworks for Python/Java/... It makes some things easier/faster and other things harder. But why act like this?

<comment><USER4> And, as other less polite posters have pointed out, some of what he says is debatable. I've read a few of Ted's posts, and while he's smart and a good communicator, he is extremely narrow minded. I'm sure he has his own way of doing stuff, and can implement like a machine using his own narrow toolset, great. No-one can learn to use every tool, and some can just be a giant time- sink ( _cough_ Google AppEngine). But that doesn't mean that everyone who uses a different toolset is a complete tool.

One minute, he's ripping into Tornado, because it's under-engineered. Then he thinks Twisted is over-engineered. Next, Node.js is crap, because it doesn't do things _his_ way. Then there's NoSQL, which he hates, because it's not MySQL. No idea what he thinks of PostGres, he probably thinks it's got too many features.

Point 1: A Scalability Disaster Waiting to Happen. No, node.js is not a scalability disaster, and even if it is, doesn't Ted advise developers not to worry about scalability as they are only going to get ~3 long-term users in the first year?

Point 2: Node Punishes Developers Because it Disobeys the Unix. Um, you can put it behind nginx, and that buys you a lot of "separation of concerns". Honestly, he mostly seems to be insulting node.js programmers, suggesting that they _don't_ bother to create full production systems - quote "let's be honest with ourselves here, if you're a Node developer, you are probably serving the application directly from Node, running in a screen session under your account." This seems to be really the core of his concerns - Node is easy for one guy to setup a working website. Isn't that a good thing?

Point 3: It's Fucking JavaScript. Which I guess is good if you are a JS expert.

He swings between two extremes - everyone using simpler tools than him is a retard who needs to man up and learn to program, and everyone using more dangerous tools should stop beating their chest and actually implement (premature optimization, guys!) In the case of node.js, he seems to believe both points, which I suspect is because he just doesn't like the toolset.

<comment><USER6> "Node is easy for one guy to setup a working website. Isn't that a good thing?"

Maybe. Maybe not.

Many people on this forum have had to rescue or rewrite systems that were built in Access. Access is easy for one guy to set up a database. Isn't that a good thing? Sometimes yes, sometimes no.

Ditto for Excel nightmares.

That said, a prime distinction between Excel/Access and something like Node (and I'd throw Rails in there too, given all the "it's so easy" love it got a few years ago) is open (and open source) and it's easier for the community to work around the issues that come up, release new versions quickly, and fix the bad parts faster than with closed solutions like Excel/Access.

But... just because something is easier to use doesn't mean it's the best tool for all use cases - really nothing is best for all use cases. :)

Haven't done much with Node beyond Hello World stuff - tried to install and use zombie, but couldn't get it to work.

</comment></comment></comment><comment><USER7> Here is a perfect example of a troll artwork:

Build a straw man argument picking a useless example exploiting a known design limitation of a particular design choice and use it to tarnish everything about it.

Unfortunately this doesn't tell node devs anything new, fuels node haters and presents deceptive information to devs unfamiliar with event loops or the scalability problems inherent with Blocking IO.

</comment><comment><USER8> If possible, can someone ignore the showers of vitriol for a minute, and comment on the technical merit of his criticism of Node? I ask because I'm a total noob and would like to understand what's being discussed.

<comment><USER9> _comment on the technical merit_

Hi, Hrishi. There is a grain of technical merit in two of his three objections, but he trollishly overstates them. I've had to think about some of the same questions lately, so here are some thoughts. If anyone has a substantially different perspective, I'd like to hear it.

By the way, the most interesting thing about his critique is that he doesn't even touch on the most common objection to Node, that async callbacks don't compose well and so break down under complexity. That one's been argued to death on HN, though, so I'll follow his example and leave it out of this.

Let's consider the criticisms in reverse order. #3, about Javascript, we can dismiss as a vacuous language flame. #2 is about separation of concerns. He argues that web servers should be separate from web apps, and Node confuses the two by doing web server stuff (handling HTTP requests) and app stuff (whatever your app does) in the same context. Now you either have to put a "real" web server in front of Node (in which case there's the question of what value Node's adding) or use a relatively immature web server (Node itself) as your front end. There is a good point about modularity here. But is the line between web servers and web apps always so clear-cut? If his argument were completely true, CGI would be perfect for everything. Most people wouldn't agree with that. Moreover, you wouldn't see complex configuration languages and extension APIs for web servers, the kinds of things that arise when the lines start to blur (and are not very pleasant to work with). So the question is just how separate the concerns really are. This surely depends on the application. Separation of concerns is a good thing until interactions between modules become unduly complex, at which point one sometimes gets a big simplification by unifying them.

For example, in the project I'm working on, there are resources that need to be requested by the browser and sometimes also by the (app) server in order to complete some computation. You could divide this work many different ways, but it sure is convenient to just write Node handlers to do whatever I/O you need in the course of completing a request. To have the app server go back to the web server would be awkward, and so would having two different ways of fetching the same stuff.

#1 is about blocking. He refutes a blurb that says "nothing blocks in Node" by showing a trivial example that indeed does block Node by doing a long computation in an event handler. (One wonders why he didn't go full retard and just put an infinite loop in there.) This is a deliberate misreading of the blurb, which obviously meant not " _nothing_ blocks" but "no I/O blocks". So, a straw man. But dig deeper and there is a valid point nearby. If you have long computations to do while fulfilling a request (where "long" is defined as "taking longer than you're comfortable having all other requests to this server wait"), then for Node to work well, you have to farm those computations out to other processes. This is doable, but adds complexity. You start to move out of Node's sweet spot.

What's the sweet spot? If writing your server code in Javascript is a win for you and your app is I/O bound (more precisely, if there aren't any long- running computations as defined above), Node looks pretty good. If in addition the app server and web server have more complex interactions than just "here's your request" and "here's your reply", it starts to look really good. An example might be a web chat app.

As things get more complex, the judgments get trickier. In our case, we do have long-running computations. Bad for Node. But we also have webserver-like needs in our appserver, a lot of I/O that we don't want to block on, _and_ Javascript is a big win for us. So on the whole Node wins. Take away the point about Javascript, though, and it probably wouldn't.

</comment></comment><comment><USER10> What a stupid asshole. How else would you expect an event-driven server to behave when you throw Fib(40) at it? The only legitimate complaint entangled in that strewn-out plesh of vitriol is that Node's http server doesn't have some features that one might like in a web server. Putting a proxy in front of Node is not a problem, because Node's strengths (handling zillions of connections with little memory overhead on top of application state, without having to write your own event system) are not abated.

<comment><USER11> Although it's expected that long calculations will block a Node server, the complaint is legitimate.

<comment><USER12> The only thing he legitimately did was build a straw man and knocked it down. If a programmer doesn't know how his tools work well enough to foresee any potential gotchas and take steps to avoid them, that's a fault in the programmer rather than the tools. Not a terrible fault; any programmer who's honest with himself will acknowledge that he does this fairly often; especially when he's learning new tools. And will respond to the situation by learning from mistakes and writing better code in the future, rather than writing breathless blog rants that smell of (to use the author's language) butthurt.

Alternatively, we could interpret the article to be based on the assumption that it's common for people whose knowledge of how computers work is so poor that they believe everything north of the southbridge happens instantaneously to be put in charge of making major design decisions for high-traffic sites. But that seems less charitable to me, since it replaces a simple straw man with something approaching delusional paranoia.

<comment><USER13> Guess what! You agree with Ted then. One of the big problems he mentions is the apparently simplicity of an event driven app.

"Because nothing blocks, less-than-expert programmers are able to develop fast systems."

That's bit he has a problem with. From your post:

"If a programmer doesn't know how his tools work well enough to foresee any potential gotchas and take steps to avoid them, that's a fault in the programmer rather than the tools."

Both of you are saying that a programmer needs to know his tools well. Ted says that Node.js doesn't encourage people to understand the limitations of an event driven framework well enough.

All you good programmers out there: Keep using Node.js. It is a great tool and does things well. But don't pretend that it's the snake oil to make everything faster. The design decisions YOU make have the most impact on the speed of your application.

</comment></comment></comment></comment><comment><USER14> I normally like Ted's posts, but in this one he either omits or doesn't seem to realize that the reason nginx scales better than Apache is that its workers are non-blocking event-loops.

</comment><comment><USER15> I have to agree with him. I bought into it, but it feels like I'm getting fucked in the ass.

<comment><USER16> Is getting fucked in the ass a good or bad touch here?

<comment><USER17> Good point, man has to be specific

<comment><USER18> Point to the places on this doll where you have been fucked by node.js...

</comment></comment></comment></comment><comment><USER19> If I was Yahoo I'd think twice before adopting something like Node.js, but if you're a little guy that wants to scale on the cheap and is willing to take risks because the alternative simply won't work for what you're trying to do, then just use Node.js. Django, PHP, Rails with Apache in front of them aren't designed to handle thousands of persistent connections and it would be far more expensive to scale the traditional web-stacks to handle them.

As some Joyent guy was saying there's real resources behind Node.js, it isn't just a cool hack made by some promising Jedi but it needs to fit your use- case. If you're designing a real-time web app and you have a limited budget then go for it, I don't think there's anything better out there now (except for Tornado, Twisted, which is just a matter of taste) unless you're Yahoo, Google, etc...

</comment><comment><USER20> "if (typeof my_var !== "undefined" && my_var !== null) { // you idiots put Rasmus Lerdorf to shame }"

Someone doesn't know about the "foo == null" idiom (it's true if and only if x is null or undefined).

Not to mention the fact that the "typeof foo == 'undefined'" thing is overly defensive "best practice" that people keep needlessly repeating, IMO. If someone is stomping all over important fields of the global object, there's nothing you can do.

JavaScript has its issues, but this one isn't fair.

<comment><USER21> > Someone doesn't know about the "foo == null" idiom (it's true if and only if > x is null or undefined).

(preface: I am by no means a javascript guru)

Really? Double equals in javascript? I thought that was a no-no due to the type coercion that "==" does.

I get a reference error when I crack open a console and try your example idiom.

<comment><USER20> Right, it doesn't work when you're testing whether foo is a bound name at all. In that case you need to use "window.foo" (or this.foo in Node).

And yeah, it's double equals. The coercion is exactly what allows "== null" to do the right thing in the presence of undefined. Contrary to popular belief, "0 == null", "'' == null", and "[] == null" are all false in JavaScript. "foo == null" doesn't test for falsiness, it just checks whether foo is null or undefined.

</comment></comment></comment><comment><USER22> So? Ted Dziuba hates node.js and thinks Ryan Dahl is a jackass.

I guess he didn't look at node for long enough to realize that it's a low level platform, not an http web framework.

</comment><comment><USER23> This is a typical troll post coming from someone who clearly doesn't understand what he is talking about. I wonder how would he write a parallel process manager ...

</comment><comment><USER24> >Node.js is an unpleasant software library and I will not use it.

a rant about a software he doesn't even use....

<comment><USER25> A rant about software that he _won't_ use. Clearly he has done some testing to see how things are, but why would he use something he's convinced is crap?

</comment></comment><comment><USER7> What a retarded post from a self-proclaimed smart guy.

First he completely misrepresents the point that Node performs well and scales is because it doesn't Block I/O, i.e. the biggest bottleneck in scaling highly concurrent applications.

It's hard to actually pull out any facts or points to dispute since he sounds like a whinny troll on a rant, hand picking disingenuous examples that are obviously going to trip up event loops, something everyone programming against an event loop already knows. A clearer example would simply be:

         while(1);

And the point is this blocks the server 'by design', i.e. no time is spent context switching between threads.

If for some reason he really needed to calculate high fibonacci numbers on a web server he could simply memoized the fibonacci function, and get back your stellar response speeds (on a 2yo Macbook air):

            function memo(f) {
    	  return function (x) {
    	      f.memo = f.memo || {};
    	      return (x in f.memo)? f.memo[x] : f.memo[x] = f(x);
    	  };
    	}
    	fibonacci = memo(fibonacci);

        ~> time curl http://localhost:1337/
    	fib: 165580141
    	real	0m0.023s
    	user	0m0.009s
    	sys	0m0.005s

If he's going to profess CGI scripts are a superior way of doing things, I want to see proofs/benchmarks since nothing he's said makes me take his word on face value - that and his previous posts he shows he's an actual baiting, troll - so I wont be relying his advice anytime soon.

And in his quest to poison JavaScript he choses an code example that no one actually uses, since it can be expressed in the more concise equivalent:

        if (my_var != null) {
          // you idiots put Rasmus Lerdorf to shame
        }

<comment><USER13> "if (my_var != null)" Throws a reference error if my_var is not defined. By checking the typeof it will short-circuit before throwing the error. It is accepted enough to be the default coffeescript implementation of "?" (the existential operator).

The OPs point wasn't that you couldn't write faster code with non-blocking I/O. His point was that just having non-blocking I/O isn't always going to make things faster. Sure, most applications get lucky and have faster implementations, but it is important to understand what is happening behind the scenes in order to avoid hanging yourself. He thinks the Node.js community has not emphasized that understanding at all and the hype around Node.js is leading to badly written applications.</comment></comment>


EFF's Fight to End Warrantless Device Searches at the Border - <AUTHOR> https://www.eff.org/deeplinks/2018/01/round-effs-advocacy-against-border-device-searches <comment><USER2> From the linked description of the plaintiff's accounts, a US citizen:

> _.. A few days later, while returning from a day trip to Canada, I was once > again detained and told to hand over my phone. When I refused, three agents > used force against me. One agent grabbed my neck and began to choke me while > another wrapped up my arms and legs. The third agent reached into my pants' > pocket and took my phone, all while I was in severe pain and fearing for my > life.

Agents once more took my phone out of my sight, only to later return it without any explanation for what they did with my phone._

I had not heard this account before, and it's pretty shocking. I had assumed that while migrants/permanent-residents could be denied entry, US citizens could have their time-wasted/device-confiscated at worst.

I didn't realize that the government had given itself the power to literally beat physical access to personal computing devices out of people without a warrant.

<comment><USER3> Generally speaking, law enforcement can do whatever they want as long as they can give their superiors a reasonable explanation of their side of the story and there isn't overwhelming evidence. Most people can't get the EFF to file lawsuits. Many jurisdictions can just charge you with resisting arrest, even if they can't file other charges that justify the arrest in the first place.

As a far less dramatic example, this morning I had a TSA agent called me "stupid" because I left my toothpaste in my luggage, which I did because the last time I took it out of my suit case, I got yelled at for following the sign instead of heeding shouted instructions to the contrary. 10 feet away a different agent also called me "stupid" because I had removed the toothpaste from my luggage instead of the small Kindle which is obviously bigger than a small iPhone. I guess that's the new threshold for devices that must be removed. And what recourse do I have against verbal abuse over arbitrary judgments? Well if I want to keep flying without excessive effort, none.

edit: I should add, generally speaking I've found American LEOs to be very polite and pleasant, ESPECIALLY compared to some other places I've lived. They have to deal with some truly shitty situations and I'm not anti-police at all - but systemically there is large potential for abuse and some places where that abuse is clearly happening.

<comment><USER4> I've stopped flying in the US simply because I can't go through the line without being molested in some way. It's only in the US.

No other security agents in the world require you to take off your shoes, or do anything more than a standard leg pat down (if they do one at all. Most places just make you turn your pockets inside out).

The TSA is absolutely beyond horrible and Americans have just stopped fighting them and accept this as the new normal. You can get past it if you pay the extortion price for pre-flight checks and have them finger print and background check you.

<comment><USER5> > No other security agents in the world require you to take off your shoes, or > do anything more than a standard leg pat down

False. At least when flying from Schiphol (Amsterdam) you'll be taking off your shoes and you'll go through an X-ray. Not sure about other airports but it wouldn't surprise me if this was a European thing instead of just a Dutch thing - I can't recall if they required it in Spain as well.

<comment><USER6> This is factually incorrect. I fly through Schiphol 10+ times a year and never had to take off my shoes. Neither did I in Paris, Berlin, Barcelona, London, Copenhagen, so "it's not a European thing" either.

I _did_ see officers asking _specific_ individuals to take off their shoes, with a specific justification: when either the shoes obviously contain metal, or the individuals go through the X ray machine and it complains and there is no obvious other metallic item.

</comment></comment></comment></comment></comment><comment><USER7> Once again: Use the TSA as an electronic waste recycling program, and donate your old phones to them by carrying them through checkpoints.

When they confiscate them, tell the TSA to keep it because it's garbage, and make it clear, your intent is to waste as much of their time, energy and resources as possible.

<comment><USER8> I don't know if I'd play that game. They can waste your time much more effectively and get paid while doing it.

</comment></comment><comment><USER9> > It's as if our First and Fourth Amendment rights don't exist at the border.

Take out the "It's as if" \-- that's precisely the government's position.

<comment><USER10> and the "border" spans 100 miles inland of US border ... entire states, like Florida, are pretty much considered part of the border... [https://www.aclu.org/other/constitution-100-mile-border- zone](https://www.aclu.org/other/constitution-100-mile-border-zone)

</comment></comment><comment><USER11> I'll be visiting the US in April this year, and I'm worried about the border crossing.

I'm guessing the best I can do as a non-US citizen is to have my previous phone on me with convincing-enough amount of dummy data in it. Is there any better way?

I will be entering the US via car from Canada by the way.

<comment><USER12> It's unlikely you'll be searched if you're entering by car via Canada. These searches seem mostly targeted at airports. I can't imagine the border patrol having enough time to search every one of the thousands of cars crossing from Canada every day.

<comment><USER13> There were a lot of things people couldn't imagine happening in America that have sadly come to bear...

</comment></comment></comment><comment><USER14> Canada continues to be the worst of airports I ever visited. I went back and forth thru the whole place and haven't seen a single information booth. This is my flight in 2017. No wonder people can lose their marbles.

If you think the sky fell because this guys' neck was grabbed, here is some _bit more shocking_ news for you:

[https://en.wikipedia.org/wiki/Robert_Dzieka%C5%84ski_Taser_i...](https://en.wikipedia.org/wiki/Robert_Dzieka%C5%84ski_Taser_incident)

[https://www.youtube.com/watch?v=_IJqdL40lvU](https://www.youtube.com/watch?v=_IJqdL40lvU)</comment>


Show HN: Income-inequality.info – visualize world income inequality - <AUTHOR> https://income-inequality.info/ <comment><AUTHOR> Author here.

This was for a United Nations Data Visualization Challenge [1] and it won 3rd place [2].

All the code is available in on GitHub: processing [3] and interactive visualization [4]

[1] [http://hdr.undp.org/en/data-visualization- challenge-2019](http://hdr.undp.org/en/data-visualization-challenge-2019)

[2] [http://hdr.undp.org/en/content/2019-human-development- data-v...](http://hdr.undp.org/en/content/2019-human-development-data- visualization-challenge-winner-gender-inequality-visual-story)

[3] [https://github.com/whyboris/Global-Income- Distribution](https://github.com/whyboris/Global-Income-Distribution)

[4] [https://github.com/whyboris/income- inequality.info](https://github.com/whyboris/income-inequality.info)</comment>


IE9 is better at blocking malware than Chrome, Safari, and Firefox combined - <AUTHOR> http://thenextweb.com/microsoft/2012/09/27/study-finds-microsofts-ie9-blocks-95-threats-google-chrome-blocks-just-33/

<comment><USER2> Actual reports are here, downloadable as PDF:

[http://www.nsslabs.com/reports/your-browser-putting-you- risk...](http://www.nsslabs.com/reports/your-browser-putting-you-risk- part-1-general-malware-blocking)

[http://www.nsslabs.com/reports/your-browser-putting-you- risk...](http://www.nsslabs.com/reports/your-browser-putting-you-risk- part-2-click-fraud)

The methodology is (vaguely) described in the first document. The click fraud result was very interesting, it seems that Chrome just doesn't address it at all. Of course I suspect the majority of click fraud goes on in Google's ad network, so Google has an incentive to ignore it just as Microsoft has a reason to catch it.

<comment><USER3> I don't see why we need click fraud blocking in the browser anyway, unless it was just a by product blocking malware, as it could be done way more effectively in the ad network.

<comment><USER2> Look at it this way, click fraudsters are parasitic to advertisers but actually symbiotic for web sites and ad networks. So how can you expect them to aggressively prevent it? As long as the fraud doesn't rise to the point where the advertisers can't make money, they'll continue to run ads because the process is opaque and there aren't a lot of other viable choices.

</comment></comment></comment><comment><USER4> The malware report here says they analyze protection from "malware downloads". If so wouldn't that be the job of an antivirus program? I don't understand why the browser is supposed to do this.

If this is basically duplicating what antivirus programs do anyway, then has IE just added some GUI integration with MS's antivirus, and that gives it the good result it gets here? It seems like all browsers will be equally safe given the same antivirus installed on their machine, so the result seems meaningless.

Even less clear is the other report, on click fraud. It mentions software running on the client's machine ("click fraud software installation" etc.), so basically we are again talking about malware? And again, wouldn't a program separate from a browser - an antivirus program - be the right tool to handle that?

Lists of dangerous URLs are something that browsers can do that antivirus programs can't. But oddly that is not the focus of these reports.

<comment><USER5> There's a link somebody posted below about how it works: [http://blogs.msdn.com/b/ie/archive/2011/05/17/smartscreen-17...](http://blogs.msdn.com/b/ie/archive/2011/05/17/smartscreen-174-application- reputation-in-ie9.aspx)

It's a reputation system for downloads. Sure its something a antimalware can do as well but given that most software/malware gets downloaded these days, makes sense to have something like this in browser

<comment><USER4> I agree the browser should be involved in some way. But wouldn't it be better to have a single antivirus that integrates with your browser, email client, and also scans USB drives you connect? Browsers aren't the only vector of attack, so duplicating an antivirus seems an odd choice.

From the article, it sounds like the main benefit of SmartScreen is the quickness. But again, wouldn't it be better to have an antivirus with that performance, and then your entire system would benefit..?

</comment></comment></comment><comment><USER6> I'd like to see false positive rates in addition to false negative rates. In my experience, SmartScreen just labels 90% of everything as malware. The false positive rate is important because if the filter is usually wrong users will learn to just ignore it.

<comment><USER5> SmartScreen is basically a reputation system. If not enough people have downloaded it and it's not known as a threat yet, it chooses to do the default thing and blocks it. That is probably what causes the behavior you referred to. But would you rather let a non-technical person not download a valid binary or let them download a malware?

<comment><USER6> It depends. If the non-technical person is so frustrated by SmartScreen being wrong all the time that they simply turn it off, or are instructed to turn it off by sites distributing legitimate binaries slandered by SmartScreen, then it's not a net win for security.

<comment><USER5> so are you saying its better to let download a (not so commonly downloaded) binary than to warn about it? Thank god you don't work on security software

<comment><USER6> Personal insults are unnecessary. What I'm saying is, a filter that prevented you from downloading anything would score 100% on this test. That doesn't make it more secure, because users would just disable it.

</comment></comment></comment></comment></comment><comment><USER7> I will avoid the "easy" joke that it's because so many sites balk at running properly under IE9 (oh... guess I didn't after all), and point out that I do believe that Microsoft understands they need to regain a certain amount of cred if they are going to regain the number 3 spot they need to be able to eventually take a shot at the summit again. I do think their development process gets in the way - in that they are setup not to be able to accept good ideas from the community that Firefox and to a lesser extent Chrome are able to. On the other hand, they have a better view of the corporate environment than the others, and I have to assume that will pay off at some point.

</comment><comment><USER8> IE9 is a solid browser, and the pop-culture IE vitriole, while clearly having roots in important history, is getting tedious.

</rant>

Firefox needs to step its game up here. Although frankly I'm surprised that the browser manufacturers don't share their blacklist data.

<comment> at-fates-hands IE9 could do itself a favor and create some decent developer tools and it would be a lot closer to the top of my list.

Hell, even Opera has a better set of developer tools and it hovers around 2.2% of the market. I'm not even including its great mobile emulator either.

<comment><USER5> concur. The dev tools and plug-ins that FF has are unbeatable. But then that is not what my mom/dad care about as much. So they still use IE.

<comment><USER9> What's FF offer over Chrome? The Chrome tools are pretty freakin' badass these days.

</comment></comment></comment></comment><comment><USER10> Something doesn't make sense here. Don't firefox and chrome use the exact same blocklist made by google? It says so right here: <http://www.google.com/tools/firefox/safebrowsing/>

So why do their graphs differ so much?

<comment><USER11> It's discussed in the malware pdf. Chrome also has some exe blocking in addition to the safebrowsing.

</comment></comment><comment><USER12> Yes, by levelling accusations of "malware!" at every download not distributed by Microsoft itself.

SmartScreen Filter is a product-disparagement lawsuit waiting to happen. I hope I hear about it in time to pile on.

<comment><USER13> That is not true. It is based more on reputation. May be you should first learn more about it before spreading misinformation : [http://blogs.msdn.com/b/ie/archive/2011/05/17/smartscreen-17...](http://blogs.msdn.com/b/ie/archive/2011/05/17/smartscreen-174-application- reputation-in-ie9.aspx)

<comment><USER12> I'm quite aware of what I'm talking about, but thanks for your concern.

Russian entrepreneurs get to pay off their national Mafia, while Windows developers get to pay off Symantec. Life goes on, I suppose. But they'd receive fewer complaints if digital signing didn't only improve reputation "twice as fast," whatever that means, in the words of the blog entry you linked to. The opacity of the process is as offensive as the core idea of basing reputation on how commonly something is downloaded.

</comment></comment></comment><comment><USER14> I like the Chromebook and Chromebox adverts, but thats probably just me.

When I see a statement such as "IE9 is better at blocking malware than Chrome, Safari, and Firefox combined" I think of it as some clever marketing spin. Reason being is if you got the malware issues of Chrome+Safari+Firefox and compared the result with IE9 malware issues and you see how some statements can be true whilst not being accurate. This is the issue with any sample based comparision. There are many forms of issues out there and new ones every day at times. Lets face it only last week IE9 was open to a expliot that the other browsers were not and was emergency patched by microsoft shrtly afterwards.

True answear is no one browser is secure all the time and if you come across a new unpatched expliot in one browser then the option to fallback to another browser is better than being open until it is patched.

From my personal experience I've found Opera to be the best out the box for blocking general crap. Shame that was not included in there testing, especialy if they wish to give out solid advice. Also note these are desktop browsers and in that, how mobile browsers fair is still a question left unansweared.

</comment><comment><USER15> They talk about URLs and MD5 (binary files). Chrome, Safari and Firefox use Google Safe browsing which target malicious pages, rather than malicious files. Malicious pages (HTML, JavaScript) is typically hosted on a different domain that the malicious executable. For my experience, GSB focuses on the malicious HTML/JavaScript. If it is blocked, the user never gets to the malicious executable. if NSS feeds URLS of the malicious executable, it is possible GSB miss them. But this would not be a real world case.

I tested GSB and IE about 2 years ago which a much smaller sample set. There was very little overlap between what they block. So I would be curious how the URLs were gathered.

</comment><comment><USER16> This is the same Microsoft marketing material that NSS Labs puts out every year. It's devoid of any of the information you'd need to quantify, validate, or falsify the findings. In past years NSS at least admitted that Microsoft sponsored these "studies." Now they lack even that transparency.

</comment><comment><USER17> I remember testing AJAX in IE9, and I couldn't do any cross-site requests, which may be impacting the click frauds?

Although, I'm a nub and don't know how to properly code an AJAX call I'm assuming.

</comment><comment><USER18> Wait..wait..wait....

 _nobody_ has caught on to the fact that NSS did this test with the latest version of IE and horribly outdated versions of FF and chrome?

Hacker news I expected better of you.

</comment><comment><USER19> How about Chrome Firefox running on Linux...?

</comment><comment><USER20> Did Microsoft commission the study?

<comment><USER13> Must be. Because anything Microsoft does better especially in the areas of security must be flawed or propaganda </sarcasm>

<comment><USER21> Well I remember when Chrome's security was broken for the first and only time, by a research firm. And guess who paid for that to happen? Microsoft.

So let me repeat that. Microsoft paid a company to break Chrome's security.

<comment><USER22> First and only _known_ time?

</comment></comment></comment></comment><comment><USER23> Title should be "... better at blocking malware on the steaming pile that is Windows...". Chrome/Fox are just fine on my Linux box.

<comment><USER18> _thank you_

</comment></comment><comment><USER24> Because nobody uses it!

<comment> simba-hiiipower ..really? well, thanks for your thoughtful contribution to the discussion. i hate to shoot-down such an insightful and well thought-out point but a quick check [1] seems to refute your claim. in fact (oddly enough) it appears that, not only do people use it, but a majority of people do.

i honestly don't understand all the hate around ie.. my experience using it on a day-to-day basis has shown it to be a stable, fast, and well-designed (and apparently quite secure) browser..

[1] [http://marketshare.hitslink.com/browser-market- share.aspx?qp...](http://marketshare.hitslink.com/browser-market- share.aspx?qprid=0&qpcustomd=0)

<comment><USER25> Not sure you "shot down" anything, your data isn't specific to the version of IE (note the title). I would assume that there's a large fraction on IE 6, 7 and 8 under the umbrella of "Internet Explorer".

<comment><USER26> From StatCounter's measurements this month, IE9 accounts for 18% of all page views worldwide; older versions of IE are another 15% of page views: [http://gs.statcounter.com/#browser-ww- monthly-201209-201209-...](http://gs.statcounter.com/#browser-ww- monthly-201209-201209-bar)

The number of people using IE9 is on the same order as the entire population of the United States, so regardless of the exact number it's kind of crazy to say "nobody uses it."

<comment><USER25> I'm not defending the "nobody uses it", it was an overreaching exageration, much like the graphic seeming to claim that IE9 had 54% share.

<comment> simba-hiiipower yeah i totally agree. i was referencing IE as a whole when i linked to that; figured IE9 would hold the majority of that at this point, but you're right and that's not the case at all.

i forgot Microsoft didn't release it for XP (which i believe still holds somewhere north of 40% desktop os share), so i can see why that wouldn't be the case.</comment></comment></comment></comment></comment></comment>


Show HN: 4USXUS – A website that bridges the gap between  government and voter - <AUTHOR> https://4usxus.com <comment><USER2> How long did this take to create?</comment>


Rsync.net – Cloud Storage for Offsite Backups - <AUTHOR> http://www.rsync.net/index.html <comment> St-Clock A few quick notes about our experience with Rsync.net

1\. It is more expensive than S3/Glacier, but they offer "free" read-only snapshots, which can be very useful if your backup software or script does not perform its own snapshots.

2\. It can be difficult to determine how much space is taken by the peculiarities of ZFS vs. your own data.

3\. Although they offer subaccounts, it is not possible to know the disk usage of a particular subaccount.

4\. If you have transfer speed issues, you can contact them and they may whitelist your IP (good if you are doing server backup, not useful for home backup on dynamic IP), which significantly increased speed for us.

5\. They have a 10% "free" soft quota, mainly because it is difficult for mere mortals to know in advance how much space your backup will take on ZFS. They send an email when you reach the soft and hard quota.

6\. You can communicate with a knowledgeable human by email. This has been helpful to diagnose small but weird issues we were facing.

7\. Although we like S3 and Cloudfront, it's nice to have a backup location that relies on standard tool (rsync) and that is outside our usual providers/datacenters.

<comment><USER2> The real human support via email is fantastic. You don't need to log into the portal to get the response from their staff. I migrated from bup to Borg and they sorted out the issue via email relatively painlessly. Definitely a feature that I would not have valued before needing it.

<comment><USER3> When I was at Creative Commons we used rsync.net extensively for various things, and the support from rsync.net was amazing. John would frequently call me, go the extra mile to get any issues fixed quickly and our setup was a little nonstandard.

Highly recommended.

</comment></comment></comment><comment><USER4> There's much cheaper pricing here: [http://rsync.net/products/attic.html](http://rsync.net/products/attic.html)

0.03 USD instead of 0.08 USD. Beating even their top tier -- so long as you follow the constraints mentioned within the link.

<comment><USER5> At 0.03 (1tb = $30/mo) it's still much more expensive than pretty much every other service mentioned in this thread.

<comment><USER6> Yes but it's the only service that supports running the attic/borg server :(

<comment><USER7> We're also the only service that allows you to 'zfs send' to a remote zpool.

</comment></comment></comment></comment><comment><USER8> I thank the rsync.net folks for getting rid of that horrific scrolljacking on the homepage which was there the last time I looked. Actually, it seemed to have been fixed since I complained about it to them on here.[0] Not sure if those events are connected :)

While their pricing is substantially more than many others (the primary complaint that I see here), in return their support is the best I have ever received from any company ever. Getting responses, in less than ten minutes in some cases, from fully-clued and super-competent engineers - I'll take it.

(no connection to rsync.net other than that I've used them at work in the past and I'm renting space on someone else's account for my personal backups)

[0] [https://news.ycombinator.com/item?id=12960218](https://news.ycombinator.com/item?id=12960218)

<comment><USER7> We got a lot of complaints about that weird scrolling behavior - thank you for your own complaint which surely pushed us closer to ripping it out.

I can confirm that nobody that works at rsync.net _is not_ an actual UNIX engineer. You will never talk to anyone here that isn't an expert.

Rare these days, but sometimes you'll even talk to me.

<comment><USER8> > I can confirm that nobody that works at rsync.net is not an actual UNIX > engineer. You will never talk to anyone here that isn't an expert.

Ah, greetings rsync.net person, and thank you for the reply :) That makes sense. Your staff are a true credit to your company. And the only times I (or people I am working with) have had to talk to you is because we were trying to do something weird like getting a MegaFuck3000 NAS with Debian version -1.5 working with your systems, not because your infrastructure has ever failed. Much love for your company and all that make it as great as it is.

<small>(but seriously I preferred your old webpage)</small>

</comment></comment></comment><comment><USER9> Anecdata, but I've had nothing but performance problems with rsync.net and while their engineers were helpful to try and diagnose why, ultimately I've been left with ~10Mbps to/from their network/storage. That's "fine" for storing with them, since I don't really mind how long the transfers take, but I dread restoring my data at that rate if I ever need to.

I might try a brand new (attic) account and see if that lands me on a storage array with good performance.

<comment><USER7> Please be in touch with us again (today, even) - performance issues at rsync.net are _always_ network issues. We should be able to do _something_ for you, perhaps moving you to one of our other global locations ...

</comment></comment><comment><USER10> Why not S3? I use Arq with my Mac to back up my important doc, which gets encrypted in my S3 bucket. However, I'm still looking for a viable method to backup all my photos and videos. Right now they reside on multiple external hard drives.

<comment><USER6> You need this:

[https://www.stavros.io/posts/holy-grail- backups/](https://www.stavros.io/posts/holy-grail-backups/)

About your S3 question, having something like rsync.net (where you can run a server process) is much faster/easier/better because your backup software can know exactly what's stored on the remote side and only send diffs.

I'm sure this can be overcome with some clever client-side engineering, but having a server process is always going to be more flexible overall.

A more pragmatic reason is "because Borg doesn't run as well on S3".

<comment><USER11> This is very helpful. Thank you!

<comment><USER6> No problem, glad I could help!

</comment></comment></comment></comment><comment><USER5> Dropbox doesn't have completing, fixed interval backups and has fairly buggy, heavy, intrusive software (on linux). Google/Microsoft's services don't have differential backups and their software is generally lacking.

Rsync.net promises exactly what I want, but at 6/gb ($60/mo for 1 tb) it's 5x more expensive than Dropbox so I'm manually hacking around Dropbox's offering for the moment.

<comment><USER12> I've been using rclone ([http://rclone.org/](http://rclone.org/)) + AWS CloudDrive form my home backups. Currently storing around 4TB for just 60eur/year. Perfect setup for me personally.

<comment><USER13> Me too, and I've tried a lot of setups before settling on this. I can download faster from Amazon drive than reading from a USB 2.0 hard drive, and rclone makes it easy to keep important documents in sync on both services as well as locally.

</comment></comment></comment><comment><USER14> I've been looking into rsync.net for personal offsite backups (turns out using zfs locally doesn't make offsite easier), and was just doing the math comparing the monthly cost to buying drives, filling them, and leaving them at lab. Rsync.net offers a ton of awesome features, sadly the pricing is about an order of magnitude too high for a personal use case :(.

<comment><USER15> Can't you just schedule an rclone cron job? [http://rclone.org/](http://rclone.org/) \- it supports a decent number of cloud services, maybe one suits your budget/requirtements? That's what I do from my FreeNAS box.

<comment><USER16> I just configured rclone to sync roughly 1MM files (and growing) to GCloud Coldline. Excellent tool.

</comment></comment></comment><comment><USER17> why would I use this over tarsnap?

<comment><USER18> This is 4-8 cents per GB-month, with no transfer fees. Tarsnap is 25 cents per GB-month, plus transfer fees.

That's for Tarsnap's encoded data---but that seems roughly comparable to rsync.net's free snapshots. So Tarsnap is something like 5x the cost.

For that 5x cost, you get secrecy of your data (but not your connectivity, metadata, backup schedule) from your backup provider.

</comment></comment><comment><USER19> anyone that can suggest me a personal backup system? I've < 100GB of photos (RAW) to store as a second backup (I already have them in an external HD). Amazon Glaciar could work for me, just i don't get much how it works and if I can use as a sort of Dropbox with very low access rate.

<comment><USER20> You _probably_ don't want to use Glacier for personal backups if there is a decent chance you need a significant restore, or want it quicker than hours.

<comment><USER19> Any other possibile solution? I was thinking of Glacier just beacuse of the RAW camera files I want to backup. I've them in two external HD, I don't access them a lot, so I was thinking of keeping just 1 HD and put the rest in glacier. If it takes 24h to get them back is not a big deal for me.

<comment><USER20> Glacier is meant as an archive - put stuff in, read just very little bits back. Reading everything/significant parts back costs extra.

But if you're using it as an archive, and not so much as a backup (which for me implies restore), then it might make sense for you. There is a simplified calculator here: [http://liangzan.net/aws-glacier- calculator/](http://liangzan.net/aws-glacier-calculator/)

</comment></comment></comment></comment><comment><USER21> Duplicity to Google Drive has been working great for me , nightly I run a synthetic backup on a local box that syncs the drive to compress each day's incremental backups into a new full backup. Wrote a Google app to auto empty the trash every night.

</comment><comment><USER22> I've got 4 TB's worth of photo's (All raw) and want them backed up.

With Crashplan Family: 160 per year. With the cheapest rsync.net: 1500 dollar's per year.

Yeah, not in 1500 years.

<comment><USER23> Different use cases. You can't archive stuff from crashplan. If you retire the your machine, you either migrate the whole thing to a new one, or your backups will expire after some days.

So if you want single machine backup - crashplan is great. If you want long term service data backup - rsync is great.

<comment><USER22> Partly true, you see: as long as you do not delete the top level "share" everything underneath can be deleted on your machine and it will stay available at crashplan.

</comment></comment></comment><comment><USER24> SpiderOak Unlimited for me personally. Cross platform, dropbox-like sync, share rooms, encryption, etc

<comment><USER25> SpiderOak's client and support are utterly horrible though. It's an okay alternative to something like DropBox where you have a few, small, frequently changed files but it's useless when you have terabytes of data to backup. It completely refused to use even a fraction of my gigabit upload.

</comment></comment><comment><USER26> so I'm pretty tired today, but I'm reading their pricing as 60 dollars a month for 1 terabyte which seems too expensive? maybe I need to drink this coffee here.

<comment><USER27> No, you're right... even more in the case of 999GB

        $ echo $(( (8 * 999) / 100 ))
        79

79 dollars/month

I have a home made solution for personal disaster recovery, which is 30€/month in Hetzner (2TB storage, no bandwidth limit) + 6€/month in OVH (same capacity, less CPU and ram, but same storage/bandwidth conditions)...

For me the difference, is not only in the price, but in who has "root access" over the data. Remote backups in third party storage, by definition, should be encrypted. Using rsync almost implies that the remote will be unencrypted (or efficiency will be lost). But we're in the age of "Virtual PRIVATE network THIRD PARTY services" nonsense... so it's hard that nowadays operators understand those principles.

<comment><USER23> > Using rsync almost implies that the remote will be unencrypted

Not sure if you meant the protocol or the service rsync, but neither one implies you store unencrypted data.

<comment><USER27> Nor the protocol neither the service, but the data.

If you're going to encrypt all the backup locally before send it to rsync.net, tomorrow you will need to transfer all the GB again, even if just one bit did change...

<comment><USER23> That depends completely on the encryption mode. This could get a full technical explanation of different modes and architectures, but in short: you probably know that if you use full disk exception, you don't rewrite the whole disk just because one bit changed. There are many ways to keep the data encrypted without relying on other blocks content.

</comment></comment></comment></comment></comment><comment><USER28> How am I not already aware of these guys? Pricing looks good.

<comment><USER29> Seems to be around 6 times more expensive than S3 for my usage (<1TB, EU Standard - Infrequent Access is $0.0125/GB vs $0.08/GB).

Of course, you can't rsync to S3 so I'm handling backups with duplicity and using S3 as the storage target.

<comment><USER20> An important point to note is that esp. with S3 infrequent access or Glacier there are additional costs associated with restoring, which can be quite high. With S3/Glacier one needs to spend a bit of time to even figure out how much a restore would cost.

<comment><USER29> Yes, the data retrieval fee for infrequent access is $0.01/GB so a 1TB restore would cost me $10.

Thankfully I've not had to perform a complete restore, though I do regular test restores of a part of the backup just to make sure it's all still working.

Edit: It's actually $100 (as transfer from S3->Internet adds $0.09/GB)

<comment><USER30> No, it's $100, since the egress traffic will cost ~$0.09/GB.

<comment><USER29> You're right, I hadn't taken that into account.

</comment></comment></comment></comment></comment></comment><comment><USER31> Not the same thing, obviously, but 1/10th the price: [https://www.backblaze.com/b2/cloud-storage- pricing.html](https://www.backblaze.com/b2/cloud-storage-pricing.html).

<comment><USER32> Does it work with Linux? All docs that I read talk only about Windows and Mac.

<comment><USER33> Absolutely! We've been using it as a special remote backend for our multi-TB git-annex repos, and it has been both painless and cheap. They have supported integrations for HashBackup and Rclone, and you can roll your own with their S3-ish (though not straight compatible) API. They have recently added native snapshots as well.

That said, as others have mentioned, b2's value differentiator is in cold storage. For us, it's largely insurance against failure of our other backup modalities. If you are pulling a lot of data back on a regular basis, the pricepoint is much more in line with the top tier providers.

</comment></comment></comment><comment><USER34> That is suspicious to me. No address, no contact, no support.

<comment><USER35> I've been a happy customer for years. The contact is email@example.com - it's on the pricing page. I've emailed support a few times and they answer very promptly.

Rsync.net has been around forever - like 15 years. They predate the concept of 'cloud'. They were the first to use a 'warrant canary', in 2006. ([https://en.wikipedia.org/wiki/Warrant_canary](https://en.wikipedia.org/wiki/Warrant_canary))

<comment><USER36> RE the warrant canary: all legal analysis I've seen points to the canary being functionally useless. A court would throw out the defense immediately, removing a canary pointing out that a warrant has been served is the same as tweeting that you got a warrant.

It's the minimal legal hack: completely useless in a court but massive generator of internet comments

Though it generating discussion around the warrants themselves is a good feature

<comment><USER37> You don't "remove" a canary, you just stop updating it. The intent being that they can't force you to _keep_ updating it.

<comment><USER36> They can't force you. Just like they can't force you to not tweet.

They can sure sue the hell out of you after you stop updating though.

<comment><USER38> The idea is that forced speech is different than free speech. That means that someone can force you to not say something, but not force you to say something.

<comment><USER36> so there are two things:

\- The government cannot force you to update the canary. A court cannot get you to update it, because it's forced speech to demand an update.

\- You created the canary of your own accord, and are responsible for its effects. Not updating the canary is, effectively, speech.

Though, from [0]:

"Realistically, though, courts compel speech all the time. Court-ordered apologies, disclosures, and notices are not unusual. And if ever a court would be inclined to compel speech, it would be in a situation like this one, where a company intentionally set out to get around a gag order with this kind of convoluted sea-lawyering."

[0]:[http://law.stackexchange.com/questions/268/is-there-any- lega...](http://law.stackexchange.com/questions/268/is-there-any-legal-theory- behind-warrant-canaries)</comment></comment></comment></comment></comment></comment></comment>


Show HN: Keeping Myself Productive this Summer - <AUTHOR> http://credit.tyrannosaurusprep.com/

<comment><USER2> That's awesome that you and your wife have come up with something fun & enjoyable.

I like the frequent feedback & rewards.

Are you writing about this anywhere? I'd love to track your progress!

For those interested in this domain, checkout 'Pomodoro Technique' too.

<comment><AUTHOR> Thanks for the comment. I just threw this together about a week and a half ago, and I haven't been documenting my progress. But I can tell you that neither of us have missed a day of exercising since we started using it.

I bet there are a lot of similar productivity apps out there. But I had something pretty specific in mind, so I just coded it up for myself.

The Pomodoro Technique sounds interesting and could definitely be implemented in conjunction with this app. I guess if someone wanted to do that, they could modify my code to add a 25-minute timer or something.</comment></comment>


Is anybody else not getting paid "because Covid"? - <AUTHOR> In the last few days I've had two clients, large American firms, say that they are suspending all payments due to covid. One had the excuse that they couldn't pay because their accounts team can't remotely access their systems used for contractor payments, and hoped to resume payments in April. The other simply said they were suspending all payments until covid is over. These are both $100M+ businesses.
This has me scratching my head, as the banks sure as hell expect me to pay my mortgages on time. No mortgage holiday available without a steep penalty and re-evaluation of interest rate after the holiday... I have savings, but they won't last forever with zero income.
Anyone else in the same boat? Is this even legal for firms to do?
I have standard force majeure clauses in my contracts - but they allow early termination in a pandemic, not not paying. <comment><USER3> Same problem here. Where are you located? Not US, I suppose. This sounds like something that call for its own subreddit, because, even if there might be remedial lawsuits you can bring to them, it will be expensive to litigate in US. I am afraid they count on that. Given this is a real emergency/problem for everybody now. In Italy, government has temporarily forbidden the actioning of repossession/penalties clauses in mortgage contracts and has suspended payment of taxes. I would recommend banding together with other people in your country/same situation.

<comment><AUTHOR> My company is domiciled in the U.K., and that's where the mortgages are - <USER2> live in Portugal. Unfortunately only two lenders in the U.K. have said they're granting concessions, and when I spoke to both of my lenders on Friday after I'd heard from clients, they both said that yes, I can have a holiday, but only on the terms I mentioned - as far as they're concerned it's all BAU until the government says otherwise.

I mean, if your business or income is entirely domestic, I suppose this is ok - but if your income is primarily from a country that has now declared a state of emergency and has companies using this as an excuse to shirk their bills, it's something of an issue.

<comment><USER3> The only advice I may be able to give you, and to myself, is talk to an association of SMB in England. Not sure it helps, but we are all in the same boat. No payment here also.

</comment></comment></comment><comment><USER4> No, it's not legal. Start by reporting them to the credit reporting companies.

</comment><comment><USER5> Fortunately, nothing like that has happened to me so far.

It's definitely not legal and, in my opinion, highly unethical as well. While it's understandable that companies scramble to protect their cash flow now one still has to pay one's dues.

Since you're based in another country it'll be difficult to quickly enforce your claim unless they have a local branch.

Invoice factoring might be an option but in the current climate this could be quite expensive. Still, getting paid x % of the original invoice amount is better than getting nothing.

Taking out a loan on accounts receivable might be another option.

</comment><comment><USER6> Better team up and make the banks accept the same terms. Write a letter saying it's happening and will be in effect until the emergency is over. You might even be able to find a clause in your mortgage agreement about how to do it. Send it to their legal department and say they have 7 days to reply, or something along those lines. Chances are their legal/administrative people are not in the office right now anyway.

<comment><AUTHOR> The problem is that in the U.K., there is no official state of emergency, so nothing for me to use on that angle, unfortunately - when I spoke with them both on Friday, they said that unless the govt announces an emergency and explicitly instructs them otherwise, it's business as usual.

<comment><USER6> Team up with others and swamp them in paperwork. There are probably people organizing rent strikes right now; Italy has frozen many financial transfers so you'll find many takers. Good luck.

</comment></comment></comment><comment><USER7> Brace for impact, be flexible (as these are extraordinary circumstances) and forget about lawsuits or credit reporting as that would be very bad rep for you or your business as it's somewhat of an ugly gesture - if you care about a reputation anyway. Look for government assistence if needed to pay bills by getting some of the smb credits being made available. Borrowing on invoice debt may be an option at your local bank. Payment enforcing is basically shutdown anyway. This is a major, WW shutdown, primary needs are top and invoiced payments are low in everyone priorities right now.

And this could go on for months, not weeks as some believe. If you take up new work now, request payment upfront.

Disclosure: I'm in Europe and I run a sw SMB with many €100M+ clients who have frozen all payments.

</comment><comment><USER8> I am not 100M company, but I have always paid my dues. Since CV came into place (a month ago) I've earned nothing, even if my business were not locked down I had no more customers, so no more money. I ve called all my debtors and explained, same they did with their debtors and so on, usually chain should finish to banks (mortgages, loans, Ecc...) Tomorrow Italian government should put in place a lot of stuff, one is the freezing of debts to banks. Over here we are all on the same boat so we deeply understand each other, no litigations on sight. I also planned to pay back in a couple of months when things will start to move back again.

</comment><comment><USER9> Some banks are offering breaks on mortgages, so don't make too many blanket assumptions about that.

</comment><comment><USER10> I run a legaltech called 40Q, happy to help and figure out if there is something that can be done here. Is on a case to case basis. Feel free to reach out.

</comment><comment><USER11> In times like this cash is king. You avoid paying your suppliers to keep as much liquidity as possible for yourself.</comment>


How to be an awesome agile developer - <AUTHOR> https://www.atlassian.com/agile/software-development/developer <comment><AUTHOR> Liked this quote:

"Regardless of how the knowledge spreads, agile teams don't end up with critical-path developers who can't go on vacation because they're the only ones who understand a particular area of code. Because nobody wants to be that developer."</comment>


Effects of marijuana smoking on the lung - <AUTHOR> http://www.ncbi.nlm.nih.gov/pubmed/23802821

<comment><USER2> You either misunderstood this or are purposefully misrepresenting it.

>findings from a limited number of well-designed epidemiological studies do not suggest an increased risk for the development of either lung or upper airway cancer from light or moderate use

This is not a decrease of lung cancer - but merely _not an increase_. Meaning it shows it does not _cause_ cancer like smoking tobacco.

To continue on...

>although evidence is mixed concerning possible carcinogenic risks of heavy, long-term use

Which means results are inconclusive for heavy, long-term use, meaning marijuana could still _increase_ the risk of lung cancer by introducing carcinogens.

>In summary, the accumulated weight of evidence implies far lower risks for pulmonary complications of even regular heavy use of marijuana compared with the grave pulmonary consequences of tobacco.

The purpose of this was to show that even heavy use of marijuana has far less risks (but still has risks over not smoking at all) when compared to tobacco.

<comment><AUTHOR> Great summary, thank you for that.

I simply could not think of a better title.

A more accurate title may be marijuana not linked to lung cancer?

Although there is some research in cell and animal studies that has shown THC, CBD and other cannabinoids to actually kill cancer. [http://www.cancer.gov/about- cancer/treatment/cam/hp/cannabis...](http://www.cancer.gov/about- cancer/treatment/cam/hp/cannabis-pdq#link/_26_toc)

I am happy to change the title.

<comment><USER3> > I simply could not think of a better title.

You couldn't think of a better title so you put one that was completely false? That's not an excuse.

"Smoking marijuana not linked to lung cancer" would have been a fine title, yes.

> Although there is some research in cell and animal studies that has shown > THC, CBD and other cannabinoids to actually kill cancer.

True, but that's like saying that the vitamin C in some candies helps prevent diabetes--that might be true, but a eating candy all the time still increases your chances of getting diabetes. Smoking marijuana is far different from being being tube-fed isolated cannabinoids that occur in marijuana.

Look, I'm all for legalization, but let's not do it with lies.

</comment></comment></comment><comment><USER4> Title changed from "Smoking marijuana not linked to lung cancer". Please don't editorialize titles when submitting stories to HN.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment>


How gzip uses Huffman coding - <AUTHOR> http://jvns.ca/blog/2015/02/22/how-gzip-uses-huffman-coding/

<comment><USER2> When I was in college at Rice, one of the harder projects in a sophomore level software engineering class was implementing Gzip according to RFC 1951 and RFC 1952. We had about an hour lecture explaining what huffman coding was and then were left to our own devices for three weeks.

Half the challenge was just understanding what the RFCs were talking about, teaching ourselves huffman coding, and then figuring out how to build this low level stuff in Java in a reasonable way. This was definitely one of the hardest projects I had up until that point.

We had a class discussion afterwards about what was so difficult about implementing GZIP and a few of us mentioned the RFCs were tough to figure out. Professor laughed and said something along the lines of "Besides just learning computer science, we're hoping to teach you the value of good documentation!"

<comment><USER3> I've implemented gzip... I found that implementing the decompressor first (with a very verbose --debug flag) was critical to understanding the bitstream well enough to implement compression :)

<comment><USER4> Would you recommend it as a learning exercise?

<comment><USER3> Maybe. There are lots of finicky details, like inconsistent bit ordering and arbitrary lookup tables. I think it's a long week of work at least, probably more.

On the other hand, it is probably the simplest compression format in widespread use that uses variable-length encoding, and there's a few implementation around for you to look at. Things like bzip2 and LZMA2 really don't have independent specifications and multiple implementations, and are more complicated to boot.

Byte-oriented Lempel-Ziv formats like LZ4, LZO and LZJB would be a good way to dip your toes into a production compression format. The LZW encoding used by GIF files is also "simpler" in principle but I personally find it harder to wrap my head around.

If you want to experiment with binary formats, it might also be interesting to write a decoder for a simple image format, like PCX files, or even for old game file formats like Doom's [[http://doom.wikia.com/wiki/WAD](http://doom.wikia.com/wiki/WAD)].

<comment><USER5> LZJB is fantastic. Here's my take on a Python implementation of both compression and decompression: [https://github.com/unwind/python- lzjb](https://github.com/unwind/python-lzjb). It's ~150 lines for both, and BSD 2-clause-licensed. It's not very high-performant (I wrote it for fairly small amounts of data) but hopefully clear enough to learn from.

</comment></comment></comment></comment></comment><comment><USER6> Huffman coding is a gateway drug for data science. Once you see raw input as data, you see as much benefit from optimizing as you do from analyzing.</comment>


Abelson Stole The Precious Course - anime comment to MIT 6.001 [flash] - <AUTHOR> http://dagobah.net/flash/Abelson_Stole_The_Precious_Course.swf

<comment><USER2> Does that have anything to do with the HN or is it just their way of saying, "We've read SICP"?

</comment><comment><USER3> yet another barely edited rip of "marisa stole the precious thing" d:

</comment><comment><USER4> what. the. hell.

A+</comment>


Show HN: Democracy.io by EFF – Write to your representatives - <AUTHOR> https://democracy.io <comment><USER2> Sigh.

Yet another tool that makes it easy to write your representative. As though this is an actual problem. It isn't. The Market is saturated with _so many_ tools to send messages to Congress. Especially electronic ones. Whether it be Blue State Digital, Change.org, BlackBaud, Salsa, or the plethora of other online tools, this problem is solved.

In fact, it's solved too well. According to the Congressional Management Foundation, Congress receives _millions_ of messages a day, and it doesn't have the manpower to actually read the messages because their systems are so antiquated and underfunded. It's as though the market goes "Congress isn't listening to us, we need to make a tool to make our voices louder" when in fact, Congress isn't listening to us because we're deafeningly loud.

Want to really solve a problem? Build software that helps members of Congress receive and sort through their messages. Using their IT systems. Build a FrontApp for Congress that can handle a million messages a day and cluster things by topic group and sentiment. For bonus points, add a public element to it so that the press and the public can _see_ what members have been receiving from their constituents.

Which leads to the second thing to build to help solve the problem: build a system that for real verifies that someone is a constituent instantly. Members want to hear from their constituents, not from the general public. But these electronic messages usually come with no verification. So do you know where they go? /dev/null

As someone who has worked with these guys for years, PLEASE stop making tools like this, and work on the other side of the equation.

<comment><AUTHOR> Hey there, I worked on this.

BSD, BlackBaud, and Salsa all deliver messages to congress, but only for _advocacy organizations who are willing to pay._ Beyond OpenCongress, I don't think there are any tools that make it easier for constituents to write _their own non-cookie-cutter messages_ to Congress. Change.org, for example, doesn't deliver emails.

The reason why Congress receives millions of messages is because advocacy organizations send millions of form letters. Congressional staff already have plenty of tools for separating those form letters from real, constituent- written letters. I can dig up their names, but they're built by high-level contractors.

Finally, one of our plans for Democracy.io is to measure response rates from representatives, and to use that to release a public report on how well MoC respond to _real_ constituent messages. Both in terms of timeliness, and the relevance of their response.

<comment><USER2> > Congressional staff already have plenty of tools for separating those form > letters from real, constituent-written letters. I can dig up their names, > but they're built by high-level contractors.

Intranet Quorum. Last updated in about 1996. It's probably what 95% of staff uses, and it's woefully inadequate. Clearly you talked to zero congressional staffers in the creation of this software. Which is a shame. Because if you had, your software would be effective.

Heck, even if you'd read one of the dozens of reports from the Congressional Management Foundation _FROM 10 YEARS AGO_ [http://www.congressfoundation.org/index.php?option=com_conte...](http://www.congressfoundation.org/index.php?option=com_content&view=article&id=67&Itemid=) you could spot the problem here.

Whether advocacy organizations "send" the emails or whether they're sent by an individual has no bearing on either the legitimacy of the message, or whether or not they will remain unread.

I'd encourage you to hop on a plane, and go visit some congressional staffers and ask them how they'd like to receive your messages. Then build a tool starting from there. Like it or not, they're the customer.

<comment><AUTHOR> Clay, I have read those Congress Foundation reports. And we regularly visit congressional staffers in DC. I'll also try not to resort to all caps in responding :).

Obviously your product, ScreenDoor, addresses some of the concerns you're raising around better data collection. Glad to hear you're so enthusiastic about that approach.

The EFF isn't planning on selling software to members of Congress. However, we are considering offering users the ability to make their comments public, which'd create a large public dataset about messages sent to Congress. If we decide to go ahead with that, the open dataset would then be available for anyone to run analytics on and create reports for members of Congress.

Improving the ways people contact Congress is one piece of the puzzle. The other part is making sure that people get better responses, and we hope to work on that too.

<comment><USER2> > Obviously your product, ScreenDoor, addresses some of the concerns you're > raising around better data collection. Glad to hear you're so enthusiastic > about that approach.

Not sure what that's about other than it being a strange comment to make.

> The EFF isn't planning on selling software to members of Congress.

Who said anything about it being commercial? I think that if you talk to a member of Congress, or an LA or SA inside of the hill, they'll all tell you the same thing: we take electronic messages and basically throw them away. That's nearly universal feedback. And before we start thinking it's out of cynicism or dislike of the constituent, it isn't out of malice. It's because if they started reading every message they receive right now, they'd be stuck in July of 2015 for the next 10-15 years with the resources they have.

So my point is: why bother with increasing their volume. It's a bit like shipping gasoline to a forest fire.

The reason this is a problem is because it drives up apathy and cynicism. People will send more messages, get worse responses, and continue to be validated with the idea that Congress doesn't care about what they have to say.

<comment><AUTHOR> > So my point is: why bother with increasing their volume. It's a bit like > shipping gasoline to a forest fire.

Isn't this exactly what you did at BSD? Enabled advocacy organizations to send millions of form-letter to Congress, making real constituent contact get lost in the flood?

I've already addressed how we plan on incentivizing members of Congress to write better responses, but again: we're looking at an open dataset of comments, and reports on timeliness and content of responses.

</comment></comment></comment></comment></comment></comment><comment><USER3> Congrats on shipping, guys!

Cool to watch this project evolve. Awesome that it's open source, too. There is a lot of value in a platform that can abstract all of the shitty non- standard forms needed to contact raps into a clean API. This was previously only available as a commercial service, it's awesome that the EFF has quietly released this for free.

My only issue here is that because of the EFF's staunch (but very understandable) policy on privacy, the public doesn't get to see the responses from the contacted representatives.

If you want to contact your rep (or any other official) and have their reply be on the record, allow me to shamelessly plug a similar tool I developed: [https://pubmail.io](https://pubmail.io) \- free public email addresses for having on-the-record conversations.

Congrats again, guys!

</comment><comment><USER4> This UK site [https://www.writetothem.com/](https://www.writetothem.com/) that does a similar job works fantastically. Using it took a significant amount of pain out of working out where to send my emails, what I had to include to be likely to get a response and so on. Even moreso in writing to MEPs. It also allows them to measure responsiveness and publish that.

I think this is great!

<comment><USER5> I like their policy of not allowing templated form emails, on the grounds that it just annoys MPs and they're more likely to reply if they're unique and personal. I also like the general philosophy of "You don't need to know which level of government representative you need to talk to, we'll find all of them and try to help you decide".

To agree with another poster on this thread, in the UK there's also the big problem with MPs getting too many emails to sort through them and reply personally, many from large campaign groups such as 38 Degrees. Democracy Club ([http://www.democracyclub.org.uk](http://www.democracyclub.org.uk), I'm a volunteer) also found the same problem in feedback from candidates in the 2015 UK General Election, many having to handle thousands of emails (partially our fault for making them open data ;)) on little to no resources or party support. I think there's definitely a space for a modern product which can group together and help a representative/candidate handle replies to different campaigns. This is much better than the alternative, which is making it harder to contact representatives/candidates.

</comment></comment><comment><USER6> I don't think writing to Congress has really ever been the problem, I think the problem is accountability.

The two things we need to see in one place are our representatives voting records for a given topic, and accurate data about what the constituents of that representative desired.

I'm not saying this is an easy thing to solve, mostly because getting accurate data about what constituent want, and doing it correctly, essentially means building an online voting system. That isn't easy, but that is exactly what we need.

Real. Transparent. Democracy.

[Edit] The accountability application wouldn't need to be binding, it just needs to accurately show if the representative is actually representing the will of the people. It should provide one citizen one vote per pole/bill, provide information about the percentage of the constituency that's registered and voted, and compare those results to the representatives actual vote. I believe that authenticating citizens and public participation would be the biggest hurdles to a system like this.

At the very least this would raise awareness and stimulate conversations between representatives and constituents.

<comment><USER7> Congress people are quite accountable already. The problem is that they are accountable to gerrymandered districts so they are basically guaranteed support on their extreme ideas. Every time the public gets actually upset about something, the system works, everyone flips on a dime. The problem is systemic at a very high level. There are a few other problems I could describe, but they are also structural and prevent the will of the people from being accurately expressed. Once you resolve the accuracy issue, you can get into real political problems rather than manufactured ones.

</comment></comment><comment><USER8> There is great irony in using the .io domain for this considering its extremely undemocratic history: [https://en.m.wikipedia.org/wiki/Depopulation_of_Diego_Garcia](https://en.m.wikipedia.org/wiki/Depopulation_of_Diego_Garcia)

</comment><comment><USER9> minor UI tweek...

Maybe make the placeholder text on the landing page something like:

123 Main Street Anytown, US 12345

Instead of 1600 Pennsylvania.

Maybe I just didn't eat my wheaties this morning, but my first thought when seeing the form was that I was somehow supposed to provide the address of the representative I was writing.

<comment><USER10> That still leaves the ambiguity. The header for "Enter your address" should be larger/emphasized. Changing the example address doesn't make it more obvious if I enter my address or theirs.

E:

Sometimes I wonder why I am downvoted - or if I have a particular unhappy person following my posts. So I'll clarify my reasoning:

A small, easily missed header that is separated from the form is all that tells me to enter my address. Changing the example address doesn't magically fix the UX problem of "my address or the reps?" because the only prompt to enter _your_ address is a small header that doesn't attract my attention that isn't located in the forms' area of attention. Adding a header to the form clears this ambiguity.

Placeholder text shows formatting. Whether it is 1600 Penn Ave or 1234 Example Street doesn't help remove ambiguity of "my address or the reps address?"

Look at their home page. Then look at my image [0]. I hope I'm explaining the problem well enough.

[0] [http://i.imgur.com/yYuEuVG.png](http://i.imgur.com/yYuEuVG.png)

</comment></comment><comment><USER11> Heads-up to the creator: I browse with cookies disabled by default, and when I go to this site this is what I see: [http://cl.ly/image/3W3D28153S0t](http://cl.ly/image/3W3D28153S0t)

I'm not sure how deep the form goes but are cookies really required for this functionality? If so, yo might want to display a message indicating that "cookies need to be enabled in order for this to work".

And even if cookies are required for actually filling out the form, why on earth would the "Why we built Democracy.io" require them?? (I'm guessing that's the reason that entire section of content is blank)

</comment><comment><USER12> This is pretty cool but sucks living in DC because we do not have equal representation. We just have a shadow representative who only has a vote in committee when democrats have the majority.

The worst part about all of this to me is that most people in the country do not know / do not care that 650,000 people that live in DC do not have fair and equal representation like everyone else. Wyoming has about 70,000 less people for the whole state and they have 2 reps and 1 senator. A little infuriating.

<comment><USER13> Only one senator? What happened to the other one?

<comment><USER14> 1 rep in the house (who can't vote), no senators

<comment><USER13> Actually I was referring to the part about Wyoming only having "2 reps and 1 senator".

</comment></comment></comment></comment><comment><USER15> As much as I like the EFF, I feel a non-profit organisation dedicated only to things like this would be better.

</comment><comment><USER16> There was already "[http://www.house.gov/representatives/find/"](http://www.house.gov/representatives/find/") for lookup. It even has map integration, if your ZIP code isn't enough.

</comment><comment><USER17> Can we have a Google Moderator/User Voice-like tool with a "page" for every representative, where they can then be encouraged to look to see what their constituents want most from them?

</comment><comment><USER18> having the party affiliation of the representatives would be useful, and easy to add.

</comment><comment><USER19> Representative government is not democracy.</comment>