Bugger: Maybe the real state secret is spies aren't good at their jobs (2013) - <AUTHOR> https://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-3149-963f-47bea720b460 <comment><USER2> This is kind of a strange (though interesting) article. The headlining claim is that "spies aren't good at their jobs". But does the article support that?

> The terrible truth that began to dawn in the 1980s was that MI5 - whose job > it was to catch spies that threatened Britain - had never by its own devices > caught a spy in its entire history.

The whole article focuses on MI5, which I'm not really familiar with, and claims that their sole purpose is _defensive_ , to catch spies, and not to spy on other countries. But almost by definition, if Soviet spies were left in high places for decades through the incompetence of MI5, doesn't that mean the Soviet spy agency had a pretty decent track record, either by luck, or by their competence in exploiting the specific weaknesses of MI5?

I think it's more likely that the focus on defense is at fault, and not the focus on MI5 in particular. If you get a bunch of spies together, and task them with discovering other spies, then they'll probably find some people who may or may not be actual spies. The problem is in part that the base rate of spies is very low, but also that the people sent to spy in other countries for the most part seem to have kept a low profile (they didn't become head of MI5 or Prime Minister, for example), and _also_ as the article states, that suspiciousness starts to crowd out your actual evidence.

But get a bunch of spies together, and task them with gathering intelligence in other countries, and maybe they'll have a much better time of it, on average. At least, if this article provides me with a reason to think anything about this question, it makes me think that they typically were.

So all in all it's a nice story, but it's not clear that the claim in the headline is warranted.

<comment><USER3> There is no doubt that MI5 was effectively rubbish in the spy vs spy games during the Cold War. But it's also possible to go a bit far in judging them purely on that basis.

If you (allow me to remove the civil liberties issues for a second) look more towards Northern Ireland and assess its success (from a UK gov point of view), along with RUC SB (the most important UK org in the conflict), SIS and the FRU, then it's a slightly different assessment you'd have to take. Of course interpretation depends on your viewpoint and how you patch the pieces of the story together. Considering the amount of Islamic radicialisation in the UK, it and CTC/SB have arguably been fairly successful. A similar sort of assessment could probably be made about the Communist Party in the UK - it was effectively going no where and well infiltrated. Though there were blips around miners and bits of the Labour Party, MI5 and Special Branch had such a tight hold of them post 1950 to the point where they were actually chasing their tail and seeing conspiracies where none existed.

I think reading the various bits of information to come out since the Cold War about the CIA in Russia can also probably show how little they really achieved there in the spy game. There is a whole genre of similar sorts of stories waffling away about disguises and technology but recently there was are challenges to the orthodoxy around that. Essentially successes were pretty minimal, dangles were swallowed all the time etc. Worth reading this on that topic "Fictitious Spies and Fake History" [https://www.tandfonline.com/doi/abs/10.1080/08850607.2019.16...](https://www.tandfonline.com/doi/abs/10.1080/08850607.2019.1668247?journalCode=ujic20)

<comment><USER4> >There is no doubt that MI5 was effectively rubbish in the spy vs spy games during the Cold War.

This is not even remotely true. At one point they knew of every single KGB spy in the UK.

[https://en.wikipedia.org/wiki/Oleg_Gordievsky](https://en.wikipedia.org/wiki/Oleg_Gordievsky)

<comment><USER3> They most certainly did not. They didn't know about Norwood amongst others until after Mitrokhin.

[https://en.wikipedia.org/wiki/Melita_Norwood](https://en.wikipedia.org/wiki/Melita_Norwood)

Plus their successes were towards the end of the Cold War. They were effectively neutered by their own arrogance, ego and class blinding foolishness in the Russia sense until the 80s.

<comment><USER5> Norwood retired when Gordievsky was still in Denmark if I have my dates correct, which is probably why he never heard about her (he never made it quite to the top of the tree).

"I did what I did, not to make money, but to help prevent the defeat of a new system which had, at great cost, given ordinary people food and fares which they could afford, a good education and a health service" (As with most Soviet spies she lived the lie until she died)

</comment></comment></comment></comment></comment><comment><USER6> If you think about it, it really shouldn't be surprising. James Bond and other spy movies have convinced us that the government just has endless amounts of money to throw at hard problems. But they don't. Even though the numbers involved are staggering, government departments fight tooth and nail for allocations.

The cash you do get, you have to spend most of it on things that make your department look good rather than what will make you better at your job. Then there's plain ole' fraud, waste and abuse, trying to instill an ethic of frugality into someone who is in charge of more taxpayer money a month than they make in a year, well a lot of times that's just going to fall on deaf ears.

Spy departments derive effectiveness mostly from having the ability to skirt the law rather than training or having better equipment. The government does have people that really know what they're doing. But their time and attention is limited, again mostly to projects that make their departments look good.

As a result it's much easier than you'd think to get away with a lot more than you would think you could.

<comment><USER7> I think that's a common, but flawed outlook on it.

Early in my career I worked for a social services department, a department that was constantly kicked around in the press for various "scandals", incompetence, etc.

It certainly wasn't the most efficient organization that I've seen, but it was not much worse than fortune 100 companies that I've worked for or done business with. And For all of the woes, it was very good at what it did. Benefit payments were made, enrollments done, procurements procured, hearings adjudicated, audits completed.

It's easy to get caught up in the noise and determine that these organizations are incompetent and ineffective. The reality is that usually the machine of state is very good at what it does, but they measure many aspects of success with a different measure (compliance) than a company (profit).

<comment><USER8> Systematic research using large datasets shows that public sector organizations are associated with significantly worse management practices.[1] Public sector organizations are nearly as poorly managed as the worse category of private sector firms: those run by the heirs of the original founder.

In particular public sector organizations have significantly worse incentive structures, are much more likely to promote based on tenure rather than competence, and are much more likely to retain low performing employees.

[1] [https://www.nber.org/papers/w17850.pdf](https://www.nber.org/papers/w17850.pdf)

<comment><USER9> > In particular public sector organizations have significantly worse incentive > structures, are much more likely to promote based on tenure rather than > competence, and are much more likely to retain low performing employees.

Have these practices been measured to cause worse outcomes? Not so long ago there was a paper here that said most companies would be better off promoting at random than the measures they actually use, and we all know how practices like stack ranking can destroy team cohesion.

<comment><USER10> That is the question. From early on in the paper:

> we define "best" management practices as those that continuously collect and > analyze performance information, that set challenging and interlinked short- > and long-run targets, and that reward high performers and retrain/ fire low > performers

It appears that the purpose of the paper is to apply a set of normative judgements in order to validate at a shallow level the types of preconceptions that GP was questioning. It's not a surprise that government organisations aren't operating in a cut throat manner.

<comment><USER7> Exactly.

MBA students are going to be looking for specific indicators and terminology (OKRs, KPI dashboards, etc) and things like comp plans. That's not because they are stupid or evil, it's just their world. They aren't trained to understand performance management in an environment where collective bargaining gives employees due process rights, for example. Conversely, public sector leaders are going to struggle with Sarbanes-Oxley compliance or financial decisions that incorporate tax optimization.

Your state/local government isn't going to provide meaningful incentive compensation, for the simple reason that it doesn't work in most cases and taxpayers won't tolerate paying rewards to people for doing their job.

You also need to evaluate the effectiveness of governance differently, because management within an organization is not empowered in the same way. If Congress or a state legislature decrees that you must do X in Y way, you need to do Y, even if it doesn't make sense or is inefficient. Usually in a corporation business management is expected to own their P&L on a broader scope and optimize. Public sector managers can only optimize in the (more limited) scope they control, and only with the consent of the elected/appointed official or board.

</comment></comment></comment></comment></comment></comment><comment><USER11> It so happens that this story has since moved on slightly since it was last posted. Two years ago, Michael Bettaney died. I knew him briefly - after he got out of jail, he moved into small-group communist politics, where we crossed paths.

The stuff about his incompetence as a spy is rather overstated. By the time I knew him, he certainly had a drink problem, which may for all I know have predated his long prison sentence (much of it in solitary). The truth is of course that MI5 was not the only intelligence agency with double agents and he was shopped by one such British KGB mole, Oleg Gerdievsky. One rather suspects that the fate of the cold war did not hang in the balance.

The underlying point - that counterintelligence has very often proved to be a spectacular waste of human effort - stands, although that is hardly a reason to be insouciant about mass surveillance.

<comment><USER12> > The underlying point - that counterintelligence has very often proved to be > a spectacular waste of human effort - stands, although that is hardly a > reason to be insouciant about mass surveillance.

Mass surveillance causes significant problems regardless of whether intelligence works, and so not only does it make sense for the IETF to write that "Pervasive monitoring is an attack" but I believe that it's morally right for us to say that therefore we should demand our governments desist from such attacks.

But that article takes a pretty typical Adam Curtis angle when it comes to facts that dismantle his core thesis - acknowledge them very briefly and then carry on as if they didn't exist. Double Cross is less than a hundred years ago and took place under the circumstance in which actual spies are more valuable - a war. It can and should continue to be held up as an example of how actually sometimes (in a war for example) there _are_ enemy spies and turning or eliminating them _can_ be significant.

In the modern era we fight a lot of actions short of war. The most significant subsequent military action in the UK was the Falklands in 1982. But something like Double Cross would have been pointless. Britain did not go to war against Argentina. Argentina wasn't at with Britain. Both countries disagreed about the status of the Falklands, which the Argentinians had (for local political reasons) decided to just seize by force. Because this wasn't a war per se, our "intelligence" was mostly just a result of being friendly with the (similarly awful but not hostile to us) regime in neighbouring Chile. No James Bond types, just somebody who will turn a blind eye to human rights abuses and focus on immediate military intelligence resources.

<comment><USER13> Körner, "The Pleasures of Counting" (1996), has a bit in "The Poles" (on breaking Enigma) that might shed some light on traditional tradecraft vs mass surveillance. (compare what the Stasi could accomplish with their non- automated labour-intensive methods)

> Churchill's romantic soul loved the excitement and secrecy surrounding > Bletchley. He relished the way that

>> ... old procedures, like the setting up of agents, the suborning of informants, the sending of messages written in invisible ink, ... all turned out to be largely cover for this other source, as one might keep some old- established business in rare books going in order to be able, under cover of it, to do a thriving trade in pornography and erotica.

2nd level quote from Muggeridge, "Chronicles of Wasted Time" (1973) p139

</comment></comment></comment><comment><USER14> I'll set aside the usual commentary on Adam Curtis just to highly recommend this article by Adam Gopnik on the utter futility/uselessness of spying [https://www.newyorker.com/magazine/2019/09/02/are-spies- more...](https://www.newyorker.com/magazine/2019/09/02/are-spies-more-trouble- than-theyre-worth) it's damn-well convincing.

<comment><USER10> For a comedic take on the topic, the British satirist Chris Morris released a movie called The Day Shall Come a couple of years ago which explores how "news" is constructed by media jointly with organisations like the FBI. It's not as entertaining as Four Lions imo but it's very well researched as usual.

</comment></comment><comment><USER15> Before I glanced at the authors name, I knew this was Adam Curtis just from the writing style. Instantly reminded me of "Hypernormalisation" (which everyone should watch) and "The Power of Nightmares."

</comment><comment><AUTHOR> (submitter)

This post was previously submitted in 2013[0][1] and 2017[2].

[0] [https://news.ycombinator.com/item?id=6184984](https://news.ycombinator.com/item?id=6184984) \- 102 comments

[1] [https://news.ycombinator.com/item?id=6690913](https://news.ycombinator.com/item?id=6690913) \- 11 comments

[2] [https://news.ycombinator.com/item?id=14500633](https://news.ycombinator.com/item?id=14500633) \- 139 comments

</comment><comment><USER16> It's still baffling to me that we are expected to believe, for example, that the CIA passes out millions of dollars in war-torn obscenely poor countries like Afghanistan, versus the more obvious assumption that people who work for the CIA have more suitcases full of cash buried around the world than Pablo Escobar ever did.

</comment><comment><USER17> There is also the interesting case where spies and intelligence can be TOO good.

It goes something thing like this:

\- Spy for Country X picks up intelligence that Country Y is about to do crazy thing A. This information is 100% true and correct.

\- Country Y is not in the habit of doing crazy things like A.

\- Given that, the government of Country X thinks "This must be false because country Y would NEVER do such a thing."

\- Country Y then goes and does thing A.

There are MANY instances of this throughout the history of intelligence services and I always think of this type of scenario every time I hear "well spies are just terrible."

<comment><USER18> Weren't the plans for Operation Market Garden discovered by the Germans in a crashed plane and ignored? Something like that.

[https://en.wikipedia.org/wiki/Operation_Market_Garden](https://en.wikipedia.org/wiki/Operation_Market_Garden)

<comment><USER19> The biggest one of those was Stalin's refusal to believe that Germans would attack the USSR, even when it was so imminent that all alarms were going off (and duly reported to him as such).

</comment></comment></comment><comment><USER20> The more I see headlines like _The Suspect was known to the Secret Services ", and, "The Suspect was on the Authorities' radar and deemed of no interest"_, the more I believe our spies are dumber than they'd admit. Either that or they, and the Government have a different agenda.

</comment><comment><USER21> Did anyone ever seriously believe that spies in general know what they are doing?

It seems unlikely that such groups of people would necessarily be better organized than any other well financed group of people (such as a major industrial concern) especially when you consider that much of what they must do has to be done in the dark and is difficult to verify.

Plus of course you have the problem that a lot of what they do know how to do only exists because of the existence of their counterparts in the opposing country and has nothing to do with actual intelligence gathering but rather is about competition and conflict between agencies both between and within counties and alliances.

</comment><comment><USER22> It's still going on:

 _Fourteen-year-old boy charged with plotting terror attack_

[https://www.theguardian.com/uk-news/2020/jun/17/fourteen- yea...](https://www.theguardian.com/uk-news/2020/jun/17/fourteen-year-old-boy- charged-with-plotting-terror-attack)

[Alice in wonderland is secret code for a terror attack.]

 _Teenage girl found guilty of plotting terror attack in London_

 _> > Safaa and Rizlaine Boular discussed the attack in a coded conversation – played to the court – about an Alice in Wonderland-themed party._

 _> > In a recording, Rizlaine Boular said she wanted to have "an English tea party kind of thing, little tea cups, tea cakes and stuff", and Safaa Boular suggested an Alice in Wonderland theme, saying: "You can be the Mad Hatter 'cause your hair's crazy. You can have cucumber and butter sandwiches."_

 _> > Around the same time, Dich and Rizlaine Boular travelled around various landmarks in London, which was believed to be a reconnaissance of potential targets. The following day, they went to a supermarket on Wandsworth Road and purchased a packet of kitchen knives and a rucksack._

(...)

 _> > "This was without doubt a major investigation for the counter-terrorism command working jointly with the security service," said Dean Haydon, the Met's senior national coordinator for counter-terrorism._

 _> > "Not only because it involved a family with murderous intent, but because it is the first all-female terrorist plot that's been launched in the UK related to Daesh [Isis]."_

[https://www.theguardian.com/uk-news/2018/jun/04/teenage- girl...](https://www.theguardian.com/uk-news/2018/jun/04/teenage-girl-boular- guilty-plotting-terror-attack-london-british-museum)

[A columbine style attack is planned by teenagers aremed with a rucksack containing stones, batteries, ~50g of screws and matches. And a bottle of Head & Shoulders shampoo.]

 _Boys given 10 and 12 years for Columbine-style plot in Yorkshire_

 _> > Police spoke to both boys separately at home after the incident. Bolland confirmed they "planned to go into school with a firearm in order to get rid of those who had wronged them", but Wyllie denied everything._

 _> > A month later, detectives seized the latter's diary and found a rucksack in his hideout containing a balaclava, a bag of screws, cable ties and a bottle of flammable liquid. He told police he had the items so he could run away with his girlfriend. He denied planning to kill her parents or pupils and teachers at his school._

(...)

 _> > Prosecutors said North Yorkshire police did not respond adequately to the threat until a specialist counter-terrorism team took over the investigation a month later. Phil Cain, assistant chief constable, admitted their investigation fell below standards and that a review had taken place._

[https://www.theguardian.com/uk-news/2018/jul/20/two-boys- giv...](https://www.theguardian.com/uk-news/2018/jul/20/two-boys- given-10-and-12-years-for-columbine-style-attack-plot-yorkshire)

(The damning evidence: [https://www.theguardian.com/uk-news/2018/jul/20/two- boys-giv...](https://www.theguardian.com/uk-news/2018/jul/20/two-boys- given-10-and-12-years-for-columbine-style-attack-plot-yorkshire#img-2))

[A terrorist assembles a terror kit containing a knife, a hammer and a suicide note.]

Ordering Gunton, who suffers from an autism spectrum disorder, to be detained at Her Majesty's pleasure, the judge Mark Wall QC, told the former A-level student: "The police found a rucksack in your room which contained a knife, a hammer and what has been referred to as a suicide note or a martyrdom letter. In the martyrdom letter you referred to yourself as a 'soldier of Isis'.

"The letter was written in such terms that it was obviously to be found and read after you had carried out a terrorist attack."

The judge described the items found in the rucksack as a "terrorist's kit" and said it was clear from Instagram posts in English and Arabic that Gunton, who lived on a farm, had planned to launch an attack.

[https://www.theguardian.com/uk-news/2018/mar/02/teenager- llo...](https://www.theguardian.com/uk-news/2018/mar/02/teenager-lloyd-gunton- jailed-cardiff-pop-concert-terrorist-attack-plot)

</comment><comment><USER23> On a related note, was there someone working in US Intelligence whose job it was to tell President Trump that possibly the WHO's early statement on human- human transmission of the "new coronavirus" depended on information from China, and maybe that information from China wasn't correct, because, you know, you can't always trust everything that the Chinese government says?

<comment><USER4> I suspect that the intelligence community hides a good deal from him, for good reason.

</comment></comment><comment><USER24> To be a contrarian, don't forget Adam Curtis went to Oxbridge. Maybe he got turned down by MI5.

</comment><comment><USER25> I mean the FBI thought it would be a good idea to persuade MLK to kill himself over his adultery. Moral quandaries aside, that is a remarkably stupid plan if you're looking to cripple the civil rights movement. Best case scenario, he does it and everyone immediately suspects the FBI/CIA forever.

</comment><comment><USER26> It's a lot worse than the title claims: almost NO experts ANYWHERE in government are good at their jobs. And it isn't limited to governments of course.

The book "Wrong: Why Experts* Keep Failing Us" by David H. Freedman shows that government, academic and private industry are quite lacking in "expertise". The current pandemic cock-ups with the CDC, "epidemiology experts", reporters, commentators, analysts and political appointees all now make sense.

Freedman doesn't have a solution, instead leaving us with "11 Simple Never- Fail Rules For Not Being Misled by Experts". but the situation laid out does suggest that we (taxpayers) should slash funding for _most_ governmental, academic and private agencies b/c they fail to come through and literally lack expertise.

"No lesson seems to be so deeply inoculated by the experience of life as that you never should trust experts."

\- Lord Salisbury

<comment><USER4> >[...] almost NO experts ANYWHERE in government are good at their jobs.

Doctors at the NIH, scientists at the Department of Energy, biologists at USAMRIID, etc etc etc.

All bad at their jobs? What kind of absurd reductionist take is this?

<comment><USER26> Then take a look at "I Quit" at:

[https://medium.com/@jamesheathers/i-quit- be062295f638](https://medium.com/@jamesheathers/i-quit-be062295f638)</comment></comment></comment>


Bullied by Beijing, America's Closest Allies Regret Saying 'Yes' to China - <AUTHOR> https://foreignpolicy.com/2020/06/27/china-bullying-australia-new-zealand-canada-britain-trump/ <comment><USER2> This all seems like trump supporter fantasy. It's "not even wrong", if signing up to an investment bank got Australia a sweet deal, then they're glad they did it. There's nothing more to that. People are dropping huawei because of US pressure, not because of human rights. Trump has no real China policy, he started a fight he didn't understand to distract from his failings and then lost that fight. Seriously, who can take the author seriously? Are they just relying on MAGA feelings so no one questions their weird, counter factual narratives?

</comment><comment><AUTHOR> No soft-paywall link: [http://archive.is/qIOeB](http://archive.is/qIOeB)

</comment><comment><USER3> facknews</comment>


As Web Traffic Grows, Crashes Take Bigger Toll - <AUTHOR> http://www.nytimes.com/2008/07/06/technology/06outage.html?hp

<comment><USER2> This should be a browser feature/plugin. Perhaps a question-mark icon next to the address bar.

Site doesn't load or has other problems? Hit the question mark and see the latest reported issues. Your details (browser, IP, etc.) are automatically uploaded and attached to an optional comment, for other people to compare against (same ISP, same country, same browser, etc.).

Pingdom and others sell monitoring. You could probably sell this data to companies - live reports on failures for certain user groups.

Actually... why not make it an open database where you can log issues (not just site failure) against all kinds of services - internet banking sites, the London Underground (District Line still suffering signal failures), etc. Many organisations would ignore or oppose it, but the good ones would find it useful, which implies a way to make money.

All you would have to do is connect the question-mark to the web site / page being visited, and use that as the basis for the ticket. People could maintain a database of contact/help email addresses for each site (the sites could pop up on a queue as they were reported), and the tickets could be sent to that address, to let the organisation know "you are being watched". :-)

Every organisation has a site, and every site has a way to get a message to whoever runs it.

This could grow to a size where it became a significant cultural force. Perhaps that's just the wine talking, but it's quite good wine, so who knows.

Edit: You should also be able to submit a screen-grab with your complaint/suggestion.

Opinions?

<comment><USER3> Of course you could make an overly elaborate uptime monitoring system. Many people have in the past. The thing that makes downforeveryone neat is that it is absolutely bare-bones. "Is it down for everyone?" "Nope, just you." No screen shots, no packet traces. Does it work? Yes/no. All I wanted to know.</comment></comment>


Microsoft Word Document Upload to Stored XSS: A Case Study - <AUTHOR> https://www.coalfire.com/Solutions/Coalfire-Labs/The-Coalfire-LABS-Blog/may-2018/microsoft-word-document-upload-to-stored-xss <comment><USER2> I'm curious if the same can be done via an Excel .xls or .xlsx file

<comment><USER3> It would possibly work with XLSX or PPTX or any of the newer Office file formats that rely on zipping a folder of XML files. Open Document Format files like those from Libre Office might be capable of this too.

XLS, PPT, DOC or other old style Office files don't follow this format so this specific approach wouldn't work on those.</comment></comment>


Chinese rover powers up devices in pioneering moon mission - <AUTHOR> https://phys.org/news/2019-01-chinese-rover-powers-devices-moon.html <comment><USER3> Does anyone know why a halo orbit was chosen for the relay sat instead of a regular, lunar orbit?† I know that due to the moon's lumpy gravitational field, there are only a few stable orbits available, but anything orbiting a Lagrangian point is going to require stationkeeping adjustments regardless, right?

†I understand that that would put the lander out of contact during that part of the relay-sat orbit, but it would also completely rule out a major source of potential radio interference during observational periods, which strikes me as an even more important consideration. Data can be stored and batched, after all.

<comment><USER4> I think orbiting around L2 would ensure the satellite was at a higher angle in the lunar sky for most of the time, and hence the lander can be in contact for longer, as low angles may be blocked by boulders or crater walls etc. The radio to the satellite would normally use high frequencies so you can have a focused beam for power saving, so it needs to be line of sight. You could transmit faster, but this would take more power.

In addition, there is a little rover[1]. NASA rovers since Pathfinder have had some automated driving, I imagine the Chinese can easily do the same, but manually steering is still nice and hence the rover is more useful if you can be in "live" contact with it for longer.

[1] [https://en.wikipedia.org/wiki/Chang%27e_4#Yutu-2_rover](https://en.wikipedia.org/wiki/Chang%27e_4#Yutu-2_rover)

<comment><USER5> The article you linked makes it clear why L2 was chosen - this orbit allows _continuous_ communication between Earth and the lander. If the satellite was _at_ L2, this would not be the case, as the moon would be in the way, so it has to be far enough away to see both the lander location and Earth at the same time

Also, orbiting the moon would give you coverage much less than half the time, and you'd need to track the satellite across the sky from the lander

</comment></comment></comment><comment><USER6> Just to be clear here because all the press releases are intentionally ambiguous about it: the only serious radio astronomy instruments are the Netherlands-China Low Frequency Explorer (NCLE) package on the relay sat in the L2 halo orbit _always_ in line of sight of Earth. Not the lander, not the rover. The relay sat there is the step towards lunar far side radio astronomy but so far that is not actually going on.

It's a cool instrument in that it's antenna are stored as a flat roll but extend out as hollow, rigid tubes.

<comment> dane-pgp The article says:

"Harvard University astronomer Avi Loeb noted, however, that the relay satellite needed to send back information from the far side also contaminates the sky."

Does that mean the international community needs to agree a protocol to establish periods of radio silence for objects on the far side of the moon, and for lunar orbiting satellites, so as not to interfere with future radio astronomy instruments?

<comment><USER6> I don't think it is that serious yet but hopefully in time we will need to create ITU region 4, [https://en.wikipedia.org/wiki/ITU_Region](https://en.wikipedia.org/wiki/ITU_Region) . The link back to Earth is relatively narrow beam width and it's doubtful a simple dish/feed setup has significant sidebands and even then at only a couple frequencies (probably ~7-8 GHz and ~2 GHz).

</comment></comment></comment><comment><USER7> What's with the rubbish photo quality?

This is 2019 after all and I'm pretty sure the Chinese know a thing or two about manufacturing cameras.

<comment><USER8> > _What 's with the rubbish photo quality?...I'm pretty sure the Chinese know > a thing or two about...cameras_

The Chinese also know a thing or two about power budgets, bandwidth limitations and optimising between function and vanity. Low quality rover photos show they're optimising for function, not propaganda value. That's good. (They're also awesome pictures.)

<comment><USER9> Just no.

The issue is not power budget, bandwidth or optimisation between function and vanity. Moon has plenty of sunlight, the bandwidth on an Earth-Moon link is very good and there's really no difference between vanity and function in terms of implementation here.

The real reasons here are a) the Space Grade™ plague, b) radiation hardening and durability and c) limited value in high quality photos.

non-web engineering on big total budget but limited per part projects is very, very conservative.

<comment><USER8> > _the bandwidth on an Earth-Moon link is very good_

The rover is on the far side of the moon. It relies on a single relay satellite at the Earth-Moon L2 [1]. This relay satellite had to be installed specifically for this mission.

> _Moon has plenty of sunlight_

Spaceflight is expensive. Every watt for a better camera means a watt away from scientific equipment. Power on such missions is micromanaged by necessity.

The functional purpose of the camera is in assisting dis-mounting and post- dismounting inspection. It did that. It also sent home good pictures.

[1] [https://en.m.wikipedia.org/wiki/Chang%27e_4#Components](https://en.m.wikipedia.org/wiki/Chang%27e_4#Components)

<comment><USER10> > _Spaceflight is expensive. Every watt for a better camera means a watt away > from scientific equipment. Power on such missions is micromanaged by > necessity._

Also every watt that you can add to the system without taking it away from something else is another watt you need to radiate away after it's done its job. Thermal management is paramount in space missions.

</comment></comment></comment></comment></comment><comment><USER11> Where's the best place to go to look at more pictures from this?

</comment><comment><USER12> The lunar surface is more brown in these photos than the ones from Apollo, which is more accurate?

<comment><USER13> Your comment reminds me of comments made about the colour of Mars. Allegedly it wasn't red enough and looked too much like Arizona so - allegedly - <USER2> made it to the expected red colour and kept this up over a series of missions.

This does not answer your question, however, 'white balance' is a thing when it comes to space.

<comment><USER12> That's funny, but this is a little different since I'm comparing it to the Apollo mission photos.

The last thing I expected to see was a brownish lunar surface, considering one of the most notable things about the Apollo photos is their B&W appearance except for the lunar lander and american flag colors.

[https://www.flickr.com/photos/projectapolloarchive/210374815...](https://www.flickr.com/photos/projectapolloarchive/21037481544/in/gallery- flickr-72157659397648815/)

</comment></comment></comment><comment><USER14> That picture with all the brown dirt totally looks like it was taken on a desert here on earth ;)

<comment><USER12> China faked the landing, it's propaganda. (I'm at least half joking)

</comment></comment><comment><USER15> I've been combing the web for new pics but have found nothing. Anything new?</comment>


Client-side MVC is not a silver bullet - <AUTHOR> http://mir.aculo.us/2013/02/26/client-side-mvc-is-not-a-silver-bullet <comment><USER2> I am quite frankly shocked.

You're telling me that trying to shoe-horn complex application logic into JavaScript is not just going to magically work, and that generating views server-side and using minimal JS to provide "cosmetic" improvements still works best?

</sarcasm></comment>


Doom Eternal does not have a main or render thread - <AUTHOR> https://twitter.com/axelgneiting/status/1241487918046347264 <comment><USER2> I've long been fascinated by watching the translation over the last generation of consoles to jobified systems. The folks at Guerilla Games (Killzone, Horizon: Zero Dawn) hasve a great document on how they jobified their gameplay loop for the last Killzone title [0]. The transition to multithreading systems which greedily take in jobs has enabled exceptionally complex and dynamic worlds, but depending on the implementation can easily come at the cost of determinism - which is honestly a pretty niche requirement for modern single- player titles.

Game engines are like supercars, and occupy a rare space in software outside of academia where individual developers are continuously innovating on an architectural level, integrating knowledge from multiple fields, and enthusiastically sharing their work with their peers.

That kind of development is often too 'in the weeds' to be economic for most development houses, but I think there's a lot of transferable knowledge waiting to be picked up on by other developers willing to keep an eye on the space.

[0] [https://www.guerrilla-games.com/read/killzone-shadow-fall- th...](https://www.guerrilla-games.com/read/killzone-shadow-fall-threading- the-entityupdate-on-ps4)

</comment><comment><USER3> Interesting since Windows used to have GUI events only going to the main thread. Window graphics contexts / rendering contexts generally a main thread thing as well.

Has that changed?

Asserting "no main thread" implies any thread can post and receive events to/from the OS with no proxies. Sounds good.

<comment><USER4> A game engine only needs very little interaction with the underlying OS windowing/event APIs, usually just open a window and handle a minimal number of input- or change-events. That code can easily be isolated into a very small module doing a minimal amount of "per frame work". My guess is they do window creation and window system event handling on "some" thread, maybe the same where main() lives, maybe a different one, but the amount of work this thread does each frame is so minimal (compared to all the other stuff) that it doesn't "deserve" a special designation.

I think what the tweet actually implies is that they don't have a main thread in a sense of a "main system controller thread" which invokes several systems in sequence (e.g. AI, physics, rendering), and those systems are parallelizing their work internally, but instead define the "per frame work" as one big dependency graph of small jobs/tasks without high-level syncpoints between systems. Speculation on my part though.

PS: I wonder how well traditional _debugging_ works in such a highly granular system.

</comment></comment><comment><USER5> Wouldn't it be cool if they released the source code like they've always done? Of course, with Carmack no longer there, I'm just kidding.

<comment><USER6> You mean after a decade or so</comment></comment>


Ask HN: Which companies allow employees to retain IP for side projects? - <AUTHOR> Most companies make you sign agreements which say all IP created during employment is owned by the company. A fair number of companies allow employees to retain IP related to side projects as long as they don't directly compete with the company's products.<p>Here's my short list : gitlab, stripe, github. <comment><USER2> My company makes you preapprove any outside business activities (including freeware/opensource). They ask you stuff like if you are working in the same domain as the company, if you work with any company competitors or clients, etc.

I can't say the name because I am critical of them and need to stay employed.</comment>


The tech utopia nobody wants - <AUTHOR> http://www.theguardian.com/commentisfree/2014/jul/22/the-tech-utopia-nobody-wants-why-the-world-nerds-are-creating-will-be-awful

<comment><USER2> The Guardian just goes down and down in my estimation with each click-bait article on tech. I get it, you don't like the software industry, SV, 'disruption' and have a big axe to grind.

Is it just me who's noticing it, or how do other HN regulars feel about this (not this particular article, but it is the latest one I've seen)? I'll arrive home this evening to my housemate quoting this opinion piece, I just know it. Ugh.

<comment><USER3> They use the word "nobody" when it means "some people". I think their sample size is far too small.

It seems like they gave the page as a project to an intern and got a "will this do?" story out of it.

<comment><USER4> I think you might have it backwards. Those of us who work in tech, _we 're_ the tiny sample of oddballs living in a bubble.

<comment><USER3> I don't disagree with that but that makes "nobody wants this" even less likely, they have to know about it first.</comment></comment></comment></comment>


Being a one in a world full of zeros - <AUTHOR>

it was best said in "Antitrust".. in this business you're either a one or a zero.. alive or dead.
if you're an entrepreneur at what point do you give up on an idea? when you see a site that's similar to yours? or when money becomes an issue?
share your thoughts... <comment><USER2> In my opinion seeing a site similar to yours its called competition, and may not be a problem. It's all about being the best in that field, or the most known, it's almost impossible to be the only one doing any kind of business, so if you see a similar site just try to make yours much better. Money will always be an issue, think about your business as an investment. There may be a lot of reasons for giving up on (or maybe changing) your project:

If people just don't like it at all, or no one uses your product or service maybe you have to start thinking about it.

If you are confident about your idea and passionate about your business, you should never give up because of competitors or money issues.

</comment><comment><USER3> Antitrust is one of the best spoofs of the software world I've ever seen. That they were shooting for something serious makes it even more hilarious.</comment>


Interview with Rui Pinto of Football Leaks - <AUTHOR> https://www.spiegel.de/international/world/interview-with-rui-pinto-of-football-leaks-a-1302330.html <comment><USER2> Interesting part about Pinto considering himself a hacker or not:

> DER SPIEGEL: That makes it sound as though you might ultimately admit to > hacking, after always telling us that you're not a hacker.

> Pinto: I fully accept that, from the standpoint of Portuguese law, some of > my acts may be considered illegal and I will speak out on that. I maintain > that many things that are mentioned were not illegally done. And I don't > consider myself a hacker.

> DER SPIEGEL: What does hacking mean to you then?

> Pinto: To me, hacking means breaking into a system with brute force and > exploiting it. I never did stuff like that.

> DER SPIEGEL: But the indictment says that hacking software was found on your > laptop.

> Pinto: It's true but first of all, that computer was not only used by me. > Second, just because the software is there doesn't mean that I actually used > it. And third, the indictment never actually says that any of these programs > were utilized to access data.

> DER SPIEGEL: You not only continually insisted that you weren't a hacker, > but also that you weren't acting alone. Since your arrest, however, Football > Leaks has gone silent. What happened to your supposed companions?

> Pinto: You have to be patient. It's true that I was the face of the project, > but we'll see what happens in the near future.

<comment><USER3> This sounds more like what a lawyer would say

<comment><USER4> maybe he's spoken to one?

</comment></comment></comment><comment><USER5> The New Yorker profile of Rui Pinto earlier this year was super-interesting:

[https://www.newyorker.com/magazine/2019/06/03/how- football-l...](https://www.newyorker.com/magazine/2019/06/03/how-football- leaks-is-exposing-corruption-in-european-soccer)

</comment><comment><USER6> Why and how is he having this conversation without his lawyer present regarding a case that is in pre-trial? Some of his comments are hardly in his favor and he and his lawyer would know that, no?

<comment><USER7> Portuguese law is very formal. What you say to prosecutors, or in court, carries a lot more weight than what you say outside the formal justice setting. This interview will certainly prompt questions from prosecutors, but as long as he can properly justify everything, as long as he didn't back himself into an impossible corner, he'll be ok.</comment></comment>


What's Next in Making Encrypted DNS-over-HTTPS the Default - <AUTHOR> https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ <comment><USER2> There's a lot of negativity here.

But this is a win overall for privacy.

DNS is used by ISPs to sell user's data and is one way that oppressive regimes track what their users do.

If you're technical enough to understand DNS then you are smart enough to change what the default is.

If you're a system administrator for a company. You should be able to push a profile down to the user's computer to configure DNS how you want.

<comment><USER3> Not if one trusts more his/her ISP more than Cloudflare. At least, an ISP is a contractual partner and under the same jurisdiction, in Europe including GDPR.

<comment><USER4> Being in the same jurisdiction is bad: your ISP is THE place for your local law enforcement to get info on your browsing.

<comment><USER5> Yes. However with Cloudflare, now everyone would effectively be under the jurisdiction of the US which is not necessarily better.

<comment><USER6> You can change your DoH provider under the settings in Firefox.

</comment></comment></comment></comment></comment><comment><USER7> The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it?

I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third- party.

<comment><USER8> The article explicitly mentions the way to tell applications including Firefox not to disregard the OS DNS: blocking a canary domain. It even links to detailed instructions.

Frankly, given how much trouble I've had with systemd's DNS meddling, I look forward to applications taking DNS under their own control.

<comment><USER7> > blocking a canary domain

And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue.

At this point this canary domain will have the same fate as Do Not Track.

> I look forward to applications taking DNS under their own control.

I am sure I can find a hundred applications/programs resolving domains on my machine. It is unrealistic to configure all of them separately. At this point we are back to the OS providing the configuration for all of them.

<comment><USER9> They already stated in the article that if the canary domain will be abused they will disable that check.

<comment><USER10> Yeah. Sounds like another do-not-track then.

I'll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.

<comment><USER11> I suppose you can block the IP 126.96.36.199, but Google serves THEIR DNS at `google.com` on HTTPS port. One of the design choices of DoH to make it look like HTTPS traffic.

It's gonna be difficult to block DoH traffic.

<comment><USER12> > _One of the design choices of DoH to make it look like HTTPS traffic._

Wait until encrypted SNI gets implemented everywhere was well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control.

However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services.

[1] [https://developers.google.com/speed/public- dns/docs/doh/](https://developers.google.com/speed/public-dns/docs/doh/)

[2] [https://www.quad9.net/doh-quad9-dns-servers/](https://www.quad9.net/doh- quad9-dns-servers/)

<comment><USER14> The difference is, DNS-over-HTTPS seems to support cookies and identification. DNS only identified the IP of a person.

So it's clearly an upgrade for Google.

<comment><USER15> A really good presentation on the privacy implications of "modern DNS" by PowerDNS [https://www.youtube.com/watch?v=V2F92orIEO8](https://www.youtube.com/watch?v=V2F92orIEO8)

<comment><USER16> > > [https://www.youtube.com/watch?v=V2F92orIEO8](https://www.youtube.com/watch?v=V2F92orIEO8)

So, given the talk, is the industry finally realizing what Mozilla, Cloudflare and Google are trying to pull off with DoH? I guess this is why the change of hearts from them and letting people block DoH within entire networks, hoping not to attract attention of how much control they want to take away.

</comment></comment></comment></comment><comment><USER17> I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?)

\---

If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing resolvers are configured as described in [0]:

> _Network administrators may configure their networks as follows to signal > that their local DNS resolver implemented special features that make the > network unsuitable for DoH:_

> _DNS queries for the A and AAAA records for the domain "use-application- > dns.net" must respond with NXDOMAIN rather than the IP address retrieved > from the authoritative nameserver._

[0]: [https://support.mozilla.org/en-US/kb/configuring-networks- di...](https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns- over-https)

<comment><USER10> If true that DoH can be disabled at network level, ad-blocking solutions like pihole should probably implement it by default.

Anyone have any idea if this is the case?

That would at least save _me_ a lot of trouble and work.

<comment><USER18> Pihole is great because it can do all your non-browser activity.

But for a browser, an ad-blocking extension works better and is less than a minute to set up. Why force it to use the same DNS blocking?

<comment><USER10> Most mobile-browsers don't support ad-blocking, especially on iOS.

<comment><USER18> They're not threatening to use DNS-over-HTTPS either.

But didn't iOS get browser adblocking capability in the last couple years?

<comment><USER10> Not for third-party browsers like Chrome or Firefox. In a classic Apple-move, it's for Safari only.

<comment><USER18> Even though those browsers have to use a safari core anyway? How strange.

<comment><USER10> Technically speaking they are not using Safari, but a WebView.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> What I still don't see addressed is the question how this will affect non- browser applications.

It's nice that Firefox (currently) still offers options to turn off DoH and to keep using local domains. (although the way DoH and HTTPS-everywhere are structured show that non-internet sites don't seem to have much of a place in the web of the future)

However, now that we have public DoH endpoints available for everyone to query, what will keep non-browser apps and devices from using DoH _without_ any way to opt-out?

Currently, tracking DNS requests seems to be a common way for security and privacy researchers to get some basic information what an app or device is doing on the internet. If DoH is widely deployed, all you'll probably be seeing is encrypted connections to IPs of shared hosters.

This seems like a perfect opportunity for apps and devices to cloak data tracking and other illegitimate requests.

<comment><USER19> The same thing that stopped it before DoH was standardized: nothing.

There are ways to make FW rules based on trusted DNS lookups (i.e. you can only do traditional DNS to a trusted DNS server with domain filtering and you can only connect to an IP if a DNS lookup has been performed) but this is extremely hard to maintain in any sort of foolproof way.

The truth is if you allow outbound connectivity then there all the sender needs to do is add 1 more level of obfuscation than you secure against.

</comment></comment><comment><USER20> I am wondering, does DNS-over-HTTPS really helps since the way I understand it, after the domain name is resolved to an IP address, the client contacts the IP address so the ISP could still know the website visited especially since many if not most websites have dedicated IP addresses. So ISP could simply crawl the web and map domain names to IP addresses.

Is there anything in DoH mitigating this? Or maybe is this attack vector negligible in practice because most servers typically host multiple websites? At least this adds plausible deniability in a wide range of situations I guess. But is it really true? And for example, would it really help in a country where a website like Facebook is censored? (Since their IP addresses are dedicated).

<comment><USER21> This! Just like https encrypting website that anyone can visit is not about privacy, DoH is also not about privacy. Anyone can visit the same https website you visit and see what you are reading. Anyone can resolve the same hostnames that you are resolving (or reverse IPs you are visiting to determine hostnames).

The benefit they do provide is authentication (ensure that google.com is really google.com) and protection against man-in-middle.

And those are great benefits!!

But it doesn't help anyone to misstate and/oversell the benefits of a new service/protocol.

<comment><AUTHOR> > Anyone can resolve the same hostnames that you are resolving

Yes, but your ISP (including "that coffee shop whose wifi you're using" in ISP here) can't necessarily tell which hostnames you are resolving, if you use DoH (subject to some limitations about what happens after you've resolved the hostname). This is in fact a privacy feature

<comment><USER21> They can see which IP addresses you go to and do a reverse lookup.

<comment><AUTHOR> They can, but of course the mapping is not always 1-1.

</comment></comment></comment></comment></comment><comment><USER22> Can somebody point me to the place in the Firefox code where the "use- application-dns.net" canary domain is actually checked? I've tried searching the mozilla-central Mercurial repository and I'm not finding it. I'm clearly inept here.

I'm looking at what my Windows DNS servers return when I put in an empty zone for "use-application-dns.net" and I'd like to see exactly what Firefox is testing for. Windows 2012 R2, at least, returns the SOA and no NXDOMAIN for an "A" query to "use-application-dns.net" with an empty zone. If they're explicitly looking for NXDOMAIN then blocking DOH behavior with Windows DNS servers probably isn't going to work. >sigh<

<comment><AUTHOR> The canary is not implemented yet, as far as I can tell.

</comment></comment><comment><USER23> I'd personally prefer to be greeted with a screen providing me with the option of multiple DNS-over-HTTPS providers, and the option of not using one at all, than being silently forced into handing CloudFlare even more of my data.

<comment><USER10> How about to save time, we could have this choice only once, and that would apply to every application on the machine. Say it could even be handled by the OS itself!

And to save users even more time, not having to configure this per machine, we could have such assignment be an automatic part of the network infrastructure...

We could call it DHCP and DNS! How about it?

<comment><USER24> And DNSSEC all the way to the user!

<comment><USER25> I'd be pretty pissed if my network connection opted me into a DNSSEC-verifying resolver, since that is pretty much pure downside for users.

<comment><USER10> As someone not very knowledgable about DNSSEC, can you expand on this point? To the uninformed that sounds very counterintuitive.

<comment><USER25> Apart from the blog post, if you don't know anything about DNSSEC, I think the things you want to know are:

1\. Almost nobody --- major tech companies, banks, privacy and security organizations --- uses it. It's decades old, and its adoption, at least in North America and in industry, is zero. There are lots of reasons, but you don't have to care right now.

2\. Since almost nothing uses it, there's no real upside to enabling it. But there is a downside! If DNSSEC is misconfigured --- which is easy to do, and it won't get noticed quickly (see: point 1) --- then sites in the DNSSEC- signed zone silently drop off the Internet, as if they never existed. That happened, for instance, to HBO when they launched HBO NOW: nobody on Comcast could see it, because it turned out they'd screwed up DNSSEC, and Comcast had DNSSEC-verifying resolvers.

</comment></comment></comment></comment></comment></comment><comment><USER26> Same story as always with Google "innovations": "hey, we're preventing DNS queries to go to your ISP who is selling it" (to go to our service instead so we can profit from it).

It's scary that Moz sides with monopolies like Google and Cloudflare on this one.

<comment><USER27> In my Firefox settings I can choose any DoH provider I want, not just Cloudflare. Naturally _something_ has to be set up as a default so it works. Why is adding DoH in the browser a bad thing?

<comment><USER10> Because if we're replacing classic DNS with something new, it needs to be part of the OS.

Not reimplemented (and configured) per application. The user and OS should control the application, not the other way around.

<comment><USER28> Is any OS vendor working on something like that? Or do you expect Moz to jump into OS dev as well? I'd expect them to import settings from OS as soon as a major OS provides this for DoH.

</comment></comment></comment></comment><comment><USER29> Why don't they rather include a resolver in Firefox ?

This way, no privacy problems, you're directly contacting authoritarive servers. And you don't rely on a single dns-over-https provider.

Is the latency a big problem there? I would say that with caching it is not too bad.

<comment><USER30> 1\. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined.

2\. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad.

I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're trying to resolve.

<comment><USER22> I disagree that the OP's comment isn't helpful. Mozilla could have taken a tack that would have increased decentralization and promoted privacy (DNS- over-TLS exists). Instead, they went the way of a centralized protocol that just trades one set of potentially bad actors (ISPs) for another.

re: network policy - If you're paying to use a network with policy that you disagree with vote w/ your wallet. If you're using somebody else's network (i.e. a corporate network I'm paid to administer, for example) it's reasonable to accept that you're bound by the owner's policy-- it's their network.

<comment><USER31> I'd love to use DoT, but afaik it's currently mostly only supported by DNS resolvers (Google, CloudFlare and other privacy-exploiting companies) rather than authoritative DNS servers.

</comment></comment></comment></comment><comment><USER32> So what will be « safer » ?

Using a pi-hole or equivalent, or using this ?

IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?

<comment><USER17> Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.

<comment> mike-cardwell For unbound, I just dropped this in my /etc/unbound/unbound.conf.d/02-block- doh.conf

      local-zone: "use-application-dns.net" static

<comment><USER31> Exactly what I did.

</comment></comment></comment></comment><comment><USER33> I wish Mozilla had Firefox version free from all integrations with 3rd parties.

<comment><USER4> Just build it from source with no API keys.

(Though DoH is not an "integration" in that sense.)

</comment></comment><comment><USER34> I tried forced-mode DoH in Firefox 68 and 69, on Debian 9 and 10. In all cases, it worked for a while then stopped to work after a few hours (at random it seems). The only way for me to make it work again was to disable DoH.

I guess a more long term solution is to have a local proxy dns-to-doh, but we are falling back in the solution that only a technical user can setup :

[https://developers.cloudflare.com/126.96.36.199/dns-over- https/clo...](https://developers.cloudflare.com/184.108.40.206/dns-over- https/cloudflared-proxy/)

[https://facebookexperimental.github.io/doh- proxy/](https://facebookexperimental.github.io/doh-proxy/)

And it means setting up firewall routing and filters, as some softwares don't have settings to add DNS proxy, or even bypass them (Google Chrome for example)

</comment><comment><USER35> > Fall back to operating system defaults for DNS when split horizon > configuration or other DNS issues cause lookup failures.

I hope we'll be given the opportunity to disable this, or at the very least show a warning (similar to cert warnings?) that something's off.

<comment><USER36> the network.trr.mode setting provides fine control

[https://wiki.mozilla.org/Trusted_Recursive_Resolver](https://wiki.mozilla.org/Trusted_Recursive_Resolver)

</comment></comment><comment><USER37> What is the latency for DoH compared to traditional UDP DNS?

<comment><USER38> Here's a whitepaper that did some benchmarks and a detailed analysis on it. Was posted on hn a few days ago. [https://arxiv.org/abs/1907.08089](https://arxiv.org/abs/1907.08089)

They test various network conditions with some results showing DoH and DoT loading webpages faster than udp dns (due to tcp timing out faster than udp on lossy connections )

<comment><USER37> Thanks!

</comment></comment></comment><comment><USER39> I wonder if this will break TP-Link's tplinklogin.net and tplinkrepeater.net for logging into their routers/repeaters? At least the latter is supposed to be intercepted by the device, and if it isn't, you get a message saying things are misconfigured.

<comment><USER5> Seems to me they should be able to keep this sort of working by resolving tplinklogin.net to 192.168.0.1 or such on their public DNS and ensuring the router always serves the web page from that IP.

Of course things will break down if a router is ever configured to use a different IP - but then again, the public DNS with local IP might trigger Firefox' heuristics and cause it to fall back to traditional DNS - so thinks may still work.

But the whole concept of using an on-device web page as config UI seems to become problematic, thanks to HTTPS-everywhere, as there appears to be no way to serve HTTPS from a local, unsupervised device that is frictionless and does not open a security vulnerability.

</comment></comment><comment><USER40> Unfortunately, Mozilla are planning to leave DoH off by default for Firefox users in the UK. Almost certainly to avoid criticism from politicians and children's charities about how DoH would interfere with the UK's network level website blocking of 'adult' websites.

<comment><USER41> Hrhr. But talk about how it intends to prevent censorship...

</comment></comment><comment><USER42> DoH bypasses the OS and the /etc/hosts file. This breaks some workflows.

<comment><USER2> Oh no.

Maybe you can configure this? [https://support.mozilla.org/en- US/kb/customizing-firefox-usi...](https://support.mozilla.org/en- US/kb/customizing-firefox-using-policiesjson)

Or perhaps use their canary domain to force Firefox to use local DNS?

Or just configure it yourself?

It's not security if an application can still access the internet. Why not block all internet access except via a proxy server? Which is what a "real" enterprise would do because they can block what they want and have a secure network.

</comment></comment><comment><USER43> ISPs, OSs and Routers should effort at providing secure resolving themselves before every app out there thinks it knows better what DNS to use.

</comment><comment><USER44> Why would Mozilla hurt Firefox's market share in such an obvioud and drastic way? Do they not have anyone at their meetings that brings up obvious and uncomfortable risks?

I use DoH on Firefox and love it but man, I myself would block Firefox in a corporate network I help oversee if this is the default. Matter of fact, web proxies already list DoH resolvers as anonymizing sites.

Even if this involves some profit with cloudflare,this is strategically terrible for long term goals.

</comment><comment><USER45> Can you run this service yourself easily?

</comment><comment> lota-putty We're getting an option to bypass TSP's DNS to a 3rd party over secure connection; be it DoH or DoT.

TSPs can easily map your usage behaviour to your identity while 3rd party DNS provider will have your behaviour alone. Albeit, TSP will still have IPs you've accessed for data transfer.

TSPs that honour their customers' privacy will allow 3rd party DoH/DoT, esp DoT(ie port:853).

TSP: Telecom service provider

</comment><comment><USER46> Could we have srv records as the default to alleviate/eliminate the ipv4 crisis?

</comment><comment><USER47> Android + Chrome + DoH + AMP = ?

Edit: typo

</comment><comment><USER6> Big thanks to Mozilla for making internet a more secure place.

</comment><comment><USER48> At what point can I expect Mozilla to start proxying my web requests as well?

<comment><USER47> Mozilla I don't know but Google is already doing it with AMP</comment></comment>


Somebody Tried to Hide a Backdoor in a Popular JavaScript NPM Package - <AUTHOR> https://www.bleepingcomputer.com/news/security/somebody-tried-to-hide-a-backdoor-in-a-popular-javascript-npm-package/ <comment><USER2> Like I've been saying, npm is ripe for abuse [https://medium.com/p/73fac4bc5068](https://medium.com/p/73fac4bc5068)</comment>


Gates predicts 10 years of woe - <AUTHOR> http://www.smh.com.au/news/world/gates-predicts-10-years-of-woe/2009/01/27/1232818386171.html <comment><USER2> "2 years of woe" would be a more accurate headline for what he actually wrote.

</comment><comment><USER3> Sounds grim, of course, but without downs we couldn't experience ups.</comment>


Ask HN: Help test our new signup process - <AUTHOR> Our product (https://www.siasto.com) is a project management tool. It competes with Basecamp, and focuses on integrations with other web apps.
We recently revamped our homepage + added an intro tutorial, so it'd be great to get feedback from you guys. What do you think of the signup process? What about the product, UI, and features? Do they make sense? Did you run into any bugs? etc
Thanks! <comment><USER2> You have alignment problems. I talk about it more here:

[http://www.chrisnorstrom.com/2011/05/quick-fix-up- redesign-o...](http://www.chrisnorstrom.com/2011/05/quick-fix-up-redesign-of- tap11-com/)

Also your call-to-action button ("Try it free") and the text above it need to be on the right, not the left. On the left you should have a screenshot of your service or a video.

Actual product wise, I like the look. Love the yellow, like the header. Unique and different yet predictable and usable. There's something odd about having breadcrumbs up there on the right and the tab bubbles centered but I'm going to give it a chance to grow on me.

I really like the guided tour. The first tutorial though, "We created a team for you", "Yeah", "Go ahead and rename it" should all be in one speech bubble instead of 3. And I suggest avoid casual lanuage like that. I've seen other startups do it and it just looks really awkward and forced. One startup had a "People kind of like us" header with testimonials underneath. "kind of" like you? I just don't think language like that belongs on something as massively used as a tutorial or landing page.

On the project task page I really think you should switch the placement of the "New Task" button and the search box. Search boxes are always expected to be on the right and I feel the new task button naturally should be the first thing you see. The average user without a doubt will create new tasks MUCH more often than searching through tasks. So naturally new task should be seen first. All the "add new ____" buttons and associated buttons should be on the left I think. That's usually the default place where they are.

Lastly when I uploaded a picture of myself, my picture wasn't completely square and it ended up being re-sized incorrectly and now looks squished. It should be center cropped.

When I hover over different date boxes on the calendar my mouse arrow should turn into a hand and that date box should subtly highlight.

Amazing job though. I really like the simplicity. I wouldn't pay $25/month but it is a very nice service that's easy to understand.

<comment><AUTHOR> Great feedback, thanks for going into detail on everything.

It's funny that when you've been building (and using) a site for a long time, everything about it starts to feel natural. I've never even considered moving the "New Task" button to the left before.

The good thing about asking others to check it out is we can get a fresh perspective and draw a line between what's actually good and what we've simply gotten used to.

</comment></comment><comment><USER3> Looks very nice. Previously, I've used Trello but this feels more streamlined. However, keyboard shortcuts! You must have shortcuts to do different things.

Also, I don't want to invite any teammates like the tutorial says, you should be able to skip that one. Especially when there is no way to stop the tutorial.

<comment><AUTHOR> Thanks for the feedback! We've got some limited shortcuts in the tasks and docs view, but nowhere else yet. We'll definitely put up a blog post once they're everywhere.

Good point about the last step of the tutorial. I'll change that right now.

<comment><USER3> Hmm, can't find the link to your blog anywhere on your website... Maybe you should add that also.

</comment></comment></comment><comment><USER4> Pretty brilliant, I like the seamless tutorial intro, the only turn-off being some of the grammer in the tutorial. The text in the bubbles should be a bit less, umm, "programmer-ish".

Nice to haves:

-An "Expand All" button for docs when viewing

-Ability to choose a destination folder for your uploaded doc (or at least a "coming soon" and a note about dragging)

-Expose the activity somehow (RSS feed?)

-Task editing is crammed on the side, needs to breathe

-Task details should be textarea, not a single line, and perhaps support markdown or html

-Calendar needs iCal support

-Tasks need grouping / color / tagging / organizing

At some point in the future, I'd like to go to my preferences, and turn off the tutorial.

Edit: fixed formatting of wishlist.

</comment><comment><USER5> As a general rule of thumb, I don't sign up for anything like this unless I can see screenshots or a video first. I know there are some on your blog, but they really need to be linked from the front page.

<comment><AUTHOR> Thanks for the feedback, we were just talking about that today with Garry Tan. There will be some screenshots on the home page in another day or two.

</comment></comment><comment><USER6> The tutorial process is pretty great. I found the circle visually unappealing.

I like that you don't try to cover too much ground with the tutorial. There are definitely some things I'll get to discover later.

The visual look of the bubbles on the comments do appear near-pixel perfect. For this kind of application, performance is absolutely critical (it's arguably the application I would use more than anything else, including my email inbox, so any delay is incredibly frustrating because it bottlenecks my whole day), so I would caution you to make sure that the tutorial looks incredibly fast. I think you've done a good job with that so far.

The tasks feature does need a little bit of work, but it does look slick. I would need the ability to tag items. In fact, I'd suggest you just look in here: <http://help.teambox.com/forums/86927-ideas-and-suggestions> (their users have already done all of the voting work for you) for a list of task features people want.

Last comment before I stop: it's unpleasant to browse around and find that you're planning to charge me $99 in 16 days for my business account. Got to tell me earlier that it costs money.

</comment><comment><USER7> Hey thanks for posting this, I just signed up and noticed two things:

1) If you guys allow signup / login with google why isn't there a sigin with google button right on the homepage /signup section? would have prefered that to entering my username and password and most people have a google account anyway.

2) There needs to be a way to exit tutorial mode, maybe it's there already but if it is, it's not obvious enough.

Otherwise I'm loving the design and ease of use.

<comment><AUTHOR> Yep, we definitely need to make it possible to sign up with Google. Just haven't gotten around to it yet. Working on the tutorial exit right now, but in the meantime you can just invite a fake email address ;-)

</comment></comment><comment><USER8> Clickable: <https://www.siasto.com>

\-----

I like the single page intro, but feel it could contain a little more information on the feature set. I agree with blakeperdue that a screenshot would help as well. The signup process is super simple, which is a big plus and makes it trivial to get started / explore the product.

</comment><comment><USER9> I like the way you have placed sign-up text boxes & button right below the pricing, so I don't have to navigate. Neatly done.

The guided start process is very helpful. Did you use any tool for this?

You could allow adding (new) people at task level with just email id. This will make it easier for user adoption.

</comment><comment><USER10> Love the design. Clean, interesting and informing. One thing I would suggest is add a screenshot of the product somewhere. I find that seeing the product helps really draw me in and want to sign up.

</comment><comment><USER11> "Help test our new signup process"

I see what you're doing there... =)

</comment><comment><USER12> The "GET STARTED" link on the homepage just seems to be a span wrapped in a button with no link. Not working for me in Chrome 18. Too many of your links seem to be javascript dependent. Whilst it can make nice fancy effects, it can easily go wrong or the user may not have it enabled (>3%).

</comment><comment><USER6> Kudos on making a feedback form that's an actual form (rather than an email link in disguise).

</comment><comment><USER13> Can't really see what the site does before you sign up - that's a major problem.

</comment><comment><USER14> The "learn more" link doesn't do anything for me on Chrome (works in Firefox).

<comment><USER12> Working for me in Chrome 18.

<comment><USER14> It's working for me now. I'm not sure what was going on.

</comment></comment></comment><comment><USER15> The tutorial is a brilliant touch, and very useful!</comment>


Intel is recalling its fitness watches - <AUTHOR> http://www.businessinsider.com/intel-safety-recall-for-basis-smartwatch-2016-8 <comment><USER2> I have one. Don't use it at all.

Anybody offer open source software? Cloud service?

The watches are probably not dangerous, just too much trouble for the low amount of revenue they bring in.</comment>


Federal government demands NYC strip Times Square of billboards - <AUTHOR> http://newyork.cbslocal.com/2015/05/05/times-square-billboards-highway-beautification-act/

<comment><USER2> Good. I hope NYC sues and takes it all the way to the Supreme Court and they put an end to the Fed using the threat of withdrawing Fed Highway funds as a means to force states to toe the line.</comment>


Ask HN: The next generation web framework? - <AUTHOR> It appears that Rails and Node's various projects (koa, express, hapi, etc.) are all dying -- or at least aren't popular within the past year on this site. There has been some mild uptick in django, which is surprising.<p>So what is the next generation web framework to take the engineering world by storm? Perhaps we are in a lull? <comment><USER2> My general shilling would be for Elixir, but let's just stop for a second.

Why do we need another web framework? Are we truly so far past displaying data munged from a database and occasionally filling queries over JSON APIs that we need some new shiny? Have our projects, our jobs, our work really changed so much in character that any of the existing stuff can be improved on by yet another set of tools to learn?

I think that more churn is something all of us should look at as annoying at best, wasteful usually, and huge trouble at worst.

</comment><comment><USER3> From HN posts, it seems to me that people are moving in these directions:

OO -> FP

frameworks -> libraries

ORMs -> query builders

weak typing -> strong typing

dynamic typing -> static typing

Rails, Koa, etc. fall on the "before" side of the trend, whereas things like React fall on the "after" side.

<comment><USER4> They're not dying. They've gone through the Hype Cycle [1] and have moved from being new and exciting tools to being just... tools.

[1] [http://www.gartner.com/technology/research/methodologies/hyp...](http://www.gartner.com/technology/research/methodologies/hype- cycle.jsp)

smt88's post is consistent with what I've been seeing as well. Two or three years ago there was an uptick in gradual typing as a transition from dynamic typing to static typing.

Functional Programming's influence and inspiration is showing everywhere, from .map() and .filter() utility libraries, to Functions-as-a-Service (Lambda, "serverless") computing, to Java 8, Model-View-Update (where Update is a Pure Function) stuff like Elm, Redux.

The NoSQL hype is finally over, we now have datastore decision diagrams that help us pick a database on its merits.

We are starting to realize that doing complex stateful logic on the client often means also doing complex stateful logic on the server and synchronizing the two, so single-purpose libraries like React are heading towards a world where we'll be rendering on the server again and just pushing virtual dom diffs on the wire. We have all the pieces right now, but so far no one has come along and done this yet.

Opinionated frameworks are falling out of favor; everything is about minimalistic libraries you have to chain together yourself. While this means more creative freedom, it also means more moving parts to orchestrate, and more problems you have to think about yourself.

</comment></comment><comment><USER5> Since when did stable / used became a synonymous for dying? Is Python dying? Java?</comment>


Tools for Remote Software Development and Pair Programming - <AUTHOR> https://zapier.com/engineering/remote-dev-tools/ <comment><USER2> I used to think there was a lot of value in the concept of pair programming but I think the Pull Request and Code Review model is simply superior. It allows for a lot of the benefits of pair programming but with lower costs. I've always found that even looking over someone's shoulder to help debug something slows to a crawl. It takes more discipline than most engineers have to keep it truly paired.

<comment><USER3> > a lot of the benefits of pair programming

So much of the work I do as a programmer does not go into the repository.

Yeah, that's not ideal, but so much of the work I do is in the technique. In the keyboard shortcut, the ~/.bashrc, the discipline of red-green-refactor, of pomodoro.

None of that stuff goes into the pull request, and yet all of it is something my programming pair can experience and learn from. And when I enter an area that's bizarre to me — when I am picking up a new language, a new tool or paradigm — a partner is 1000x more productive than my incessant slacking of code snippets when her explanations easily become demonstrations, and not least of all because it means that helping me is not an interruption to your KPIs.

None of that comes across in a pull request.

Maybe if your work exists entirely within code, within languages that you know, with build toolchains that are done changing, and you're entirely satisfied with your development environment, habits, and methods. In that case, yeah, CI and a little PR review are probably all you need.

Meanwhile, pair programming actually decreases the discipline you need to be a good engineer.

<comment><USER2> I agrer that these things have value too but some places do Developer Share Sessions where one developer does a short presentation on a complicated subsystem or tools they use or a new api that needs integrated.

<comment><USER3> That sounds terribly dull. Unlike during a programming exercise, there's no forcing function during a presentation that impels me to try and put this information in the right place in my mind. Certain note-taking strategies attempt to fabricate such a forcing function, but it's ersatz.

Most of my notes during presentations or long-winded meetings boil down to "what motivated this presenter to speak?" or "why do I have to sit through this?"

</comment></comment></comment></comment><comment><USER4> How did they fail to mention Floobits?

[https://floobits.com](https://floobits.com)

 _Real-time collaborative editing with text editors and IDEs._

Supports Sublime Text, Atom, Neovim, Emacs and IntelliJ IDEA (which includes the family of editors, e.g. PhpStorm WebStorm PyCharm RubyMine, etc)

It can be pretty interesting to watch two people code in one of the public workspaces..

[https://floobits.com/active](https://floobits.com/active)

<comment><USER5> NET::ERR_CERT_REVOKED Issuer: StartCom Class 2 IV Server CA

<comment><USER4> Where do see this? Generally Chrome will provide me a warning in such situations. And I'm not receiving any warnings.

<comment><USER5> It was in Chrome at the time I wrote that. But it works OK now; CA seems to have changed to RapidSSL? <shrug>

</comment></comment></comment></comment><comment><USER6> I've used a shared tmux session over ssh in the past, which worked quite nicely without installing any extra software (besides tmux obviously)

<comment><USER7> Is Wemux ([https://github.com/zolrath/wemux](https://github.com/zolrath/wemux)) still relevant?

<comment><USER8> Not the OP, but as a frequent tmux pair programmer, I've never found wemux to be particularly relevant. It's useful if you don't know how to use the advanced features of tmux. Everything in wemux can be done in tmux -- you just need to know how to do it. Having said that, reading the tmux manual is something that might occupy you for more time than you would like to spend :-)

<comment><USER9> Yeah, tmux is pretty powerful all by itself, and perfectly suited for pair- programming, assuming ssh is set up. I wrote a little wrapper script a while ago to handle the setup of the ssh keys on a temporary basis (the partner's SSH key is allowed to attach to the appropriate tmux session only and is removed when disconnected): [https://github.com/goerz/tmuxpair](https://github.com/goerz/tmuxpair)

<comment><USER8> I do something similar. I set up a "pair" user on the system whose login shell is just a script that attaches to the tmux session. The script that starts the tmux session, sets the group permissions on the socket to "pair". This means that even though the "pair" user has their ssh key in pair's authorised_keys file, they can't log in unless there is an ssh session with the appropriately shared socket. Also, they are never logged in as your user (though, sharing the session, they can do whatever you can do -- only you are guaranteed to be able to see it).

</comment></comment></comment></comment></comment><comment><USER10> What about a shared whiteboard, though? That's the one thing I'm missing at the moment. Using one of those with a couple of nice graphics tablets would be great.

<comment><USER11> I have lamented the lack of a good online whiteboard experience for decades now. I think the real problem is that for a proper whiteboard, we need obscenely large and high-resolution displays.

Analog is much better than digital in this particular.

<comment><USER12> You might be interested in [https://gsuite.google.com/products/jamboard/](https://gsuite.google.com/products/jamboard/) though I doubt your company would pay for each of you to have one at home. It's more of an office to office type of thing, I think.

<comment><USER11> Not nearly big enough, but a step in the right direction.

</comment></comment></comment></comment><comment><USER13> The system that Slack bought was the best I've seen. Can't remember the name of it though.

<comment><USER14> Guessing you're talking about Screenhero.

[https://screenhero.com/](https://screenhero.com/)

<comment><USER13> That's it. That system was fantastic.

<comment><USER15> Was? Are you saying you don't hold that opinion anymore, or do you just not use it?

<comment><USER16> Signups have been closed for 2.5 years since they were acquired by Slack.

[http://blog.screenhero.com/post/109337923751/screenhero- join...](http://blog.screenhero.com/post/109337923751/screenhero-joins-slack)

<comment><USER13> Yep. That's what I was talking about.

</comment></comment></comment></comment></comment></comment><comment><USER17> At my current place (team of 5), we set up Zerotier[0] to create a LAN between all of our computers and servers. This lets us directly ssh into each-other's machine, simplifies file sharing to an rsync, etc...

I find this works really well, as when someone has a bug and needs help, we can all access [http://<hisip>:8000](http://<hisip>:8000) to access the instance he's working on, and ssh into the machine to get access to the logs to try and help figure out what's wrong.

Disclaimer : just a happy Zerotier user.

[0]: [https://www.zerotier.com/](https://www.zerotier.com/)

</comment><comment><USER18> I find [https://localhost.run](https://localhost.run) to be a great tool when you need a tunnel to your machine to show things. Just a line of ssh, works everywhere.

<comment><USER19> Works better for me without https

[http://localhost.run/](http://localhost.run/)

</comment></comment><comment><USER20> If you are developing with Vagrant boxes -- Vagrant's built in share (and tmux) working pretty well for pairing or reviewing.

[https://www.vagrantup.com/docs/share/](https://www.vagrantup.com/docs/share/)

</comment><comment><USER21> Annoying website forces you to have cookies enabled... I refuse to open this.

</comment><comment><USER22> I'm surprised this wasn't mentioned, I've used it before with great results.

[https://atom.io/packages/atom-pair](https://atom.io/packages/atom-pair)

</comment><comment><USER23> I used to use TeamViewer for remote pair programming - even forking out $700 for a licence - until I discovered it had a huge security hole: [https://www.optiv.com/blog/teamviewer-authentication- protoco...](https://www.optiv.com/blog/teamviewer-authentication-protocol- part-3-of-3)

Won't trust them again.

</comment><comment><USER24> I find a private leaderboard keeps me updated on my remote friend's programming and helps me feel connected to what they are working on:

[https://wakatime.com/features#leaderboards](https://wakatime.com/features#leaderboards)

</comment><comment><USER25> I use appear.in and/or vnc nowadays a lot for pair programming.

<comment><USER12> How's the latency with VNC these days? I haven't used it in probably 10 years, but it was pretty bad back then and basically only useful for emergencies in my experience.

Edit: IIRC VNC being awful was why Citrix became so popular way back when. Something something thin client something proprietary compression algorithm. Is that ringing any bells?

</comment></comment><comment><USER26> I've always used tmate.io inside a linux container. The only downside is the person I'm pairing with must be comfortable with command line interface.

</comment><comment><USER27> Hangouts and tmate</comment>


Ask HN: programming with a chording keyboard - <AUTHOR>

A friend of mine has recently been having some difficulties with typing: turns out it isn't his wrists, but rather he's pinching a nerve somewhere in his arm/back whenever he flattens his arms out to type. I've been investigating alternative keyboards and came across the Twiddler chording keyboard (http://tekgear.com/keyboards/chording-keyboards.html). Has anyone used this to program and if so how was your experience? What major drawbacks did you experience? He uses emacs as his primary editor and is mostly in an SSH shell. <comment><USER2> I haven't tried the particular keyboard you referenced. But I went through a phase of building and testing such keyboards - mostly variants on Doug Engelbart's design. I could never get decent speed and some chords were harder on my fingers than a regular keyboard. The biggest problem is that with five fingers, the maximum number of chords is 31 before you have "slide" positions, i.e two or more keys to one finger / thumb.

Remembering codes for characters took a lot of time too.

Might be far easier to investigate exactly how and when the nerve pain arises. I used to have a massive issue with mice. Solved it by using a trackball under right hand and a mouse (with optical sensor for positioning disabled) under the left hand. So I wasn't moving the mouse and clicking at the same time. That was enough to overcome my RSI issue. I also currently use a MS Curve keyboard. It is what works best for me. Some of my colleagues use those weird MS ergonomic keyboards with split areas and funny looking wrist rests.</comment>


CDC: Romaine lettuce linked to E.coli outbreak - <AUTHOR> https://www.wtnh.com/news/health/consumers-advised-by-cdc-to-not-eat-romaine-lettuce-following-ecoli-outbreak/1609464911 <comment><USER2> Where is this outbreak? The site doesn't give many details.</comment>


Kevin Rose Steps Into Part-Time Role at Google Ventures to Build a New Startup - <AUTHOR> http://techcrunch.com/2014/08/15/kevin-rose-google-ventures-north/

<comment><USER2>
        If the model sounds familiar, that's because it was
        kind of the idea behind Milk. But the world has
        changed since then, according to Rose. "The biggest
        thing that's changed in the last three years is that
        back then we spent a lot of time spent building out
        the back end… But the scaling piece is a solved
        problem," Rose told me.

They shipped one app, Oink. Oink didn't fail because of the amount of time required to build out the backend. It failed because it was a me-too product in a sea of me-too products, and didn't do anything to differentiate itself or provide meaningful value to its users.

Edit: On an unrelated note, it looks like Kevin must've been binging on Wes Anderson films recently. The North website looks like one of Anderson's film title cards. Compare [http://wesandersontitlecards.tumblr.com](http://wesandersontitlecards.tumblr.com) and [http://www.n-o-r-t-h.com/](http://www.n-o-r-t-h.com/)

Edit 2: Yep, Futura. [http://en.wikipedia.org/wiki/Futura_(typeface)#Usage](http://en.wikipedia.org/wiki/Futura_\(typeface\)#Usage) and check out the CSS on the North website.

<comment><USER3> From what I remember, Oink differentiated by being about the things inside stores/restaurants instead of the businesses themselves.

For example, if you were in the mood for a certain dessert, you'd see the ratings of the dessert in a city versus the ratings for the place.

<comment><USER2> Right. There were at least half a dozen other apps in the App Store doing the exact same thing that launched before Oink. It's been a couple years since I've thought about this space, at all, but some of the others were:

* Stamped: [http://techcrunch.com/2011/09/26/stamped/](http://techcrunch.com/2011/09/26/stamped/)

* Chewsy: [http://chewsy.com](http://chewsy.com)

* Foodspotting: [https://itunes.apple.com/us/app/foodspotting/id350727118?mt=...](https://itunes.apple.com/us/app/foodspotting/id350727118?mt=8)

* Ness: [http://en.wikipedia.org/wiki/Ness_Computing](http://en.wikipedia.org/wiki/Ness_Computing)

</comment></comment></comment><comment><USER4> What an absolutely terrible domain name: [http://www.n-o-r- t-h.com/](http://www.n-o-r-t-h.com/)

<comment><USER5> Actually, I'm not so sure. It's easy to tell people: "North.com, with a hyphen in between every letter." It's not that hard to type, and once you've typed it once, it's in your address bar.

From an SEO and aesthetic perspective, it's a shitty domain name. But from a branding perspective, it's not bad. It's memorable, easily verbalized, and allows him to brand under "north" instead of some longer or abstract name.

</comment></comment><comment><USER6> > Nowadays he says, a lean startup can work specifically on product and > design, and leave the infrastructure side of things to someone else.

Probably not true. Anyway, that's not what the plan is:

> He envisions North as a team that has one product person, one design person, > and a full-stack engineer

</comment><comment><USER7> What does he mean that scaling a mobile backend is a solved problem? What has changed?

<comment><USER8> Services like Parse - [https://parse.com/](https://parse.com/)

</comment></comment><comment><USER9> Link to his new company: [http://www.n-o-r-t-h.com/](http://www.n-o-r- t-h.com/)

<comment><USER10> I'm sure it's just a place holder until he can secure north.com or some variant of that. The foundation video series run by Kevin seems to have gone through a dozen domains.

</comment></comment><comment><USER11> This doesn't surprise me. To me Kevin seems to have a drive to tackle the latest interesting trends in social and always with a new twist. Success or Failure. This is a good quality. Good Luck Kevin.

</comment><comment><USER12> It's weird to see a shopping cart powered by Squarespace at n-o-r-t-h.com

[http://www.n-o-r-t-h.com/commerce/show-cart](http://www.n-o-r- t-h.com/commerce/show-cart)

</comment><comment><USER13> I admire this guy's talent at failing upwards.

<comment><USER14> He'll be CEO of HP in no time.

</comment></comment><comment><USER15> interesting domain name n-o-r-t-h.com i wonder if the hyphens could become a trend like "getX.com"

</comment><comment><USER3> Kevin seems to be full of ideas. I look forward to seeing what they release.

</comment><comment><USER16> Did anyone else actually laugh out loud at the "Scaling is a solved problem" line?

Guess I can take off early for the weekend then.

</comment><comment><USER17> Cool vibe to it. I've always enjoyed how Kevin organizes things. Curious to see what they'll be working on.</comment>


It Will Take Years for Smart People to Understand Cryptocurrencies - <AUTHOR> https://nakamoto.com/it-will-take-years-for-smart-people-to-understand-cryptocurrencies/ <comment><USER2> Is it like the Internet in 1995? Time will tell but it has the same potential to change our lives forever; and break government's monopoly on the (fake) money.</comment>


"Anshika Packers & Movers" ranked #3 by traffic in the U.S., according to Alexa - <AUTHOR> http://www.alexa.com/topsites/countries/US

<comment><USER2> Someone Hijacked yahoo.com on Alexa!

When you click on the link it clearly shows that it's yahoo.com and not anshikapackersmovers.

About anshikapackersmovers (yahoo.com): providing you the best possible solutions for all kind of relocation such as home relocation, car carrier service, office or corporate relocation mumbai providing you the best possible solutions for all kind of relocation such as home relocation, car carrier service, office or corporate relocation .</comment>