Can someone explain database scaling issues for web? - <AUTHOR>

I don't really understand the technical challenges behind scaling, when people talk about using NoSQL or Redis.
I mean at the end of the day aren't you still trying to lookup (or insert or delete) into a very, very, very large list? Is one technique to "flatten" out your entire user database into a tree, say by location and then further subdivide so you just go down the tree to choose which smaller DB to access?
Those are my initial naive thoughts on the matter; could someone help me understand some of the non-trivialities to database scaling?
Thanks <comment><USER2> Nowadays instead of having the sub-systems you are referring to for storing data, many scaled databases use NoSQL and Redis for databasing and caching. The caching is probably the more scalable of the two because caching at any level has to do with usage and not all database data is used. Caching has allowed the most used data to be readily available. The limits of scalability may only require the system you described, but bigger and more complex systems like Twitter and Pinterest have been documented using database scaling via caching with things similar to Redis and Memcache. Keywords for finding more information are "cache/caching".

Problems with the sub-system of databasing are too many transactions (I/O) and the speed of getting the data and acting on it is very inefficient.

If you want to talk to me about it in more detail, message me on Twitter: @compooter or get my email at mayorpear.com

<comment><AUTHOR> Here's a question: where is all this caching taking place? I understand caching in the context of processors but not so much what you're describing.

</comment></comment><comment><USER3> With MongoDB, there's a concept called Sharding, that divides a collection based on a property in the collection the developer selects.

<http://www.mongodb.org/display/DOCS/Sharding+Introduction>

Each shard can be either a single node, or can be divided among nodes in a Replica Set for distributed reads.

<http://www.mongodb.org/display/DOCS/Replica+Sets></comment>


An act regarding the use of offensive words - <AUTHOR> https://malegislature.gov/Bills/191/H3719 <comment><USER2> It's scheduled for a hearing on the 22nd of this month, so any of you in Massachusetts who happen to be represented by him should feel free to use the rights granted to you under the First Amendment to let him (his office) know what his constituents think:

Electronic Mail: email@example.com

Actual Mail:

24 Beacon St.

Room 166

Boston, MA, 02133

Phone: (617) 722-2692

However, do realize that Massachusetts has the right to free petition, which means that legislators are obligated to put forth proposed legislation from their constituents, and that is what this falls under, apparently.

Per _The Washington Post_ :

 _In Massachusetts, unlike other states, citizens have what's known as a "right of free petition" allowing them to file proposed bills directly through their legislators. That's exactly what happened in this case, Hunt said: A woman in his district came to him this year requesting legislation, and he, in turn, filed it on her behalf. He didn't think he'd get such a harsh reaction, he said._

 _"It's funny and ironic that the constitutional provision that allows this constituent a conduit to free speech and proposing her idea has been so viscerally pushed back on by people saying this is stifling free speech," Hunt told The Washington Post. "It's important whether you agree or disagree with the legislation being proposed that you honor the duty to represent your constituents and have their voices heard."_

<comment><USER3> That right of free petition is... interesting. Is it just not well known? It seems like there's enough crazy and/or bored people out there that they could totally clog up the legislature.

<comment><USER2> Massachusetts has historically seen many questionable (and fantastic) things voted on because of it. For a better explanation of how it works, see here:

[https://massbar.org/advocacy/legislative-activities/the- legi...](https://massbar.org/advocacy/legislative-activities/the-legislative- process)

</comment></comment></comment><comment><USER4> I really dislike the B-word, but I think it's clear that the First Amendment protects its use.

That said, I wonder if an argument could be made that the B-word is a form of hate speech against a protected group (women) because it is dehumanizing (compares them to an animal in a degrading way).

In the private sphere, Facebook says it treats such speech as Tier 1 hate speech (see [https://www.facebook.com/communitystandards/hate_speech](https://www.facebook.com/communitystandards/hate_speech)) although I don't know whether it treats the B-word as qualifying. (I would argue it should, based on FB's own definition.)

Granted, hate speech is still protected by the First Amendment. So there are no legal penalties in the U.S. for using it.

But I wonder whether treating the B-word as hate speech in terms of our cultural attitude toward it might make its use less common.

<comment><USER5> > _I think it 's clear that the First Amendment protects its use._

I'm not so sure. The Second Amendment's "keep and bear arms" doesn't protect my ability to buy and keep any gun I want, regardless of how obvious a reading that seems, so I wouldn't count on the First's "the freedom of speech" to protect the use of any words.

In context, it's between the freedom of religion and the freedom of the press, of assembly, and of petitioning the government. It makes sense that it protects advocating any political viewpoint. It does not necessarily follow that it protects words in general.

The judicial history of the freedom of speech clause is mostly about political speech, speech critical of the government, etc. Advertising is heavily regulated. Copyright infringement is illegal. Lying to federal agents is illegal. Obscenity is still unprotected (though very few things are considered obscene today).

And if we look at what the framers intended, well, many of them went on to vote for the Alien and Sedition Acts (which are widely considered today to have been unconstitutional).

I think there is a lot of merit in a constitutional protection of the right to say any word. It's just not clear to me that a law preventing you from saying a single word (any word!) runs afoul of the freedom of speech clause, specifically.

</comment></comment><comment><USER6> Here's the chapter and section that would be amended:

[https://malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Cha...](https://malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Chapter272/Section53)

The first 2 subsections are broad and vague, relying on (I presume) some "reasonable person" standard to evaluate them. This proposed section seems oddly specific. It only seeks to add "bitch" as a specific violation of (a) or (b).

Not sure why "whore", "cunt", or other vulgarities aren't also enumerated.

Also, I gotta be missing some backstory here. Did Daniel J. Hunt get his feelings hurt one day outside the capital building?

EDIT: I _was_ missing something. See sibling comment on Massachusetts' Right to Free Petition. My apologies to Mr. Hunt for assuming he was the impetus for this.

<comment><USER7> There are some corkers in there.

For example, if you disturb someone in a library (Section 41) or drive quickly past a funeral procession (Section 42) you're going down for upto a month (Section 40)!

Amazing.

</comment></comment><comment><USER8> I believe MA legislators are required or at least encouraged by tradition to file Acts given directly to them by constituents. This is what is happening here. I don't think anyone in the state house has any interest in enacting this.

<comment><USER9> The rep forgot to tick a checkbox - [https://www.wbur.org/news/2019/10/24/bitch-bill- massachusett...](https://www.wbur.org/news/2019/10/24/bitch-bill- massachusetts-legislature)

</comment></comment><comment><USER10> If this passes it's definitely going to end up on one of those "Can you believe they made this stupid law?" lists.

</comment><comment><USER11> This is the result of free petition in Massachusetts. If you like the 1st Amendment, then I would expect you also like that citizens in Massachusetts have the right to propose arbitrary laws (and the legislature is not required to enact them).

</comment><comment><USER12> This doesn't seem helpful. For those who want to offend, it's easy to substitute a different word.

I'd like to hear more from people who initiated this, what were their motives and goals.

<comment><USER13> > For those who want to offend, it's easy to substitute a different word.

Words by themselves aren't even the offensive part most of the time, it's the signal of intention that someone _wants_ to offend you, that actually upsets us.

Friends call each other "bad" words all the time. Even online you can say all sorts of things in certain contexts without offending anyone. Meanwhile someone can convey their intent to upset you by just typing a "lol"

But apparently it's easier to just ban words than teaching people to not be dicks.

<comment><USER14> Right, you can't legislate intent to make someone feel bad.

Any given word can be replaced by a paragraph with near infinite variations of content but the same hurt. See /r/roastme for light examples.

If you need protection from ideas, you need to grow up instead.

</comment></comment></comment><comment><USER15> I wonder if this passes, will people substitute "Hunt" for the banned word in honor of the sponsor of this legislation.

For example: That person is a real Hunt.

<comment><USER16> So in the UK we have a politician named Jeremy Hunt. He previously held the government role of Culture Secretary. The job includes things like protecting us from Rupert Murdock's attempt to monopolise all broadcast media.

One day a few years ago the presenter of the foremost UK political radio show, Radio 4's Today Show, referred to "Jeremy Hunt, the Culture Secretary, reviewing the Murdock bid for Sky TV"... or at least that's what he meant to say.

What he actually said was something else... and then followed it with silence.

Silence slowly followed by the sound of a "serious" man in his 60s practically crying in his desperately attempts to speak without laughing... for about 5 minutes.

No one else in the studio even tried to help him lest they also be caught trying not to laugh.

That on its own was funny enough for another serious presenter in his 60s on the same radio station, about an hour later, to make light of his colleague's failure to say "Jeremy Hunt, the Culture Secretary". Except that's not what he said either... More silence slowly followed stifled crying.

BBC management issued a formal apology but to this day I'm not sure anyone really knows why.

</comment></comment><comment><USER17> If passed, no doubt people will have to switch to beyotch and biyatch and other such variants, just as every time a molecule is banned illicit new molecules appear as if out of nowhere, often with more side effects than the original. As with the internet, insults route around damage.

</comment><comment><AUTHOR> This is no joke. This is the official Massachusetts legislature website.

> (c) A person who uses the word "bitch" directed at another person to accost, > annoy, degrade or demean the other person shall be considered to be a > disorderly person in violation of this section, and shall be subject to the > penalties provided in subsections (a) and (b). A violation of this > subsection may be reported by the person to whom the offensive language was > directed at or by any witness to such incident.

<comment><USER18> Yet another reminder that Massachusetts common law has all manner of archaic crap cluttering it up, going back to the Puritans. Take a gander at the current text that this bill is proposed to amend:

> Section 53. (a) Common night walkers, common street walkers, both male and > female, persons who with offensive and disorderly acts or language accost or > annoy another person, lewd, wanton and lascivious persons in speech or > behavior, keepers of noisy and disorderly houses, and persons guilty of > indecent exposure shall be punished by imprisonment in a jail or house of > correction for not more than 6 months, or by a fine of not more than $200, > or by both such fine and imprisonment.

> (b) Disorderly persons and disturbers of the peace shall, for a first > offense, be punished by a fine of not more than $150. For a second or > subsequent offense, disorderly persons and disturbers of the peace shall be > punished by imprisonment in a jail or house of correction for not more than > 6 months or by a fine of not more than $200 or by both such fine and > imprisonment; provided, however, that an elementary or secondary school > student shall not be adjudged a delinquent child for a violation of this > subsection for such conduct within school buildings or on school grounds or > in the course of school-related events.

[https://malegislature.gov/laws/generallaws/partiv/titlei/cha...](https://malegislature.gov/laws/generallaws/partiv/titlei/chapter272/section53)

<comment><USER19> That reminds me of my favorite MA fine - $1 for the first few times you jaywalk and $2 for the 4th and subsequent instances.

Interestingly there are 2 bills seeking to make it so the fine can go up or otherwise limit jaywalking [1] & [2].

> [...] Whoever violates any provision of any such rule shall be punished by a > fine of one dollar for the first, second or third such offense committed by > such person within the jurisdiction of the district court in the particular > calendar year, and by a fine of two dollars for the fourth or subsequent > such offense so committed in such calendar year. [...]

[https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXIV/Ch...](https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXIV/Chapter90/Section18A)

[1]: [https://malegislature.gov/Bills/191/H3030](https://malegislature.gov/Bills/191/H3030) [2]: [https://malegislature.gov/Bills/191/H3283](https://malegislature.gov/Bills/191/H3283)

<comment><USER20> Those bills both appear to be free petitions submitted by constituents that have been merely forwarded by their representatives. Notably they both come from small towns far away from Boston whose opinions on "jaywalking" should probably be disregarded.

</comment></comment></comment></comment><comment><USER21> Is 'dick' still ok?

</comment><comment><USER22> there is a dangerous undercurrent here. the use of the word "bitch" "biatch" "B hatch" is strongly associated with a particular sector of society. that sector of society is very heavily marginalized already.

the problem is that a culture will normalize or marginalize interpretations of words and develop a "Dialect" and a cultural lexicon.

The punch line is that one sector of society has certain words that are offensive, while another uses those words in a daily vernaculum.

as in: " Yo i just ordered us Frings and Zah ! " replied to with, "Ohh, biatch shut the front door! "

so this would reduce to:

...to ACCOST, ANNOY, degrade demean. and that seems to translate to intent to harrass verbally. It would seem to be already covered by harrasment ordinance.

and it probably is a 1st amendment right to state that "Oh man that bitch has the sweetest ride!"

why bitch made it over buddy, guy, dude, gentleman, etc. who knows, but this concept of administratively marginalizing a culture, by making its defining properties illegal, or subject to scrutiny is concerning.

How can we and should we even, police emotional overtones of a statement. we eschew using all caps. we have emogis and emoticons to give our msgs some context, bt what comes next?

"yo mang that bitch be aight !" " hey did you just insult that guy? "

...turn around hands behind your back.

<comment><USER23> This isn't the slippery slope or conspiracy theory you're making it out to be. Search some of the top-level comments for "free petition."

</comment></comment><comment><USER24> " __Congress shall make no law __respecting an establishment of religion, or prohibiting the free exercise thereof; or __abridging the freedom of speech __, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. "

An old dusty document should settle that one quickly.

<comment><USER23> This isn't Federal congress, but I think you're basically right that through indirect mechanism (supremacy clause? I'm not a lawyer), the 1st amendment applies to states.

<comment><USER24> The 1st amendment applies to states

[https://www.law.cornell.edu/wex/incorporation_doctrine](https://www.law.cornell.edu/wex/incorporation_doctrine)

<comment><USER23> We're in agreement. Thanks for the pointer to the specific law.</comment></comment></comment></comment>


Confessions of a Binge Drinker - <AUTHOR> http://www.theatlantic.com/health/archive/2012/01/confessions-of-a-binge-drinker/251582/

<comment><USER2> There's a individual, social/cultural, and interpersonal context that a raw number threshold ignores completely.

As the writer points out, seven drinks over the course of a multi-hour fine dining experience with friends is _far_ different from a college freshman downing seven shots of tequila in his or her first hour of partying.

Other variables that matter:

* physical - weight, body fat, alcohol tolerance, fatigue, illness

* sex - men and women respond differently

* experience level - has the person ingested alcohol before in a variety of ways?

* emotional state - is the person using alcohol to self-medicate? to "get drunk" deliberately?

* social context - drinking at a social occasion is quite different from drinking alone

There are probably several other factors that a person could name.

The point is, there's no exact threshold above which red lights go on and drinking becomes "excessive" or "binge". It's a matter for the individual to judge, in a social context.

<comment><USER3> Another major change is stomach contents. It's vary different to down 7 shots on an empty stomach vs 7 shots after a full meal.

PS: 5 shots in a row classifies someone as a binge drinker. But for most people 7 glasses of wine over 2 hours results in the same level of intoxication.

<comment><USER4> 7 glasses of wine in two hours is just under one full bottle of wine an hour. That's a significant amount of wine.

edit: What I'm trying (probably poorly) to get at is that almost anyone who kills a bottle of wine in an hour knows that they're drinking heavily.

<comment><USER3> Average wine bottle 750ml average glass of wine 5-US-fluid-ounce (150 ml). So 5 glasses / bottle. Drinking 1.4 bottles of wine over 2 hours is significant, but not all that much. Assuming that's all you drink for the night AND you drank during a large meal. For example my BAC would probably peak at around .07 which is below the drunk driving limit in Virgina. (Yea, I am a big guy.)

PS: His comment was simply that 5 drinks in a short period is not exactly reasonable definition for binge drinking.

<comment><USER5> Sorry, there is _no_ way you can drink 1.4 bottles of wine in 2 hours and blow a 0.07. Sorry, but this is a huge problem and the reason there are so many people who drink and drive. If people realized they were over the 0.08 limit, they probably wouldn't drive, however, many people think they are under when they are not.

<comment><USER3> 7 glasses of wine over 2 hours ~= 6 glasses of wine in 1 hour for a reasonably healthy person. A 140 LB male drinking 6 glasses of wine ~= BAC of approximately .16. I weigh twice that .08. However, a full stomach can significantly delay the amount of time to takes alcohol to enter the blood stream. Not that I would actually drive like this, I do these calculations using the 140lb model to play it safe.

 _In a fasting individual, it is generally agreed that 10% to 20% of a dose of alcohol is absorbed from the stomach (the volume of alcohol affects the absorption) and 75% to 80% is absorbed from the small intestine. Because of this peak blood alcohol concentrations are achieved in fasting people within 0.5 to 2.0 hours, (average 0.75 - 1.35 hours depending upon dose and time of last meal) while non-fasting people exhibit peak alcohol concentrations within 1.0, and in extreme cases up to as much as 4.0 hours (average 1.06 - 2.12 hours)._ <http://www.intox.com/t-Physiology.aspx>

PS: Again, this assume 'standard' glass of wine many people poor more than twice that into a single cup and call it a glass. If your actually going to drive play it vary save and or drink beer with alcohol content printed on the label.

<comment><USER5> Being 280lbs certainly helps you out :) With that much wine, the ABV makes a big difference as well. I crunched the numbers using 12% alcohol content, 35 ounces (1.4 750ml bottles), 2 hours and 280lbs to get 0.091, so still not _hammered_ , but with 14% ABV it was over 0.122.

<comment><USER3> Sure, I prefer the 9-10% ABV side of things because they tend to be sweeter and 5ounces @ 10% = 1 standard drink equivalent so I can just use the chart. Still, I think people are pushing up the alcohol content to compensate for weighing more.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I wish the author hadn't spent so much time on 'I beat the CDC score required to binge drink, therefore it must be wrong' to get to the actual point. It made his argument seem incredibly nit-picky.

While 'the number of drinks imbibed is the wrong way to measure drinking' is an interesting point, I wish he had actually spent time discussing the actual research / anecdotes that he mentions, which should have been the meat of his article.

I usually expect more from the atlantic.

</comment><comment><USER7> > If, as the CDC suggests in a new report, binge drinking leads to violence, > spread of sexually transmitted diseases, unwanted pregnancy, and risky > behavior, then why am I doing just fine?

Because these studies never apply to 100% of the subjects.

<comment><USER8> That is his point. He is saying that while the generic definition of binge drinking [X drinks in Y time] shows an increase in those problems, it does not paint anywhere near the whole picture. Instead, he argues, a more important factor is the context in which those drinks are consumed and this context should have the most importance.

</comment></comment><comment><USER9> The point being made, although not very clearly - as I read it: It's not the drinking, it's the drinker. We all know people who are 'nasty drunks' and we all know people who behave just fine, even after a full night of drinking.

Drinking enhances your emotions. If you're emotionally unstable, getting drunk could well lead to an outburst of feelings and depending on how well you can manage your expressiveness, lead to ill-advised sexual encounters or violence.

If you're emotionally in balance, chances are you can keep that balance getting drunk.

There are probably health issues to drinking too much, but fixing social issues by throwing a blanket maximum number of drinks indiscriminately over everybody.

</comment><comment><USER10> So, I made a little web app for fun, that could consider trying next time you're drinking. It's dedicated to all of you who, like myself, get to a certain point in the night and then cannot stop drinking more.

<http://www.drinkpacer.com>

unfortunately once I get into this state I also stop using the app.. so... it's a work in progress :)

and yes, native android/ios apps are planned :)

</comment><comment><USER11> The point of this article has less to do with drinking than people realize. It has to do with his establishments. They promote binge drinking, and the CDC discourages binge drinking, so he has to find a way to reconcile this to his very white, very educated patrons who also read the Atlantic.

</comment><comment><USER12> Seven drinks in four hours, at a nice restaurant with friends? Of course he didn't get into a fight.

</comment><comment><USER13> Though I didn't kill or sleep with anyone - I regret last night right now.

</comment><comment><USER14> Confession of the binge drinker who wrote this article: I don't understand statistics, or why anecdotes aren't the same thing as data.

Up next from this genius: "I smoke but I don't have cancer, so suck it, ALA!"

<comment><USER15> Yeah, complaining about the CDC's definition just make him sound like someone trying to cover up a problem. Maybe he doesn't have a problem with alcohol, but it's possible to read this essay as "I drank too much at least 4 times last month, and take the opportunity at events to get shitfaced, but I'M FINE."

FD: I have had a binge or two myself in the last month, I'm just not impressed with this article.</comment></comment>


Ask HN: Review my app / startup: Yobiz - <AUTHOR>

Hi all - I posted this a week or so back, but it fell off the radar before I got responses. So, not sure what the protocol is here, but thought I'd resubmit -- I hope that's the right thing to do!
We are just launching a new application focused on solving some of the lingering problems in e-Commerce inventory management.
Specifically, if you are selling products on multiple online stores (as I was) or are selling products online and offline, then managing inventory is a real pain in the asymptote.
Yobiz eRetail Inventory, Pick-and-Pack, and Ship are for small to medium size online / e-Retailers that want to centralize inventory in one place that is then sync'd with a number of online e-commerce platforms and Quickbooks.
It also provides some insight into actual packing and shipping costs so you know the true profitability of your shipments and allows to you track your packing supplies so you don't run low at the last minute.
Right now, we're offering a trial/alpha but haven't launched the app yet as we're still looking to have conversations with more online retailers so that we make sure to build the right things in the right ways. We are more concerned about building too MUCH stuff than too little.
Feedback, comments, criticism, guidance, suggestions, questions encouraged --
You can find the app at http://eretail.yobiz.com/ips (www.yobiz.com redirects there, for now) <comment><USER2> I like the page, very clean and tells me what you're trying to solve. The video was a nice intro and looked very professional; I really like when product landing pages have a video as it really embraces the "don't make me think" paradigm. My only nitpick is with "pick & pack." Is that an industry phrase? If so, I'd capitalize it: "Inventory, Pick & Pack, and Ship without the hassle or the cost. Otherwise, I'd just say "pack" as the "pick & pack" thing made me thing there were multiple products, one for Inventory and another for Pick & Pack.

Just out of curiousity, how many guys are working on this app? It looks fairly polished for just entering alpha.

<comment><AUTHOR> Thanks! We appreciate the feedback. Yes, Pick-and-Pack is a term, but it might be too industry wonkish -- we are experimenting with other headers.

This might be hard to believe, but it's just two very experienced developers / SaaS people working on this plus a contractor or two as needed. But just 2 for now. We'll need to expand soon when this takes off (notice I didn't say _if_ ).

</comment></comment><comment><USER3> I'm not really sure what this product does, even after watching the video. At first, I thought it was a place I could send all my items from different sites to a central location.. and then, everything would be ship at once. But, then, I was able to view all my inventory, see stats about different things, compare prices...? I'm a bit puzzled.

Everything looks quite clean and is very easy to navigate.

You might want to take a look at how dropbox does it. Even thought there are lots of features, they show mainly the most important ones in the first video.

<comment><AUTHOR> Thanks -- good feedback. I guess we need to do a better job identifying the target customer. This is for online retailers (not their customers) to manage their inventory. It's particularly tough if they are selling in multiple places and have limited inventory. This adds functionality that their ordinary e-commerce apps don't have. We'll make sure that the site clearly identifies that this is for the retailers, not the customers.

</comment></comment><comment><USER4> I think it looks great, but I'd test if it converts better with the Free Trial button above the fold (most likely by removing or shrinking the header).

</comment><comment><USER5> Clickable: <http://eretail.yobiz.com/ips/index.php>

<comment><AUTHOR> Thanks - not sure why it didn't resolve to a clickable link above.

<comment><USER6> URLs in submissions don't get parsed into links. From the FAQ:

      Don't abuse the text field in the submission form to add commentary to links. The text field is for starting discussions. If you're submitting a link, put it in the url field. If you want to add initial commentary on the link, write a blog post about it and submit that instead.

</comment></comment></comment><comment><USER7> great landing page. video is very well done. I think there might be a small css bug, the "Join us on facebook" link is on a new line <http://i.imgur.com/MG6Y7.png> edit: i'm on chrome (mac)

<comment><USER8> On Safari 5(mac) the Facebook link is not visible. <http://imgur.com/VkMdm.png>

<comment><AUTHOR> Thanks for pointing that out! We just fixed that - hopefully should be visible on Mac Safari and also Chrome</comment></comment></comment>


Orion's Arm Universe Project: Collaborative Hard Sci-Fi Worldbuilding - <AUTHOR> https://www.orionsarm.com <comment><AUTHOR> From the about page:

What is "Orion's Arm" you might ask? That is an excellent question, and in a nutshell here is your answer: Orion's Arm is:

The next step in the evolution of science-fiction

A collective hard science fiction world building endeavor

A space opera

A communal background for science fiction stories

A universe ready to be brought to life through illustration

A forum for cutting edge science

A roleplaying setting

A transhumanist projection of what the future might look like

A bunch of semi-sane sentients having fun together

Why are we here? The answer to that question can be found in our Statement of Purpose:

Our purpose is to inspire writers, artists and thinkers. To create a vision of the future that is plausible at every level, internally consistent and abides by the accepted facts and theories in the physical, biological, and social sciences. We embrace speculative ideas like Drexlerian assemblers, mind uploading, posthuman intelligence, magnetic monopoles, wormholes and the technologies, and developments that will make all this possible.

To quote Arthur C. Clarke's Second Law:

The only way to explore the limits of the possible is to venture a little way past them into the impossible.

Our task is to create an ever evolving universe that is interesting, inspiring and provocative - to theorize on a future that may, or may not, come to be.

<comment><USER2> Replace "Orions Arm" with "Star Citizen" for chuckles.

</comment></comment><comment><USER3> The technology page at [https://www.orionsarm.com/eg- topic/45b175dbc0d73](https://www.orionsarm.com/eg-topic/45b175dbc0d73) is worth skimming for anyone who is interested in posthuman sci-fi. Much of the exotic tech on their is based on realistic (but highly speculative) physics. The site also has a good list of physically plausible megascale engineering: [https://www.orionsarm.com/eg- topic/45b5645097563](https://www.orionsarm.com/eg-topic/45b5645097563)

<comment><USER4> I love the hard-sf in there.

However there are some weird things, like these Dyson-megastructures, that are polyhedral and thus not equidistant to the gravity center:

[https://www.orionsarm.com/eg- article/4670a60a449d5](https://www.orionsarm.com/eg-article/4670a60a449d5)

Would it not be unstable? Gravity pull and thus orbital velocities would be wildly different at different points of the segments...

I wonder if I can bring the project to "harden" their SF, if this is truly collaborative...

Or, at least, if there are discussion pages where they can convince me of the existence (at this point in future) of suitable techs rendering the megastructure viable ;)

</comment></comment><comment><USER5> If you are interested in this, you might also be interested in Atomic Rockets / Project Rho [1]

[1] [http://www.projectrho.com/public_html/rocket/](http://www.projectrho.com/public_html/rocket/)

<comment><USER3> Project Rho is an amazing site with completely horrible navigation. It taught me as much rocket science as Kerbal Space Program, but every time I visit it, I can never find what I want on the table of contents (bottom of the page) and have to search the site. It has some nice sections like this page on pre- electronic computers and nomograms: [http://www.projectrho.com/public_html/rocket/astrodeck.php#i...](http://www.projectrho.com/public_html/rocket/astrodeck.php#id --Computers--Slide_Rules)

</comment></comment><comment><USER6> Be aware of their terms & conditions:

b. By visiting the Site, joining Orion's Arm, or initiating Communication via the associated Discussion Groups, you agree to be bound by Section I of these Terms ("General Terms").

The contents of this Site are protected by United States copyright law, international conventions and other applicable laws. All Content and material submitted to, or otherwise created for, Orion's Arm is the copyrighted property of the original Contributor(s). Any use of any of the Content on this Site other than for private, non-commercial viewing purposes is strictly prohibited.

<comment><USER7> This seems to contradict this:

>Our purpose is to inspire writers, artists and thinkers. To create a vision of the future that is plausible at every level, internally consistent and abides by the accepted facts and theories in the physical, biological, and social sciences. We embrace speculative ideas like Drexlerian assemblers, mind uploading, posthuman intelligence, magnetic monopoles, wormholes and the technologies, and developments that will make all this possible.

Just looking at anything on that site means that if you happen to use any similar ideas you're at risk of violating copyright. It seems kind of like the same reason why none of the dolphin emu Devs can even look at the nintendo leak. You'd have to then prove your ideas are original and not lifted from Orion's arm.

</comment></comment><comment><USER8> Interesting, but "hard sci-fi" with traversable wormholes seems questionable. Why not have Alcubierre warp drives too if all that's required is a theoretical physics paper and a thousand years of engineering progress? :)

</comment><comment><USER9> Really good stuff here, I love the Archailects bits the most. Kind of reminds me when SCP used to be good before it was inundated by Dr. Soandso self- inserts.

<comment><USER10> The setting really allows for some fantastic stories: \- There's a story about a world where the local archailect forbids all non-animal power sources for some reason, but high tech itself is still allowed. This leads to hyper- optimised tech like computer-stabilised bicycles on metal rails that have so little resistance they get up to hundreds of km/h. \- The "rebuild nanotech civilisation from scratch" reality TV show where a group of people gets dropped naked onto an uninhabited planet and have to work their tech level high enough up to get back to orbit, kinda like factorio but as a game show. The current record is 72 years, set by a group of superhumans who gene- engineered themselves to need less food and no sleep. \- The whole sub-genre of humans who don't trust the ruling AIs and build their ships to be invisible against the background radiation of the universe.

And so many more. Highly recommended.

</comment></comment><comment><USER11> I grabbed an archive of the Orion's Arm mailing list a while back: [https://diyhpl.us/~bryan/irc/yahoo- groups.orions_arm.2000-20...](https://diyhpl.us/~bryan/irc/yahoo- groups.orions_arm.2000-2013.zip)

</comment><comment><USER4> Damn I love that!

I only feel the future itself is going to be properly astonishing... Even in the mid term...

Nevertheless I just crazy love science-fiction, so, thanks for this project!!!

Btw I see that not just as a fiction works, but as an exploration of the evolution paths for our real future as well, so that's just as important as real science.

That's our compass for science and technological progress.

</comment><comment><USER12> This is so incredibly cool. We need more imagination and storytelling. This is exactly right - awesome.

</comment><comment><AUTHOR> There is an active forum and also a Discord server!

[https://www.orionsarm.com/forum/showthread.php?tid=3500](https://www.orionsarm.com/forum/showthread.php?tid=3500)

[https://discord.gg/gcBKANv](https://discord.gg/gcBKANv)</comment>


Ask HN: What will coding look like in 10, 25, 50, 100, 1000 years? - <AUTHOR> How do you think professional programming will change in the short term and as x approaches infinity?<p>I'm thinking in terms of [The Clean Coder](https://www.amazon.com/Clean-Coder-Conduct-Professional-Programmers-ebook/dp/B0050JLC9Y), but if you're not familiar, feel free to use your own metrics. <comment><USER2> In some distant future, people writing code will be seen as dangerous. Few will know how. Some of them will be weaponized.

Agents will deliver on requests and factor problem sets and assist in solutions. We get augmented and assisted.

Computer code will be something basic, a useful, but guarded infrastructure.

Biological systems and tools will be like code is today, only humans will be assisted by these agents, large bodies of code from days of old. Mastery of biological code will prove an order or two more complex than any computer, Turing code will. Vast numbers of proteins, emergent properties, effects...

Emergent tools will be artifacts of our work today. We will not fully understand them, and they will be guarded much like some very specialized things are today. We know what they do, but why is an area of intense, and also closely guarded study.

Think current AI trained and performant, but not well understood. It will be like that.

People using rogue tools will be criminalized. Integration of code, these emergent agents and biotech will raise the stakes very considerably.

Bugs, virii will literally have death and major environmental consequences. Basics like networks are robust, ubiquitous and very well guarded due to their necessity. Few will hold keys. Rogue agents are hunted, employed or killed.

There is a fiction book I like which speaks to some of this.

The Bohr Maker

There are others. Anyone want to toss recommendations out there?</comment>


Difference between open source and closed source - <AUTHOR> https://utopia.fans/blog/whats-the-difference-between-open-source-vs-closed-source/ <comment><AUTHOR> At least all the questions found its answers</comment>


Why open source developers are burning out: No respect (2017) - <AUTHOR> https://www.techrepublic.com/article/why-open-source-developers-are-burning-out-no-respect/ <comment><USER2> This is why everyone in the public eye who isn't a shock jock is burning out</comment>


Now there's a platform that people can see the world from different perspectives - <AUTHOR> http://paradict.com <comment><AUTHOR> Paradict aims to create cultural area in a dictionary format that come together people around the world

</comment><comment><AUTHOR> And it is going to be exclusive environment, unlike urban dictionary. We are waiting for your feedbacks !</comment>


Show HN: Plyr.io – A simple, accessible and customisable HTML5 media player - <AUTHOR> http://plyr.io

<comment><USER2> That's the first HTML5 video player that I've come across which instantly loads in fullscreen. Every other player has a lag. Do you know why that is, what did you do differently?

I'm out of sync with HTML5 video news, do we finally have a single file format for all browsers (without requiring hardware support for the codec) or are websites still required to host webm, ogg and mp4?

</comment><comment><USER3> One small issue. When I change the volume the element appears to wait for me to let go of my mouse button before altering the volume. I'd expect the volume level to change as I'm dragging the range element.

It'd also be nice to get the progress bar to display how much video has buffered.

Good work.

</comment><comment><USER4> Does everything it needs to, and looks great.

</comment><comment><USER5> Nice one Sam!</comment>


Show HN: Alive - Live Programming for C# - <AUTHOR> http://comealive.io

<comment><USER2> This is really cool stuff! Is it built using Roslyn?

</comment><comment><USER3> It looks kind of like the InstaRepl in LightTable.

<comment><AUTHOR> I think the main difference is that Alive can run any piece of code you unit test. This means we can run code dependent on state.

We're hoping thus makes it easier to read and modify code written by others.</comment></comment>


How do I move from finance into tech? - <AUTHOR>

Hi.  I have an EE degree from a pretty good/well-known engineering school, but I've long since forgotten everything EE related as I went into finance right after school.  Part of that finance career involved a couple years of scripting work, but that's now past as well.  How does one move from finance back into tech? Thanks. <comment><USER2> If you are interested in going the route of an entrepreneur/start-up founder, an interesting place to begin would be to explore where these two fields converge.

Ask yourself questions like:

What kind of new technology could improve the world of finance?

What technological tools did you wish you (or your company) had during your career in finance?

Or you could apply your skills in finance to financing technological enterprises. Perhaps look for a job at a VC firm that focuses on tech investments. You could learn more about technological enterprises on the job there, and see where in the tech world you might like to branch out to next.

<comment><AUTHOR> Thanks for your response. I'm not in a position right now to start a startup however. My career in finance has not allowed me to build up a substantial nest egg (curse those student loans). A VC firm also sounds impossible to get into. I'm pretty low on the totem pole at work - not exactly gordon gekko here. I do think about those two questions quite a bit actually (nothing concrete yet).

My question was a bit broader than that. There's the possibility I could sharpen back up my development skills and go the route of trying to be a software engineer. My friends in development tell me I would be good at it. If that is indeed true, what are some good ways to show the world that?

Also, what other routes are there? Coder and VC - are those it? Or are there lesser known paths?</comment></comment>


small bug in YC application (sorry, dont know where else to post this. Feature Request is for News.YC) - <AUTHOR>

<comment><AUTHOR> If your application has quotes, they are escaped each time one submits. They should be escaped only once. From my application: \</comment><comment></comment><comment></comment><comment></comment><comment> They can 'squeeze more juice' from

</comment><comment><USER2> Similar bug with submission headlines existed. I believe that was also fixed.

</comment><comment><USER3> It's also with apostrophes. It might be fixed by now though.

<comment><AUTHOR> No, it is still not fixed. Double quotes is fixed, not single quotes.</comment></comment>


Ask HN: Twitter feed format - <AUTHOR>

Can the twitter entries for HN also include the link to the discussion page? In fact I would prefer the short url to be to the discussion page on HN - rather than the article.<p>Possible? Others feel the same? <comment><USER2> It's not an official feed, but here's one that I've been hosting for a while. <http://twitter.com/HNComments>

<comment><AUTHOR> Thank you

</comment></comment><comment><USER3> Couldn't you use the rss feed?

<comment><AUTHOR> on my android my favorite way to follow news is twitter feed. That is where I would like this as I can quickly link to the discussion (which has a link to the article).

I dont find myself using rss as much. twitter nicely encasulates divergent interests - cycling, tech, eff, economist, local blogs, etc

I could approximate it with rss feeds but twitter has been good for this</comment></comment>


Node.js Internals and Powerful Non-blocking I/O Libraries - <AUTHOR> http://blog.zorinaq.com/?e=34

<comment><USER2> I liked this post for the comprehensive list of internals - before reading I only knew v8 and libev were part of node.js.</comment>


CoffeeScript Tricks - <AUTHOR> http://dev.hubspot.com/blog/coffeescript-tricks?h <comment><USER2> One of my favorite tricks is how naturally mixins can be implemented (scroll to the bottom): [http://arcturo.github.io/library/coffeescript/03_classes.htm...](http://arcturo.github.io/library/coffeescript/03_classes.html)</comment>


Don't use JSX - <AUTHOR> https://medium.com/@iofjuupasli/don-t-use-jsx-9568d9414778 <comment><USER2> I just read another post on Hacker News yesterday saying that JSX is the Bee's Knees

[https://medium.com/javascript-and-opinions/state-of-the- art-...](https://medium.com/javascript-and-opinions/state-of-the-art- javascript-in-2016-ab67fc68eb0b#.a846jsvjf)

>JSX is awesome. You get all the power of JavaScript and its tooling when writing your markup.

<comment><AUTHOR> > JSX is awesome

Article is about trends

> You get all the power of JavaScript and its tooling when writing your > markup.

This is just not true

</comment></comment><comment><USER3> It's not exactly news that HTML is verbose. I just like having the HTML I'm writing look like HTML. It's a fairly minor thing, and I wouldn't particularly mind using a different syntax, but on the whole I find it a bit easier to work that way.

<comment><AUTHOR> DOM and HTML is different things. Are you sure that you write HTML when you use React? HTML is one of the ways to build DOM. But not the only one.

In very dynamic parts of site JS is better, which is the case for React.

But even for static parts, HTML is just familiar way to describe what should be displayed. I don't see anything wrong in use js syntax for that. Especially when js is used under the hood.

<comment><USER3> This is a pretty trivial issue of a preference for one syntax over another. I'm not really interested in arguing about it. I personally find it useful to be able to use HTML syntax.

</comment></comment></comment><comment><USER4> I'd rather go with the flow, with built-in support from Babel and other workflows, etc.

</comment><comment><USER5> Interesting.</comment>


Multiplayer in-browser GTA clone in JavaScript - <AUTHOR> http://bad.city/

<comment><USER2> Not a bad effort! Actually playable to an extent minus the network lag. Only gripe is, once you figure out where your mouse needs to be in order to shoot accurately, all I had to do was move around and spam the shoot button. Started getting kills across the map.. Fun. Cars on the other hand.</comment>


More than 1MM Facebook accounts exposed  - nico-roddz https://www.google.com/search?q=bcode%3D&oq=bcode%3D&sugexp=chrome,mod=0&sourceid=chrome&ie=UTF-8#q=inurl:bcode%3D%5B*%5D%2Bn_m%3D%5B*%5D+site:facebook.com&hl=en&safe=off&prmd=imvns&filter=0&bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&fp=8c0bb27d33614e56&bpcl=37189454&biw=1560&bih=698 <comment><AUTHOR> My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put protection in place to reduce the likelihood that anyone else could click through to the account.

For a search engine to come across these links, the content of the emails would need to have been posted online (e.g. via throwaway email sites, as someone pointed out - or people whose email addresses go to email lists with online archives).

As jpadvo surmised, the nonces expire after a period of time. They also only work for certain users, and even then we run additional security checks to make sure it looks like the account owner who's logging in. Regardless, due to some of these links being disclosed, we've turned the feature off until we can better ensure its security for users whose email contents are publicly visible. We are also securing the accounts of anyone who recently logged in through this flow.

In the future if you run into something that looks like a security problem with Facebook, feel free to disclose it responsibly through our whitehat program: <https://www.facebook.com/whitehat>. That way, in addition to making some money, you can avoid a bunch of script kiddies exploiting whatever the issue is that you've found.

<comment><USER2> The URLs don't need to be posted online. Some browsers (Chrome, possibly Firefox with Safe Browsing mode, very likely any browser with a Google Toolbar installed) send visited URLs to Google and they will be indexed. I don't know if this is officially documented by Google, but several people have reported seeing this while testing new/beta websites that weren't published or linked anywhere.

<comment><USER3> an old meme, and my usual recommendation: just test it: create a page that i not linked from anywhere. visit it with the browsers mentioned above. watch the logfiles. wait for it. nope, no googlebot request. it is unbelievable easy to test, i have done so on various occasions in the past, so there is no need for you to spread a "several people have reported" rumor. just ... test ... it.

as for the old stories, that google does this kind of thing: people, especially SEOs or people who think they know SEO, always blame google. oh, my beta.site has been indexed, it must be because of ... google is evil.

most of the times i have seen cases where googlebot found a not published yet site it was because of (just some examples, not a complete list) i.e.:

* turned on error reporting (most of the PHP sites) * the URLs were already used in some javascript * server side analytics software, open to the public * apaches shows file/order structure * indexable logfiles * people linked to the site * somebody tweeted about it * site was covered on techcrunch (yes, really) * all visited URLs in the network were tracked by a firewall, the firewall published a log on an internal server, the internal server was reachable from the outside * internal wiki is indexable * intranet is indexable * concept paper is indexable

testing your hypothesis "chrome/google toolbar/... push URLs into the googlebot discovery queue, which leads to googlebot visits" is easily testable. no need to spread rumors. setup for testing this: make an html-page (30 seconds max, basically ssh to your server, create a file, write some html), tail & grep logfiles (30 sec max), wait (forever)

<comment><USER4> It is a myth that is hard to get rid of. No one wants to admit they tweeted out a link to the dev website.

Though I recently found this on the Google+ FAQ: [http://support.google.com/webmasters/bin/answer.py?hl=en&...](http://support.google.com/webmasters/bin/answer.py?hl=en&answer=1140194)

      When you add the +1 button to a page, Google assumes that
      you want that page to be publicly available and visible in
      Google Search results. As a result, we may fetch and show
      that page even if it is disallowed in robots.txt.

I can understand adding a +1 button to a dev site, and then not understanding why it shows up in the index.

</comment></comment></comment></comment><comment><USER5> Facebook's privacy settings have a ton of bugs. Here's another one: 1\. Make a stupid status update post. 2\. It appears in all your friends newsfeed. 3\. You realize you said something stupid and private. 4\. Panic. Delete post 5\. Breathe sigh of relief that it is no longer showing up in your profile. 6\. But wait a minute! It still keeps showing up in all your friends newsfeed. 7\. Now that you deleted the post, you can't even modify it's visibility settings. Heck you can't even get to the url. But all your friends continue to see the post in their newsfeeds

So the way facebook implements a delete of any activity(status post/like/comment) is that the owner stops seeing it but everyone else keeps seeing it. That is simply the most retarded delete implementation ever!

<comment><USER6> to be fair,

cache invalidation is hard.

<comment><USER7> And naming things.

<comment><USER8> Together with off by one errors, they're the two hardest things in computer science...

<comment><USER9> Yes, the three hardest things in Comp Sci are cache invalidation and off by one errors.

<comment><USER10> Don't you mean the 10 hardest things?

<comment><USER11> I think he means the 11 hardest things actually.

<comment><USER9> 10 in ternary (which I think was his part of the joke)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Weird. I clicked on one of the links and it asked me if I was that user, and, if so, that I should click the login button. When I did, it logged me in as that user.

Edit: This happens for multiple users.

Edit2: It looks like if you click on the link, it automatically expires. bCODE is "an identifier that can be sent to a mobile phone/device and used as a ticket/voucher/identification or other type of token." I'm guessing somehow these tokens (the ones that auto log you in) never got used, plus the old ones were saved and contain email info. Not sure how Google could have gotten them though. Probably just got accidentally listed, despite robots.txt.

<comment> nico-roddz It's really weird.

<comment><USER13> how? I am unable to replicate this bug

</comment></comment></comment><comment><USER14> Here's one theory and analysis of what might have happened. Some people's emails got out into the public internet, and were indexed. Some of these emails were from Facebook, and included links to resources that require login. These links pre-populated the username field for convenience, or in some cases auto-login the user. Facebook's engineers probably did not anticipate email notifications to users being crawled by Google. Live and learn, eh?

But could Facebook have done something to prevent or minimize the damage caused by these leaked emails?

1\. Lets start with the auto-login links, as those are the scariest. Do those links use one-time-use tokens, and do the tokens expire? If either or both of those steps was skipped it makes this leak much more serious, and speaks to negligence or disrespect for user security. If Facebook has both of those security measures in place, though, they did all they realistically could. If somebody lets their private email get indexed by Google (seriously, though, how does that even happen??), that's their own problem.

2\. The other class of leaked urls link email addresses to Facebook profiles. This isn't as immediately scary, and for a lot of people it wouldn't even matter. But it is easy to imagine scenarios where this kind of privacy would be important to someone, and this kind of leak would be just as scary as someone being able to log in as them. Frankly, I never would have thought of securing this, and I doubt Facebook did anything to secure it. Going forward, though, it would probably be worth it for them to link auto-username- populating through one-time-use, expiring tokens as well.

So, it looks like Facebook probably got hit with a bizarre edge case privacy / security issue. There are likely things they could do to make their system more resistant to this kind of thing, but at the same time they probably didn't do as badly as this might make them look at first glance.

Again, this is speculation, any confirmation or disconfirmation would be great.

<comment> nico-roddz This is how everything started:

A friend forward me an email from a FB group notification

Something like:

<http://www.facebook.com/n/?groups%[id> here]%2Fpermalink%[id here]%2F&mid=[id here]&bcode=[id here]-mjoi&n_m=[email adress here]

When I clicked the url I got automatically logged into my friend's account.

So is definitely a Facebook security issue.

Then I tried some google searches to see if I could find some urls containing the parameters:

bcode= &email= n_m= mid=

Not a big deal, really.

<comment><USER15> Thanks for catching this nico-- looks like it's been removed from Google.

<comment> nico-roddz You're welcome!

</comment></comment></comment></comment><comment><USER16> Okay, I've been through all the comments and I'm going to try to summarize:

\- It looks like in some situations, Facebook will send an email that has a link. That link expires after a certain amount of time, but in the mean time, clicking that link lets people access that Facebook account.

\- A large number of services can be set up to automatically post any email received onto the web. One major category is disposable email services such as asdasd.ru. Any email to a throwaway account on asdasd.ru gets put up on the web. Here's an example Facebook recovery email that got turned into a web page: <http://asdasd.ru/read/414831>

\- Once these emails are just webpages, it's no surprise that search engines discover those URLs. Note that this is not a Google-specific issue. When I search on Bing for the query [site:facebook.com bcode n_m mid], the first result is also one of these urls that has an email address embedded in it. For a debunk of the misconception that this is related to the Google Toolbar or Chrome, see my post elsewhere in this discussion at <http://news.ycombinator.com/item?id=4733276>

So: an email gets sent to someone. That email gets put up on the web as a webpage. Search engines (including both Google and Bing) find that webpage as they follow links on the web.

<comment><USER4> I tried Bing and Yandex to find the email bodies. They didn't return many results (but they do return results).

[http://www.bing.com/search?q=%22wants+to+be+friends+on+Faceb...](http://www.bing.com/search?q=%22wants+to+be+friends+on+Facebook%22+%22If+you+don%27t+want+to+receive+these+emails+from+Facebook+in+the+future%22)

When I try on Google to find the email bodies, I get 250k results, of which the large majority are on blogspot.com sites.

While mail bodies can be found on a few other sites, like the asdasd.ru example, and other search engines have found these links too, the main issue still seems to be with blogspot.com -- These aren't throwaway accounts with public inboxes, but likely some virus that is intercepting certain mails (Facebook, Twitter, Youtube, Twoo) and reposting them as a blogpost for everyone to see.

As Blogspot is Google-owned, this does seem to me a predominantly Google- specific issue.

<comment><USER16> No, Blogger also has a feature that will automatically post messages sent to an email address. Here's an example email from Facebook that was posted to a blogspot.com url: [http://weight-loss- information-123.blogspot.com/2012/08/misb...](http://weight-loss- information-123.blogspot.com/2012/08/misbaul-hussain-wants-to-be-friends- on.html)

If you look at the bottom of that Blogger post, it says "This message was sent to <a gmail address>." So an email from Facebook got posted as a web page to this blog.

There's no need to suspect some virus that's intercepting emails. Plenty of people have set up their systems such that email messages get turned into web pages.

<comment><USER4> You are probably right and I apologize for any misinformation. To me it seemed strange that the blogs first started spamming, followed by publishing only certain emails. Wouldn't it make more sense if all emails were published, not only from certain webservices? Why would a user want to publish their private Facebook emails in the first place? None of these accounts posts normal updates, they act compromised.

</comment></comment></comment></comment><comment><USER17> Thank you for exposing this. Much appreciated. Here's one more - The last time I checked, Facebook revealed 'what you liked' to search engines like Google. For example, if you search for your name inside double quotes like this - "Your Name" you will see your name listed virtually on every single page you liked, for example, If you had liked Sony's Facebook fan page, then your name would appear in the search results something like this - "[Your name] and 8 others like this"

That's strange because I did tell Facebook under my account settings NOT to list my profile or my name on Search engines.

To summarize - So be careful with what you 'like', because it really just takes a Google search to find out your interests. This could (potentially) be a problem if you are actively seeking employment (and if you had 'liked' some crazy stuff) or if you have a crazy girlfriend.

</comment><comment><USER18> Common misinterpretation on how Google handle `Disallow` in robots.txt

Q. If I block Google from crawling a page using a robots.txt disallow directive, will it disappear from search results? [1]

robots.txt Disallow does not guarantee that a page will not appear in results: Google may still decide, based on external information such as incoming links, that it is relevant. If you wish to explicitly block a page from being indexed, you should instead use the noindex robots meta tag or X-Robots-Tag HTTP header. In this case, you should not disallow the page in robots.txt, because the page must be crawled in order for the tag to be seen and obeyed.

[1] [https://developers.google.com/webmasters/control-crawl- index...](https://developers.google.com/webmasters/control-crawl- index/docs/faq#h17)

<comment><USER19> We develop and host a bunch of extranets, which without login consist of your typical authentication page. We put a _robots.txt_ file there, and the only sites that link there are our customers companies home sites.

Google still indexes them. The definition of "relevant" here defies my wildest imagination.

<comment><USER20> robots.txt is not about indexing. It's about crawling.

</comment></comment></comment><comment><USER21> Large number of login emails seem to be from asdasd.ru domain. Googling one of these emails I find a site that resembles a public inbox with emails from Facebook in it, like this one - <http://asdasd.ru/read/414831>.

</comment><comment><USER22> You are able to post on blogger via email. If you register with this blogger- email-address on facebook, all facebook notifications are published as blogger posts and indexed by Google. Actually this might be a used to circumvent a firewall preventing you from using facebook. You can search for the leaked email addresses on Google and propably find blogger blogs with facebook notifications posted.

</comment><comment><USER23> I'm somewhat curious, why MM for million/mega and not M? Or does the second M stand for some unit?

<comment><USER24> The Roman numeral M (mille) means 1000. M^2 therefore equals one million.

<comment><USER23> If that's truly how people use it, it is very strange. In actual roman numerals MM = 2000. Using 'M' as a roman numeral but then multiplying digits makes no sense at all (you'd need numerals for all the prime numbers to represent arbitrary numbers...).

And in SI, the prefix 'M' (mega) already means 1 million, so to me it seems MM is the notation that maximizes confusion.

<comment><USER25> I totally agree - there's not a roman numeral justifaction for it at all and it's very confusing in normal situations. My understanding is that it comes from financial (specifically trader) jargon and I suspect it probably originated to differentiate it from some other use of "m", but don't know for sure... Maybe someone else knows why it arose?

</comment></comment></comment></comment><comment><USER26> More than 1 millimeter Facebook accounts exposed?

<comment><USER27> Millimetre is mm, not MM which would be "meter meter" which is nonsense. MM is actually the roman numeral for 1 million.

<comment><USER23> Capital M would be 'mega' as a prefix, but I think it does not exist as a unit. If you're willing to read MM as Mm, then it would be Megameter.

Your really should revisit roman numerals. MM = 2000, you have to add them, not multiply.

<comment><USER27> Good point. So it turns out that MM is supposed to mean "thousand thousand" in the world of finance, but it is indeed not a correct roman numeral. Old school.

</comment></comment></comment></comment><comment><USER28> A large number of the emails are from 'blogger.com'. Aren't google and blogger one in the same? Are the urls being crawled because google is reading its emails and crawling contained urls?

</comment><comment><USER29> You think this is bad. Try doing the following google search:

"password" filetype:csv

<comment><USER30> I'm sure lots of people have had unwanted encounters with Google's crawlers, but here's mine: I used to have a subdomain pointing to my home IP which was protected using Apache htpasswd. I naively had all of my clients' credentials stored in text files (conveniently named credentials.txt). Somehow I accidentally removed the htpasswd authentication and it was publicly exposed for a day or two. Of course Google indexed it and you could view everything in Google's cache.

There was a process for removing content from Google, but it took a few months to get completed. I never told anyone and I'm pretty sure all that info is now purged (I've tried to find it multiple times and it doesn't seem to exist anywhere).

I also downloaded a WoW guide that I had temporarily thrown up on one of my servers and forgot to take down. Like a year later I randomly was running a Google image search for 'Northrend Map' and happened to notice my site was the THIRD image. At first I thought it was a personalized search result, but I checked from multiple other places and it was still there even though there were zero inbound links.

</comment></comment><comment><USER31> What is the meaning of the square brackets in the Google query syntax? I could not find any official documentation.

<comment><USER32> They don't seem to do anything. Searching without the brackets seems to give the same results for me.

[https://www.google.com/search?q=inurl%3Abcode%3D*%2Bn_m%3D*+...](https://www.google.com/search?q=inurl%3Abcode%3D*%2Bn_m%3D*+site%3Afacebook.com)

</comment></comment><comment><USER33> Looks fixed.

<comment><USER34> not fixed here, i can access (private?) infos from people i dont even know, scary.

<comment><USER35> Yeah? Proof?

</comment></comment></comment><comment> nico-roddz [http://translate.google.com/translate?sl=es&tl=en&js...](http://translate.google.com/translate?sl=es&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Fnicoroddz.com%2Fagujero- de-seguridad-en-facebook-permite-acceder-a-perfiles-sin-siquiera-pedir- contrasena%2F&act=url)

</comment><comment><USER36> I'm only getting one result at the moment... what did I miss? Did Google censor the results?

</comment><comment><USER37> I don't understand how these pages could have been crawled - could someone enlighten?

<comment> nico-roddz It's seems that Facebook uses robots.txt to block this pages

<https://www.facebook.com/robots.txt>

But, depending of the amount of inbound links, Google will index the urls anyway.

It's a common issue.

<comment><USER37> Google ignores robots.txt if the number of inbound links is > N?

Also - any speculation as to how so many sites were lining to peoples login pages?

</comment></comment></comment><comment> nico-roddz For the curious. Google results before patch:

[http://nicoroddz.com/wp-content/uploads/2012/11/google- faceb...](http://nicoroddz.com/wp-content/uploads/2012/11/google-facebook- leak.png)

<comment><USER38> 0,120x800,160x600,160x800;tile=3;ord=1043435364?

</comment></comment><comment><USER39> What is the MM quantifier?

<comment><USER40> I think it's just meant to mean "million" but it's used a lot in the VC/startup community in valuations (" _CompanyX_ receives $10MM in angel funding" etc). I think it has come from finance originally, but either way I think it's unnecessary.

</comment></comment><comment><USER41> Can someone give write a summary on the exact issue ? Was it that people's FB accounts were accessible through an auto-login link ? Also, I only see one result returned, and not 1 million.

</comment><comment><USER42> This is insane. That's why I use the <https://mypermissions.com> plugin, so these types of things do happen to my Facebook...

</comment><comment><USER43> Smart! You can extract the emails from result URLs :) param = n_m

</comment><comment><USER44> I wonder if this is the source of the Facebook data leak ("I just bought more than 1 million Facebook data entries") last week?

<comment><USER45> If you read that original article, they were harvested from a 3rd party Facebook App. <http://talkweb.eu/openweb/1819>

</comment></comment><comment><USER46> Google patched this , search results with emails no longer available.

</comment><comment><USER47> Seems like Google have already pulled these results. That was fast.

</comment><comment><USER48> saw couple of email accounts, though clicking on the links logged me out

it seems more of what google crawled and stored, another possibility could be illegally via cookies for ads or analytics

</comment><comment><USER49> I don't see anything except results for "bcode"

<comment><USER50> When I click on a link I see another person's email address in the login box. I assume it's a facebook user's email.

See these two examples :

[http://www.facebook.com/login.php?next=http%3A%2F%2Fwww.face...](http://www.facebook.com/login.php?next=http%3A%2F%2Fwww.facebook.com%2Fn%2F%3Fprofile.php%26id%3D100001456572036%26mid%3D6fa41a9G5af3e5dcfef2Gae3ee8G96%26bcode%3DtKss9DeN_1.1351631995.AaTwYn8dLQ56MqMZ%26n_m%3D987654i%2540asdasd.ru&email=987654i%40asdasd.ru)

[http://www.facebook.com/login.php?next=http%3A%2F%2Fwww.face...](http://www.facebook.com/login.php?next=http%3A%2F%2Fwww.facebook.com%2Fn%2F%3Fphoto.php%26fbid%3D361719993917155%26set%3Da.115623531860137.28715.100002374734257%26type%3D1%26mid%3D6e9f28dG5af3c735c4fbG0G109%26bcode%3DKYQ4O9gF_1.1350563168.AaRdixP- iiqGCuph%26n_m%3Dlachatelaine.baroque%2540mail2.blog.fr%26lloc%3Dphoto_image&email=lachatelaine.baroque%40mail2.blog.fr)

</comment></comment><comment><USER51> Can someone explain this to me?

<comment><USER52> Yeah, me too. I think I got to this too late to understand what's going on here :)

</comment></comment><comment><USER53> i think it was really great work done by facebook team.

</comment><comment><USER7> What exactly was exposed here. It looks like it's been blocked now...

Just stealing from other bit in this thread: somehow these urls got on the Internet even though they shouldn't have. They are pre-authed urls that auto- login and then expire.

<comment><USER54> Seconding this... I see just ordinary account numbers from here.

<comment><USER55> Still exposed here - when you click a link, it pre-fills the login box with a users email. And I guess some of the links include auto-login tokens.

<comment><USER54> Oh, OK. I can see the mails too, I just didn't think it's such a security risk.

</comment></comment></comment></comment><comment><USER56> This whole Facebook (lack of) privacy thing just keeps getting better and better, doesn't it?

</comment><comment><USER57> 1 million million? You mean a trillion?

</comment><comment><USER7> I'm interested to speculate on how to best mitigate:

delete all bcodes? Ask Google for a full list of results, regex and a delete statement? Disable the bcode login and then re-ask the question?</comment>


Wind jvm: A JVM written in C++ - <AUTHOR> https://github.com/wind2412/wind_jvm <comment><USER2> It's neat some folks are still interested in JVM implementations from scratch, and I'm sure the author had fun / learned a lot in the process. I doubt it's meant to be practical (? is it?), and I personally wouldn't make some of the style choices here from a code style perspective, but to each her/his own.</comment>


The strangest Google search result I have ever seen - <AUTHOR> Search for "swiftui combine image download" limited to the past 24 hrs. There are thousands of entries, most on websites not devoted to programming, and all forward to hard coded IP addresses. Many have .it and .pl (but also others) domains. The search snippet appears to be useful information but clicking on the link forwards to the IP addresses. I have no clue what's going on. This seems like a weird hack, or Google is having some strange issue. <comment><USER2> This was probably published by automated content generation tools.

<comment><AUTHOR> To random urls that google indexed and then clicking on them went to a dead IP address. Most of the domains themselves are dead (one should a huge page of Tiktok text).</comment></comment>


Ask HN: What is your favorite StackOverflow question? - <AUTHOR> <comment><USER2> This answer [1] is my favorite as it resonates with many work/life experiences.

[1] - [https://security.stackexchange.com/questions/33470/what- tech...](https://security.stackexchange.com/questions/33470/what-technical- reasons-are-there-to-have-low-maximum-password-lengths/33471#33471)

</comment><comment><AUTHOR> I like the graphic examples in this question (besides the obvious attempts at answers): [https://stackoverflow.com/questions/1050222/what-is-the- diff...](https://stackoverflow.com/questions/1050222/what-is-the-difference- between-concurrency-and-parallelism)

</comment><comment><USER3> At first look I tougth it was brainfuck but it's valid JavaScript:

[https://stackoverflow.com/questions/7202157/why-does- return-...](https://stackoverflow.com/questions/7202157/why-does-return-the- string-10)

</comment><comment><USER4> You can't parse [X]HTML with regex. Because HTML can't be parsed by regex.

[https://stackoverflow.com/questions/1732348/regex-match- open...](https://stackoverflow.com/questions/1732348/regex-match-open-tags- except-xhtml-self-contained-tags/)</comment>


Neil Young Says the MacBook Pro Has 'Fisher-Price' Audio Quality - <AUTHOR> https://www.theverge.com/2020/1/28/21091655/neil-young-podcast-vergecast-interview-phil-baker-book-pono-hi-res-audio <comment><USER2> _That's what Steve Jobs told me. He told me that exact thing: "We're making products for consumers, not quality." So they don't want audio quality. They don't want to spend a lot of time on that._

Tyranny of the minimum viable user.

[https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyr...](https://old.reddit.com/r/dredmorbius/comments/69wk8y/the_tyranny_of_the_minimum_viable_user/)

<comment><USER3> In the form factor given for a macbook, I'm not sure anything could be done to truly satisfy the true audiophile. It's almost easier not to try since adding $100 to the cost of the system won't add $100 of value for 99% of the people and still won't satisfy the other 1%.

<comment><USER2> Young's specific gripe was DAC conversion.

Given external mics are already being used for capture, that should be a small HW/SW requirement, and a generally solved one.</comment></comment></comment>


Banking, trade and taxation is at work decimating our entire country right now. - <AUTHOR> http://www.megrobertson.com/post/8708219865/dylan-ratigan-mad-as-hell-his-epic-network-moment

<comment><AUTHOR> The entire quote:

"We've got a real problem…this is a mathematical fact. Tens of trillions of dollars are being extracted from the United States of America. Democrats aren't fixing it, Republicans aren't stopping it — an entire integrated system, banking, trade and taxation, created by both parties over a period of two decades is at work decimating our entire country right now."

<comment><USER2> That hardly seems worth posting as an article. I don't think you're clickfarming, but this is pure linkbait. Also. Ratigan's shouting doesn't make him any more persuasive. I'm really tired of this staged debate passing itself off as TV news.

<comment><AUTHOR> The part about setting up a governmental bank to lend directly to business seems relevant. And the part about congress being bought reminds me of the patent discussions here.

Edit: ignoring his presentation, do you disagree with what he says?

<comment><USER2> Yes, for a few reasons. Sure, I think money has had a corrupting influence on Congress, to the point of regulatory capture of legislatures by business in many cases. But:

\- It's misleading to just say everyone in Congress is bought, as if tall legislators were equally corrupt. This discourages analysis rather than promoting it.

\- while I think an infrastructure bank is a good idea and should have been implemented back in Spring 2009, the idea that the President can just bring one into being by fiat is laughable.

\- particularly a President that ~20% of the electorate entertains wild conspiracy theories about.

\- it was said of Teddy Roosevelt: 'You must always remember that the President is about six.' I feel the same way about the emotional maturity of people who wish the President would solve problems by thumping a bully pulpit or swinging a big stick. Not that I'm endorsing Obama's apparent passivity in the face on Congressional instransigence; he puts me in mind of Taft, another well-meaning but unworldly executive.</comment></comment></comment></comment>


Show HN: Ever wondered what's that icon on your colleagues's computer? - <AUTHOR> http://whatsthaticon.com <comment><USER2> I've got more icons in my bar than you've got on your website. You could just scan a few "favourite menulet" pages[0] to bulk add stuff, should take a small amount of time.

Here's some content for you [http://snpy.in/nNlirJ](http://snpy.in/nNlirJ) in order: Caffeine, DragonDrop, Keyboard Maestro, 1Password, Hazel, Snappy, DayOne, aText, f.lux, Dropbox, Mail Notifr and then the standard OS ones.

You can probably find 100 more just on first page of google.

Maybe changing your site to something like "menulet database.com" and collect them like that would have a stronger audience though (I know I'd be first i line).

[0] There used to be blogs dedicated to this very thing in the past.

<comment><AUTHOR> Thanks for the feedback and the screenshot! Yes, there are only a few icons on the site currently, I just wanted to show the concept and get feedback before I put more effort into that.

I haven't even heard of the term menulet, will look into this.

</comment></comment><comment><AUTHOR> Author here. When I'm at a meeting and a colleague of mine is presenting something I often wonder what's that app they have in their menu bar. But I rarely ask because I don't want to interrupt the presentation and by the end of it I usually forget.

So I put together this simple page listing a few apps. For now it's macOS only and only has a few icons. Any comments?

</comment><comment><USER3> A thousand years ago when people installed stuff.</comment>