Stack Overflow: Defend PHP - convince me it isn't horrible - <AUTHOR> http://stackoverflow.com/questions/309300/defend-php-convince-me-it-isnt-horrible <comment><USER2> These topics always just smell of "Now I'm a grown up programmer I'm going to tell the world how much I understand by slamming an easy target language".

I love PHP and have used it for years since moving away from asp.net and agree with some of the posters arguments as a theoretical principle, but as day-to- day PHP developer I also say so what. Naming and parameter inconsistencies? Yes, my libraries have that too and I can at least learn the PHP ones with some experiernce. I don't know any asp.net developer that doesn't have to use some kind of tool to help them find where System.Obscure.FoundItOnline.Function exists in the monster .net namespace system. It allows me to be productive and allows me to be the gatekeeper of how well or poorly I implement things. This is a crucial point of the constant argument about poor PHP logic/presentation support for me, I can happily write mixed and messy code for a £500 job or I can write some clever system that implements caching and output buffer manipulation and have a great template system.

There are far too many people spending far too much time thinking that academic level programming considerations are applicable in every detail to every day programming practices of web developers.

<comment><USER3> Agreed. Fwiw, many of the complaints apply to other "better" languages also:

\- _PHP has inconsistent naming of built-in and library functions._ \- C has types like int, size_t, jmp_buf and FILE

\- _PHP performance is abysmal without caching_ \- MRI Ruby is pretty slow too

\- _Functions are case insensitive_ \- Lisp anyone?

etc etc

The whole meme of PHP warts seems more like an exercise in confirmation bias than objective analysis.

<comment><USER4> Yeah, but if we continue that logic and fill up that "etc etc" it would seem that the other languages have their own bad features and PHP combines them all.

<comment><USER3> That "all" is what I'm referring to when I mentioned confirmation bias. PHP programs don't segfault when you have a typo. You don't have macro expansion problems. It's not particularly verbose. Most languages have a ton of issues. Imho, the stuff in the PHP list is pretty minor compared to some of the warts in some other languages.

</comment></comment></comment></comment><comment><USER5> I'm spending most of my time maintaining a web application consisting of around 150k lines of PHP code. We (well - initially, it was just me) began development back in 2004 but since then the application has grown constantly.

Back in 04, I already felt some reservations against PHP, but that's what I knew best and that's what was most used for the web (Rails might have been around, but not really known - other ruby options were not quite there yet. Python I disliked and Java I. don't. touch.).

The application was written in PHP5, initially developed on some RC of 5.0.0 and I was careful to keep a clean style and not using deprecated code.

This lead to a quite clean application that I could really be proud of. And still: While it has suffered from sometimes not quite reasonable customer demands, it's still very good at what it's doing and while there might be some dead bodies rotting in the code, it's nowhere near daily WTF material (aside of some bugs we have a good laugh at and fix shamefully).

Still. I have some bad gripes with PHP that made me stop doing anything new in that language.

I can easily live with the usually quoted problems though:

\- parameter order in library function? I don't care - my IDE lists them.

\- Huge base library? I don't care as the stuff I don't need doesn't cost me anything but disk space and the stuff I do need, I'm glad is there.

\- No namespaces? Yeah. Bit me a couple of times, but I can work around that - besides, with 5.3 we got namespaces, so this doesn't count any more

\- Performance issues? It's fast enough for said application.

\- Security? It's just as secure as any other language you can write insecure code in (i.e. all of them).

\- Allows intermixing of layout and code? Sure, but you don't have to. If you have _any_ sense what so ever, all requests go through a central /index.php and all other code is in some not-publicly accessible location and emits no html what so ever. All output is generated using any of the thousands of templating libraries.

What really disturbs me about PHP is its type conversion rules. 1 == '1' or even worse 'foobar' == 0, or '123n' == 123. This is cause for so many subtle bugs.

Just use === you tell me? Sure, but then you clutter your code with an insane amount of isset()'s and isint()'s and whatnot - the fact that the database library I'm using (pgsql) returns everything as strings doesn't help that cause either.

The other thing is the really clumsy syntax. Array literals, anonymous functions, closures (with explicit declaration of all variables of the outer scope you want access to), operators, even just the lack of named function parameters. The syntax is clumsy and all the elegant code you see even from JavaScript just gets bloated and unreadable once you port it to PHP.

These two issues made me do stuff in Ruby, Python(3) and lately a lot of Node.js, but the maintenance of that huge application remains to be the main part of my day-job and even though the two issues really bug me, it's still not painful enough to really be complaining (or, heaven forbid, port the thing to whatever-other-language-thats-currently-hip).

So in retrospect, while I'm as die-hard a PHP user as you can get with many, many lines of PHP under my belt and while I do find some of the stuff highly enjoyable (php's arrays that are also ordered hashes for example. Or the really easy and accessible web-server/HTTP integration), I also dislike it quite a bit to the point of being unwilling to start something new in PHP.

<comment><USER6> _It's just as secure as any other language you can write insecure code in (i.e. all of them)._

That may be true; I've only developed two half-serious projects in PHP a while back. But given the amount of XSS and injection vulnerabilities we're seeing daily, I think that something is wrong with those web development guys. PHP is admittedly a widely used tool and I can't help but wonder: " _Could it be just the language? Is there a possibility things would be better if PHP was abandoned?_ ". Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language).

<comment><USER7> _Is there a possibility things would be better if PHP was abandoned?_

Nope. Beginning coders write vulnerabilities until they're otherwise educated. In PHP these are SQL injection and XSS holes. In C they're buffer overflows.

 _Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language)._

Education is feasible for any language. Some segment of the programming population will always remain uneducated -- laziness or apathy on their part -- but this doesn't mean education doesn't work.

<comment><USER6> You mean to tell me that in a world where anyone could take up on any programming language and start writing code on one's own, properly educating that someone is feasible?

Please. This isn't 1960 anymore. Code is not written by "scientists" exclusively anymore.

</comment></comment></comment></comment><comment><USER8> The real advantage of PHP is deploy-ability.

If you choose mod_perl, mod_python, JSP, or most of the classic environments you need a sysadmin to take care of the web server... It's going to crash from time to time, run out of memory, and otherwise make trouble for you.

PHP's mode of integration with the prefork Apache web server is almost trouble-free... It's such a big difference that there could be a "blub" factor here... People who program in other environments often have a really hard time believing that a large fraction of the sysadmin activities that they are doing just don't need to be done if you're running PHP. (You can go five years and never "kick Tomcat", something that some shops have to do every 5 hours).

That said, scaling comes to play here. For a small company or for a company that's doing a number of small projects, the cost of system administration that comes with other programming environment matters a lot more than it does for a big company. It's not such a big factor for a company like Facebook.

On the other hand, PHP forces people into a "shared nothing" model that scales well and ~eliminates~ a wide range of concurrency-related problems that are endemic to thread-based backend apps. For instance, quite often I've seen a race condition in an ASP.NET app and had everybody on the team swear up and down that there's no shared state, then I spend a few hours looking at the app and there's a static variable that nobody knew was there.

Another strength of PHP is that it has a very complete library that's largely correct. The PHP team is much more honest about what works and what doesn't work than a lot of others (PHP and Python have the same problem with threads, for the same reason -- PHP says "don't use them", Python says "jump in the water is fine".) If you program in some weird-o language like Haskell you'll probably have to write your own urldecode function and you'll probably be so busy thinking about higher-order functions you won't pay attention to details... Like making it work right. (Perl has a broken urldecode function in CPAN FOREVER)

Don't get me wrong, there's plenty to hate about PHP; but try to get some real work done in environment X and you'll find plenty to hate too.

</comment><comment><USER9> I'm not a PHP advocate, but I'll take this one:

 _PHP encourages (practically requires) a coupling of processing with presentation. Yes, you can write PHP that doesn't do so, but it's actually easier to write code in the incorrect (from a sound design perspective) manner._

The ideal web application is the one that best fits the unique characteristics of the data being manipulated. When exploring how a web app should work, you _should_ be thinking at all levels: view, controller, model. A framework that forces you to separate all three from the start is a bad framework. It pushes you toward generic data manipulation forms and reports. If those generic tools are the best ones for the data model being manipulated, why involve a programmer at all?

We would have much more interesting and varied web applications out there if the prevailing "wisdom" of MVC would die.

<comment><USER10> > When exploring how a web app should work, you should be thinking at all > levels: view, controller, model.

And separating those aspects programmatically makes it _easier_ to think about them, not to mention program the ideas that occur to you when thinking about them separately.

> If those generic tools are the best ones for the data model being > manipulated, why involve a programmer at all?

If intertwining essentially unrelated ideas is the best way to write programs, why use high level languages at all?

MVC--just like garbage collection, just data abstraction, just like most other high level languages features--is about modularity and separation of concerns.

> We would have much more interesting and varied web applications out there if > the prevailing "wisdom" of MVC would die.

How do you reconcile this with the fact that there occurred a veritable _explosion_ of various interesting web applications when MVC was (re)discovered by the webdev crowd?

<comment><USER9> The explosion you speak of is sites making better use of JavaScript, a movement that took off with the launch of gmail in 2004. Paul Buchheit talks about the thinking and communication that created gmail. He doesn't mention MVC; he talks a lot about rapid prototyping. He shares some of his then- current thinking in the form of a single 600-line source file. Read the post: [http://paulbuchheit.blogspot.com/2009/01/communicating- with-...](http://paulbuchheit.blogspot.com/2009/01/communicating-with- code.html)

EDIT: HN discussion: <http://news.ycombinator.com/item?id=444615>

</comment></comment></comment><comment><USER11> I think this is the wrong approach. The guy should try to convince me that PHP is bad. That PHP has never not did what I wanted it to do. That I need to invest time and switch to some other language because it's better for my needs and purposes, and the switch will quickly get me to a level of expertise that I have with PHP now.

The fact of the matter is PHP is ugly and that's really it. I can live with ugly because I know it and it does everything I've ever asked it to.

Frankly, it's no different than me switching from English because it has quirks.

<comment><USER6> _The guy should try to convince me that PHP is bad._

It goes both ways: he has tried to do certain things with PHP and made his life miserable; you've done certain things with PHP that made your life easier.

Telling each other which is which will let the one know what to avoid and the other one what's he doing wrong.

Anyway, it's about time we started thinking and being more mature than 'my language is better than yours'. Which is why I hate all similar postings and articles which aim to enlighten me On the Amazing Features Of Language X (or the opposite).

</comment></comment><comment><USER12> This debate reminds me a lot about another debate about language. When I studied English in college, I occasionally came across papers enumerating the weaknesses of the English language. It's terrible for writing poetry, because you can't rhyme like you can with Italian or seduce like you can with French. It's difficult to learn, because of irregularities in spelling and pronunciation.

Now that I'm a PHP developer, the response I give when people ask me why I use PHP and not a "real language" is the same one I would give if someone asked me why I speak English. There are more people who speak my language. If I travel to a remote fishing village in China, chances are I can find one person who speaks English. Try to find someone who speaks Italian. When I'm working on a web project, I know that if I write it in PHP I can find hundreds of developers to hire at a reasonable price versus hunting around for Ruby developers (who cost double).

At my day job, we run 200 websites, and 194 of them are written in PHP (1 is Java, 2 are .NET, 1 Ruby, 2 Coldfusion). When the company buys sites, the first step is converting them to PHP (if they aren't already), just so future maintenance is easy and cheap.

</comment><comment><USER13> To be honest I don't think case insensitivity is really that much of an issue. Common Lisp is case insensitive as well and I have never had any problems with that.

<comment><USER14> They could have made it fully case sensitive, or fully case insensitive... but they went for the confusing middle point:

      foobar() == FOOBAR()

but

      $foobar != $fooBar

And then there was that fun issue with the Turkish locale and function names...

</comment></comment><comment><USER15> Actually, I think the depreciation point is one of the better points. Yeah, sometimes clean up is necessary, but when a language is a moving target like that, it raises serious concerns about portability and long term maintenance.

<comment><USER16> But the PHP guys had told us about the deprecation of pass-by-reference years before it was deprecated. I think that's a really good argument _for_ portability and long term maintenance.

It they would've simply changed it over night, I'd have problems.

</comment></comment><comment><USER17> No one ought to convince anyone of anything.

Use it yourself and keep using it for as long as you like it. When you stop liking it, stop using it.

That doubles as a recipe for learning any new thing.

</comment><comment><USER18> I wish I could ignore PHP, but it's just so darn ubiquitous. Most webhosts priced within the means of "normal" people have PHP, while far superior (IMO) platforms like ASP.NET are the exception. Until webhosts can be convinced to support a wider range of platforms, I fear humanity will never be freed of the bonds of PHP.

Bill, hates PHP with the heat of a thousand suns.

</comment><comment><USER19> Personally, my distaste for PHP centers around the fact that there are so many developers pumping out crappy PHP code for $20 / hr.

I don't need to compete in a race to the bottom.

</comment><comment><USER20> From a programming language perspective, PHP is somewhat horrible (PHP 5.3 less so, but still). I guess nobody will deny that. But from practical perspective, PHP is very suitable tool for many tasks and has huge ecosystem behind it. Complex real-world websites and applications have been successfully built with PHP. Isn't that proof enough?

Do you consider yourself a purist or pragmatic? In the latter case, PHP may be worth dating for a while.

<comment><USER18> "Complex real-world websites and applications have been successfully built with PHP."

Thanks to PHP or in spite of PHP?

<comment><USER20> :-)

Seriously, I like the photographing analogy: "Wow, what a photo you have taken! You must have really good camera?"

A programming language is rarely the limiting factor. Skillful programmer may benefit from advanced language, but mostly it's about knowing your tools and the bigger concepts, regardless of the language. Try yourself and learn to master something you like most. (My current choice being Python.)

</comment></comment></comment><comment><USER21> It's a little pointless to defend PHP to someone who thinks it's horrible.

That's like asking someone to defend a religion. A waste of time and energy.

In a good programmer's hands, the results will be good, regardless of language or platform choice.

Sure, you can argue the finer points until you're blue in the face, but in the end, the only thing that should matter to your "customer" is that the solution satisfies his/her needs.

</comment><comment><USER22> I'm wondering, as a fairly inexperience programmer with most of my time in PHP: is there any good reference for "How to start web development in ___ with previous experience only in PHP". I would love a tutorial that explained how to accomplish in another language all the things that PHP makes simple for newbies. I'd also be totally willing to help an experience person develop such a tutorial.

</comment><comment><USER23> "There are more useful systems developed in languages deemed awful than in languages praised for being beautiful--many more." -Bjarne Stroustrup

</comment><comment><USER24> PHP is great if you need to get some small thing up and running yesterday. PHP is also great if an out of the box solution will almost fit the bill due to the fact that there are so many. Just take a box and do some small modifications, voila, done!

<comment><USER16> ...or big thing running yesterday, right? Take Facebook for an example.

To me, Facebook seems like a pretty complicated piece of software. The concept isn't very complicated but there are _so_ many features all over the place.

<comment><USER25> He didn't say you _can't_ use PHP for such things, he said PHP is "great" for getting smaller sites built quickly. It's possible to build very large apps with PHP alone, if you like, but there are other solutions I think are preferable. Most of them weren't even available when Facebook was born.

For example, I would rather build a Facebook-sized app in Rails than a PHP framework, especially with Rails 3's new features. There are some very capable PHP frameworks out there, but you'll still end up writing much larger models and a lot more code than if you were using Rails.

<comment><USER26> Rails would get you started on Facebook app quicker, but then you'd be forever fighting the framework to do things outside of it's core abilities. For something as large as Facebook, that will be all the time.

</comment></comment></comment></comment><comment><USER27> php is a tool. it has its benefits and its drawbacks. you shouldn't have to "defend" the language itself, but you should be able to defend your choice of language. if you don't like a language, go use another one.

</comment><comment><USER28> Facebook and Wikipedia.

</comment><comment><USER29> PHP may be one weird concoction, that's for sure, but all of the arguments brought up by this guy - and this is the exact same boring song belched out whenever there's an argument of "PHP is a terrible language" - fall into the category of vanity, because no matter how one twists and turns these points they still really don't make the language itself terrible, and they don't make PHP one bit less capable, nor one bit less adequate for the supposed job.

<comment><USER30> What do you mean?? Do you have any idea of just how many programmer hours have been wasted by the absence of features, just how insecure so many web apps are due to the weird casting system and lack of safety-oriented features.

My impression is that people who claim PHP has not cost them development time have simply never looked at alternatives that solve many of the problems.

<comment><USER29> Without going off on a limb, I'm guessing you're a not too experienced developer. You comment as if instead going for Perl, Ruby or ASP inherently makes an application safe, saves buttloads of manhours etc. And you're wrong. Gravely wrong.

Excluding the obvious issues caused by bugs that are a natural part of any programming language's development, security problems are not caused by the language chosen, but by the developers themselves.

<comment><USER31> A well designed language or library can decrease the likelihood of specific bugs, and especially security problems. Imagine the existence of a library which made it easier to use SQL placeholders than to concatenate user input into a string. Imagine PHP without register globals.

<comment><USER29> PHP already does that via PDO. PHP's "Register globals" was deprecated exactly one year ago, in 5.3.0.

<comment><USER32> That was exactly chromatic's point---language design and features _do_ make a difference.

<comment><USER29> It's always easier to blame the tool for your failed craft than it is to be a good programmer, isn't it :)

Putting PHP in the "inadequate corner" or trying to convince oneself that it is lacking in features is just an easy excuse.

<comment><USER31> _It's always easier to blame the tool for your failed craft than it is to be a good programmer, isn't it :)_

Do you object to the attractive nuisance doctrine?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> To answer to the topic of the post - why should I (or anyone else for that matter) bother trying to convince the author that PHP isn't horrible.

If the author does not think that PHP is suited for his/her needs then he/she should not use it. There is a plethora of programming languages out there - pick and choose.

The post has a disconnect between the title and the content. The author does not want to use PHP and tries to outline the flaws in the language from his/her own view. Sorry to disappoint, but I disagree with those points. I use PHP amongst other programming languages and I use it only when it suits my needs and the needs of my project. It is not perfect but then again nothing is.

Final thought for the article would be a paraphrase of its title as a reply:

Defend 'behaviour'. Convince me it isn't spelled horribly - correct spelling 'behavior'.

I think you get the point :)

<comment><USER34> My friend Anthony Lewin and I were Macintosh salespeople back in the Dark Times when Jedi Master Jobs was in exile. People would walk in to the store and ask the same question:

        Convince me: Why should I buy a Mac instead of a PC?

Anthony quickly learned not to feed the trolls. He would say "I don't know. Why _would_ you buy a Mac instead of a PC? Most people buy PCs. What's so special about you that you need what a Mac has to offer?"

The genuinely curious would explain about their graphics needs or what-not, and Anthony would go from there.

I think of Anthony when I see questions like this. My response back to the OP is to ask _Why should you use PHP? What's so special about your situation that you need it?_

<comment><USER35> Doesn't this fit more appropriately the other way around?

"I don't know. Why would you use a language other than PHP? Most people use PHP. What's so special about you that you need what another language has to offer?"

In your example, the PC is the inferior but nearly ubiquitous (and easier) choice. Isn't that the position PHP is in as well?

</comment></comment></comment><comment><USER36> Drupal, Joomla, Wordpress, phpbb, vbulletin, invision power board:: Together they are 99% of online communities + personal websites. If you want to use any of them. Then it is php.

I may not particularly like PHP, but to deliver projects in reasonable time, you may have to leverage PHP</comment>


There are too many video games. Now what? - <AUTHOR> https://www.polygon.com/2018/9/28/17911372/there-are-too-many-video-games-what-now-indiepocalypse <comment><USER2> What I can't figure out is why stores make it so hard to _find_ any of these games that supposedly exist.

Now, a substantial amount of space is devoted to _pre-orders_ : games that can't even be played yet!!! How does that help the games _currently_ for sale?

There are lots of positive feedback loops: advertising only the top 10 keeps them (shockingly!) in the top 10 seemingly forever. And the categories suck...why should _anyone_ care which games have made the most money, especially when some in-app purchase lists seem scammy as hell?</comment>


Launching Aragon Court - <AUTHOR> https://blog.aragon.org/launching-aragon-court/ <comment><USER2> Aragon is why I left the crypto space, their bias is (un?)believable given the message they purport to uphold. Maybe now that there is a dispute channel outside of leadership, bastet can get its day in court¿

<comment><USER3> I'm with you. I took 6 months off crypto/ eth community after going to the Aracon one conference and seeing trust fund babies drowning in VC money talk about "freedom".</comment></comment>


I charted my progress learning DVORAK every day for a year - <AUTHOR> http://lifebyexperimentation.com/2013/08/learn-dvorak/?

<comment><USER2> As someone who has used the Dvorak layout for over 15 years, and loves it, it's my impression that the biggest reason people don't learn it, is because they don't know what they are missing. But dvorak is so much nicer, it was well worth the annoying first couple of weeks.

Another common misconception is that people fear that they will for some reason "unlearn" Qwerty, which is not the case at all. In fact, after this many years, for me it is easy to look at a qwerty layout, with the actual layout on the OS set to Dvorak, even while typing.

The best thing about learning dvorak is how it taught me things about how the brain learns concepts, autonomously. For example, I remember how, after an hour of practice, I went to do something unrelated, and every now and then I became conscious of how my brain was still processing the previous hour of practice. So I would see images in my mind's eye of pressing letters on the dvorak layout.

I also noticed how smoothly I started to type dvorak in the beginning of a practicing session, and, after a while, seemed to become more frustrated because the number of mistakes increased as time progressed. That made me realise that I should stop practicing when that moment of frustration would hit me, and then "let my brain take over from here". Then, once I stopped, there came the images, letting me know that the brain was still processing what I was trying to teach it.

It took me about a month of practice and the better I became, the more natural dvorak started to feel. Now I can type on both qwerty and dvorak, although qwerty does make me realise every single time, how bad that layout really is, in comparison. But what's also fun is that the brain seems to associate layouts with the actual computer -- if I was typing on a school computer, I'd start typing in qwerty without even realising it. Then, when I came home and continued behind my own PC, I continued in dvorak.

So for me, the most important thing that made me continue practicing it, was that this experience of learning dvorak in itself was already a lot of fun. It taught me how awesome the brain is, especially if you don't force it to do what you want with a timeframe in mind - learning dvorak at a speed that was good for me, and letting the brain carry on without "me" forcing it to become better, is how I learned more about how the brain is able to program itself with newly introduced concepts.

<comment><USER3> > But what's also fun is that the brain seems to associate layouts with the > actual computer -- if I was typing on a school computer, I'd start typing in > qwerty without even realising it. Then, when I came home and continued > behind my own PC, I continued in dvorak.

I've noticed the same thing, but on a smaller scale: I use a Mac at work, but a PC at home. I have the same keyboard model (a Logitech wireless) in both locations. When I type on the Logitech model on the PC at home, I find myself hitting Alt (which is mapped to Cmd on my Mac) when I mean Ctrl. However, I don't have that problem when I use my PC laptop. It's interesting how the brain makes those associations.

<comment><USER4> I had a similar experience. When I went to France I bought a laptop, they only sell them with AZERTY layouts. Now, at work they had a QWERTY keyboard for me. Without realizing it I could write in AZERTY at home and QWERTY at work without any problem whatsoever.

The difference between both layouts is not that big, but enough to be felt.

</comment></comment></comment><comment><USER5> At least for programming, it seems like predictive typing, Intellisense, templates, etc, negate the advantages a given keyboard might provide compared to a regular typist. Emacs or vi bindings contribute a lot to keystrokes type.

<comment><AUTHOR> Perhaps... but even for a programmer, I'd submit that there's still plenty of "regular communication" (emails, slack/gchats, etc.) which would benefit from higher WPM.</comment></comment>


Rails Presenters: filling the Model-View-Controller gap - <AUTHOR> http://www.inspire.nl/blog/rails-presenters-filling-the-model-view-controller-gap/

<comment><USER2> If you're interested in using presenters with Rails, the draper gem is worth a look: [https://github.com/drapergem/draper](https://github.com/drapergem/draper)

<comment><USER3> Thanks for the link! I'm happy to answer any questions about Draper or presenters as a strategy in Rails apps.

</comment></comment><comment><USER4> Presenters are awesome (I second the that draper is excellent).

Once you start decorating you find yourself decorating everything, because Ruby makes it so easy to throw on one-off delegates. I've even taken a presenter-ish approach to all my DCI implementations now and my model code is really clean.</comment>


Dark Social: We Have the Whole History of the Web Wrong - <AUTHOR> http://www.theatlantic.com/technology/archive/2012/10/dark-social-we-have-the-whole-history-of-the-web-wrong/263523/ <comment><USER2> It's called "social web" for a reason.

Instant messenger and chat rooms and ICQ and USENET forums and email are not web. At most the OP is talking about the history of the Internet.

{The World Wide Web (abbreviated as WWW or W3,[2] commonly known as the Web), is a system of interlinked hypertext documents accessed via the Internet. <http://en.wikipedia.org/wiki/World_Wide_Web>}

<comment><USER3> Pedantically speaking, Usenet and email at least are part of the web. They aren't http-based, but the "web" is really anything with addressable URIs, and both usenet and email have well-defined URI formats, eg:

      nntp://<host>:<port>/<newsgroup-name>/<article-number>
      mailto:<user>@<domain>

<comment><USER4> You can't really like email documents or accounts to each other, so I don't think they're part of the "web" of connected pages.

<comment><USER5> You can link nntp news articles.

</comment></comment></comment></comment><comment><USER6> I was just saying to someone that we had IM on IBM mainframes (the chat facility) or the (confusingly named) Ethernet on DEC VAXes back in the mid 80s.

What we used them for was 'are you going for tea?' and other social chit-chat between the various terminal rooms up the Uni...

<comment><USER7> I just discovered the 'kibitz' command on linux, which is basically remote desktop assistance for linux (well, remote terminal). Apparently, this is used for chatting quite often too (i.e open up a text editor).

EDIT: screen can do this too! screen -x can attach to a non-detached screen session.

<comment><USER8> Can't you just use talk(1)?

</comment></comment></comment><comment><USER9> This is one of those topics where you have to be careful not to slip into meaningless semantics where you're just arguing about how we should use some word and what things should be named.

</comment><comment><USER10> By their logic the "dark social" is ANY inbound link not coming from "Facebook, Twitter, Reddit, YComb, Digg, Stumble" or do I get that wrong? If so, well, that is called the "Internet". It uses hyperlinks to send people between pages on it.

<comment><USER11> No, it is any inbound link to a page unlikely to be typed manually "blah.com/articles/random/crap/article-title-goes-here/35487623", that has no referrer header at all. Traffic coming from other websites will still have referrer headers, just traffic from email, IM, etc don't.

<comment><USER12> I believe any referral traffic from an <https://> site will NOT send the referrer header. It does not seem like the article is taking that into account.

<comment><USER11> He did mention that, but of course there's no way to figure out how much of that traffic is from https referrals. Of course, I wouldn't be shocked if 90%+ of https referrals are from gmail, which would put it right back to what he is assuming: email, IM, etc.

<comment><USER13> You make a pretty good point, but not just gmail. Pretty much all -mail providers use https when users access their web interface.

</comment></comment></comment></comment></comment><comment><USER14> Oops, someone (the author) forgot about AOL, which was founded in 1985 and began mailing floppy disks to people in 1993 (<http://techcrunch.com/2010/12/28/aol-floppy-disk/>). That is when and where I had my first social web experience (it was in an AOL chat room, specifically). The company and the "social web" boomed from there, so much so, in fact, that eventually AOL bought Time Warner. It was the largest merger ever, at the time (<http://money.cnn.com/2000/01/10/deals/aol_warner/>). And it flopped, but that beside the point :)

</comment><comment><USER15> +1 for tldr inserts on The Atlantic articles. Always have found their articles meaningful but verbose.

<comment><USER16> +1 for immediately thinking the same thing

</comment></comment><comment><USER17> The title could be better. What he's describing with the term "dark social" is not the "Web", it's the internet. That's a distinction that is important to understand. There is much you can do over the internet that is difficult to do over the "web". Moreover, the "web" is still quite centralized in the sense that there are a disproportionate number of servers to clients. It has been called the "calf-cow" model. Some are calling for an end to that.

</comment><comment><USER18> I vividly remember working on SunOS (later Solaris) and SGI machines and using ytalk, irc and gopher all the time before WWW. WWW made us all want to occupy graphics workstations more instead of vt320s, ha! Even though most of us were in graphics programming at the time, we were working on vt320s, imagine that.

</comment><comment><USER19> I think he's confusing the web and the internet.

AIM, email, USENET etc. are not really web. Unless you have web clients.

<comment><USER20> I think, most people confuse the internet with the web, so maybe the essence of the article should have been that the internet is "social" even without Facebook, Twitter etc. wich would be still a very similar statement.

</comment></comment><comment><USER21> I use few "social" web links, maybe 1%. He fails to mention bookmarking. Most of the traffic I generate comes from bookmarked or search engine URLs. (I may or may not be unusual in that I surf with referrer turned off.)

</comment><comment><USER22> This piece reads so much like the Salon.com piece in 2004: <http://www.salon.com/2004/03/09/deep_web/>

<comment><USER17> I'd say this is a flaw of the "web" and relying on hyperlinking and "HTML forms" as a means to access all content. That's what web crawlers do.

Better would be putting databases on certain known ports, with no "hostname" requirements and let search engines scan IP ranges for openings on those ports. You send a ping to the port and if a "Welcome" response comes back, then you have a public database to explore. The response might even describe the contents of the database. (Yikes, I'm having flashbacks to gopher.)

What's funny is that "port scanning" is like the term "hacker" it has a negative connotation even though there's nothing inherently devious about it. Pinging a port to detect if there's a public database open on it is actually a more efficient less resource intensive means of service discovery than crawling hyperlinks in HTML generated by some web developer (maybe even one employed by a governemnt agency with a tight budget) hoping to stumble upon every possible data resource.

</comment></comment><comment><USER23> This is why app developers need really well-thought out sharing features - preferably based on URIs.</comment>


Doctored video of sinister Mark Zuckerberg puts Facebook to the test - <AUTHOR> https://www.theguardian.com/technology/2019/jun/11/deepfake-zuckerberg-instagram-facebook <comment><USER2> It's an interesting concept, but anything that would be effective has to be believable and appeal to a wide audience. I think people can tell this is fake, so it doesn't really work.</comment>


A man is about to launch himself in a homemade rocket to prove the Earth is flat - <AUTHOR> http://www.chicagotribune.com/bluesky/technology/ct-flat-earth-rocket-20171122-story.html <comment><USER2> Previous discussion from yesterday: [https://news.ycombinator.com/item?id=15751398](https://news.ycombinator.com/item?id=15751398)

Previous discussion from today: [https://news.ycombinator.com/item?id=15760481](https://news.ycombinator.com/item?id=15760481)

They are all based on slightly different articles, but they don't seem to be adding much to each other.

<comment><USER3> Actually 6 different posts and discussions over the past 48 hours all on the same canonical story.

See => [https://hn.algolia.com/?query=Earth%20flat%20rocket&sort=byP...](https://hn.algolia.com/?query=Earth%20flat%20rocket&sort=byPopularity&prefix=false&page=0&dateRange=all&type=story)

Why does this even belong on HN? Why are people obsessed with this onion-esque gimmick?

<comment><USER2> It's about (pseudo-)science and rockets... I guess it is a good fit for HN, otherwise it would not have been voted onto the front page three times in two days. On the other hand, the people upvoting it are apparently not the ones who pay attention to what was recently on the front page?

</comment></comment></comment><comment><USER4> Sounds like he wanted to build a rocket and figured the flat-earth schtick would get him attention and funding.

<comment><USER5> Yep. If this guy really believed in a powerful conspiracy to convince everyone the Earth is round, it would be very strange to publicise his plan to expose it. It's weird how many commentators are taken in by an obvious publicity stunt.

</comment></comment><comment><USER6> Upside: discovers the Earth is round.

Downside: only retains that knowledge rather briefly before himself becoming flat.

</comment><comment><USER7> 1800 feet seems like too small a payoff for strapping yourself into a home- made missile. Has he considered renting a Cessna or something?

<comment><USER8> Or walking up a hill.

</comment></comment><comment><USER9> What worries me most is how so many people can believe in obviously stupid ideas.

One would assume that some basic education is enough to debunk such crackpot ideas yourself.

On the other hand, saying the Earth is flat and scientists, media, school books, etc have been lying to me is a testimony to big distrust in society.

We should all be asking ourselves where such big distrust is coming from.

<comment><USER10> It would be easier and safer if he just sent an air balloon strapped with a Go Pro up. He would get the footage he needs to prove his bogus claims are wrong and he would be safe on the ground.

You are right though, we need to understand how so many people still believe that the Earth is flat.

<comment><USER11> People have done this of course, but you cannot convince a flat earther with GoPro footage because of the fisheye lens that will allow you to film the horizon curve either way, depending on the angle.

What you'd need is a wide angle rectilinear lens not normally found on light weight cameras.

He shouldn't expect much from 1800 feet tough in terms of seeing the curvature. It won't be pronounced. I think he just wants to fly.

<comment><USER12> Counterpoint: you can trivially correct for lens distortions by calibrating the camera on earth using far-away objects.

I agree that he's making claims in bad faith and just wants to fly.

</comment></comment></comment></comment><comment><USER13> Let us not forget: There are _plenty_ of people out there for whom the Earth is, yeah, okay, round, not really because of some deeply held conviction or as a result of some deep cogitation on the subject, but simply because they have been told. And if someone one day tells them something else in a reasonably persuasive tone of voice, well, then perhaps _that_ is the way it is.

Not a few of those people, assuming they hear this story, will come away from it with a vague idea that those space and rocket guys aren't really all much that in agreement about the round-or-flat thing.

[Edit: missing word]

<comment><USER14> Being wrong is in itself not a big problem. Believing what you're told about something that's not going to affect you anyway, is no big deal.

The problem with flat earthers is that they put a lot of effort in being wrong, and try to convince others to be wrong, and that the people who are right are all liars conspiring against them. It would be nice if they put that time and energy into something more productive.

</comment></comment><comment><USER15> Seems like there's a lot of competition for the Darwin award of the year.

</comment><comment><USER16> That's the great thing about these fringe groups: any outcome of this project will continue to serve there 'beliefs'. Most likely the rocket might not even get off the ground, or may explode in mid-air, or injure the pilot gravely in a rough landing. In all cases they can blame the 'elite' and 'freemasons' for colluding and hindering/sabotaging their efforts to discover the 'truth'.

I have to admit I do admire his 'brass balls' if he does go through with this.

</comment><comment><USER17> I wish him the very best in his endeavor, and hope that he doesn't hurt himself.

</comment><comment><USER18> Here's a thought I had for quite a while now: Find the most notorious flat earther who also happens to have a very strong reputation in the flat earther community. Launch a Kickstarter to collect enough money to send him to space (like all those billionaires do).

I'd hate to make a moron such an awesome present, but it could convert a lot of other morons.

<comment><USER19> > but it could convert a lot of other morons

I think you may be underestimating the sheer tenacity of these beliefs. I mean, what makes you think that super flat earther wasn't an Illuminati stooge all along?

BTW if you do decide to do this, I happen to be a very strong believer that the earth is flat, there's no such thing as space etc etc. In case you struggle for a candidate...

</comment></comment><comment><USER20> Isn't this kind of how evolution works? Nature is just running its course -- nothing much to see here.

</comment><comment><USER21> "Hughes only recently converted to flat-Eartherism, after struggling for months to raise funds for his follow-up flight over the Mojave."

What a coincidence.

I do wonder if he manages to fly high enough to see for himself that the earth is not flat, whether any other people that supported him would believe him or would they just dismiss it as another conspiracy theory.

If he's in it for the money though, he'll probably say something along the lines of the flight being inconclusive at best.

</comment><comment><USER22> I am French and I haven't heard of flat earther until recently.I don't think anybody in Europe believe such things. That's just too weird. I wonder if there's really a significant amount of people who believe it or of it just some kind of buzz word..

</comment><comment><USER23> No matter the outcome this will not end well.

About flat-Earth theory some arguments may seem valid but how wouldn't it be easier by starting off explaining how something, now, everyday like GPS or satelites would work if the Earth was flat?

<comment><USER9> Your treating this as a scientific issue, but it's not.

This is is social issue: there are people that just don't believe anything anymore.

<comment><USER24> No, you've got that backwards. There are people that will believe anything.

<comment><USER25> Well, they believe one thing and then they claw onto that belief like their life depends on it.

<comment><USER26> Almost like if it was a religion.

</comment></comment></comment></comment></comment><comment><USER27> 1800 feet, that is, like, 600m? There are even cliffs that are double that height.

Why not just hike up a mountain? In New Zealand or Hawaii it should be possible to go from sea-level to above 3000m in one push.

Or take a balloon?

</comment><comment><USER28> This seems to be the video mentioned in the article:

[https://www.youtube.com/watch?v=4jU_forLM_s](https://www.youtube.com/watch?v=4jU_forLM_s)

</comment><comment><USER29> So if he doesn't return alive, will his friends think the government sabotaged his rocket to prevent the truth from being exposed?

</comment><comment><USER30> So... why not launch a drone mounted with a gopro? Do they also believe the government is hijaking those and editing the footage?

</comment><comment><USER31> This guy belongs in a mental institution, he is seriously deranged and about to cause harm to himself and/or others.

</comment><comment><USER32> >walks up to the engine and pokes it with a stick

Slightly concerned about the engineering approach

<comment><USER33> Stick-poking, kicking and wrenching are popular and underestimated hardware engineer debugging tricks.

[https://youtu.be/dEkOT3IngMQ?t=28s](https://youtu.be/dEkOT3IngMQ?t=28s)

</comment></comment><comment><USER34> So he wanted to use other people's money to build a rocket and waste his life. Nice.

<comment><USER34> So it's my turn, I don't believe social media is popular, I need funding to build a social network.</comment></comment>


Web Latency Benchmark: A new kind of browser benchmark - <AUTHOR> http://google.github.io/latency-benchmark/

<comment><USER2> Awesome to see a non-Virtual Reality use of our Latency Tester.

<comment><USER3> It's an awesome piece of hardware, thank you for making it! I'm currently brainstorming ways to use it more extensively in the tests.

This benchmark does have a connection to virtual reality, as part of my inspiration to make it came from my experience using vr.js[1] and WebGL for virtual reality in browsers[2]. The Web isn't yet ready for VR due to latency issues, but I hope to change that!

On that note, are you guys interested in browser support for the Rift? I believe the latency issues are surmountable with effort and some cooperation from browser vendors, and I'd love to see something official in that direction (in fact, I'd love to _work on_ something official).

[1] [https://developer.oculusvr.com/forums/viewtopic.php?f=20&t=7...](https://developer.oculusvr.com/forums/viewtopic.php?f=20&t=753)

[2] This is what I made: [http://www.youtube.com/watch?v=pWYlTIt4j0Y&hd=1&t=1m11s](http://www.youtube.com/watch?v=pWYlTIt4j0Y&hd=1&t=1m11s)

</comment></comment><comment><USER4> 1.1 out of 10 running the latest stable version of Chrome on a 2010 13" MacBook Pro with a 2.40GHz Core 2 Duo, 8GB of RAM, and a Samsung 840 SSD. Geez... Is there anything I can do to improve the score?

<comment><USER5> odd, i have much the same mac, same cpu/ram with a regular 7200rpm disk, same chrome and i get 2.5

</comment></comment><comment><USER6> Has anyone assembled benchmarks across the different browsers yet? I like the aims of this benchmark a lot -- I've recently switched away from Firefox to Chrome simply because it feels less janky.

<comment><USER3> (benchmark author here) I don't have comprehensive numbers compiled yet, but I can give you a general ranking of browsers. From best score to worst, the current ranking is roughly:

      Safari
      Firefox (except Mac)
      IE 11
      Chrome and Mac Firefox

<comment><USER7> I wonder if I'm using my browser differently than others or if there is something wrong with my machine. Whenever I try to switch from Chrome to FF it seems way behind Chrome in terms of speed and snappiness.

edit:

Windows 8.1, SSD, i3, 16GB RAM (63% used)

Chrome 30.0.1599.101 m: 3.4/10

Chrome Incognito: 4/10

Firefox 25: 5.4/10

FF Private Browsing 3/10 O.o

All tests done at least twice with similar numbers.

But Chrome has been running for a few days while FF was just started. Guess I'll leave FF running a bit and see if it changes anything.

Also interesting, FF takes around 2-3 times as long to run the tests than Chrome.

The reason for the low Chrome score is this:

JavaScript jank Tests responsiveness during JavaScript execution. CSS: 1.0 frames jank, Scrolling: __170.1 __frames jank

<comment><USER3> There are many different ways to measure speed. For example this benchmark says nothing about page load times or JavaScript speed; Chrome might (hypothetically) be way faster than Firefox there and still score worse in this test.

> FF takes around 2-3 times as long to run the tests than Chrome.

There are a couple of reasons for this. Firstly, lower latency is more difficult to measure, so it takes more trials to get the same number of good measurements. Secondly, Firefox has longer scroll momentum than Chrome, and the benchmark waits for the scroll momentum to die down between each scroll latency measurement.

<comment><USER7> The main problem I have with FF is it's scrolling performance ;)

Thanks for the explanation, makes a lot of sense.

Can you explain the extreme FF private browsing results?

<comment><USER3> I have no idea why a private browsing window would perform differently, but you're right, I get the same results myself. That's weird! It's exactly the sort of issue I hope to expose with this test. Latency issues like that are often ignored because they're not visible, and I want to make them visible.

<comment><USER8> Thanks very much for making this test. I use just about every browser out there, and love Chrome on my new Nexus 5, but I've felt that with iOS 7 and 10.9, Safari made huge improvements in responsiveness and it was hard to pin that down until now. I look forward to future optimizations. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I can't help but think this should be a test for websites, not computers. It's individual sites full of 3rd party shit that are slow and you can see the performance penalty by installing Ghostery.

<comment><USER3> It's more of a test for browsers than computers. You can compare Chrome vs. Firefox vs. IE vs. Safari.

Measuring the input latency of individual websites would be interesting too. I'd love to incorporate that into the benchmark if I could figure out a way to do it.

</comment></comment><comment><USER10> 1.8/10 on a Dell Latitude laptop.

Did anyone else have difficulty getting it to work on a multi-monitor setup? It gave me an error about trying to find the reference image and suggested I switch monitors, but that didn't work. I finally had to disconnect my secondary monitor altogether before it would work.

<comment><USER3> (benchmark author here) Interesting. I will have to do more testing on Windows multi-monitor setups. I would not be surprised to learn that it's broken.

<comment><USER10> If it helps at all, I'm on Windows 7 with my laptop screen as my primary monitor and an LCD screen to the left as my secondary.

I was initially in Win7's "enhanced graphics" mode (can't remember actual feature name) but when I tried to run the benchmark I was thrown into Basic mode. I had a fair amount of other applications running, though, so I may have just run out of memory.

<comment><USER3> Being thrown into Basic mode is unfortunately expected. I'll bet the reason it didn't work is having the secondary monitor on the left. I think I only tested it with the secondary monitor on the right.

</comment></comment></comment></comment><comment><USER11> Low latency is more important than overall throughput when it comes to UX, so that is a measurement that makes a lot of sense. Has anyone experience with it?

</comment><comment><USER12> I learned a new definition for jank today!

3.0/10 on MPBR early 2013 w 16GB and SSD.

Authors should consider a way to collect and present the data.

</comment><comment><USER13> The windows version disables the "Aero Glass" transparency effects on my Win7. A first glance looks like it might not be intentional, but it triggers some kind of compatibility mode in the OS. Not sure why a headless daemon would mess with transparency effects.

<comment><USER3> Benchmark author here. This is unfortunately intentional due to the way the benchmark works. Measuring latency requires taking screenshots really fast, and on Windows 7 it is very difficult to impossible to take fast screenshots with Aero enabled. In Windows 8 they added a new DirectX screenshot API[1] that makes this unnecessary (which is good because it is impossible to disable Aero on Windows 8).

[1] [http://msdn.microsoft.com/en- us/library/windows/desktop/hh40...](http://msdn.microsoft.com/en- us/library/windows/desktop/hh404487\(v=vs.85\).aspx)

</comment></comment><comment><USER14> Getting different scores when the test is ran at different browser sizes.

3.4 when the window is sized to it's smallest size.

2.5 when it's at maximum resolution (1600x1200).

Running on OSX 10.9.

<comment><USER3> Yes, window size can definitely affect latency and jank. The benchmark page has a hidden full-window-sized layer that the browser must paint every frame, and a large browser window requires more CPU and GPU work to paint.

</comment></comment><comment><USER15> Keeps failing for my Win7x64/30.0.1599.101 m.

> Failed to find test pattern on screen. Ensure that your browser's zoom level > is set to "100%", and the top-left corner of the window is visible. If you > have multiple displays, try moving the browser window to the main display.

* Zoom 100%: check.

* Main monitor (of 2): check.

* Top-left visible: check.

I give up.

<comment><USER3> Sorry to hear that. Due you have the Chrome flag for "Experimental Web Platform features" enabled? I recently learned that there's an issue with the test related to this flag.

Edit: It's more likely that it's just buggy support for multiple monitors. I will look into fixing it; for now the only workaround would be disabling your second monitor.

<comment><USER15> Sorry for the late reply; I did notice a Github issue for it so I commented there. Thanks!

</comment></comment></comment><comment><USER16> Does not work in Safari on Mavericks using a rMBP @1680x1050 retina resolution. It suggests browser zooming be set to 100% which it is.

<comment><USER3> Thanks for the report; I see the problem. I'll look into fixing it, but in the meantime you can get it running by enabling WebGL in Safari (under the Develop menu, and if you don't have a Develop menu you can enable it in Preferences->Advanced).

Spoiler: Safari actually gets a very good score (relative to other browsers).

<comment><USER16> Enabling WebGL works. My three tests scored 8.7, 6.7 and 6.3 respectively. I guess Safari, like me, hates repetitive tasks. :)

<comment><USER3> :) There is a lot of run-to-run variance. Some of it is real in that browsers do give different results, and some of it is just test noise. I'm still working on improving the robustness. Recently I've been working on hardware latency measurement which gives more reliable numbers.

</comment></comment></comment></comment><comment><USER17> keep on getting [https://github.com/google/latency- benchmark/blob/master/src/...](https://github.com/google/latency- benchmark/blob/master/src/latency-benchmark.c#L505) on the first test... not sure why.

<comment><USER3> Interesting, what platform and browser?

<comment><USER17> Vista all attempted browsers (tried FF, Chrome, Opera)

<comment><USER3> Hmm, I don't have a Vista machine around to test on unfortunately.

</comment></comment></comment></comment><comment><USER18> Has anyone else heard the term jank before? It's the first time I've seen it.

<comment><USER19> There is a website [1] with more informations and talks about "jank".

[1] - [http://jankfree.org/](http://jankfree.org/)

</comment></comment><comment><USER20> 3.3 on a beefy Windows 8 machine running Chrome 31.0.1650.39 beta-m. Interestingly, running an Incognito tab with no extensions allowed to run in incognito results in a 2.7.

Huh.

<comment><USER12> Lower scores are better since we are measuring latency?

<comment><USER21> Looking at the source, higher scores are better. There are a bunch of tests, and each one produces a score from 0 (bad) to w (good) for some w. The total score is the total of all these.

Given that all the other numbers on the page are ones for which smaller is better, I think the main score itself should be accompanied by a note saying explicitly that higher scores are better.

<comment><USER3> Good point. I'll add a note next to the scores.

</comment></comment></comment></comment><comment><USER22> I managed to get a 6.5 on Safari on Mavericks on a 3.5 year old MBP. All the other browser I've tried were below 2, except for Opera Next (2.2).

</comment><comment><USER23> 2.8 / 10.0 on a 1 week old 15" MBP (high-end) running latest stable Chrome.

</comment><comment><USER24> Somehow the second test always timeouts in IE 11 on Windows 8.1 for me.</comment>


How My Startup Got Robbed - <AUTHOR> http://torgronsund.com/2013/01/07/cofounders-and-thieves/ <comment><USER3> "Several consultations and meetings later, however, the company's board faced a dilemma. We had to make a decision. The costs of pursuing the case would simply exceed any compensation from winning it. So, should we then pursue the case?"

Maybe I don't know how your countries legal system works, but surely the cost is borne by the state? I assume then you mean the cost of the time you would need to spend to support law enforcement? But the thing is, now you:

a) can't name this fellow,

b) if someone does a background check of him and his father in the future, they will not find this

c) his father, a layer (?!), stands a lose a LOT if this really is true, and would probably be smart enough to settle this ASAP,

d) if a customer had not paid, you'd probably consider writing off that as a bad debt, but still possibly engage a collection agency to attempt to recover the debt - you would only get a fraction of it, but you'd get some. You might have found a willing law firm to pursue the case, in return for a % of the settlement/award.

e) assuming a successful prosecution, most countries would block this young man from being a director of a company for a LONG time - that should be enough reason to follow through alone

I understand it's expensive but I, for one, feel that you have a moral obligation to take the evidence to the correct authorities, and let them make the decision on whether they have a case and to proceed or not.

<comment><USER4> The site is down, so I'm working from inference - but robbery is a violent crime. Theft is a non-violent crime. Both are matters for the police, not civil litigation.

Since it's up to the board to decide to pursue the case, it sounds like it's neither - probably some sort of breach of contract we're looking at, which is bad enough, but not robbery.

</comment></comment><comment> X-Istence I was involved in a company in which one of the co-founders used the company debit card as his personal card to purchase food, snacks from vending machines, gas and groceries. He ended up spending almost half of the money we had made from contracts and equity we had put in and refused to pay it back.

We had a choice here, we could have taken it to the police, we could have used the law to our advantage because technically he was embezzling. Instead myself and the other co-founders called for a board meeting, we sat him down and talked to him. We considered his misappropriation of the funds ground enough to fire him from the board/company and considered the money taken to be more than enough compensation for his share of the company (to which he agreed), in return we wouldn't pursue him. This worked out for the better for all of us, since it meant we didn't have to spend time and money on a lawyer/court case and he could walk away without any penalties.

We had him sign a document stating that he no longer held any interest in the company (we had already long deactivated any and all accounts he had on the company network/services and his access to the bank account) and let it go.

Every so often I will still get calls from people looking for references (his name can still be found on Google to be associated with this company), and I will simply state that I have worked with him the past, and he was let go.

Unfortunately due to various reasons it never really did work out and the company fell apart. We made some money, I learned a boat-load and had my first failure. We were trying to bootstrap the company ourselves, so the only thing lost was the equity we all put in to start the company.

<comment><USER5> Wow, I'm actually in the middle of exactly the same situation right now (significant untracked and unauthorized personal spending by a co-founder), except I don't have a board, it's just me and the other co-founder.. We tried to work things out together to balance everything, but I finally gave up out of frustration and hired a lawyer.. Something I should have done from the start..

I'm going the opposite route though, and forcing him to buy me out of the company instead (with the alternative resolution being litigation against him), so he can keep the mess he created, and I'll get out of the liability and get a lump sum payment on the way out..

<comment> X-Istence The biggest mess was for our accountant/taxes for the IRS, but that was all resolved.

</comment></comment></comment><comment><USER6> It sounds like a lot of obvious mistakes were made here. #1 on my list would be to never give direct access to the company's bank account if possible, and definitely not without limits. There should be 1 or 2 names on it max.

What has personally worked for me is providing company credit cards with a max limit of $25k to anyone who actually needs to be actively spending. Right now that's head of tech, head of marketing and CEO. My company is larger and spends quite a bit. If you are bootstrapping or have done an angel round, perhaps this number should be $5k or $10k. Either way, the important part is the limit.

As far as withdrawals go, a 2-signer system on all checks is a no-brainer, though in this case it sounds like an in-person withdrawal from a branch is what got you. I would check with your bank to see if they can setup a similar system for withdrawals over $X. I've worked with Silicon Valley Bank and they are super flexible to any of these custom needs.

Best of luck with getting back up after this. These are the kinds of events that you need to creatively persevere through.

<comment><USER7> > There should be 1 or 2 names on it max.

The founder and co-founder's? Couldn't resist, :+)

</comment></comment><comment><USER8> I worked with a company where there were 2 founders and one of them told the other guy he would like to retire so he got bought out. He was still working for the company while the other guy went on vacation. 2 weeks later he came back, not a single one of all the orders was finished and he had introduced his new company to all customers.

In the months leading up to all this, the "evil" partner had bought an exact copy of all the machinery and software.

It was illegal what that guy had done and he was at risk of doing some time in jail. They eventually settled for a price that was way too low because the victim was tired of it, he couldn't stop thinking about it, he couldn't sleep, he wanted it to stop.

Here's the kicker. The evil partner had done it 2 times before and his latest victim knew about it when they founded the company, but figured it wouldn't happen again because the evil guy was close to retirement.

Lesson learned ? I don't know. Trust your gut ?

<comment><USER9> _"Lesson learned ? I don't know. Trust your gut ?"_

The lesson to be learned is that the biggest predictor of what someone _will do_ is what they _have done_.

This doesn't only apply when dealing with others, but also with yourself. I've gotten quite good at recognizing when I'm bullshitting myself about something that I will do, and often now find myself saying, "Yeah Oz, but that's what you said last time. What's different this time?" When I don't have a good answer, I know I need to take a different approach.

Sebastian Marshall (HN:lionhearted) said it best. "Track records don't lie."

</comment></comment><comment><USER10> It doesn't sound like the person in question was actually a co-founder this just seems a bit too sensational:

 _My co-founder didn't have any formal position or rights at the company at the time. Despite several attempts at formally hiring him, he had insisted on not being employed. Rather, he wanted to function as a board member and a contractor._

Co-founders are generally there right from the start (or very close) and don't become contractors -- they hold equity and are deeply committed to the success of the company. Also, I'd not been able to find any references to a 'co- founder' in a search, and given that LingoSocial has a lot of mentions, it seems unlikely that all traces have been scourged.

</comment><comment><USER11> Wow.. I personally know the co-founder, and his story is pretty much the oposite of this.

<comment><USER12> Perhaps he should identify himself and elaborate.

<comment><USER11> Talked to him, and he pretty much laughed at this, but he cba commenting. However he is one of my best friends, and he has told me this story a few times.

He, lets call him Mr X. Created a software product which got quite popular and started making money, so he decided to start a company with this guy (Tor). Tor isn't a computer engineer, he is just an entrepeneur who like making companies or something. Anyway, they recieve some money from the norwegian governement through something called Innovation Norway. They both keep working in the company, but in separate offices, so none of them knew what the other was doing. Mr X keeps coding on the product, and Tor does something else (Mr X isn't really sure what). After some time, Mr X checks the bank account and notices that almost all the money they recieved from the Innovation Norway is gone. Thats when he makes the statement "give me 30 per cent of the companies cash", because he wanted out. Mr X had done all the work, Tor handled finances, Mr X realizes he can't trust Tor, so he wants his share and leave.

Long time since I've heard the story (happened like 4-5 years ago), so probably don't got all the details.

Just had to post this since Mr X wouldn't.

TL;DR

\- Co-founder (Mr X) created a product

\- Starts company with this guy

\- Mr X does the product dev. This guy does the business part (I assume this also include finances)

\- This guy takes money

\- Mr X found out, and wants to bail with half the money left

<comment><USER13> 1) Mr X jumped into bed with Tor without either of them doing their due diligence

2) Mr X and Tor failed to set proper expectations for what they would be doing

3) neither of them opened up a channel of discussion when things were not going as they expected

A good lesson.

<comment><USER14> You absolutely nailed it... and you made me laugh :)

</comment></comment></comment></comment></comment><comment><USER15> I imagine there is another side to this story. This doesn't seem to be the full picture.

<comment><USER16> it doesn't help that he keeps calling him a cofounder, when he says the guy made it clear he wanted to be a consultant + board member. If your cofounder is charging you by the hour, he's not a cofounder.

<comment><USER17> It sounds like he wanted to collect his remuneration by invoicing as a contractor rather than being made an employee. It can be quite 'tax efficient' to do this if you don't need the cash straight away.

(In the UK at least) being a director is quite separate from being an employee. I'm a director of two companies but employed by neither.

<comment><USER16> It's the same way here in the US. Board members aren't employees.. the company isn't even required to compensate them for serving on the board.

</comment></comment></comment></comment><comment><USER18> How much money was at stake here? How many actual employees? It sounds like it was you, a friend, and his dad trying out a startup that didn't work, from the way the post was written.

</comment><comment><USER19> One thing the Internet taught me is to never pass judgement on a one sided story. I'd love to hear the other side from the horse's mouth

</comment><comment><USER20> If any of this is true then you should at least make this blog post the #1 result on google for their names. So at least future parties they're involved with stand less of a chance of getting fucked.

</comment><comment><USER21> I am undergoing a very similar experience, I don't think it is wrong to name the parties involved. It would be a benefit to your local community. In the USA at least, you don't have to worry about "libel" or "defamation" as the burden of proof is on the plaintiff.

<comment><USER22> European Libel laws are much more...liberal than they are in the US. Frequently, truth is _not_ a defense to libel as it is in the U.S. In much of Europe, the primary element is that the defendant suffer harm to his reputation. See, for example, the British aristocrat who was truthfully outed as a Nazi sex fetishist...but won a judgement against the tabloid that published the pictures.

<comment><USER23> He was outed as a sex fetishist. The libel action was brought over the Nazi label, and the judge found there was no evidence of a Nazi theme. If the judge had found there was a Nazi theme, then the libel action would have failed - truth is a defence. <http://news.bbc.co.uk/1/hi/uk/7527319.stm>

<comment><USER22> Yep, you're right. I mixed up the libel action with the invasion of privacy action. Truth is a defense to the libel claim but not to invasion of privacy. For IOP, truth is an element in newsworthiness, which can be a defense to IOP. (See eg <http://www.lse.ac.uk/collections/law/news/libel.pdf> for a long boring legal discussion.)

</comment></comment></comment></comment><comment><USER24> A guy stole half of your money and you decided not to do anything about it?

D:

</comment><comment><USER25> Not 100% but assuming this is a US company, isn't this a criminal act? Also if it's as much money as it sounds surely its a felony.

<comment><USER26> The website is down currently but if it really is money which was embezzled from a bank account then I agree. You do not need to sue the guy. Embezzlement and theft are both crimes in most jurisdictions so the police can handle the case for you.

EDIT: Seems they were aware it was a crime and just did not want the hassle of appearing in court when they were busy with the company.

</comment></comment><comment><USER27> An ordinary suburban accountant can give you good advice about the basics of cash control.

That the _director of the board_ had access to the accounts boggles my mind. Board members are not management, they shouldn't have this kind of access.

Also, if you've kicked someone out in a dispute over cash ... get on the phone at 8am and _lock them out of your accounts_. Or get onto the internet banking admin screen (you know where that is, right?) and _lock them out of your accounts_.

</comment><comment><USER28> While you don't announce it in your blog, I certainly hope you're giving your local startup community a heads-up about this guy (and the board director).

<comment><USER29> I would be extremely wary about taking someone's word that someone else did something criminal, with zero evidence to back it up. What if this author has lied to us and you then refuse to hire "this guy" based on those lies - <USER2> imagine he would have a good case against you.

</comment></comment><comment><USER30> I'm getting HTTP 503s on this story.

<comment> paul-woolcock [http://webcache.googleusercontent.com/search?q=cache%3Atorgr...](http://webcache.googleusercontent.com/search?q=cache%3Atorgronsund.com%2F2013%2F01%2F07%2Fcofounders- and-thieves%2F&oq=cache%3Atorgronsund.com%2F2013%2F01%2F07%2Fcofounders-and- thieves)

</comment></comment><comment><USER31> Somebody has to figure out the name of the thief and post it!

<comment><USER29> I figured it out! The name of the thief was "James Sanderson", whatever you do do not start a company with this person.

And if I'd ended the post there, you might have actioned my advice.

It's terrible that this person has lost out, and more terrible that the person that wronged them got away scott-free. That's not fair, it offends my sense of fairness and justice, and even though I have no connection to the author I would be happier if justice was served.

But what would be far more terrible is if someone else, completely innocent, was caught in the cross-fire amongst our demands for justice. This could happen lots of ways. Someone with all good intentions could make a mistake when snooping, and post the wrong name (in this example, I used my own name). At the other end of the goodness-of-intentions scale, the submitted post could be a complete fabrication, designed especially for people to snoop out and target a specific victim.

Acting based on the say-so of someone on the internet that someone else did them wrong is a very bad idea: you have no reason to trust this person, and if you do believe what you hear on the internet then whether or not justice prevails comes down to which party submits their story to Hacker News first - not ideal.

<comment><USER10> Where is the evidence? Searching for that person's name in quotes along with either the author's name or the startup name does not seem to return any evidence.

<comment><USER32> clearly you only read the name not the entire post. the original commenter mentions that it is his own name and was just pointing out that by doing research you could post the wrong name and adversely affect someone who was otherwise innocent.

<comment><USER33> I find it enlightening that the post was not read (which takes very little effort to complete), YET google was opened up and queries commenced.

Not only that, but you were able to successfully determine that this was the action that took place.

I do the same thing myself far too often - skim something quickly, pick a key word and then google it myself out of context. Wonder how many things I misinterpreted because of this behavior.

<comment><USER29> > I find it enlightening that the post was not read (which takes very little > effort to complete), YET google was opened up and queries commenced.

This is exactly what terrifies me when the mob starts baying for personal information. I've seen it go wrong too many times now (personally I think HN should follow Reddit's example and add a rule about posting personal information)

</comment></comment></comment></comment></comment></comment><comment><USER34> can somebody point me to some good examples of co-founder/partnership legal documents? preferrably free of charge and 100% tweakable of course :)

<comment><USER27> Bunches and bunches come up on Google.

But really, it's a few hundred bucks to have a lawyer draft one that is precisely configured to your requirements. With the added bonus that it will be written to your local legal situation, which generic templates can't be.

</comment></comment><comment><USER35> Site is crashing. Anyone has a cached link ?

<comment><USER36> [http://webcache.googleusercontent.com/search?q=cache:torgron...](http://webcache.googleusercontent.com/search?q=cache:torgronsund.com/2013/01/07/cofounders- and-thieves/)</comment></comment>


How I stumbled onto a security flaw in Box Sync for Mac - <AUTHOR> http://enterprisemac.bruienne.com/2015/02/07/box-cutting-how-i-stumbled-onto-a-serious-security-flaw-in-box-sync-for-mac/

<comment><USER2> > ... heads up to fellow Mac Admins and anyone else who uses or deploys Box > Sync to ensure that the 4.0.6035 update is applied ASAP. There is no way of > knowing who else has been aware of the exposed information before me and > whether or not it may have been used to access Box customer data. This is > especially important in environments that use a managed software update > workflow which may be holding back automatic updates until specific action > is taken by an admin.

Looks like that second-to-last sentence was inserted after an initial writing, since the last line refers again to the urgency to update. In my opinion, there's far too little discussion (just the one line) about the implications of what might have been exposed here. In other words, this sounds much more like evidence of a possible data breach than just a client security bug that is fixed with an updated version. Of course, that discussion/clarification should come directly from Box.

If information like S3 credentials was exposed, I assume Box's response was to immediately change all the relevant credentials (and be sure the new ones aren't exposed in later versions). If that's the case, then the client update itself probably isn't the critical thing to worry about at this point, right?

It's a bit like saying "oops, we accidentally pushed secrets to our public GitHub repo and didn't know about it until someone else pointed it out" and that person saying "quick, everyone pull down the latest revision that doesn't include the credentials."

<comment><USER3> Wish the blog would have started with "As it turns out, the development team at Box embedded a lot of rather sensitive information in the files belonging to the conf module..." and then gone one to explain exactly how and why the information is sensitive.

A configured client (Box, DropBox, whatever) must by definition have access to all the files that are being sync'd. I recall DropBox having exactly the same kind of token which can be stolen. How is this different?

<comment><USER2> The location and context of these credentials seems to suggest that they were intended for mostly internal use. Another comment here mentions that the updated client contains just an api_key and client_secret (makes sense), implying that for normal user operations (syncing a user's files) the client probably just communicates with Box's servers, not directly with S3. I guess it would be possible to use a single set of S3 credentials and still lock down per-user access with other means, but I have a hard time believing that's how Box syncs your files.

In any case, this really doesn't seem like the place you'd store user-specific storage credentials (if Box were to use S3 directly in that way). Remember, this was found in a _pre-compiled_ .pyo file, within site-packages.zip.

</comment></comment></comment><comment><USER4> I removed Box Sync because the client was so annoying. Every time I booted up without internet, it logged me out and required me to log back in. This security flaw only adds to my view that they have a poor product, at least for Mac.

</comment><comment><USER5> Well that doesn't inspire confidence. I'm not a Box user; is data usually encrypted with a user-supplied key as well before transmission to Box's systems? Is access to Box's "internal" S3 storage going to potentially yield unencrypted (or encrypted with a known key) user data?

</comment><comment><USER6> The tl;dr of the vulnerability is this: the Box sync application had sensitive information (e.g. application secret keys) exposed.

Fairly widespread problem, which is almost inevitable given enough binary digging and reverse engineering work, unless you do real work to segregate the authentication process to a serverside PKI or something similar.

If the author comes across this, good work, nice writeup! However, if you're going to have a _tl;dr_ section at all, you should put a brief description of the vulnerability in it. In this case, the vulnerability is simple enough that it can be briefly expressed in a tl;dr.

</comment><comment><USER7> _" On February 6th I was notified that an updated version 4.0.6035 had been released which is supposed to resolve the issue."_

It would have been useful to check whether that 'supposed' is true and if so, how they fixed this. Worst-case, they did the easy thing and obfuscated the strings.

<comment><USER8> I supposedly have the updated version (according to Box's about screen) and I still see values for api_key and client_secret in these files.

I can't say what they do or if it's a real issue, but it's troubling to still see values there. There are also a few other keys that don't look like they should be there...</comment></comment>


HTTPie, command line client with intuitive UI, JSON support - <AUTHOR> https://httpie.org/ <comment><USER2> I use HTTPie almost daily, and it is fantastic. Really useful for debugging my APIs.</comment>


Show HN: JavaScript web component for online spreadsheets - <AUTHOR> https://github.com/paulhodel/jexcel/blob/master/README.md <comment><USER2> There's no shadowroot usage or customElement definitions here - what part of this is a web component? Not to trivialize the creation of what looks like a decent spreadsheet library, but this just looks like a standard library, not a web component.

<comment><USER3> Before there were Web Components, people made reusable web components.

But, probably good to disambiguate

</comment></comment><comment><USER4> this is awesome. One feature I'd like is the frozen column of airtable:

[https://support.airtable.com/hc/en- us/articles/203312065-Cha...](https://support.airtable.com/hc/en- us/articles/203312065-Changing-the-number-of-frozen-fields-columns-)

<comment><AUTHOR> [https://jexcel.net/v4/examples/freeze- columns](https://jexcel.net/v4/examples/freeze-columns)</comment></comment>


Sblack: an ultra-lightweight Mac client for Slack - <AUTHOR> https://www.sblack.online/ <comment><USER2> How is this different than wrapping the slack website with Fluid.app?

Also, [https://github.com/frankdilo/sblack](https://github.com/frankdilo/sblack) says "Sblack is no longer available for download since the app is in violation of the Slack Acceptable Use Policy. It was fun while it lasted, sorry guys!"

Also, telling me that it's safe without any evidence is awful. Don't do that. Link to the github repo instead of these meaningless "I promise that you can trust me, honest!" shenanigans.

Also, forcing an email signup to download? HAHAHAHAHA.

<comment><USER3> Did he take down the repo? It's no longer visible.

Solid observations.

<comment><USER2> > _Did he take down the repo? It 's no longer visible._

It looks like it. I can't articulate why, but that sets off alarm bells to me.

</comment></comment></comment><comment><USER4> Could you add some screenshots?

</comment><comment><USER5> Wey is a super fast, lightweight Slack client. However, the author doesn't seem to actively maintain it.

[https://github.com/yue/wey](https://github.com/yue/wey)

</comment><comment><USER6> Using the builtin WebKit instead of a bundled Chrome is not enough to make an app "ultra-lightweight". I was hoping for an actual native client…

<comment><USER7> Agreed, this doesn't seem to me `ultra-lightweight` vs normal slack after looking at Activity Monitor as a quick comparison. However, the dark theme is nice to have.

</comment></comment><comment><USER8> Developer of the app here. Feel free to ask questions.

<comment><USER9> Looks like the repo is gone, care to explain why? Concerns around security with apps like this are common. OSS doesn't fix that, but it makes things a bit easier to audit.</comment></comment>


Android is direct threat to Windows and Mac - <AUTHOR> http://atthy.com/android-is-direct-threat-to-windows-and-mac/

<comment><USER2> There's already a laptop shell that you can jack your phone into. That future is looking really interesting, and is probably why Microsoft is doing Windows 8 for ARM chips - just imagine a 15" or 17", high resolution laptop that weighs as much as an Air and has a multi-day battery!

[http://www.engadget.com/2011/01/05/motorola-atrix-4gs- webtop...](http://www.engadget.com/2011/01/05/motorola-atrix-4gs-webtop- application-turns-your-phone-into-a/)

</comment><comment><USER3> Nothing but fanboy fluff.

"Android Tablets will use keyboard and mouse as input devices, that means end of the game for windows and Mac."

Get real.

<comment><AUTHOR> Ofcourse, that was fanboy fluff.. thats why I admitted myself, its outrageous.. :)</comment></comment>


Show HN: Mobile Version – Tracking Covid-19 Cases and Testing by State - <AUTHOR> http://virustracking.net/track-covid-19-by-state.html <comment><AUTHOR> I quickly hacked a website together last weekend based on the COVID Tracking Project[1] data because I wanted to see how much COVID testing was being done at the state level.

I spent this weekend creating a mobile version of the site which came out pretty well I think. But if you want to see a LOT of data at once, the desktop version is still the way to go.

[1] [https://covidtracking.com/](https://covidtracking.com/)</comment>


Why the 'happiest' cities are boring - <AUTHOR> http://www.ft.com/cms/s/2/1b915f0e-517b-11e5-b029-b9d50a74fd14.html <comment><USER2> Was into this article until the 'survey' halfway down the page put the text into 'vertical seizure' mode</comment>


Ask HN: How do you overcome very stressful periods? - <AUTHOR> How do you deal with the stress due to approaching exams, tight deadlines, things that need to be done but are not yet, etc. which might be very frustrating if it is something important, and especially if you know it won't disappear until the whole event causing the stress ends? <comment><USER2> The "Will this still be important to me in 5 years?" test.

Nearly (not entirely) all the things I've ever worried about haven't mattered in 5 years.

In hindsight the relationship didn't matter (I'm in a happy one now), the company didn't matter, I gave it my best and walked away slightly burnt out but intact and my health while mediocre now is still better than it was a year ago (it takes a long time to recover from some things, rather than stressing about what I was in the past I focus on been better tomorrow than today).

Including tight work deadlines, exam results (I just re-sat some of them back then).

5 years ago I hadn't started (and failed) a company, I was still with my ex in an unhappy relationship and my health was fine.

Also stoicism, some things are just going to suck until they don't, accepting that they'll suck but not forever genuinely helps (me at any rate).

Also lots of things that can wrong are fixable even if they do.

Some of this I think just comes with age (not inevitably perhaps), I certainly gained perspective on things that in the past I'd have struggled to cope with.

</comment><comment><USER3> Go for small wins first and focus on just one item at a time.

</comment><comment><USER4> Wait.

This too shall pass.</comment>