Faster DOM - <AUTHOR> https://annevankesteren.nl/2016/05/faster-dom <comment><USER2> > _That way, you only do the IDL-dance once and the browser then manipulates > the tree in C++ with the many operations you fed it._

As a beginning web developer, I remember being surprised that there was no way for me to group DOM manipulations into SQL-like transactions, or even an equivalent to HyperCard's lockScreen.

I'm finding it a little tough to tell whether the author is talking about putting the browser or the web developer in control of grouping DOM updates.

<comment><USER3> > [...] I remember being surprised that there was no way for me to group DOM > manipulations into SQL-like transactions [...]

There is a way to group DOM manipulations: a DocumentFragment[0]. If you have a wrapper, you can easily use

        parent.replaceChild(fragment, wrapper); // [1]

So long as you start with your fragment having a new copy of that wrapper—the entire node and its children will be replaced in 1 operation. Then layout and paint should only happen once apiece.

I've used similar techniques to make applications that render efficiently.

[0]: [https://developer.mozilla.org/en- US/docs/Web/API/DocumentFra...](https://developer.mozilla.org/en- US/docs/Web/API/DocumentFragment) [1]: [https://developer.mozilla.org/en- US/docs/Web/API/Node/replac...](https://developer.mozilla.org/en- US/docs/Web/API/Node/replaceChild)

<comment><USER4> That assumes that all the changes are grouped under the same part of the tree...

<comment><USER3> Sure. If you have a ton of potentially layout-thrashing changes, just clone your page's highest wrapper node. Then make your changes and replace the node. I haven't needed it, or tested it for performance, but it's clearly doable.

        // Example; untested pseudo-code
        var fragment = document.createDocumentFragment(),
            wrapper  = document.getElementById('wrapper');

        fragment.appendChild(wrapper.cloneNode(true));
        // update your fragment
        // update the page
        document.body.replaceChild(fragment, wrapper);

That said, because the change is to a page's entire structure I'd think the layout operation would be much slower. I'm betting React and Ember might do similar things for their "application" wrapper/scope node(s).

<comment><USER5> You also potentially lose things like focus, input text, and selection on elements that otherwise didn't need to be replaced. I'd wager that re-creating all of that would add a discernible performance cost.

</comment></comment></comment></comment></comment><comment> c-smile We all know that Element.innerHtml = "..." can be significantly faster than set of individual DOM mutating calls. Element.innerHtml = ... gets executed as single transaction - relayout happens only once, at the end of it. Yet there is no overhead on JS-native bridging and function calls in JS in general.

But the need of "transactioned" DOM updates is not just about the speed. There are other cases when you need this. In particular:

1\. Massive DOM updates (that's your case), can be done with something like: Element.update( function mutator(ctx) ). While executing the mutator callback Element.update() locks/delays any screen/layout updates.

2\. That Element.update( function mutator(ctx) ) can be used with enhanced transitions. Consider something like transition: blend linear 400ms; in CSS. While executing the update browser makes snapshots of initial and final DOM states and does blending of these two states captured into bitmaps.

3\. transactioned update of contenteditable. In this case Element.update() groups all changes made by the mutator into single undoable operation. This is a big deal actually in WYSIWYG online editors.

There are other cases of course, but these three functionalities are what I've implemented in my Sciter Engine ( [http://sciter.com](http://sciter.com) ) already - proven to be useful.

<comment><USER6> _" We all know that Element.innerHtml = "..." can be significantly faster than set of individual DOM mutating calls"_

Not necessarily:

[http://stackoverflow.com/questions/8461851/what-is-better- ap...](http://stackoverflow.com/questions/8461851/what-is-better-appending- new-elements-via-dom-functions-or-appending-strings-w/8461877#8461877)

That's an old post, but even then the conventional wisdom didn't hold up.

<comment> c-smile "Not necessarily".

Of course there are situations when these two methods of DOM update are on par.

But in any case I agree with one of answers there:

"If you don't mind the fact that innerHTML is a bit limiting (only total replacement of DOM sub-tree rooted at target element) and you don't risk a vulnerability through injecting user-supplied content, use that. Otherwise, go with DOM."

When you do for example this: element.setAttribute("a","b"); browser

1\. drops all resolved CSS rules on element, its siblings, its parent and all children. Just in case you have CSS rules like:

      element[a="b"] > span { display:none }

2 Invalidates rendering tree of the element's parent.

And when you do element.appendNode(node):

it does the same as above + plus ensures consistency of HTML DOM (<select> cannot contain <div>s for example).

If you have multiple calls like these then all steps above need to be done for each of them. Engines can optimize such cases but not that much in some cases.

While browser do element.innerHtml it does each step strictly once: build consistent DOM, resolve styles, build rendering tree and mark window [area] as needed painting - request painting.

<comment><USER7> > drops all resolved CSS rules on element, its siblings, its parent and all > children.

Browsers optimize this, too - they try hard to keep up metadata structures that tell them whether they _need_ to invalidate styling or not. (This is why mutating the stylesheet is so expensive - browsers have to freshly rebuild the supporting data structures. They _could_ optimize that too, but it's a lot of effort for a rare case.)

So if there's no rules mentioning an [a] attribute in the page, el.setAttribute("a", ...) will generally not do anything.

(One of the benefits of shadow DOM is that the shadow trees are scoped away from the main tree and each other, so you can have more expensive rules in them without making the _rest_ of the page slow. Yay for componentization!)

<comment> c-smile "So if there's no rules mentioning an [a] attribute in the page, el.setAttribute("a", ...) will generally not do anything."

That's true in general but there are exceptions as usual. Changing @href may trigger not only [href] rules but also :link ones. And :link rules are always present at least in default style sheet. @value triggers :empty. And so on.

But if someone in some library in galaxy far far away (small library used by your application) will add that [a] rule then magically you will get a spike on innocuous el.setAttribute("a", ...) calls in your code.

That's one of points of having transactional yet explicit DOM update mechanism. We have jQuery, Angulars, React, Ember, Vue, (you name it) that definitely need such thing. Sites/webapps that do not use one of those are quite rare these days.

</comment></comment></comment></comment></comment><comment><USER8> I'll leave this module here for those of you how haven't heard of it. [https://github.com/patrick-steele-idem/morphdom](https://github.com/patrick- steele-idem/morphdom)

It diff's the DOM instead of a VDOM

<comment><USER9> Thus it can be estimated that you can get, on average, a 45% speed improvement?!

I'm going to try and bench this on a mobile webview and see what happens.

<comment><USER5> Where are you getting that number? The benchmarks in the readme show morphdom being much slower for several operations.

<comment><USER10> 5 out of 31? And I'd say only 3 are noticeably slower, and only 1 seems to be "much" slower (at 0.38ms). But given that just about everything benchmarked seems to be sub-0.05ms, I'm left thinking that gaining noticeable and much- increased performance is highly dependent on operations, and a high-precision timer. Humans aren't going to notice a difference between an operation lasting 0.04ms vs 0.02ms. Unless a ton of operations add up to something noticeable, of course.

After looking into it further, morphdom appears to be a solid alternative to virtual DOMs. Seems worth having around for that reason alone, especially if it were to improve with time, or become used by other tools.

</comment></comment></comment></comment><comment><USER11> I was playing with the idea of using JS objects as a template engine: [http://m1el.github.io/jsonht.htm](http://m1el.github.io/jsonht.htm), and I'm pretty happy with it.

I think DOM is pretty damn fast in modern browsers. `innerHTML` can be slower than creating elements from a JS object!

Here's the script I'm using for timing: [https://gist.github.com/m1el/b28625b3b9261f0fab819e866133e49...](https://gist.github.com/m1el/b28625b3b9261f0fab819e866133e49a)

My results in Chrome are: dom: 2663.580ms, innerHTML: 10999.449ms

<comment><USER12> > _I was playing with the idea of using JS objects as a template > engine:[http://m1el.github.io/jsonht.htm](http://m1el.github.io/jsonht.htm), > and I'm pretty happy with it._

Isn't that the same as (among several other things) React's JSX?

<comment><USER13> It's pretty much identical.

I don't think people realize that all JSX is, is a way to elegantly write out something that transpiles down to a pure object representation of the DOM.

JSX and React have a few quirks where React means it's not _quite_ a _pure_ object, but the React devs are working on removing those.

</comment></comment></comment><comment><USER14> I wrote up a response to this but haven't found a good place to put it; might as well post it here.

1) I think the idea about such an API encouraging good practice is very much correct, in the sense that it makes it harder to interleave DOM modification and layout flushes. That might make it worth doing on its own.

2) DOM APIs are not necessarily _that_ cheap in and of themselves (though they are compared to layout flushes). Setting the various dirty flags can actually take a while, because in practice just marking everything dirty on DOM mutation is too expensive, so in practice UAs limit the dirty marking to varying degrees. This trades off time inside the DOM API call (figuring out what needs to be dirtied) for a faster relayout later. There is some unpredictability across browser engines in terms of which APIs mark what dirty and how long it takes them to figure that out.

3) The IDL cost is pretty small in modern browsers, if we mean the fixed overhead of going from JS to C++ and verifying things like the "this" value being of the right type. When I say "pretty small", I mean order of 10-40 machine instructions at the most. On a desktop machine, that means the overhead of a thousand DOM API calls is no more than 13 microseconds. On mobile, it's going to be somewhat slower (lower clocks, if nothing else, smaller caches, etc). Measurement would obviously be useful.

There is the non-fixed overhead of dealing with the arguments (e.g. going from whatever string representation your JS impl uses to whatever representation your layout engine uses, interning strings, copying strings, ensuring that provided objects, if any, are the right type, etc). This may not change much between the two approaches, obviously, since all the strings that cross the boundary still need to cross it in the end. There will be a bit less work in terms of object arguments, sort of. But....

4) The cost of dealing with a JS object and getting properties off it is _huge_. Last I checked in Gecko a JS_GetProperty equivalent will take 3x as long as a call from JS into C++. And it's much worse than that in Chrome. Most of the tricks JITs use to optimize stuff go out the window with this sort of access and you end up taking the slowest slow paths in the JS engine. What this means in practice is that foo.bar("x", "y", "z") will generally be much faster than foo.bar({arg1: "x", arg2: "y", arg3: "z"}). This means that the obvious encoding of the new DOM as some sort of JS object graph that then gets reified is actually likely to be much slower than a bunch of DOM calls right now. Now it's possible that we could have a translation layer, written in JS such that JITs can do their magic, that desugars such an object graph into DOM API calls. But then that can be done as a library just as well as it can be done in browsers. Of course if we come up with some other way of communicating the information then we can possibly make this more efficient at the expense of it being super-ugly and totally unnatural to JS developers. Or UAs could do some sort of heroics to make calling from C++ to JS faster or something....

5) If we do provide a single big blob of instructions to the engine, it would be ideal if processing of that blob were side-effect free. Or at least if it were guaranteed that processing it cannot mutate the blob. That would simplify both specification and implementation (in the sense of not having to spell out a specific processing algorithm, allowing parallelized implementation, etc). Instructions as object graph obviously fail hard here.

Summary: I think this API could help with the silly cases by preventing layout interleaving. I don't think this API would make the non-silly cases any faster and might well make them slower or uglier or both. I think that libraries can already experiment with offering this sort of API, desugaring it to existing DOM manipulation, and see what the performance looks like and whether there is uptake.

</comment><comment><USER15> I'm curious about the source of the slowness of the IDL operations. Is it specific to the DOM, or is he referring to overhead that exists for _any_ bindings between JS and C++?

<comment><USER14> IDL operations are not particularly slow. Last I measured, a call from JS into C++ is between 10 and 40 CPU instructions of fixed overhead depending on the exact thing being called (method vs getter vs setter; they have slightly different costs) and the browser involved. At least once you get into the top JIT tier; baseline jit and interpreter can involve more overhead, obviously.

There's additional cost for dealing with the call arguments, too; this varies widely by type of argument (e.g. an options object is clearly more expensive to deal with than a boolean, or even than a list of arguments containing the same information as the options object) and somewhat less widely by browsers.

<comment><USER16> > IDL operations are not particularly slow. Last I measured, a call from JS > into C++ is between 10 and 40 CPU instructions of fixed overhead

To put that in perspective, that's the same number of instructions as objc_msgSend, which every Objective-C method call in native iOS or Mac apps goes through [1]. "The DOM is slow compared to native" is a common meme, but it's not that simple.

[1]: [http://sealiesoftware.com/msg/x86-mavericks.html](http://sealiesoftware.com/msg/x86-mavericks.html)

</comment></comment></comment><comment><USER17> Yeah, that's why in our framework, we go the FastDOM /greensock route and encourage writing mutation code explicitly for when the state changes.

However to be fair the point of React, vdom, mithril etc. is to allow the developers to write a mapping from state to view and let the mutations be calculated automatically. They claim it's easier to just write the logic of the mapping instead of all possible transitions. I don't buy it, but it has grown to a huge community.

</comment><comment><USER18> I think this is a natural evolution of where DOM has been headed. Batching requests is entirely within the spirit of the original DOM.

</comment><comment><USER19> Something like suspendLayout(), resumeLayout() I guess this GUI technique is like... 50 years old?

</comment><comment><USER20> At what point does fiddling with the DOM get complicated and unpredictable enough that WebGL and/or Canvas starts to look like the saner alternative?

On that note, I just stumbled on an old framework that's been out of development since 2012 called Blossom. It looks like it uses Canvas instead of the DOM. Does anybody have any history with it?

<comment><USER14> At the point when you decide you don't care about accessibility or actually rendering any interesting text.

<comment><USER7> Or search engines, which are a special case of disabled users.

</comment></comment></comment><comment><USER21> Is there anything in a browser that ensures that simple updates with local effect have O(1) layout cost?

Or do developers have to live with the uncertainty that simple updates may have a higher computational complexity?

<comment><USER7> The CSS 'contain' property helps ensure that local changes don't cause dirtiness to spread higher up the tree. <[https://drafts.csswg.org/css- containment/>](https://drafts.csswg.org/css-containment/>)

I know Chrome has an implementation that I think is still moving thru the shipping cycle, and the other browsers are working on theirs iirc.

</comment></comment><comment><USER22> Build faster browsers. Don't be afraid of dogma.

There were times before there was a DOM (you might not have been born yet) and there can be times after DOM :)

</comment><comment><USER23> > backed by C++ (née Rust)

"née" means "originally called" (usually someone's maiden name). I don't think C++ used to be called Rust.

<comment><USER10> Yeah, that stuck out to me, too. I'm still a bit fuzzy on how to interpret the author's original intent.

<comment><USER24> I think he meant "C++ (now Rust)", referring to the Servo browser using Rust - [https://servo.org/](https://servo.org/)

<comment><USER25> I think he is actually a she.

<comment><USER7> "Anne" is a male name in the Netherlands. (I don't know if it can _also_ be a female name there, but this Anne is definitely male.)</comment></comment></comment></comment></comment>


IDF soldier brags about killing 13 children - <AUTHOR> https://facebook.com/mzeyara/photos/a.141664095952620.28025.118863654899331/627127677406257/?type=1

<comment><USER2> I dont believe this to be true. The IDF STRONGLY discourages social media posts about anything military related. Posting something like this I imagine would land you in military jail for some time.

</comment><comment><USER3> Didn't the same thing happen with the Nazis? Viewing Jews as sub-human, and bragging about how many they killed?

It is interesting to see how history repeats its self.

</comment><comment><USER4> Lol in denial much, you're brave idf kkkunt has been sentenced to 30 days in jail

</comment><comment><USER5> This is offensive anti-Israel propaganda that has no relevance to Hacker News

</comment><comment><USER6> Any reason to believe that this is actually true?

<comment><USER7> So far the Palestinian propaganda has been quite lame. Wonder why they can't manage to be more sophisticated and less obvious. I'm sure the talent is there. Somewhere? So far the Israeli left is much more thorough and fact- checked in criticizing their own government then anything I've seen so far. It's as if there no pro-Palestinian that are capable of doing this on their own.</comment></comment>


Password Rules - <AUTHOR> http://portal.cs.oag.state.tx.us/OAGStaticContent/portal/login/help/ChangePassword.htm <comment><USER2> Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question.

I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining about security questions a bunch):

"Just got challenged with a security question, which was "Thank you for your loan application." Wtf, that is not a question. And I've never filled out any security questions for this website, so I have no idea what it's expecting me to enter.

"I swear, security questions are out to get me."

<comment><USER3> Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish to answer the questions honestly.

<comment><USER4> Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.

<comment><USER5> In 2008 Sarah Palin's Yahoo! Mail account was broken into simply by looking up the answers to the security questions.

</comment></comment></comment></comment><comment><USER6> Of those ten rules, nearly half of them hurt password strength. The others make it harder for users to remember their passwords which will lead them to frustration and, ultimately, bad passwords.

Austin#1 is a perfectly valid password according to those rules. zxcvbn says it'd take 2.508 seconds to crack that.

</comment><comment><USER7> WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be.

Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

<comment><USER8> > You're basically forcing a 7 character password since I already know one of > them is one of those three special characters.

Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is reduced by roughly 1 bit.

Still, it is an incredibly stupid rule.

<comment><USER9> I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.

<comment><USER10> I don't know whether this is cool or sad. Fallout 3 passwords were trivially easy to infer from a single guess. They took extra time to reduce the ambiguity and make it easy once you understood the principle.

Were you running a mod?

<comment><USER9> I think it's probably more on the side of "sad", considering the way I did it. No mods. I wrote a little android app that you could put the words and number of correct letters each try into and it would shorten the list each time you did.

After a while I figured out "the trick" and could do them in my head and didn't need the program anymore. It was a fun little programming exercise, though.

</comment></comment></comment></comment></comment><comment><USER11> Everyone's making fun of this, and it is dumb. But really this is just an example about how passwords are a stupid form of authentication. Not just this site, all passworded sites. We really need something better.

I favor OpenID or something like it. Single strong form of authentication, delegate login authority from that to non-critical sites like Hacker News. OpenID has enough of a bad reputation now it's probably a non-starter. BrowserID has some promise: <https://browserid.org/>

<comment> steve-howard I don't know that passwords are all bad. For an alternative approach to complex rules, see:

<http://xkcd.com/936/>

The last time I changed a password for a service I set it to a phrase that I can easily remember but which no human or current machine will easily guess. I'd say that the only good rule is "Make it at least 9 characters" (which is at least long enough to disallow "password").

<comment><USER12> Character minimums hurt your entropy too. Stripping the entire search space up to nine characters isn't really a good idea.

In my opinion it'd be better to just find a list of the top 10K passwords and disallow them.

One out of 50 people use one of the top 20 passwords. [0]

I'd bet that over half of passwords used are in the top ten thousand.

[0]: <http://xato.net/passwords/how-i-collect-passwords>

<comment><USER13> "Character minimums hurt your entropy too."

Not really. If X is the number of characters your password can be made up of, there are 8^X possible passwords that are 8 characters long, and 8^X-1 possible passwords that are less than 8 characters long. Even here, right on the border, you've only lost 1 bit of entropy (half banned, half allowed), and you win big the moment someone makes it even one character longer than the minimum who wouldn't have otherwise.

<comment><USER14> If X is the number of different characters your password can contain then the total number of possible passwords exactly 8 characters long is X^8.

The number of passwords that are _less_ than 8 characters long is X + X^2 + ... + X^7 which is significantly less than X^8 for large X.

So your point is even more valid.

</comment></comment></comment></comment></comment><comment><USER15> This reminds me of an anecdote from "The Codebook" from Simon Singh (highly recommended book btw.).

One of the reasons, why the British could crack the Enigma code, was that German officers introduced rules on how to use the system. For the Enigma machines they had to choose three out of five cylinders in different positions. The officers thought it would be more secure if they impose a rule "never use the same cylinder in the same position the next day".

</comment><comment><USER16> Yeah. As someone who prefers passwords in the 12-24 character length I get really annoyed when a site comes back and tells me my password isn't good enough because it doesn't follow various rules. Oh you really think someone is going to brute force $MILKAndDailyCheeseRe because it doesn't have a number in it?

<comment><USER17> Even worse is when they limit to 12 characters, but don't enforce it in the UI. I couldn't login once because the bank website _truncated_ my password silently to 12 characters. On a whim, i tried the first 12 characters and i was able to login.

</comment></comment><comment><USER18> Ironically, each of these restrictions reduces the space of possible passwords for a brute-force attack, which is already pretty small given the inane 8-characters-exactly requirement.

<comment><USER19> I have pointed this out to people before too. It doesn't seem to deter their slavish adherence to what they declare to be "best practices", which seems to correspond to something they read in some magazine or blog.

</comment></comment><comment><USER20> After coming up with a password that obeys all those rules, I recommend writing it down on a yellow sticky note and putting it on your monitor.

<comment><USER21> Which I have seen at secure facilities, as we all have, I think.

<comment><USER22> If it's a secure facility, it's probably pretty safe.

</comment></comment></comment><comment><USER23> I've worked with rules like this, and it's even worse when it's some domain password used across multiple crappy systems. Often a 3rd party system that has integrated with this password doesn't accept the $, or has to be 7 characters or something. So the IT folks tell you to follow the rules, but if you use the accounting system, make sure not to put $ in there. #facepalm

</comment><comment><USER24> The sub-password "similarity" rules (#8) mean that it is incredibly unlikely that the system is storing the password history hashed, and basically impossible that they're storing it salted. What could possibly go wrong?

<comment><USER25> You don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password. When processing that request, you have all the information you need to do the similarity check.

<comment><USER26> What about the 7 passwords prior?

<comment><USER27> I believe the 7 passwords prior aren't checked for similarity, only equality.

</comment></comment></comment></comment><comment><USER9> I get annoyed when I can't use spaces, because my general password strategy is to click my link bar shortcut to Random Wikipedia Page, pick five or six words and use that as my password. Easy to remember, hard to guess, even harder to brute force. Thanks XKCD!

I use Keepass to store passwords for the various things I use, and even though my hive is stored on a web server (uses SSL and requires a password, of course) for convenience, it has a well chosen, rotated password and a key file that I carry on a USB stick with my keys. I keep a backup of the key file in a safe physical location.

No two passwords are the same and none is less than 16 characters. One nice thing about Keepass is that you can also store URLs and other arbitrary information in the hive. Should anything ever happen to me, my wife will automatically receive instructions on how to locate and access the hive. (automatic email, dead man switch) Keepass also lets you set reminders so you can regularly change passwords.

<comment><USER28> This is a terrible way to choose passwords, and in no way equivalent to the XKCD method. It's not equivalent because additional length in your password is very predictable rather than random.

To brute force your password, all somebody has to do is choose a starting word in Wikipedia and some number of consecutive words. This is log2(size of Wikipedia) + log2(entropy of your "5 or 6" distribution). This is less than 32 bits of entropy, or about a six character password in a 64 character alphabet, i.e. it's trivial to brute force this password if you have the hash.

<comment><USER9> I didn't say I picked _consecutive_ words. You'd be right otherwise, though.

<comment><USER28> Why are spaces important then?

<comment><USER9> For word breaks? Why are they _not_ important?

</comment></comment></comment></comment></comment><comment><USER29> If you had to create a list(or non-list) of requirements a password must pass what would it be? (Ex. Case sensitivity, length, cannot be the same as username etc etc) The bare minimum with the least frustration for the user? I was very surprised by the news-piece that blizzard was using case-insensitive passwords and that got me thinking...

<comment><USER30> What if we started saying 'passphrase' instead of 'password' and made the minimum be 4 words and 18+ characters.

It wouldn't be overwhelming to new users if they had examples of what a memorable passphrase is. You'd likely need to disallow specifically using the example passphrase but other than that, I'd be curious to see how well non- technical users respond to an interface asking them for a phrase.

<comment><USER31> We also need to get rid of the stupid habit of blanking out the password on the screen as it's typed, which imposes a time penalty exponential in the password length, or at least make it optional and disabled by default.

<comment><USER32> Re: this. Just have an option to 'display password' on the field itself somewhere, like you get when entering your WiFi password, or passwords on your phone.

Re: GP. Attackers would just switch to brute-forcing with common phrases. Song lyrics, expressions, etc. Then your passphrase rules will change to accommodate that, and be even more confusing. "The quick brown fox jumps over the lazy dog" and other long, memorable phrases, will be as insecure as "password123".

[http://arstechnica.com/business/2012/03/passphrases-only- mar...](http://arstechnica.com/business/2012/03/passphrases-only-marginally- more-secure-than-passwords-because-of-poor-choices/)

<comment><USER30> Really interesting article and absolutely a fair point, but from the article itself, pass phrases are still better. Just not a cure all. The title ("... only marginally better ...") does not match the body ("... vast improvement ...")

>> The "30 bits of security" means the chances of a single guess cracking a four-word passphrase would be one in 230. What's more, the two-word phrases cracked in the study provided just 220.8 (or 20,656/0.0113) bits of security. Another way of expressing the same finding is that a dictionary of slightly less than 21,000 phrases is enough to guess the login credentials that slightly more than 1 percent of people in the real world will use.

To be sure, that's a vast improvement over the security of normal passwords. Analyses of compromised passwords leaked onto the 'Net, including a corpus of 32 million plaintext codes dumped following the 2009 hack of online games provider RockYou, show that it's trivial to crack a sizable proportion of real-world codes. A dictionary of just two of the most common passwords—123456 and 12345 respectively—typically guess 1 percent of login credentials.

</comment></comment></comment></comment></comment><comment><USER12> Of course this is totally ridiculous, and shoots their entropy with a shotgun. But my heart goes out to whoever was logging into the child support page at the texas attorney general website.

That sucks.

<comment><AUTHOR> I was the one who posted this. It's the same login used to report new hires to the attorney general... Luckily no child support issues here.

</comment></comment><comment><USER33> Is there any reasoning at all behind the thinking that requires passwords such as this? These sorts of rules are so commonplace that there must be some reasoning for it?

<comment><USER34> To begin with, preventing SQL injection when passwords are stored in plain text without any escaping. (CHAR(8) field. No special characters allowed.)

<comment><USER33> That's an utterly horrible reason but I take the point.

I imagine many sites implementing these policies (some banks etc) are hashing their passwords properly and sanitizing SQL though!

</comment></comment></comment><comment><USER35> Stupid password rules is probably the leading source of consternation for this internets user.

Has anyone ever analysed if password rules help at all? Aren't most compromises social-based or otherwise accidental? No one breaks in by slamming millions of login attempts at a server, do they?

<comment><USER36> My Diablo 3 account was hacked because my password was 'abcd1234'. This is no longer the case.

So yes, sometimes. And no, I'm not certain why on earth I set that as my password...

<comment><USER35> Are you sure it was brute-forced? And the website owner had nothing in place to see that it was getting hit with brute-force password attack?

</comment></comment></comment><comment><USER37> Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anything.

I have never understood the number/uppercase requirement, if someone somehow put a key logger it won't matter or if some one is using brute force, it wont matter either.

<comment><USER38> Well the "not the same as last 3" rule is easy to circumvent: Just add a number at the end, password1, password2, password3...

<comment><USER17> So schemes notice the incrementing value, so I ended up doing !,@,#,... which is equivalent to 1,2,3...

The bonus is that I could still track how many quarters I worked for that place before leaving (lasted into the 6 quarter).

</comment></comment></comment><comment><USER39> There needs to be an ISO standard for passwords. Things like this are ridiculous.

<comment><USER40> What I want to know is whether there is a subset of passwords that will be valid against almost all password rules. Like if I make a password that has 12 characters, one symbol and one number, will that fit in 99.9% of cases?

</comment></comment><comment><USER41> Having overly restrictive password rules like this, combined with requiring a new password every x months, just leads to more users writing down the passwords on notes stuck to their monitor.

</comment><comment><USER42> " Characters in the first, second, and third positions cannot be identical. "

Any reason for that? Using pretty similar passwords with minor differences is how I manage to remember passwords for all those fifty different services I have to know password for...

</comment><comment><USER43> This demonstrates what is wrong with what the world expects a password policy to be, very few of these even increase password cracking complexity. They are just dumb rules to annoy your users. Sigh!

</comment><comment><USER44> I always wondered about these arcane rules, where passwords are easy for computers to hack, but hard for humans to remember.

See obligatory xkcd comic:

<http://xkcd.com/936/>

</comment><comment> angry-hacker I wonder how many possible variation of passwords with these rules there can be... 8 chars, no same letters next to each other etc.. brute force hacking might be fun..

</comment><comment><USER45> If a system has sufficiently crazy password rules, I'm sure to forget the password, and default to the password reset system.

</comment><comment><USER46> I work for a major bank in Australia and I'd be ecstatic to have requirements as (comparatively) simple as this.

</comment><comment><USER35> Can someone convince me that password requirements add _any_ value to the matter?

</comment><comment><USER47> Whomever thought this was a good idea needs to be kicked in the groin.

</comment><comment><USER48> Need . . . public key . . . access

</comment><comment><USER49> If this weren't a US government website, I'd swear it was a hoax!

</comment><comment><USER50> I bet this has something to do with some mighty Oracle DBA.

</comment><comment><USER51> Wait, what? This isn't a joke?

</comment><comment><USER52> I swear one day we will see.

"Unfortunately time and again we have come to observe the inability of employees to follow simple rules during password creation. For example, despite our warnings, employees often create a password containing more than one consecutive non-numeral; other employees attempt to createa a password consisting only of numbers, only of letters, or an insecure mix of numbers and letters - e.g. 5:1 - with no special characters.

This is unacceptable.

Henceforth, new passwords must be one of the following five possibilities, as described below:

s$sVC!{IV{wG:|9 (Employees with last name beginning with A-F)

bE#40,$&T@V}266 (Employees with last name beginning with G-L)

U>~7nw*,55{][%H (Employees with last name beginning with M-R)

EL8$v{4#L8482 5 (Employees with last name beginning with S-X)

or

1^_4s"x&T3pB,%% (All other employees).

You may not use a password you have ever used previously. In two weeks, the new possibilities will be posted to the web site, and you must change your password immediately to one of the new possibilities.

You have brought this on yourselves, and if you begin to show an ability to use secure passwords, you may get to pick your own in the future. Until then, they will be assigned to you.

HR."

<comment><USER53> > The password must be exactly 8 characters long.

This is probably the root cause of bad passwords. In the case of Average Joe, he is now having to choose something memorable which is 8 characters long. 'PassworD'

<comment><USER54> Sorry, "PassworD" doesn't validate. You're missing a symbol, and you have a character repeated. Try "P@s5w0rd" instead. Or, better yet, "abc#1234" as suggested in the examples.

<comment><USER53> We've moved on to a fictitious setup. I was so disgusted with my bank and their password policies and authentication measures. They too restrict to 8 characters, but they happen to also offer a SecurID token. This token can be used in conjunction with the initial authentication. I would happily switch to any bank where I can know my data is secure. How do we trust them?

<comment> X-Istence I have a student loan that is limited to 8 character passwords. Thing is, when you go to set your password the first time it will happily take the password and use it, good luck getting in though because the next time you go to enter your password the web form truncates it for you (using JavaScript upon submitting)!

Then when you go to reset your password they keep telling you that your password doesn't meet the requirements (the form allows you to type as much as you want) but doesn't tell you about the 8 character password rule. Then when you finally get one that works and you are logged in (12345678 is not a secure password, but apparently that is fine) you go to change your password and this time they will tell you that 8 characters are all that is allowed, but the web form is set to only accept 7 characters, so you have to use the Safari Inspector to change the form to accept 8 characters and submit.

And unfortunately I can't leave them because it is a loan and not just a checking account. Thing is, even I don't know my password anymore, so it is as secure as it can be :P

<comment><USER55> > And unfortunately I can't leave them because it is a loan and not just a > checking account.

You may be able to refinance the loan through another bank, which would pay off this one and let you go with someone more reasonable.

<comment> X-Istence If I could get the same interest rate or lower I would do it, but as of right now I would get lucky if I could find one that gave me 3x the interest let alone higher...

</comment></comment></comment></comment></comment></comment></comment><comment><USER56> Password Sucks</comment>


Fabrice Bellard [pdf] - <AUTHOR> http://www.freearchive.org/o/55dfc9935a719fc36ab1d16567972732c2db1fd7d7e3826fd73ee07e4c3c7d0b

<comment><USER2> Heh, funny to see this still floating around. This is the first draft of a paper I wrote with a partner for the "breadth and history of computer science" (EECS 101) class at Northwestern University my freshman year. At the time I found myself having just finished submitting a handful of patches to the FFMpeg project the year before I entered college, just finished a major patch for QEMU that winter, and using tinycc in a dumb project for using distcc to quickly find compile errors in huge C projects. When my professor/advisor put up this assignment and asked us to chose a notable character in the field I of course jumped at the chance to get to know the man as well as I had gotten to know his work.

To be honest, I'm a tad ashamed at some of the grammar and spelling mistakes in that draft. As you can see from the citation style and LaTeX footer, it was suggested by my advisor that I submit a draft to one of the general ACM journals for publication, but I never got around to it, so I never fully proofed the paper either.

<comment><USER3> It's really funny. I built freearchive.org for archiving my del.icio.us bookmarks (tagged with fa:archive). I tagged your draft sometimes ago (<http://www.delicious.com/adulau/fa:archive+qemu>) just because it was a good summary of Fabrice works. But I was not really expecting the archive to be useful for someone else...

</comment></comment><comment><USER4> (X = E ́cole Polytechnique)

      X stresses a curriculum of breadth, rather than depth. Although the university
      specializes in engineering, students are required to take classes in sports and
      humanities. Students spend the first four years studying a wide undergraduate
      curriculum before their year of military service and then spend the remaining year
      exclusively studying their specific major.
      <…>
      The goal of the X curriculum is to develop critical thinking skills rather than
      preparation for an engineering occupation.

We still have system similar to this. Too bad many students don't like it :( I often read and hear cries "we ain't gonna need this". Not going to need brains? And yes, critical thinking involves the knowledge of some trivia.

<comment><USER5> But why do French universities appear to perform relatively poorly in several international university rankings?

<comment><USER6> Anecdotal, but some French computer scientists I know think language is one factor for their relative invisibility: basically everything is done in French, and much of it is _required_ to be in French. The increasing practice in some other European countries is to allow a greater scope for English in the sciences and engineering.

In particular, any official thesis or report must be in French, which means that the thesis itself won't be widely read/cited internationally, _and_ means that it can't be directly chopped up to make English-language journal articles; the student would have to translate their own thesis to republish parts of it in journals. In addition, they aren't generally required to be able to: since everything official is done in French, it's not necessary for a student to have English writing skills of a level sufficient to write for a scientific journal (though they do generally need English _reading_ skills sufficient to read papers in their area).

<comment><USER7> _> basically everything is done in French, and much of it is _required _to be in French._

« La langue de la République est le français. » ("The language of the Republic is French"), first sentence of the second article of the French Republic Constitution (see [http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITE...](http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000006071194)).

Since universities are public, so republican, schools, it makes sense to make them apply and respect the constitution.

The idea is that any French citizen is able to have access, read and understand any published university thesis (PhD), since they paid for them (via taxes). In the same vein, students of the École Polytechnique are required to work 5 years for the State after their studies, since the State paid such a good formation to them.

French can always go to private school (or emigrate) if they don't agree with that.

<comment><USER8> "Since universities are public, so republican, schools, it makes sense to make them apply and respect the constitution."

Many constitutions have a clause like that. Encouraging international visibility, which requires English language skills, is not contrary to that.

"French can always go to private school (or emigrate) if they don't agree with that."

The point is that they're cutting off their nose to spite their faces. French researchers and students, and citizens more in general, are isolated in their own little world because their strange sense of 'pride' is causing them to be so. I don't care, really; but I do sometimes feel sympathy for those that I talk to who realize this and (rightfully) blame the system for their lowered chances at international success.

<comment><USER7> _> Encouraging international visibility, which requires English language skills, is not contrary to that._

No, it's not, and international visibility is obviously a good thing! But there is a problem if a PhD is published _only_ in english, because then there might be French citizens who will not be able to read a work they paid for (remember, the public education system is funded by the taxpayers-citizens). Since most people yelling about the "language restriction" problem actually imply that they should be able to publish in english _only_ , I did recall that this would be unconstitutional in France. _Additionally_ publishing in english has never been forbidden or discouraged!

 _> I do sometimes feel sympathy for those that I talk to who realize this and (rightfully) blame the system for their lowered chances at international success._

This system is the application of the law. The French law is the consensus of all the French citizens on the way they want to live all together. If you, individually, don't like the law, you can militate for a change (possible since France is a democracy), or leave the country, if you really can't live with this general consensus. _Dura lex sed lex_.

In this specific case, you can also just go to a private school which will let you write in english or whatever. Sure, you'll have to pay there; sorry, you can't have the free public education with no duties in return in France.

Ideologically speaking, the French education system is very egalitarian and very meritocratic. Lots of people don't agree with it (the majority still does). That's why the private schools were allowed (after a violent public debate). But it's a chosen, working and interesting system. Yes, you can _"rightfully blame the system"_ , in the sense that you have the right to disagree, but otherwise it's not any more _"rightful"_ to blame it than to blame any other working system (e.g: the US one). It's just a different conception of education and its place in the society.

<comment><USER9> > But there is a problem if a PhD is published only in english, because then > there might be French citizens who will not be able to read a work they paid > for (remember, the public education system is funded by the taxpayers- > citizens).

Maybe those citizens should learn English.

But one of the main reasons why so many people in France don't speak English is precisely their broken educational system. (This is not exclusive to France, Spain for example is very similar.)

> Ideologically speaking, the French education system is very egalitarian and > very meritocratic.

I don't see how a system can be both egalitarian and meritocratic.

> But it's a chosen, working and interesting system.

It is a system that fails the majority of the population ans only benefits the extremely small elite that gets to go to the Grandes Écoles.

<comment><USER10> "I don't see how a system can be both egalitarian and meritocratic."

Egalitarian: education is free for all, and richs and poors (normally) go to the same school, the one of their town, until at least 16. Egality of chance.

Meritocratic: but after 16, you go to the university or a grande école according to your abilities/ranks. The best can go to Polytechnique, the good can go to a grande école or a good university, the rest goes to the other universities (and it's still free for all).

It doesn't matter if your parents are poor and if you were born in the country and not in Paris, if you're great you can go to Polytechnique. And no matter how rich the parents, if you suck, you won't go to Polytechnique.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Fabrice is a rare genius of immense proportions. Although the summary mentions some of his former work on the FFT and computing Pi, it was written before his more recent record breaking feat:

<http://bellard.org/pi/pi2700e9/>

The linux kernel in a browser blows my mind. This is surely an immense amount of work. How does a mere mortal find the time!

And don't forget his IOCC entry (in 2048 bytes) of a self compiling C compiler:

<http://www0.us.ioccc.org/2001/bellard.hint>

</comment><comment><USER12> I like the reference given in the first paragraph:

      These computer scientists have become personalities as well as authors,
      earning universal respect and sometimes a cult Following. [Munroe]

Munroe is listed in the bibliography as <http://xkcd.com/163/>

</comment><comment><USER13> As mentioned by someone in the "boot the Linux kernel in your browser" thread, don't read this if you are patting yourself on the back (meaning you should read it: all of it).

Fascinating; I had read very little about him before this, so thanks.

</comment><comment><USER14> I haven't checked git blame, but I suspect most of the FFmpeg features ascribed to him were actually written by Michael Niedermayer.

Of course he did write it, but it's quite different now or even in 2004 than it was at the beginning.

<comment><USER2> Sure, Michael has had a significant (defining) contribution. I don't think that really makes a difference for these purposes though.

</comment></comment><comment><USER15> I knew him only for TinyCC, but looking at everything he accomplished I can see him as a pure coding genius.

<comment><USER16> Don't.

[http://deconstructinggenius.wordpress.com/2011/04/22/there-i...](http://deconstructinggenius.wordpress.com/2011/04/22/there- is-no-magic/)

<comment><USER17> Are you really sure ? <http://bellard.org/dvbt/>

</comment></comment></comment><comment><USER18> Does anyone know where he works?

I've done a bit of Googling and can't find anything.

<comment><USER19> It's been suggested on the other thread that he works at Netgem: <http://fr.wikipedia.org/wiki/Netgem> (sorry, the link is in French, but it's been deleted from Wikipedia EN). Wikipedia FR for Fabrice Bellard supports this claim.

A quick google for "fabrice bellard netgem" shows his email address at Netgem and a slew of C header/source files copyrighted Netgem and written by him, so he was definitely working there at some point.

</comment></comment><comment><USER20> If you combined this guy with Linus Torvalds and [insert charismatic Twitter- celebrity hacker of choice here], you would have Manfred Macx.</comment>


Tell HN: The day that lasted 25 hours - <AUTHOR> I wonder how many people using MomentJS are aware of this.<p>http://jsfiddle.net/mauron85/aujyeacc/ <comment><USER2> A version for the US DST: [http://jsfiddle.net/j7tf54xn/](http://jsfiddle.net/j7tf54xn/)

It's the test spec that's wrong. On the day DST ends, the hour from 1:00 to 1:59 is repeated twice, which gives you 25 hours. When DST begins, that day is only 23 hours long. MomentJS isn't doing anything strange here.

<comment><AUTHOR> Ok. I've been already punished on stackoverflow for this question. But what about moment isDSTShifted method? Doesn't seems working. The shift was on 2:00AM.

But both moment('2015-25-10 2:00', 'YYYY-MM-DD HH:mm').isDSTShifted() moment('2015-25-10 3:00', 'YYYY-MM-DD HH:mm').isDSTShifted()

return false

<comment><USER2> Those are both supposed to return false. isDSTShifted() tells you whether the datetime you entered was shifted by the library because it doesn't exist in daylight savings time. For example, in pseudocode, if you try to "add 1 day" to "2:30AM the day before DST begins", it'll be shifted because there is no 2:30AM on the resulting date. The clock skips from 1:59AM to 3AM that day.

Here's a fiddle showing isDSTShifted() working with the US DST start (I don't know what date to use for your location):

[http://jsfiddle.net/d9tz0tv1/](http://jsfiddle.net/d9tz0tv1/)

I think you're looking for isDST()?

<comment><AUTHOR> Do I have to call something like moment.tz() before isDST()?

</comment></comment></comment></comment><comment><AUTHOR> Ok you're test is failing in my timezone. But it is OK, as far I understand (still not 100% sure if I do) :-).

But: moment('2015-25-10 2:00', 'YYYY-MM-DD HH:mm').isDST() moment('2015-25-10 3:00', 'YYYY-MM-DD HH:mm').isDST()

return false.

That's not correct in my TZ. Confused.

<comment><USER2> DST ends at 1:59AM. 2AM and 3AM are after DST ended, so it is correct for isDST to return false.</comment></comment>


Wikipedia link hidden by 'right to be forgotten' - <AUTHOR> http://m.bbc.com/news/technology-28640218?ocid=socialflow_twitter

<comment><USER2> But which one? Can't read TFA as it's blocked here.</comment>


MacBook upgrade set for Q3 - <AUTHOR> http://www.9to5mac.com/macbook_upgrade_schedule <comment><USER2> I was wondering when to splurge for one; now I know.</comment>


The dangers of optimization - <AUTHOR> http://refactoredthinking.com/2013/03/24/the-dangers-of-optimization/

<comment><USER2> Actually Knuth wrote "We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil." It's _premature optimization_ that Knuth says is evil, not all optimization. Big difference.

<comment><AUTHOR> Updated, thanks.</comment></comment>


Silicon Valley's acquisition fever is bad for innovation - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2014/02/20/silicon-valleys-acquisition-fever-is-bad-for-innovation/ <comment><USER3> Sigh, survivor bias taints this analysis so hard it hurts. There are lots and lots and lots of innovative startups that don't get acquired and go through the whole process without all that much press. You don't see them, it's boring to read "Startup that changes the ways machine tools are stocked at machine shops turns in another year." The really crazy ones (either crazy funding like Color, or crazy exits like WhatsApp) get _lots_ of press, and so one things "oh they are all like that."

Acquisitions are a way that investors get their money back, so they encourage investors to invest in startups, and by its nature that _encourages_ innovation. Perhaps not as much as random $100K grants given out on the street corner would, but it does encourage company formation and execution. IPOs do the same thing.

What investors _don 't_ like is a company they invest in, own a big chunk of the equity and it never goes anywhere. So called "zombies", companies that are nominally profitable, but not not enough cash flow to support M&A, too much cash flow to just roll them up. Those companies need an innovative way to 'cash out' their investor over time so that they can get on with their lives.

<comment><USER4> _Acquisitions are a way that investors get their money back, so they encourage investors to invest in startups, and by its nature that encourages innovation. Perhaps not as much as random $100K grants given out on the street corner would, but it does encourage company formation and execution. IPOs do the same thing._

I have trouble understanding this paragraph. It seems to argue that acquisitions encourage company formation and execution. So far so good--but what's the definition of _innovation_ in this discussion anyhow?

Perhaps the most confusing idea to me is suggesting that investing in startups _does_ encourage innovation, but not as much as randomly giving out grants would. Is it possible to compare the efficacy of the VC, M&A, IPO ecosystem to those targeted grants or even a guaranteed wage? To me, _that_ is worth exploring.

Instead I fear we get SV press releases heralding innovation in something-- anything--other than yet another example of cashing out for the established network of moneyed interests.

</comment></comment><comment><USER5> As long as these newly minted millionaires & billionaires continue the Silicon Valley tradition of reinvesting their money back into new startups then I think we'll more than offset the potential innovation we lose by them being locked away and their own companies merged/shuttered.

Now if the culture ever changes and people start hording their money, then I'll agree we have problems.

<comment><USER6> _Now if the culture ever changes and people start hording their money, then I 'll agree we have problems._

They're hoarding it within their own closed social network. The new purpose of VC is to make trust-fund kids look legitimate (see: Snapchat, Summly, Clinkle). It's the same effect: the ecosystem doesn't die, but gradually becomes uninspiring.

</comment></comment><comment><USER7> He says "Suppose that Yahoo had pledged to allow Google to operate independently...Chrome and Android likely would never have gotten off the ground." But Android was...an acquisition.

<comment><USER8> "..but it just wouldn't have occurred to the people running Yahoo's search subsidiary to branch out into web browsers and mobile OSes" \- That's probably true, regardless if via acquisition or in-house development.

</comment></comment><comment><USER9> Not only is this argument wrong, the /opposite/ is true.

Buyouts are actually the /engine/ of innovation. They're the fuel. The oil.

You know this yourself. Just take a quick look at Silicon Valley - it's a hotbed of innovation. If you believed this argument, you'd expect to see a dirge of new businesses & a desert of new ideas. That's just not true. We have wearable tech. Quantified self. Bank challengers. News extractors. And things that don't even have names. The place is full of vibrant startups & new ideas. Just compare it to the energy, banking or agriculture sector.

So, why is the argument wrong?

Because buyouts /liberate/ innovative entrepreneurs from their old companies so they can go onto to found new startups - new startups that push the envelope again. San Fran is full of serial entrepreneurs who skip from one place to the next - first, revolutionising auctioning. Then, payment processing. Then, something else.

Just look at the PayPal mafia: [http://en.wikipedia.org/wiki/PayPal_Mafia](http://en.wikipedia.org/wiki/PayPal_Mafia)

What if PayPal hadn't been bought out. YouTube might not have existed. Nor LinkedIn. Nor Palantir. SpaceX. Yelp. Yammer.

Buyouts lets these innovative people sell-up - at the right price - and move on. Not only that, but they allow them to move on with additional capital that they can plough into their next venture.

If buyouts didn't happen as often, entrepreneurs would have to wait another 3-5 years - or even longer than that - for an IPO. It would lock in capital, and enterprise would suffer. Plus, an IPO is mighty expensive & just not right for some businesses.

Entrepreneurs would be locked into their first companies.

This 'lock-in effect' is exactly what happens when Governments raise Capital Gains Tax - the tax on the profits of selling a business. If it's harder (or more costly) for an entrepreneur to cash out and move on, they stagnate - <USER2> so does innovation. This is a well-known and studied phenomena: [http://www.fas.org/sgp/crs/misc/R40411.pdf](http://www.fas.org/sgp/crs/misc/R40411.pdf)

Acquisition don't suffocate innovation.

Acquisitions are the oil of the economy.

<comment><USER10> > The place is full of vibrant startups & new ideas.

While there are certainly exceptions the vast majority of startups are _not_ very innovative. Having some slight twist on sharing photos or sending messages or analytics isn't innovation.

<comment><USER4> Redefine "innovation" as "generate money for VCs". Then anything which lets you sell eyeballs to advertisers (or metadata about eyeballs to advertisers) becomes innovative, if you do it at the right scale.

<comment><USER11> That's not really the meaning of innovation, though.

<comment><USER12> Some amount of innovation seems inevitable for any successful startup. Most of us could build a site in a weekend that does image sharing, but it would take some serious innovation to scale the site up to a billion users without blowing the bank on infrastructure. Doing the same thing people have been doing, but at 1/10 the cost is clearly innovative.

Whether its scale, raw idea, business model, speed, quality, or whatever; there has to be something new to get any significant traction. Are all types of innovation equal? Of course not, but all types provide some sort of value. Throw open source into the mix and you start to see the network effect in play where even "useless idea" startups provide value (although the creators may not get much return on it) in the form of assisting more useful ideas come to fruition.

<comment><USER13> That innovation is now commoditized: AWS will let you buy it. The first few times it was a big benefit to society to get invented, but the next social app won't advance what society can do the same way the first one did.

</comment></comment></comment></comment></comment></comment><comment><USER14> and the alternative would be? why would VC invest money with such an ease if there wouldn't be a good chance of a good exit? And how would you have innovation without VC? I mean take any place outside Bay Area - such anyplace would be an exaple of innovation without easy VC.

>WhatsApp is the kind of unconventional startup that could have changed the world if it had grown into an independent public company.

future is easy to predict.

>It might have been able to attract some of Silicon Valley's most talented engineers and pioneered new business models that don't rely on intrusive ads and pervasive data collection.

and the money to pay these engineers would come where from? I mean if we exclude "intrusive ads and pervasive data collection" as the revenue stream (the stream that glorified in the article Google mostly relies on).

<comment><USER15> Startups could create products that generate revenue. They would use invested money to scale quickly.

<comment><USER14> by the time startup reaches 19B valuation i'd say it either have created such product or there is no chance for it to happen.

<comment><USER4> Valuation by which criteria? The asking price of an acquisition, paid in RSU with their value measured in the potential asking price for an acquisition? This seems a little circular.

<comment><USER14> "The fair market value is the price at which the property would change hands between a willing buyer and a willing seller, neither being under any compulsion to buy or to sell and both having reasonable knowledge of relevant facts."

<comment><USER4> Perhaps a more specific question is: what's the valuation in a real currency such as USD, not the monopoly money of FB RSUs?

</comment></comment></comment></comment></comment></comment><comment><USER16> He forgot that those big acquisitions give employees enough money to start their startups independently and be crazily innovative.

If I get $500M I might work on my good bad idea. Good bad ideas like Space X

</comment><comment><USER17> Meanwhile, in the rest of the world: _" What I would give to have problems like that"_...

</comment><comment><USER18> Acquisition fever is certainly a force pushing innovation downward, and I think the argument this article puts forward is sound. On the whole, however, I think innovation in the technology sector is driven by other factors. In particular, the barriers to entry for a new company in the technology space are extremely low.

Once upon a time a young company needed to devote significant monetary and human capital to building their software and hardware platform. Today, they can use open source frameworks and commodity hardware. Marketing once meant medium to big media buys, which had high entry costs and provided little to no insight into their success. Today you can literally buy attention by the individual customer, and enjoy a deep and detailed understanding of the success of your campaign. In addition the (relative) abundance of early stage investors means if you have an idea, you can bring it into reality with (relative) ease.

Innovation is so cheap that it doesn't have to happen inside a big company anymore. If a team gets bought out and cannot pursue a new opportunity, someone outside the company will step up and go after it.

</comment><comment><USER19> The (bad) article discounts at least the following:

1\. Often acquisitions thrive under their new overlords (think android, youtube, instragram). They might also need the financial resources of the purchaser to aim higher.

2\. Acquisitions increase the # of potential angel investors, which leads to more money for startups. Look at what PayPal's acquisition has done for innovation (it's famous "mafia" ended up funding and/or founding Facebook, Tesla, Palantir, Spacex etc.)

3\. An acquisition culture leads to more examples of successful founders, which leads to more people wanting to be founders.

</comment><comment><USER20> Silicon Valley has a cash 'problem.'

AAPL - $158b, GOOG - $58b, CSCO - $48b, ORCL - $37b, INTC - $20b, HPQ - $16b, FB - $11b, EBAY - $9b

$357 billion in cash among just the top eight tech firms (cash wise). Those eight firms are generating roughly $100 billion a year in profit, compiling that cash hoard ever larger.

It's not surprising Silicon Valley has acquisition fever. Cash and equivalent yields almost nothing these days. To top it off, the stock market is at all time highs, so stock-as-acquisition-currency is primed as well.

</comment><comment><USER21> this is a silly article. re-write the headline and it is an explanation of reality:

SV's innovation fever is driven by acquisitions (or the possibility anyway).

People launch companies, iterate like mad, in the hopes of a payout of some kind. willing to go without revenue to prove out a concept quickly. the endless trial-and-error results in a lot of interesting outcomes. the reward is the acquisition.

</comment><comment><USER22> It's worthless to speculate about what would have been if this or that. There is no way to know. It is sad, however, when the aquisition happens simply to remove competition like some of the buyouts that are immediately followed by startups removing their product offerings.

</comment><comment><USER23> Google maps was based on an acquisition, as were many of Google's marquee products:

[http://en.wikipedia.org/wiki/List_of_mergers_and_acquisition...](http://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Google)

</comment><comment><USER24> Acquisitions provide liquidity for startups that hope to realize value only in the long-term. This is actually a good thing because it can actively encourage more ambitious startups.

</comment><comment><USER25> This is a very poor conclusion, but arguably will sit very well with the audience of the general populace who will feel smug that "they had the idea of whatsapp and facebook first":

> _But any new products he launches will be shaped by Zuckerberg 's vision for > the web, not his own. And that's a shame._

Innovation is a vehicle for the creation of wealth. Innovation is in and of itself fairly worthless. The only reason the concept of innovation is so popular is because of the value (and the valuations) we put on companies who are seen to be innovating. I don't think it's in question that a lot of wealth is being created right now. Where's the shame in that?

</comment><comment><USER26> It's bad for innovation at Whatsapp but great for innovation in Silicon Valley as capital flows back into the cycle.

<comment><USER27> Yes, it flows back again, so the founders of Whatsapp can go fund another photo sharing or messaging app with another twist.

</comment></comment><comment><USER6> As a place for innovation, Silicon Valley is dead. It's now a cross between Hollywood for ugly people and Wall Street for people who can't hack winter.

Acquisitions aren't the problem. If the alternative is hard-stop failure, meaning the work and acquired knowledge is effectively thrown away, I think M&A is far better. What _is_ a step down is the replacement of R&D by M&A, but that's the fault of shortsighted executive fuckheads all over the country-- not limited to the Valley.

If you see the Valley as another Wall Street-- with a similar corporate ladder (engineer -> VP/Eng -> CTO -> founder -> investor)-- it will piss you off less. But you will also realize that it's a much crappier Wall Street-- worse pay and bonus structure, less prestige outside of the Bay Area echo chamber, more project-management bullshit (e.g. "iterations" and extreme closed allocation and "story points"), less autonomy, and more age discrimination-- and wonder why the fuck anyone would go into the startup game (unless born into VC connections).

The danger of startups (by the way) is that if you play that game for too long, you end up stuck in it because the "job hopper" stigma makes it hard to move back to hedge funds. This might have been OK when engineering roles at startups had real upside, but now that engineer equity allotments are in the pathetic 0.01-0.1% range, it's a shameful and wasteful trap.</comment>


Insomnia 5.0 – Autocomplete, OAuth 2.0, and Better Debugging - <AUTHOR> https://insomnia.rest/blog/insomnia-5-announcement/ <comment><AUTHOR> I'd just like to thank everyone who uses Insomnia for your support and feedback. This update includes features inspired by literally hundreds of email conversations over the past year. So, thank you!

~ Gregory

<comment><USER2> I love Insomnia. Keep up the great work.</comment></comment>


Sex, Income and Happiness - <AUTHOR> http://www.samuelwbennett.com/sex-income-and-happiness/ <comment><USER2> I love the graphs, they clearly show that women have far less sex when they are grumpy and in bad mood general, the effect is lesser in men but still exists. Other graphs clearly show that you should be satisfied with you life in order to get ahead. And negative view on life clearly hinder your ability to increase your income.

</comment><comment><USER3> I'm note sure they showed which was cause and which was effect. I look at that chart and I see that unhappy people have less sex. Not surprising. On the other side, happier people have sex more often than unhappy people. Some happy have sex less often some have sex more often.</comment>


When did the `0x` convention for hexadecimal literals originate? - <AUTHOR> https://retrocomputing.stackexchange.com/questions/15897/where-and-when-did-the-0x-convention-for-hexadecimal-literals-originate <comment><USER2> better than the trailing "h" convention common in the PC era of the early 1990s</comment>


Your phone number turns into your email address: "Mailcell" - <AUTHOR> We've just launched a new application called "Mailcell" which allows users can send e-mails directly to the phone numbers without typing an e-mail address! Users simply type the phone number of whom they'll going to send their e-mail to. Your phone number turns into your email address.<p>You may find our news link below; http://www.cnnturk.com/bilim-teknoloji/is-dunyasinin-whatsappi-olmaya-aday-mailcell http://www.hurriyet.com.tr/is-dunyasinin-whatsappi-olmaya-aday-mailcell-40404241 http://www.sabah.com.tr/teknoloji/2017/03/24/sirket-ici-yazismalarda-yeni-donem-mailcell http://www.dunya.com/tekno-trend/mailcell-120-ayri-ulkeden-indirildi-haberi-355508 Regards, Kamil Volkan Gündüz Mailcell: +905428261202 Mailcell: +905303932034 <comment><USER2> Honestly, that sounds awful. I already guard my phone number more closely than my email because a) spam calls are more disruptive than spam email, and b) it's easy to make a throwaway or catch-all email; throwaway phone numbers are harder to obtain. To the point that phone numbers are being used by some systems as an identifying datum. Hell no.</comment>


Ask HN: Does a bootcamp make sense for someone with 20 years experience? - <AUTHOR> I had a conversation this weekend that made me think a little. It was with someone who had just finished a 12 week  bootcamp and had received offers in the range of 100k-150k without much prior experience. I have >20 years experience and at the moment I work at a medical device company making a little more than 150k without much prospect for advancement.
I have applied at a few jobs lately but I don't have much to show for the currently fashionable technologies and it seems saying "I can catch up in a few weeks/months" doesn't cut it anymore these days. Being 50 years old doesn't help much either probably.
I am wondering now if I did a bootcamp myself if that would get me up to speed with current stuff and open up new job opportunities. If people without experience are employable after 12 weeks I think I should do even better because I will understand the material quicker and should be able to go deeper.
i work a lot with younger people and I don't think the stereotype of young people being innovative and old people being conservative applies to me. Usually I am the one pushing my team to try new stuff and doing creative things.  Unfortunately in medical progress is very slow so you pretty much always are 5-10 years behind state of the art.
So  the question is: Would doing a bootcamp increase employability and possible open up higher salary ranges? Are there any that cater to experienced people?  And what area to go into? I would love doing something around AI or large scale systems. Is it possible get a jumpstart there with a bootcamp?
Hope this makes sense.
PS: Trying too anticipate responses. Usually the advice is to have a network. This used to work for me but the last 10 years it slowly has dwindled because a lot of people left or had to leave the industry in the 2008 crisis. <comment><USER2> No. Boot camps are for beginners, not people with 20 years experience. Their existence is a direct response to a lack of qualified candidates and their sole purpose is to increase the labor supply.

It is a negative to go back to boot camp for you just like it would be a negative if a research professor went back to junior high.

However, if you could find a position TEACHING at a bootcamp that would be better.

<comment><USER3> > _However, if you could find a position TEACHING at a bootcamp that would be > better._

I disagree. From what I've seen of bootcamp instructor postings over the years, they usually pay terrible, and OP said they're already pulling in over 150k.

It would make more sense for OP to just deep dive on modern JS web stack, or Rust, or whatever new technology they wish to become proficient in on their spare time if they must. Side projects are a great excuse to do this. Then make the career change jump after they're proficient.

<comment><USER4> Most I've seen will pay a lot of money for P/T instructors, exactly what Op should be doing with his massive amounts of experience then working the rest of the time on some research none of us can understand.

</comment></comment></comment><comment><USER5> On the ageism - I feel for you man.

But I recommend not doing one. You are skilled enough that you could dedicate yourself to 3 to 6 months of serious study of the technologies you are interested in. Teach yourself by doing projects that interest you, and then use those projects as evidence of enthusiasm and experience.

Boot camps might be beneficial if you don't feel capable of teaching yourself, but they will have so much training-wheels stuff that you are well past so it will be a mixed bag of value. Plus it costs a lot of money.

I don't think the fact you did a bootcamp will increase your value much. Certainly not as much as self study and projects in a public git repo.

<comment><AUTHOR> I know I could easily study up by myself. I have done this my whole life. I am just getting the impression that without being credentialed in some way nobody really would give me a chance. Especially in a new field.

My current job is pretty much repeating the same thing over and over again with ever tighter deadlines. I am at the same time stressed and bored out of my mind. There is no intellectual or technical challenge, just always more pressure. I used to be pretty cutting edge but the last 5 years it was pure stagnation.

Somehow I want to break out of this but between age and lack of the latest stuff on the resume it seems it's really difficult to get a foot in the door somewhere else.

Do people really look at GitHub repos? I have never had anybody ask and I have never looked myself.

<comment><USER6> Credentials - in my experience they just aren't a thing in software development. Apart from juniors just starting out I've never once seen a CV or a job application that mentioned any kind of programming credentials or certifications (if I understand you're meaning of "credentials" correctly?). For getting into a new area of development some ways to prove yourself are:

1\. Contribute to open source codebases

2\. Work on side projects

3\. Convince your existing company to use a new technology so you can work on it in your day job.

Maybe others? I can't think of anything else right now..

Github profiles can be a bit hit or miss - I think probably most people don't really look at them. However if you have made meaningful contributions to open source codebases on github then you can link to those in your CV, or mention it on your covering letter or just mention it in the interview.

</comment></comment></comment><comment><USER3> > _... and it seems saying "I can catch up in a few weeks/months" doesn't cut > it anymore these days. Being 50 years old doesn't help much either > probably._

A lot of companies have job postings that have wording to the effect of "you are proficient in xyz or are willing to learn xyz", and I see it often enough for senior positions. When I see it in the latter case, I view it as an excellent signal of a chill, mature team.

Like you I believe it should work that way. Barring the most urgent scenarios, it's largely bullshit to reject senior talent that's capable of deep diving on new stacks rapidly.

Best of luck to you.

</comment><comment><USER6> No, do not do a bootcamp. As others have said bootcamps are for people who have never coded before. If you want to up-skill and get a job using more current technologies, then you can self study in the evenings and weekends (if your circumstances allow for it) or you can quit your job and spend a few months learning a new technology/platform/language etc. (again, if your circumstances allow and if you have enough savings to do this). It sounds like you are itching for a more fast paced (to use a cliche) environment so I would recommend you start looking at other companies to work for while trying to learn the skills necessary for those jobs.

That said, if its mainly salary that you're concerned about then 150k is a pretty good amount. Even in more "trendy" companies - there is a ceiling to how much developers earn, AFAIK the only way to earn more than ~200k as a developer is to work for a FAANG company.

Finally, don't think that just because you heard one story about somebody who got a 150k job straight out of bootcamp that this is the norm. The reality is most bootcamp grads find it extremely difficult to get a job because there is so much competition for junior developer roles these days.

</comment><comment><USER7> In my experience ageism is a real factor. So no matter what's on your resume, once they see your grey hair, if you have any left, the negativity kicks in. Of course they won't actually say that, perhaps "too experienced" for the role? Or looking for skills in a trendier area.

Have you confirmed that people actually end up working for that sort of money after a 12 week bootcamp? From what I have heard few companies will pay that much for somebody with only having completed some bootcamp and having minimal track record. It could all be just marketing spin.

Typically if you want to switch into a new field, then not only would you need to learn the applicable technologies, but also get some experience. For example, it is rare that you could pivot your medical device experience to data science and machine learning and keep earning at least the same or more.

</comment><comment><USER8> I can give you my anecdote of a similar situation. I was pigeonholed into a job using legacy tech a couple years ago. I quit because it was a dead end. I found a company willing to let me learn modern tools on-the-job, which I did. That ended up not panning out in the long run because of work/life balance. But that is when the story gets interesting:

My next job was the old job. I got hired back into the job I quit, but instead of being stuck on the old tech, I'm working on modernizing multiple old products, including my own legacy products, into new tech.

It wasn't the original plan, but it ended up being a 12 month sabbatical to modernize myself.

</comment><comment><USER9> I recommend Udacity or any other type of structured learning. I personally have a difficult time learning something unless it's in a classroom-type environment or a virtual classroom.

When I was catching up to development trends bootcamps weren't around. I went to a ton of Meetups and I didn't understand a lot of what I heard. I'd note things and research them and hearing certain concepts over and over paid dividends when I was eventually able to make connections in my head.

</comment><comment> em-bee for me to hire someone like you the main question is that you have a good idea of what you are getting into. without any relevant work experience i'd worry that you might find that this new field is not for you, and you'd rather do something else. (i know i can expect you to try your best to keep the job, but i'd like to know before hiring if you'll enjoy it)

you won't need a bootcamp, but you should at least be familiar with the territory.

aside from that, try some thinking outside of the box. what other experience do you have besides programming? what industry knowledge have you gained from working at a medical device company?

are there any startups where you can use that industry knowledge?

or try freelancing? what are the pain points in the medical device industry? can you solve them and sell those solutions?

as mentioned, for regular employment 150k is kind of a ceiling. to go beyond that you need to do something to stand out.

[https://jonathanstark.com/](https://jonathanstark.com/) has some good arguments about that pay ceiling. it applies to freelancers billing hourly just as much as it applies to employees because in both cases you are paid for time. to earn more, you need to break out of that.

</comment><comment><USER10> Are you sure you need a bootcamp? It sounds like you are selling yourself short and/or not getting job prospects in the right fields. As someone who recently was reviewing resumes bootcamps are so variable in quality that they are in the same boat to me as no-name certifications. A bootcamp is just making the time to spend dedicated effort for you to learn something and it's only going to give you as much as you put in. If you've spoken to people and heard success stories it's likely not because they went to the bootcamp but they used that time effectively- this is the common advice for any of these short-term career shift sort of programs for any industry.

Are you sure that AI or large scale systems actually exists in the markets you are looking for? Not all markets support the same industries and as you would probably know the number of times it's just lip service and held together in the back with cellotape is still amazingly high. To really get into this sorts of things you would probably be having to pursue a role labeled as architect if it wasn't a market where these things were relevant. The kind of job you are looking for probably isn't being posted in a place you can find it, and I have found that recruiters are the gatekeepers not any public posting. I haven't tried cold messaging recruiters of companies I am interested in on LinkedIn but I think that's probably what I would do, you could also cold message engineers working in something you find exceptionally interesting.

Try some of the alternative sites like hired.com where it just isn't blindly submitting resumes.

Are you just interviewing poorly? Is your resume even relevant? I remember reviewing someone's resume last year that still had Windows 98 as a skill. As just a general resume trend listing every version of a thing you know is less popular than listing the types of skills you have and if they want further details be ready to provide it.

From the salary side are you just capped out for the market? There are definitely some places where 150k is the ceiling that's very hard to break without some sort of exceptional relationship with you as an individual and the employer, or an industry that just happens to command higher salaries. If you want to get into say 250k town in a 150k market you've got to be doing something differently than just being a tech lead and trying to climb the ladder.

A couple weekends to get up to speed so you can talk to the interviewer at the same level will always do better than 'I can catch up' but in the conversation it is clear you are missing the big picture. Someone who is living and breathing the problem but just needs to switch gears to actually apply themselves to it will go to the top of the stack versus someone who is like 'teach me.' So many people show up to interviews and show only passing interest in the work to be done and the conversation. Don't be that person.</comment>


U.S. Weighs New Move to Limit China's Access to Chip Technology - <AUTHOR> https://www.wsj.com/articles/u-s-weighs-new-move-to-limit-chinas-access-to-chip-technology-11581942688 <comment><USER2> Seems like all this is going to do is give more impetus to making SMIC be a real TSMC competitor. Sort of like how the US banned certain Intel chips in China because they were making a supercomputer with them, so China starting building the most powerful supercomputers with home built and designed chips.</comment>


What is the future of the mobile app (specifically games) economy?  - <AUTHOR>

IAPs, Ads, and Paid apps rule the day today, is the a future beyond those three? The Deck (http://decknetwork.net/) for mobile? Others? <comment><USER2> Game companies are all the way in for bait-and-sell IAP model. In other words push some pain intermittently and then try to sell the painkillers. Which seems to work for them at least for now. I wish we would have a more healthy model to cover the production+marketing costs, but it's not gonna change anytime soon...

For apps with more utility, still there is a chance to go for upfront payments, but then again significantly slowing down user traction especially when there are free alternatives (even if they are not any good)

And there is the ad-supported model, which boils down to how much traffic your app generates, from which countries and how engaging your app is. A reaaalllly long shot for all the apps except for a lucky few</comment>


Fukushima plant operator to evacuate control room personnel - <AUTHOR> http://www.sify.com/news/fukushima-plant-operator-to-evacuate-control-room-personnel-news-international-ldpvklficcj.html

<comment><AUTHOR> During the discussions I saw several times the argument on how well the nuclear power plants stood up considering the magnitude of the desaster. I just can't share this opinion as the crises is still unfolding and it is not clear what the outcome will be.

To me the nuclear energy debate should be made with a real long term view beyond this event and the next decades. There is nuclear waste, aging reactors all these things need to be carefully considered to be sure if this is really the choice we want on how we create energy.

I am personally against nuclear power plants, but even if that technology continues to be used the demand should be made that it will be build and operated as safe as possible.</comment>


Ask HN : Blogger, wordpress? Which one is good for programmers? - <AUTHOR>

I wanted to start a programming related blog where I will be occasionally be posting code snippets. Primarily C and Python but also some Scala. I was looking for a blogging system that will help me do some code highlighting and indenting. Which service will you recommend? Or should I host my own and if so using which my software? <comment><USER2> How about this: <http://code.google.com/p/syntaxhighlighter/>

It works with WordPress, MoveableType, etc.

<comment><USER3> Here's another JS-based syntax highlighter: <http://softwaremaniacs.org/soft/highlight/en/>

And here's what Google Code uses: <http://code.google.com/p/google-code- prettify/>

</comment></comment><comment><USER4> I remembered this discussion from before, perhaps this will help you:

WordPress or TypePad or....? 'd like to start a blog and I am wondering which platform HN suggests. Thanks for voting/discussing! <http://news.ycombinator.com/item?id=280016>

Also, very good discussion here: Blogging platform: Wordpress or Webby?

I'm relaunching my blog and I'm considering two platforms, Wordpress and Webby/Webgen/staticfiles. I plan to use disqus comments for both, and my requirements include easy embedding of media and syntax-colored code.

<http://news.ycombinator.com/item?id=338485>

<comment><AUTHOR> Thanks that was helpful. One of the complicating factors in my case is code highlighting and particularly handing Scala code. But as others are pointing out, I guess I can think of it as a client side problem independent of what blogging software I run.

</comment></comment><comment><USER5> Rolling one's own is always a nice little project, but whether that's the right option for you will depend on whether you're prepared to take the time to do it, or if you have other priorities. Installing WordPress takes a couple of minutes if you want a decent amount of control over your software but without the hassle of writing your own, and there are plenty of decent themes and syntax highlighting plugins out there.

</comment><comment><USER6> I want to know which blogging platform would be the best for a programmer running a shareware business.

<comment><USER7> I think that a self-hosted blog would be better, because it looks more professional.

<comment><USER8> You can always use a CNAME record to point blog.mysite.com to the hosted blog.</comment></comment></comment>


How good is IPv6 only Internet? - <AUTHOR> https://xor.wf/how_good_is_ipv6_only_internet.html <comment><USER2> It's tough because of backwards compatibility issues.

Are you deploying a network?</comment>


10 most influential personal computers – in pictures - <AUTHOR> https://www.theguardian.com/technology/gallery/2017/feb/17/10-most-influential-personal-computers-in-pictures <comment><AUTHOR> I'd argue that the Alto and Mac are the most visionary, it's the beige IBM PC that allowed the market to explode. And the keyboard on that Thinkpad. Why can't a laptop have these kinds of keyboards?</comment>