Landing Page in a Day – Get a custom landing page that converts - <AUTHOR> http://landingpageinaday.com

<comment><USER2> $1000 is a huge amount of money for what looks like a very basic landing page. In my opinion it would be better to just shell out $150 for the designmodo's startup framework, [http://designmodo.com/startup/](http://designmodo.com/startup/) and spend an afternoon tailoring it to your needs.

<comment><USER3> I don't think that $1000 is to much for a service like this. Having worked with many non technical founders I know about their pain of finding someone who builds a landing page for a reasonable about of money.

I also know quite a few solo founders with a technical background who have pretty shitty landing pages, even though they know (technically) how to build one and/or extended one from themeforest. They just forget about white space, proper padding and stuff, but hesitate to hire a designer for a day.

<comment><USER4> I wouldn't have an issue paying $1,000 for a landing page, but I do have an issue paying $1,000 for a landing page where the developer only devotes a single day to learning about my business, understanding the problems we're solving, writing copy, designing, and coding.

I'm looking at the before and after example, and there are just a few words changed, previous headlines enlarged and colored, and a call to action at the very bottom. Yes, those are positive changes, but for $1,000 I'm expecting someone to bring far more to the table than a few minor tweaks. If you're asking for a premium price, I'm expecting a premium service.

<comment><USER5> Assuming a day means 8 hours, that's only 125/hr, which is right in line with what many contractors make already. Hardly premium.

<comment><USER6> Assuming yours is the only page he is working on. He really might have dozens of projects going at the same time.

<comment><USER7> Right at the bottom he mentions that only 15 slots are available, first come- first serve. So he blocks out each day for a single client.

</comment></comment></comment></comment></comment></comment><comment><USER8> I would like to create a landing page service using your landing page in a day service. When you design my landing page service page, please make it read "Landing Page in Half a Day". The cost will be $999.

</comment><comment><USER9> I've found that landing pages are less of a design issue and more of a messaging issue, although having something attractive is certainly nice to have. If you're largely taking existing headlines and making them look nicer, you're missing greater opportunities for improvement.

I also don't think saying you get 10% - 17% conversion rates resonates at all. A lot depends on what you're optimizing for. I have landing pages that can routinely convert 70-75%, but that's a first step optimization for click-thru, not sale. I think it's best not to pigeon-hole yourself into a range and instead just say "I've increased conversions by x%".

<comment><AUTHOR> Thanks for this—very insightful. I do include copywriting. For the case study, Justin already had copy that was in great shape. Other clients might not, so I'll provide writing from scratch in those cases.

As for the conversion rates, totally agree that the metric I shared is somewhat vague. Every project has different goals, and sometimes even a fraction of a percent is a major win, such as with major display advertisers.

Also, your point about showing the increase in conversions for my projects is way more powerful. Unfortunately, since this is brand new, I don't have better data to share. Hope to have some soon.

<comment><USER10> Sorry, but the metric isn't vague, it's bullshit. You can't promise a conversion rate. Probably not even a conversion improvement, since the people you're targeting won't have enough traffic for testing. I'd stay away from making such claims if I were you. Making nice, clear landing pages with good copy is a good enough value proposition for people who suck at writing and/or building websites.

</comment></comment></comment><comment><USER11> $1000 is a a huge amount of money to pay for a landing page when you can just buy a template for $5 (or get one for free?) and get a similarly nice-looking page in more or less the same amount of time, no?

</comment><comment><USER12> I like the idea of offering the service for a flat fee. The "before/after" section is cool, too - although it reminds me of the "lose 20 pounds in 2 weeks" ads I see on Facebook :-)

This is productized consulting at its best.

</comment><comment><USER13> Sorry to say but everything about this website feels cheap and generic to me: from the font to the use of huge font-awesome icons, to the texture in the background; to me this page looks like it's from 2012.

"Sound too good to be true? I wrote and designed this very landing page you're reading in 1 day."

Yeah, I can tell. It's impossible to create a design that will stand on its own in a day, if only for the fact that you need to have looked at it for so much longer than 24h (which is probably more like 10h) to have any kind of perspective on what you've produced. And, frankly, I feel like somebody who's been doing this for 10 years should know this.

To me, this whole thing just reads as an easy cheap hack for this guy to make more money.

<comment><USER14> I see what you mean - although given my poor landing page design skills pretty much anything looks good to me.

Can you give an example of a decent landing page?

<comment><USER15> Check out land-book ([http://land-book.com/](http://land-book.com/)).

I honestly think products like OP's (original OP...) degrade design as a profession. It takes much more time than a day and much more than $1k to properly design a landing page. You not only need to understand the brand (or help build it in some cases) but the language and tone of the business (even in larger companies that have a tone already you still spend a considerable amount of time on this). You need to bring the essence of that product into an easily digestible 'frame'.

The design of OP's site tells me that they think design is something that can be done hastily and with very little information.

</comment></comment></comment><comment><USER16> All of the work on this site looks like it was done by someone with less than a year of experience in design.

</comment><comment><USER17> This could just be my opinion, but you're selling custom design and using Courier New as your type - that's not very convincing. After browsing your other pages I was convinced you could design, but I would not have guessed that from this landing page.

</comment><comment><USER18> Looks like a great idea. All the best with this!

</comment><comment><USER19> There's something incredibly meta about this that I love.

This does seem useful though. I've probably underestimated the impact a landing page can have on idea validation and conversions.

</comment><comment><USER20> Can't read the text at bottom "I wrote a popular design ebook, and write a weekly newsletter to thousands of subscribers." Green of green, and hover that link is white over light green...

Great stuff anyway, but the price put me down, at least for me, but I don't usually pay for nothing. I'm a bad customer (:

</comment><comment><USER21> Pretty sure $1k doesn't buy the in-depth product understanding that is required for a good landing page.

</comment><comment><USER22> UI programming is different from UX design. If it is just programming 1000$ is too much, there are lot of other alternative options. If it is UX design I think lot more effort involved than you are assuming.

</comment><comment><USER23> This is pretty awesome. I would love to see some of the work you do from this.

</comment><comment><USER24> What would really sell me is if there was some hardcore copywriter/marketer behind it as well... that coupled with your great design skills would sell me!

<comment><AUTHOR> Sorry if this was unclear, but I do include copywriting & marketing advice in the project.

<comment><USER25> So many comments from people who clearly did not even read your page! The subtitle states "I'll WRITE, design, and code a custom page...", and the very first paragraph describing your offer states: "I'm an expert COPYWRITER and designer, and I want to help you...".

Don't let the ADHD crowd get you down. Beautifully done.

<comment><USER10> An expert copywriter would know he has to optimize for the "ADHD crowd" (which is about 80% of people on the internet), for example by mentioning he provides copy in at least one of the subheads, instead of keeping his head in the sand like you suggest.

<comment><USER25> _for example by mentioning he provides copy in at least one of the subheads_

I repeat:

The subtitle states "I'll WRITE, design, and code a custom page..."

 _keeping his head in the sand like you suggest_

Where did I suggest that? So many dramaz. Jeez.

</comment></comment></comment></comment></comment><comment><USER26> "jQuery, the JavaScript framework"

wat

<comment><USER27> "wat"

I think what you're trying to say is: the page says jQuery is a framework, when really it's a library. Frameworks have more structure (Angular, Backbone, etc), and JQuery calls itself a library...

Author might want to fix that.

<comment><AUTHOR> Heh, good point. Fixed. The explanation is obviously intended for non- technical folks, so the distinction is probably lost there, but I do want to be correct.

</comment></comment></comment><comment><USER28> I don't think anyone can get quality copy in 24 hours. Research alone takes weeks.

</comment><comment><USER29> isn't 1k too steep? With weebly and other similar apps, its much easier for non developers. For developers bootstrap themes are on a rise?

</comment><comment><USER30> This site has a pretty good landing page.

<comment><USER31> I'd wager it doesn't have >10% conversion however...

<comment><USER32> It's a site offering a $1000 product/service. I'd love for you to name a single company pitching this rate that does get 10% conversion.

<comment><USER31> Context: this is a site claiming to create landing pages with said conversion rate in a day. Landing page itself was designed in a day.

Additional context:

> My landing pages convert at over 10%. Even as high as 17%.

</comment></comment></comment></comment><comment><USER32> I'm still seeing the old design: [http://productpeople.club/](http://productpeople.club/)

<comment><AUTHOR> I just sent Justin his new design yesterday. So, can't really blame him for not having it online yet. :)

<comment><USER33> Justin is you buddy right and not your client? Did you actually spend only one day on his page and charge him too?

</comment></comment></comment><comment><USER34> Like a bespoke Launchrock. Whatever happened to Launchrock? Oh, it got acquired by a company I've never heard of. Moving on.

</comment><comment><USER35> Neither your site nor the 'Case Study' contain a privacy policy and both use Google Analytics. Both are in breach of the TOS which is problematic, especially in pro-privacy jurisdictions (like Germany for example).

From their Terms of Service at [http://www.google.com/analytics/terms/us.html](http://www.google.com/analytics/terms/us.html) the language is crystal clear _" You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data..."_

I'm surprised by the number of sites that ignore this. I wish you good luck with the product launch but privacy and legal compliance are hot topics lately and I think you should consider bring your site, and especially your client's sites, into compliance.</comment>


Attention HTML5 mobile devs.  It doesnt work - <AUTHOR> http://sundropdev.wordpress.com/2012/06/28/attention-html5-devs-facebook-cant-make-it-work-can-you/

<comment><USER2> The lack of the faster Nitro javascript engine in webviews on iOS is probably a major reason for this.

> The Nitro JavaScript engine is only available within Mobile Safari. Outside > Mobile Safari — whether in App Store apps using the UIWebView control, or in > true web apps that have been saved to the home screen — apps get iOS's older > JavaScript engine. [1]

> "Apple is basically using subtle defects to make web apps appear to be low > quality — even when they claim HTML5 is a fully supported platform," says > one mobile web app developer, who asked that his name not be used.[2]

[1][2] <http://daringfireball.net/2011/03/nitro_ios_43>

AFAIK all that is still true today aside from webapps saved to the home screen (which now does use the Nitro engine)

</comment><comment><USER3> So the web doesn't work.

And it will never work in the future.

Despite the fact mobile devices are getting more and more powerful.

And mobile browsers and getting faster and faster javascript and rendering engines.

Just do everything native. Build it for Android. Then for iOS. Then for Windows Phone. Spend lots of money doing that. Because everything must be native.

The web is dead. Cross platform web content is a dead end. It never worked!

Really.

</comment><comment><USER4> LinkedIn seems to be doing a good job with it. Also:

> " If Facebook cant make this work, I seriously doubt you can."

Nice confidence.

<comment><AUTHOR> nobody uses linkedin

<comment><USER5> But that belies the point that someone managed to make HTML5 webview work reasonably well in mobile. From a technical point of view that represents an interesting data point.

<comment><AUTHOR> Seems to be doing a good job, is not really a technical statement. Lot of things that fail seem to be doing a good job.

Im sure Zuck had a meeting yesterday about his mobile HTML5 team and said "You seem to be doing a good job".</comment></comment></comment></comment>


ORM (Object Relation Mapper) for Elasticsearch - <AUTHOR> https://github.com/mayank-chutani/elasticsearch-orm <comment><AUTHOR> I use Elasticsearch extensively at my job so I created this ORM to augment my ES usage. All constructive feedback are welcome. Few highlights of the project: 1\. Handles geoqueries 2\. Versioning enabled 3\. Handles Date fields

<comment><USER2> If it meets the guidelines, this might make a good 'Show HN'. Show HN guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> @brudgers Thank you for your suggestion. As I was trying to do the same, it seems like HN doesn't allow to update the title of the posts, neither I'm able to repost the same with "Show HN" in the title. Do you have any suggestion to make it work?

<comment><USER3> I think it locks after an hour or two.

<comment><AUTHOR> Yeah I can't change it anymore. Thanks anyway :)

</comment></comment></comment></comment></comment><comment><USER4> How does this compare to elasticsearch-dsl?</comment>


Ask HN: Hey recruiters, do you look at my personal website? - <AUTHOR> Recruiters, what do you look at?
on my resume do you look at:
my website? my github? my past work experiences, if so do you read the description of what I did? my projects, if so do you read the description of the project? the languages and technologies I know? <comment><USER2> I do, but I'm an outlier. I have a CS degree and 20 years of software experience, so I'll actually look at your code and if I know that language, take a look at your style. I've seen someone check all her Emacs autosave (~) files into Github. And unnecessarily jam multiple classes into one file. That was a bad sign.

All but a handful of recruiters will not because they simply don't understand any of that. They don't understand whats on the resume or job description. Better ones will take note of those things and pass them along to the hiring manager, who should take a look. But it's best if you link them in your resume.

Here's my comprehensive write-up on resumes, I think this is what you are looking for:

[http://www.madeupname.com/optimize-developer- career/resume-t...](http://www.madeupname.com/optimize-developer- career/resume-tips-developers/)

<comment><USER3> If I have side project I have to do in Java, you bet I'm going to have a lot of static inner class abuse. Perhaps you just don't understand the tradeoffs.

<comment><USER2> First, this didn't stop me from inviting the applicant to discuss her work/knowledge relevant to the job. She did not respond.

Second, it's totally possible I misunderstood something. I do run the largest JUG in SoCal, so I'm not a complete Java noob. But in truth the last few years have been Groovy, and I'm not close to being a FT coder. I don't claim to be a Java expert.

However :-) You are assuming these were static inner classes, and they weren't inner/nested at all. These were multiple _top level_ classes in one file. I can see how _maybe_ you'd do that for composition, and I did it once to get around a wrinkle in Grails, but this really seemed unnecessary. They weren't short classes. This person was a masters candidate and had little production experience, and the whole thing came off as rushed and sloppy. Frankly, seeing all those ~ files because there was no gitignore bothered me more.

</comment></comment></comment><comment><USER4> I'm pretty sure most of them don't.

My resume is either still out there on some "jobs" web site somewhere or it's been sold/shared between recruiting firms as I still get one or two "cold" e-mails a week from a recruiter; I haven't been "looking" for 5+ years.

In mine, near the beginning, it says something to the effect of "If the responsibilities for your position include the words 'Microsoft' or 'Windows' anywhere, I am not interested in the position. Please do not contact me."

The last recruiter e-mail I received, two days ago, says:

> _Your profile came up in my database as a possible candidate that might be > qualified for a new Windows Systems Admin I received in my office this > morning. My client is with the Department of Defense and is looking for > someone with a MSCA_ [sic] _or MCSE or higher for this role._

I believe the overwhelming majority of them don't look at them at all. They punch a keyword or two into their database, then, like spammers, blast the same form e-mail out to anyone whose name comes up.

<comment><USER5> > "If the responsibilities for your position include the words 'Microsoft' or > 'Windows' anywhere, I am not interested in the position. Please do not > contact me."

You're going to hold off the recruiters who conscientiously scan resumes and take such requests seriously at the expense of triggering automated scans for those keywords. I doubt if it's a net win.

<comment><USER6> Additionally, as someone who isn't a recruiter and doesn't work with any Microsoft products, this might actually come off as a bit of a red flag. The intention may be to stave off recruiters that blindly fire off job postings, but it comes off as egotistical.

</comment></comment></comment><comment><USER7> I do. I look at your repos and what you contributed to as well. The recruiters who have built a business on high match rates look at any/all info you provide. For example, a recruiting firm I partner with in NYC boasts a 89% offer to job acceptance rate.

For recruiters who are purely matching using LinkedIn recruiter filters a lot of the matching is done with your skills section and the descriptions under each job.

It's helpful to add industries you want to work with and languages/technologies w/ context. e.g. worked as a javascript developer for X company that did Y, a leader in the Z industry. built end-to-end messaging system using javascript and socket.io that had an engagement with 30k users.

This will help you get more relevant matches. Granted you'll get some spam- but there are some quick tricks like asking for e-mails to include certain information on your LinkedIn description so you can easily filter out.

As a software eng. who's getting to see both sides of the market it's always best to get a referral to a really good agency in your location. A good recruiter is worth a lot of time/money especially for such an important decision like where you're going to be spending 1/4~ of your week at.

</comment><comment><USER8> I'm not a recruiter, but I am a developer that helps with interviews.

Whenever we interview a candidate, we actually try to learn as much about people based on what they have online.

Before we set up an interview, we usually check out their personal site, their Github/Bitbucket/etc, any sites related to those repos, their Linkedin, Twitter, etc, etc...

We try not to be too creepy, but we just really want to be somewhat familiar with their work before they come in.

</comment><comment><USER9> Check out [http://leafii.com](http://leafii.com)

It's a website with of people that has personal websites.

</comment><comment><USER10> I use Google Analytics to find out! It's pretty easy to set up.

So far there's a 1:1 correlation between viewing my website and sending me a non-automated LinkedIn message.

</comment><comment><USER11> From my experience most recruiters ever contacted me were just buzzwords detectives. When i put in my linkedin profile how can i help, what are benefits of my work, what can i bring to the table, almost no one reach me with specific job offer. Just one message during month or two.

Another sad thing is that job description is very often the same bullshit as most linkedin CV's. They put in every buzzword, but reality is somewhere else. Your day-to-day tasks are far away from original requirements and very often also from whole job description. Same is it with candidates. Matching between buzzwords and real candidate value is very difficult. And only real HR professional can do it.

Outsourced hiring process make this gap and misleading even bigger. They play just keyword matching game (good opportunity to automate them).

I think that something like HN's karma should be implemented in linkedin. Current situation is facebook style (more friends more reputation). At least this could help filter HR pros from spammers.

</comment><comment><USER12> I've had recruiters contact me from information that can only be found from my website. A good way to track is to extend your e-mail with the '+' notation for different sources.

for 'firstname.lastname@example.com' you can add arbitrary messages after a '+' sign and before the '@' sign.

firstname.lastname@example.com

email@example.com

email@example.com

email@example.com

You can now track how someone got ahold of you, by looking at your e-mail header.

</comment><comment><USER13> From a hiring manager perspective, I look at github accounts and personal websites.

</comment><comment><USER14> Not sure if the HR person checked out my site, but I know at least one of the interviewers did as he asked me about a personal project I was blogging heavily about during the interview.

<comment><USER15> You were blogging heavily during the interview? I can understand that he asked...

<comment><USER14> I like to think they appreciated my ability to multitask under pressure.

<comment><USER16> I had a laugh. :)</comment></comment></comment></comment>


Slack announces pricing - <AUTHOR> https://slack.com/pricing

<comment><USER2> Pricing is only available to people in the preview. I'd guess $3-10 per user per month.</comment>


Race, Class, App.net: The Beginning of 'White Flight' from Facebook & Twitter? - <AUTHOR> http://thesocietypages.org/cyborgology/2012/08/09/race-class-app-net-the-beginning-of-white-flight-from-facebook-twitter/

<comment><USER2> Isn't the basic premise here that Black people can't afford to pay $50 to join app.net?

Isn't that WAY more racist than building a site that costs $50 to join?

Did I miss something?

<comment><USER3> There is no cohesive argument in the article. It's all just speculation:

"to be fair, this piece _is_ a speculative article. my aim here is to raise questions & start a conversation, not to make a pronouncement on what app.net will or will not be (because i don't think that's predetermined, or something we can know yet). there's a reason there's a question mark in the title."

I feel that not making herself clear in the article is deceptive. I had to read the entire article to figure out there's nothing there.

[Edit] Furthermore: with Twitter's follower model how much more segregation can you get? How can you compare white flight from neighbourhoods with white flight from Twitter? What are they running away from if they choose whomever they follow?</comment></comment>


NOAuth - <AUTHOR> http://neonacho.calepin.co/noauth.html

<comment><USER2> You don't need a keylogger. An iOS app can inspect the cookie store of a WebUIView instance it created.

<comment><AUTHOR> You won't get the credentials in clear text from that.

<comment><USER2> With a session cookie you don't need them.</comment></comment></comment>


Wufoo + Free Incentivization = Cheap, Effective User Surveys - <AUTHOR> http://www.kalzumeus.com/2010/01/17/wufoo-free-incentivization-cheap-effective-user-surveys/

<comment><USER2> I am chiming in on this Patrick recommendation. We use Formspring, but 6 of 1, half dozen the etc. Surveys have been extremely useful to us.

Particular for businesses that sell products to other businesses, here's what we've found about doing surveys:

* It's easy to drive people to surveys using Twitter.

* They're a fast way to build an opt-in list of people to contact in the future.

* Just asking questions about the problems you address raises awareness and generates leads; for us, more effectively than advertising.

* Most of your assumptions are broken.

* If you're smart, you can build surveys that will generate newsworthy results; survey stories are layups for trade reporters.

We've had a lot of luck incentivizing survey respondants with posters and refrigerator magnets. We're happy to spread those around anyways. Now that we have a solid base of respondants, we're going to look to drive responses with less tangible payoffs. For instance, we'll extrapolate assertions about our industry off survey responses, publish them, embed them in the survey, and wait for nerds like us to come "correct" us.

</comment><comment><USER3> The problem with me posting one of these things at 1:00 AM on a Sunday night and then talking to my family, taking a shower, and logging in to HN "one last time" prior to bed is that keeping up with comments from 3:36 AM is kind of difficult. Oh bother.

Well, I hope y'all like it. In particular skip down to the bit about information scarcity -- I think that one is broadly applicable to most of the businesses here. (Capsule summary: You can use something which you can create in abundance but which your users/customers perceive as scarce/valuable and trade it to them in return for things which have business value for you.)

<comment><USER4> Thanks Patrick. That was an incredibly interesting read. Essentially, in consumer webapps, you've got to ask _"What's in it for me?"_ for every action you want the user to take.

</comment></comment><comment><USER5> Something several of my friends have recommended for me to try, is to artificially limit my already free product under the premise that people want more of what they can't have. In this article He goes from 15 to 20 bingo cards for free, which makes sense since the alternative is buying bingo cards. But has anyone seen anything like that work effectively for a product that only has one level (i.e. everything is free)?

Some suggestions i've gotten is to say users can generate 15 widgets per month, but can get unlimited if...they follow us on twitter, facebook friend us, email us to a friend...etc. At the end of the day has anyone seen a case where limiting a free and unlimited product actually increase the number of users?

<comment><USER5> no? Anybody? Was this a stupid question, or did no one have any evidence pro or con?

</comment></comment><comment><USER6> I don't really understand the privacy part. You feel compelled to say it's anonymous, and then torture yourself over it.

I'd be perfectly fine with telling users "This survey will be linked to your account.", except that it sounds weird/unnecessary.

Paying customers don't generally expect/desire anonymity. Most probably _want_ you to know _their_ opinion.

A survey like this is little more than a predefined conversation between you and your customers. You're not anonymous in your regular communication (email/phone), so why would you be for the survey?

</comment><comment><USER7> Perhaps not as polished as Wufoo, but Google Docs (Form) is great for creating user surveys and it's free.

</comment><comment><USER8> It might be a little different than your use case, but Yongfook (another entrepreneur here in Japan) is working on a very nice-looking survey app called Seashell.

<http://seashellapp.com/></comment>


How Magnetic Refrigeration Works (2014) - <AUTHOR> https://www.youtube.com/watch?v=9eYuQnqIXpY <comment><AUTHOR> There's another video, which I can't seem to find right now, where it talks about the inventor of the Neodymium magnet creating a magnetic refrigeration effect without using Gadolinium -- to do this, he needed to create Neodymium magnets which were manufactured from Neodymium powder which had a smaller particle size than for regular Neodymium magnets (something like .5 mm vs. .3 mm, or 5 microns vs. 3 microns or something like that).

The problem is (or was!), that apparently when you create Neodymium powder that small, it catches on fire in the presence of air/oxygen!

So the apparent solution was to manufacture it in sealed machines which contained some special gas (Nitrogen?).

Apparently this revolves around a patent dispute of some sort -- using Gadolinium to obtain magnetic cooling was apparently patented... or so the video said...

I don't know the full story; some or all of the above pieces of information might be wrong, but I thought it was interesting that you could use magnetic effects alone (with the right materials) to create cooling...

[https://en.wikipedia.org/wiki/Magnetic_refrigeration](https://en.wikipedia.org/wiki/Magnetic_refrigeration)

I never knew that magnets (well, Neodymium and Gadolinium!) could be used for cooling until now...</comment>


What People Say Before They Die - <AUTHOR> https://www.theatlantic.com/family/archive/2019/01/how-do-people-communicate-before-death/580303/ <comment><USER2> My father's last word was "Wow!". He was at the end stage of esophageal cancer at the age of 46. He fought until about a week before his passing and made the decision that he did all he could and try to go with some grace. By the point the pain was constant and unbearable, even oxycontin wasn't getting the job done. As a family, we said our goodbyes, and said everything that needed to be said.

Over the course of the next few days, people from his life came from near and far to visit him in the hospital. After about 5 days, the flow petered out. The night he passed, he was in and out of lucidity, and in a clear moment we talked about all of the people that came to see him. He was clearly impressed and humble. At the end of the conversation, he exclaimed "Wow!" in a voice that was barely a whisper and then closed his eyes. Several hours later, hid body finally succumbed to the cancer and he exhaled his last breath.

<comment> rv-de what do think he meant by that?

<comment><USER2> My interpretation was that he was expressing amazement at the number of people that came to see him. Friends, relatives, co-workers from 15+ years ago, etc. It was the topic we were discussing at that moment.

Of course, it may have been something else, too.

<comment><USER3> >> _Of course, it may have been something else, too._

Is it possible that the brain prepares us for a peaceful ending? Showing paradise or whatever we like as we breath one last time?

<comment><USER4> That would be comforting, but I can think of no evolutionary purpose for such a mechanism to emerge...

<comment><USER5> In the event of a body's catastrophic system failure (i.e. serious injury / dying) the brain spikes the endorphin levels since pain no longer serves a useful purpose: the damage is done but it _does_ serve a useful purpose to reduce the pain levels to allow us to function at a higher level than writhing on the ground in agony so that in some circumstances we might live to see another day.

Think of it this way: a bear just ripped/slashed/whatever your arm off... which is more useful: 'arrgggghhh!' or for the brain to pump out endorphins so that you at least concentrate and have a chance of fighting back or running/limping away or hiding? I doubt the brain differentiates between serious injury and dying, it's just wired at a certain point to try to minimize the pain. That would seem to be a very useful evolutionary purpose.

<comment><USER6> And even if it did differentiate between serious injury and dying, considering mankind's history of warfare, being able to continue to perform while mortally wounded is definitely beneficial to the survival of the clan.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> My mother-in-law died of amyotrophic lateral sclerosis (Lou Gehrig's disease).

When she passed, my wife, her sister and her husband, and my mother-in-law's ex-husband were with her. I was stroking her hair because I wanted the last thing she felt to be a human touch.

At one moment, she said quite clearly, "I'm ready to get on the train". Not a second or two later, we heard the train whistle (Palo Alto) as it passed the stop near her home. And then she stopped breathing.

Coincidence, of course, but nonetheless lovely.

</comment><comment><USER8> "Don't cry for me, for I go where music is born."

Who: Johann Sebastian Bach, Baroque composer.

Now that is how you go out in style.

<comment><USER9> To put in context

"All music should have no other end and aim than the glory of God and the recreation of the soul."

Bach believed that all music, secular as well as sacred, had to be inspired by god or be written for his glory. Puts his last words into context :)

<comment><USER10> His family suffered badly after he died. His wife and mother of his children died on the street begging for money. Really sullied my connection to his music.

<comment><USER11> That was humanity's doing, not his music.

<comment><USER10> I've told myself that too but it's small comfort. Really only highlights for me that humanity owes itself better than it provides.

</comment></comment></comment></comment></comment><comment><USER12> I remember my Grandpa's last words on his deathbed: "Well, I'll see you'all later."

<comment><USER13> The last thing I gave my Grandpa was a Get Well Soon card, at his funeral.

/everyone had a good laugh, he would have loved it.

<comment><USER14> I've had the same thought from time to time. I stopped expressing them to my parents; they don't share the points of view as your family, you, and myself appears to.

</comment></comment></comment><comment><USER15> I'll never forget my grandfather's last words (word really). Seconds before he passed, he mustered up enough energy to call out "NO" quite loudly. Then he was gone. I still find his last expression somewhat haunting, although I suspect that the whole "dying" thing hadn't become real to him until that very last moment when he knew it was inevitable.

</comment><comment><USER16> I saw my grandpa the night before he passed. I asked him if he wanted my wife and I to stay or go and let him sleep. His last words to me were "Just let me sleep".

<comment><USER17> Classic granpa move.

</comment></comment><comment><USER18> "On a winter morning in 1360, Zen master Kozan Ichikyo gathered together his pupils. Kozan, 77, told them that, upon his death, they should bury his body, perform no ceremony and hold no services in his memory. Sitting in the traditional Zen posture, he then wrote the following:

Empty-handed I entered the world Barefoot I leave it. My coming, my going — Two simple happenings That got entangled.

After he finished, Kozan gently put down his brush, and then died. He was still sitting upright.

" [https://www.japantimes.co.jp/culture/2016/07/02/books/black-...](https://www.japantimes.co.jp/culture/2016/07/02/books/black- illumination-zen-poetry-death/)

<comment><USER19> Here we are, Western mortals worrying about the last spoken word, while the Himalayan yogis exit their body consciously...

</comment></comment><comment><USER20> I'm a little bit different - I don't want to prepare for death. I want to die at my desk, completely unconscious of, unready for and ultimately, unburdened by my own mortality. There's nothing you can do about it anyways, and waiting to die is boring and miserable. I don't want to give death any respect, I want to be inconvenienced by it, interrupted by it.

<comment><USER21> Sadly, you are unlikely to get much choice in the matter.

<comment><USER20> What I'm saying is that I'm against the alternative which is to prepare for death like it's this big day or something.

</comment></comment></comment><comment><USER22> I still think "Fuck that alligator" is my favorite:

[http://gawker.com/fuck-that-alligator-man-killed-seconds- aft...](http://gawker.com/fuck-that-alligator-man-killed-seconds-after- mocking-1715887134)

<comment><USER23> BuzzFeed later published a more detailed and sympathetic account of this tragedy: [https://www.buzzfeed.com/amphtml/golianopoulos/fuck-that- gat...](https://www.buzzfeed.com/amphtml/golianopoulos/fuck-that-gator)

<comment><USER24> It really steams me that they killed the gator. The gator didn't do anything wrong, and considering that it was the first lethal gator attack in the state in two centuries, the gator almost certainly did not represent a significant hazard to any other people, almost all of whom would be more respectful of it. Suggesting that there was something wrong with the gator, like it had a moral deficiency or something, is just absurd.

<comment><USER25> The justification I've often heard has nothing to do with morality or vengeance. It's simply that animals that have killed humans tend to do it again because they now associate humans with prey. I don't know how accurate this is but it's definitely the rationale used for killing such animals.

</comment></comment></comment></comment><comment><USER26> interestingly, Texas keeps a record of the last statements made by death row inmates uttered before execution. I'm not sure if other states do this.

[https://www.tdcj.texas.gov/death_row/dr_executed_offenders.h...](https://www.tdcj.texas.gov/death_row/dr_executed_offenders.html)

<comment><USER27> Wow [https://www.tdcj.texas.gov/death_row/dr_info/rodriguezrosend...](https://www.tdcj.texas.gov/death_row/dr_info/rodriguezrosendolast.html)

<comment><USER18> Those were his words.

These were his deeds : [https://en.m.wikipedia.org/wiki/Rosendo_Rodriguez](https://en.m.wikipedia.org/wiki/Rosendo_Rodriguez)

</comment></comment></comment><comment><USER28> So uncomfortable to read. We all like to pretend that death's not a thing until it becomes unavoidable. I think the mentality of a human being is built to be deeply anxious of the possibility of changes in circumstance, yet adaptable when possibilities become certainty. Everyone I know who has faced life-altering circumstances eventually adopts a new life. I suppose those terminal are the same. A lot of shit probably just doesn't matter anymore, because it can't.

</comment><comment><USER29> My Mom was in hospice care for about the last year of her life. She was religious and I am not, I am an Atheist. We talked about that toward the end. We came up with a very unique "pass phrase" and she agreed that if she got "up there" she would try to get it to me. That was 10 years ago, still nothing.

But I thought it was interesting that part of the way I think she dealt with it was writing her Eulogy. She had been the organist at her church for many years until she became too ill to continue. She had a friendly little rivalry with her much younger replacement playing little practical jokes on her like leaving a funny cartoon in the hymn book to "throw her off timing", silly fun things like that.

My Mom had been placing this idea with the church goers for some time, claiming that our family had Native American Heritage (we do not).

When I attended her funeral, many members of the church mentioned this and my sister and I just assumed maybe she was confused towards the end. But she was not confused at all. It was all part of an elaborate, one last practical joke from the grave.

She had convinced the church to allow the organist to perform a "Native American Chant" in her honor. The Chant was "O-what-ajerkiam" over and over but in native sounding phonology she had devised. She had even provided the poor unsuspecting organist an "official native American drum". (this whole thing shamelessly stolen from Mel Brooks). The ruse went off perfectly and my sister and I were cracking up, Mel Brooks was her favorite.

I hope I have a great sense of humor like my Mom at the end like that. It was her completely. And everyone got a huge kick out of it afterwards including the organist who was in tears of laughter after she realized she had been had one last time.

<comment><USER30> >We came up with a very unique "pass phrase" and she agreed that if she got "up there" she would try to get it to me

This sort of thing is addressed in the Parable of Lazarus and the Rich Man in Luke 16. An excerpt:

"'Then I beg you, father,' he [a rich man in hell] said, 'send Lazarus [a beggar in heaven] to my father's house, for I have five brothers. Let him warn them so they will not also end up in this place of torment.'

But Abraham replied, 'They have Moses and the prophets; let your brothers listen to them.'

'No, father Abraham,' he said, 'but if someone is sent to them from the dead, they will repent.'

Then Abraham said to him, 'If they do not listen to Moses and the prophets, they will not be persuaded even if someone rises from the dead.'" (Luke 16:27-31)

<comment><USER31> > This sort of thing is addressed in the Parable of Lazarus and the Rich Man > in Luke 16

IMO that passage only addresses it in so far as to make up an excuse to explain the silence. If even a modest amount of the supernatural claims in the Christian Bible are true then at least one of them should be reliably repeatable. And despite years wasted looking I'm not convinced.

<comment><USER30> >If even a modest amount of the supernatural claims in the Christian Bible are true then at least one of them should be reliably repeatable

If it were reliably repeatable, it wouldn't be supernatural. That's tautological.

<comment><USER32> OK, just keep doing different miracles each time. Keep it fresh.

<comment><USER30> What you're getting at is actually a profound paradox in philosophy of science: the statement "no miracles occur" is itself unfalsifiable, and thus (at least in the Popperian sense) not scientific. It's unfalsifiable because to repeatably falsify it would be tantamount to repeatably producing miracles!

Here's an interesting paper on the subject: [https://philpapers.org/archive/FROTNA-2.doc](https://philpapers.org/archive/FROTNA-2.doc) (Greg Frost-Arnold, 2010, "The No‐Miracles Argument for Realism: Inference to an Unacceptable Explanation", Philosophy of Science 77(1))

<comment><USER33> What an incredible display of navel gazing (the paper you link). I'm well aware that modern science was born from philosophy, but much of what is left in the realm of philosophy seems to me so incredibly useless.

Logic, reason, critical thinking, ethics, these are all valuable things. But anti-realism? I challenge anyone to tell me something useful that has come from the study of "anti-realism".

Not that everything has to be useful. Far be it from me to try to control anyone's hobby. But I, for one, don't want any of my tax dollars to go toward supporting that fruitless pasttime.

<comment><USER30> It's too early to expect real-world applications of anti-realism. Instead I would redirect your attention to a similar pattern in the foundations of mathematics.

Mathematical foundations were once very shaky, but real-world mathematicians didn't care in practice. Bertrand Russell showed that an early mathematical foundation attempt was inconsistent. At the time, to a working mathematician, this would have been about as airy-fairy as anti-realism seems to us today. A mathematician back then could well and rightly have said: "Proofs, equations, solutions, these are valuable things. But Russell's paradox? I challenge anyone to tell me something useful that has come from the study of Russell's paradox." Indeed, the paradox was actually known to Zermelo before Russell, and Zermelo didn't consider it important enough to make a fuss about!

Now in hindsight, we know that foundational work DID pay off in practical ways. It was a crucial step toward the development of, for example, automated proof verification software like COQ, which has extremely important real-world applications and whose importance will only grow in the future.

Here's my speculation: things like anti-realism are equivalent to Russell's Paradoxes which seem like navel-gazing today. In a hundred years' time, they might have proven to be a crucial step toward formal science verification software. Just like fixing mathematical foundations was a crucial step toward formal mathematical verification software.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> Before my mother died (from lung cancer), she was just extremely anxious and miserable. Don't expect some kind of revelation or great thought about the meaning of life when people die. It's just horrible for everybody involved.

</comment><comment><USER35> My grandfather was saying "help!" through an oxygen mask on his face for several days before he died. I didn't know how to respond because there wasn't anything we could do. He struggled like this, in pain, but at the very end he had an expression of complete joy and peace that was really moving to me. I was very close with my grandfather and felt I could understand what he was feeling without any words. My interpretation is that he experienced some type of complete acceptance of death and/or awareness of something beyond death. It was really beautiful and comforting to see, especially after watching him struggle for days prior to this.

</comment><comment><USER36> For those that want a list, Wikiquote has a page of "last words" [1].

[1] [https://en.wikiquote.org/wiki/Last_words](https://en.wikiquote.org/wiki/Last_words)

<comment><USER37> "Thomas Jefferson survives."

<comment><USER38> Narrator: "He didn't."

</comment></comment></comment><comment><USER39> Before Einstein died he called his live-in nurse over to hear his last words. Unfortunately she didn't speak German. So we don't know if he uttered a breakthrough physics formula or just complimented her on a nice set of cans.

Anyway, fascinating article even though we all seem to want to talk about famous last words instead.

</comment><comment><USER40> > Zagraj w Mozarta na moją pamiątkę, a ja cię usłyszę.

— Frederic Chopin

This one is my favourite.

<comment><USER41> Translation: Play Mozart in memory of me—and I will hear you.

<comment><USER28> Mine might just be "Play Chopin in memory of me".

<comment><USER42> Ironically those were Mozart's last words.

</comment></comment></comment></comment><comment><USER43> The book is actually "Words at the Threshhold", not "on" the threshhold... [https://www.amazon.com/Words-Threshold-What-Nearing- Death/dp...](https://www.amazon.com/Words-Threshold-What-Nearing- Death/dp/1608684601/)

</comment><comment><USER44> not sure this is relevant but my grandmother's last words to me...

she was the always happy type of person. super socialite knows everyone and everyone loves her always a kind word for everyone.

The last time I saw her was the only time I ever heard her have a negative attitude about anything.

She said "getting old sucks!"

</comment><comment><USER45> William S. Burroughs: "Hurry up, please. It's time."

And OK, those weren't his last words. They were the last words in his last book, _The Western Lands_. Maybe they were more about being ready for death.

His final journal entries were published as _Last Words: The Final Journals_. My favorite:

> Here I sit with my three old cats, getting closer to eternity all the time, > on a twine chair—(Van Gogh) and me too—and it gets very depressing. What can > I do? I had high hopes. We all did. Remember just outside the Tangier > Consulate: "Have you met the Skipper yet?" Later I did. And now no skipping, > no transport anywhere, except to a cut-rate mortuary. Where were you when I > wasn't there? "Hound of Hell!!" screamed the Pop Star, and kicked the fink > dog in the nuts. "Only decent thing I done." "Forget the whole thing. I > have." Great gasp at this point. How much time? have I left? Not much it > seems."

<comment><USER46> [https://www.sparknotes.com/poetry/eliot/section3/](https://www.sparknotes.com/poetry/eliot/section3/)

<comment><USER45> Thanks. And yes, Burroughs didn't bother much with attribution.

</comment></comment></comment><comment><USER47> [https://en.m.wikipedia.org/wiki/John_von_Neumann](https://en.m.wikipedia.org/wiki/John_von_Neumann)

The section about his death is surprising. I was an atheist at the time I first encountered the story.

<comment><USER48> What made you change your mind?

</comment></comment><comment><USER49> When I was a child, my family and I drove from Florida to New York to say goodbye to my dying grandfather, wasting away from cancer. Ours was the only group now already in New York. He was unconscious for the first 24 hours we were there.

The day after we got there, he woke up. He wasn't able to see, and he asked my grandmother, "is everyone here, Mother?"

"Yes, George, they are."

"So I can go now?"

Through tears, she said, "yes, you can go now."

He took one more breath.

</comment><comment><USER50> cancer/bleeding out/religious martyr Grandma "I can feel his warm light on my body!"

cancer/coma Grandpa "I am sorry for all the things I did (as a Nazi)we where just fighting for our rights and lives."

cancer/coma Grandpa 2 "Y'all talk to much." joking

cancer/coma Cousin 1 "I fought as long as I can don't cry it's all cool"

sleeping pills/instant Cousin 2 "Fuck this world and fuck you're gods" heard over the internet

old age 102/stopped breathing Great grandma "(I have seen a lot of stuff) I'll tell you more tomorrow right now I'm tired."

</comment><comment><USER51> "I drank what?" — Socrates

</comment><comment><USER52> "What happens after I kick this bucket?"

</comment><comment><USER53> Or maybe he saw the truth about God. Steve Jobs said "oh wow, oh wow, oh wow" too. Could be one for each, the Father, the Son and the Holy Ghost.

<comment><USER54> Or maybe one for each, Zeus, Poseidon, Hades.

<comment><USER53> Well.. it's either/or. Both can't be true.

<comment><USER55> Zeus, Poseidon and Hades are siblings. Of course both could be true.

</comment></comment></comment></comment><comment><USER56> " hold my beer and watch this"

<comment><USER57> HN doesn't like jokes. Too Reddit-like.

<comment><USER58> I think the bar's just higher.

<comment><USER55> No, that's not it.

</comment></comment></comment></comment><comment> W-Stool "Rosebud".

</comment><comment><USER59> I like how this article and research de-romanticizes dying words.

There is nothing romantic about it, just incoherence that can only sometimes be applied out of context to conform to a blissful end.

<comment><USER60> I'm curious if you've ever sat with a dying person.

<comment><USER59> Yes, I have

So logically the next thing you have to do is to question whether I've sat with enough and kept a spreadsheet to elevate my experience away from an anecdotal outlier</comment></comment></comment>


1337day.com domain seized by the CIA - <AUTHOR> https://www.facebook.com/inj3ct0rs/photos/a.188734184521282.47586.121674351227266/923154241079269/

<comment><AUTHOR> Or so they say... My bet is on a rival, seeing they're trying to sell the site exploits.</comment>


Play Dos Games Online (Chaos Engine) - <AUTHOR> http://playdosgamesonline.com/chaos-engine.html <comment><AUTHOR> I know this is hardly new and there are easier ways to emulate but it just blows my mind how EASY the access is now. I saw some lotus 3 pixel art online that reminded me of my childhood and inside 10 seconds (literally) I manage to type in play lotus 3 online and started playing after clicking the first search result.</comment>


Apple blog update - <AUTHOR> http://daringfireball.net/linked/2010/04/16/app-store-rejection-fiore

<comment><USER2> "I realize this was an app, not an e-book, but Apple can't credibly run a book store while holding any sort of policy that bans political satire." -Gruber

I could not agree more with Gruber's last statement.

</comment><comment><USER3> > I think he should have resubmitted immediately, and hoped for a different > reviewer.

Isn't that a symptom of a broken system though?</comment>


Lessons in website security anti-patterns by Tesco - <AUTHOR> http://www.troyhunt.com/2012/07/lessons-in-website-security-anti.html <comment><USER2> Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at <http://www.realestate.com.au/> Just to refresh your memory..

[https://twitter.com/#!/realestate_au/status/2207319148043059...](https://twitter.com/#!/realestate_au/status/22073191480430592)

Anyway, "we are aware of this issue and are working on it".

Click <http://www.realestate.com.au/> then "Register".

Then stand in utter amazement at their solution.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-

 _Why do we need your email address?_

         *We send your password via email.*
         *Your email address is your log on.*
         *If you forget your password, we'll send you a new one.*

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-

This is hilarious. I can only assume that they took offence to you choosing a "strong version" password, so they decided, how can we fix this? I know, lets just pick the password for them.

So, their fix that they told you about, was to ensure that you can't pick a password at all, and they will still email you their "super strong version password"...

> Thank you for registering. Your password has been sent to > username[at]gmail.com. It should arrive shortly.

12 seconds later.

Your password is: DTCNE

(In case people aren't aware, realestate.com.au is owned by HomeAway)

<comment><USER3> In slight defense of that horrible password practice:

You can't really do much with a realestate.com.au account unless you are an Agent (which is a separate account). There's no payment processing, or any way to add content to the site. The accounts there are basically just a way to save common realestate searches as far as I can tell.

<comment><USER4> Yeah, no.

All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security.

This is especially true with the high amount of password reuse that goes on.

<comment><USER5> I'm not sure I agree. I'd say my name is private, I'd say my date of birth is more private, I'd say my medical conditions are more private still. There are clearly degrees of privacy.

Does it really make sense to hold my bank to the same standard as a real estate website? Sure they should all reach some minimum requirement (salted and hashed passwords), but I expect my bank to have far higher standards (e.g. two factor auth) than a a random site.

<comment><USER6> The problem with storing passwords insecurely is that people reuse them. You can try to tell them otherwise as much as you like, they _will_ do it, so even if one service holds non-sensitive data, stealing the password will grant access to other, completely unrelated services.

</comment></comment></comment></comment></comment><comment><USER7> This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure most people.

There have been many calls in past exploit threads for a name and shame policy, but that won't do anything. Name and shame only works when people keep up with the list, and people won't. They're too busy with their lives to focus on a list, especially given the number of insecure websites around the world.

We need everyone to have a list of easy to remember rules about web security from a consumer perspective. This list of rules needs to reach everyone. Putting them in the browsers may lead to the exposure needed, but I don't see that happening.

This primitive level of education needs to start breaking through as it's only going to get worse as computing and security advance further. We haven't even finished explaining to people that plain text passwords almost always indicate impending disaster, yet we already need a way to explain MD5 is never enough and SHA256 isn't enough without a salt...

<comment><USER8> > There have been many calls in past exploit threads for a name and shame > policy

There is an attempt at naming and shaming here: <http://plaintextoffenders.com/>

<comment><USER9> I'm bothered that that blog doesn't distinguish between sites that (A) email generated passwords for new accounts and sites that (B) email plaintext passwords for existing accounts.

</comment></comment></comment><comment><USER10> What's _really_ weird to me is how some people can foster an actual _anti- security_ mindset, where they explicitly try to argue _against_ proper security practices. I don't know where it comes from, but i've seen it often.

You report that the way a particular type of SSL cert is implemented leaves a MITM attack, and they come back with a dissertation on why MITM is not a concern of ours. (Oh? Then why the fuck are we encrypting the connection?!)

You tell them that they have unpatched, years-old, remote root vulnerabilities in their servers, and they give you the long list of reasons why we not only don't need to patch it, patching it _would be bad._

You tell them how storing a password unhashed will lead to a PR catastrophe when an attacker gets your PW DB. They tell that implementing scrypt isn't feasible, bcrypt is weaker than scrypt, SHA1 hashes are easily crackable, and that if somebody has our PW DB we have bigger problems, so we shouldn't even worry about the passwords. And since we shouldn't worry, we might as well e-mail them.

My guess is they think it will be extra work and they're trying to avoid it. The alternative that I hope isn't true is that their egos are so big they don't want to believe they did something insecurely, so they craft a story to tell themselves and others that actually what they did was smart. Either way, the users lose out in the end, and there's nothing we can do about it.

<comment><USER11> I've seen exactly this attitude multiple times with clients from a wide range of industries. So much so that I'd say that this is attitude towards security is the norm rather than the exception.

</comment></comment><comment><USER12> I watched this exchange occur over Twitter on the weekend; the worst part of it was not that Tesco stores the password in a reversible manner, but that their representative actively defended their mechanism.

Otherwise, all of their other "crimes" (cookies are sent unencrypted, etc) are bad but not really unexpected from a large chain like this. I'm never really surprised when large organisations get these things so wrong, given the way many either contract this work out and/or [mis]handle it in-house.

<comment><USER13> If it was the weekend, it seems unlikely to me that the person running the Twitter account would have got in touch with someone with a technical understanding of how the site works. More likely they just consulted their list of talking points and picked the ones that looked most relevant to the situation.

<comment><USER14> On the other hand, the sensible thing to do would be to say something like "Can you provide your contact details in a DM: we'll get one of our tech guys to contact you on Monday"

<comment><USER13> Yes, definitely. Having customer service respond to security complaints on Twitter really isn't very smart.

</comment></comment></comment></comment><comment><USER15> I discovered this a couple of years ago and emailed and got an unsatisfactory response:

<http://pastebin.com/C745weQ2>

Hopefully this new attention will have them change the policy.

<comment><USER16> So they actually say the passwords are not encrypted in that email, which is quite different to what they say on twitter. I wonder if they're using a reversible encryption now, or (perhaps more likely) they just don't _know_ what they use.

<comment><USER17> They have a maximum length requirement. That's a red flag which suggests they are just storing it plaintext.

</comment></comment></comment><comment><USER16> > In fact the only real possibility that leaves any credibility whatsoever is > that the stored password is being decrypted then compared to the password > provided at logon using a non-case sensitive comparer.

You can do case-insensitive passwords with hashing/salting. It's just a matter of lower-casing the password before hashing it. (Edit: I'm not saying this is a good idea, of course!!)

I remember reading once that Facebook actually hashes multiple versions of your password (eg with the first letter upper-cased to handle the case where a phone auto-corrects it, and also with all character cases toggled to handle the case when you left caps lock on). I wonder if there's any statistics about how often this kind of thing actually helps?

Of course, it seems pretty clear in this particular case that Troy is right and they're just storing your password in a case-insensitive database column.

<comment><USER18> If you want hash based passwords to be case insensitive (or have case insensitive characters) You should convert the case before you hash on login. Saving every hash makes it easier for an attacker to find a collision.

<comment><USER19> Does it really? What matters is NUM_POSSIBLE_KEYS / NUM_SAVED_HASHES, saving hashes for multiple casings of the password can't possibly increase the number of hashes by more than lowercasing the password would decrease the keyspace by.

<comment><USER18> You're right, I was thinking that the attacker didn't know the publicly available information that passwords were case insensitive. However, I would still be concerned that it unnecessarily increases the chances to exploit some weakness in the hash algorithm.

</comment></comment></comment></comment><comment><USER20> The plain text password thing might have been an edict come down from marketing.

For example, they might find that people who forget their password become less likely to use the site because when they get their new (hard to remember) password emailed to them they can't figure out how to change the password back to what it used to be. This means they end up resetting their password every week to do their shopping.

<comment><USER21> But... a proper password reset mechanism wouldn't send the password via email in first place, but rather a one-time link to set a new one.

<comment><USER20> True, but perhaps they find 0.5% of users get confused by that screen and that 0.5% represents several million £ in revenue.

<comment><USER22> And imagine how much being hacked affects revenue!

I don't doubt, though, that some sort of similar short-sighted thinking led to this decision. Is it really possible that such a large organization simply doesn't understand password policy? Not to mention, an organization that's on the board of PCI-DSS?

<comment><USER20> Possibly not that much, as long as their security is good enough that they don't get sued.

At the point where you are worrying about hashed passwords, your system has already been owned.

It also depends on public reaction to the incident, people won't necessarily blame tesco either and blame the "1337 chinese super h4x0rs"

</comment></comment></comment></comment></comment><comment><USER23> It boggles my mind that this is STILL happening. How many leaked databases of plain text passwords, not to mention 'point and shoot' tools like firesheep, will it take before companies start taking security seriously?

Yes it's possible they two way encrypt their passwords, but that's still not as secure as salted hashes, not to mention all the other security blunders.

<comment><USER24> You can two-way encrypt your password (even with hashes, and repeated rounds). And you can even make it as secure as hashes, if you keep the decryption key offline, on paper, in a safe. (So no: We send your password to you via email, if you forget it.)

Of course, you shouldn't do it, unless you have a good reason. E.g. There was talk a few months ago about a new law being proposed in France requiring companies to provide the police with user passwords.

</comment></comment><comment><USER20> Whilst I agree with the big one about plain text passwords some of the niggles here seem a little odd.

Tesco are not advising that everyone goes back to IE 3, they are simply stating this as a lowest common denominator since I'm assuming that was the first browser to support whatever version of TLS they were using etc.

Also, is running an old version of ASP.NET and IIS really a problem? Does he advocate going through the expense of rewriting/retesting the entire website every time MS drops a new version? If they are pulling down security patches this should be a non issue.

<comment><USER25> The post advocates simply staying reasonably up to date, then says that IIS 6 is unreasonably old. relevant bit:

 _This is not necessarily a high-intensity exercise, once every few years you simply make sure you haven't fallen too far behind the eight ball. Certainly you don't let key software components get 9 years old and nearly 5 versions out of date._

This is quite a bit less intensive then you describe and I think it's reasonable to expect that a website taking payments not be more the a couple years out of date.

<comment><USER20> IIS 6 is part of Windows 2003 Server, therefor it will be on "Extended Support" until 14/07/2015

[http://support.microsoft.com/lifecycle/search/default.aspx?a...](http://support.microsoft.com/lifecycle/search/default.aspx?alpha=Windows+Server+2003+R2)

This means that if there is some security vulnerability discovered with it then Microsoft will provide a patch, therefor from a security point of view it isn't "out of date".

The number of years and versions is fairly irrelevant, there will be plenty of very secure systems in use by banks and the military that will no doubt pre- date much of what tesco is using by several decades.

<comment><AUTHOR> The relevance is that none of the _additional_ protections added to the technologies are available. We're in a very different threat landscape today than what we were in 9 years ago and the technologies provide advances to better protect ourselves. If you're using them!

</comment></comment></comment></comment><comment><USER26> And yet, they have a very clued up technology department led by Nick Lansley, which many years ago opened up a public API to access to Tesco online shopping.

<comment><USER27> Yes, I get the impression he is somebody who _cares_ , so probably a good place to start for anyone who wants to see this fixed:

<http://www.blogger.com/profile/00087509895945257528>

</comment></comment><comment><USER28> I don't think it's fair to expect a customer service representative to understand the issue here. Maybe it might be better to go through Tesco's corporate arm? I just tried submitting something through the feedback form on the front page of Tesco.com, perhaps this has a better chance of reaching somebody in a position to actually do something about it.

<comment><AUTHOR> I totally agree, which of course is why they shouldn't be commenting on it! But regardless of the Customer Care's Twitter account, their messaging is consistent with the misunderstandings demonstrated throughout the website.

</comment></comment><comment><USER29> Doesn't some of this fall afoul of PCIDSS? (In particular, leaking information about the webserver's configuration).

</comment><comment><USER30> I've just bought a Thinkpad from Lenovo via their website. They're doing the same infuriating thing.

        > Dear ****,
        > Thank you for contacting us on Lenovo Outlet.
        > The password you requested is: ******
        > Please note: This e-mail message was sent from a
        > notification-only address that cannot accept
        > incoming e-mail. Please do not reply to this message.
        > Sincerely,
        > Customer Service

Tesco can live without geek business. You'd think a company like this would care though. They send it in plaintext when you sign up too.

<comment><USER31> How about Ajaxian? They're ONLY geeks, and yet do the same thing.

</comment></comment><comment><USER32> These are all big problems, but one incredibly common security anti-pattern out there that I never see talked about are the "security questions" that so many websites use to let you reset your password.

It's amazing: a website will make me choose an 8-character (but not more than 14!) password with a number, a symbol, and at least one capital and one lowercase letter, but then it will let anyone who knows my birthday and favorite color change that password to whatever they like.

(Obviously, I can opt out of this feature by typing gibberish into those answer fields, but do you think your grandfather will think to do that?)

One variation that I know of that you _can't_ opt out of it is on some banks' two-factor authentication, where they have you log in by answering a security question first, and then entering your password once you get the question right. The great thing about this is that it makes the bank an easy test- ground for guessing your security questions to use on other sites.

<comment><USER33> _It's amazing: a website will make me choose an 8-character (but not more than 14!) password with a number, a symbol, and at least one capital and one lowercase letter, but then it will let anyone who knows my birthday and favorite color change that password to whatever they like._

The most common implementation is to require to reset a password via a link sent in the email (and only then you answer security questions), which solves the particular problem you describe.

<comment><USER32> That has thankfully become more common recently, but many smaller sites never caught on.

</comment></comment></comment><comment><USER34> Shocking stuff. Given the level of ignorance on display here, the size and political clout of Tescos and the detailed summary of possible attack vectors presented by Troy, is there a chance he could be fitted up for 'hacking' charges? What worried me was his trace.axd request: it's definitely using a computer system in a way it was not intended, which has caused problems for other security researchers in the UK in the past.

Just commenting quickly over breakfast but if I find the time later I'll try to look up the cases. (I remember something about a kid ending up in court for using relative paths to explore a web server (/content/../../ etc.)

Thank God there's still Waitrose.

</comment><comment><USER35> It's fun to bash on the most recent security naiveté, but can someone explain why GNU Mailman _still_ emails users' passwords after subscribing?

Mailman warns users that passwords will be mailed plaintext, but why mail passwords to begin with?

<comment><USER36> For accounts that I use rarely and have a low cost even if compromised, I prefer convenience over security.

As mailman has a fairly technical audience and reminds users that passwords are stored/sent in plaintext, I see it as a feature, not a bug.

</comment></comment><comment><USER37> Great analysis except I'm puzzled by his claim about trace.axd -- is it really a security risk that tracing is enabled, given that it can only be accessed from the local machine?

<comment><USER38> Depending on the configuration, it can be accessed from a remote computer. In this case, it was configured for localhost access, however it is entirely possible that it could be world-accessible.

<comment><USER37> Right... that's like saying "The root password was strong, however it is entirely possible that it could be an empty string."

Fortunately, someone on the main article did respond that having trace.axd enabled could result in 500 errors dumping a stack trace. That's a much clearer argument for why having tracing enabled is a bad thing.

</comment></comment></comment><comment><USER39> This is an entirely baseless accusation, but I have my cynical hat on today. I'm wondering if the cost to provide the additional customer service that could be involved in helping people deal with stronger security (password reset email, reset pages and confirmations etc) has been weighed against the cost of upgrades and reparation for account breaches, and influenced the decisions here.

</comment><comment><USER40> I think it's safe to assume that they outsourced this aspect of their online service, given the quality of the copy in some of the pages.

</comment><comment><USER8> Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites.

This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.

<comment><USER41> > _Tesco are fundamentally in the business of selling meat and potatoes to > everyone in the UK_

That is changing - it is getting to the point where their business angle is more "renting shelf space to brands" as much as selling what we want to buy (that is a general industry thing, not a Tesco specific comment).

Even ignoring that cynicism, their business is far more than food and I suspect the food sales are dwarfed when you add everything else together. Food is just the product that gets us through the door to see the other stuff: meat, veg, bread and milk are the things that the rest of the occupants of large shopping centres tend to lack.

> _not [in the business] of making highly-secure websites._

On the contrary: they are taking in and storing personal details and in some cases banking details (they sell banking services as well as physical products), and getting access to your account may give someone the ability to buy things on your credit card. It is my understanding that both _by law_ and by the agreements they have in place with their chose credit card processing partners they are required to live up to certain security expectations, and if they do not live up to those expectations they should be investigated, fined, and stopped from trading in those ways until they are up to scratch.

The claim that their password storage is "up to industry standards" is both unduly vague (though as the conversation was by tweet the length limitation there may be partly to blame for that) and simply wrong. They are not compliant with PCIDSS ([http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...](http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard)) which I believe is considered the industry standard for handling credit card data or accounts that are associated with it.

<comment><USER8> Good answer. The problem is the mismatch between the business that they think they're in and the business that they are becoming.

However I am not finding anything about "you may not store passwords in plain text or using reversible encryption" in that PCIDSS wikipedia link. If it is part of the standard (as it should be) then it deserves to be in the wikipedia article.

<comment><USER41> I may be confusing it with other standards that we had to ensure we were compliant with on a project a couple of years ago.

Even if it isn't in PCIDSS, _not_ storing passwords securely is certainly not industry practice for any company that operates as a bank in any of its parts.

</comment></comment></comment></comment><comment><USER42> … and then he goes and recommends 1Password, a closed-source "security" software. Yes, I'm one to talk, I'm using the OS X password manager. But I wouldn't recommended it in a security blog.

Sadly, 1Password is probably the best solution there currently is. But this only shows how abysmal the current state of affairs is for security.

</comment><comment><USER43> This reminds me of "Our security auditor is an idiot. How do I give him the information he wants?"

\--> [http://serverfault.com/questions/293217/our-security- auditor...](http://serverfault.com/questions/293217/our-security-auditor-is- an-idiot-how-do-i-give-him-the-information-he-)

Have anyone seen this? :-)

<comment><USER44> I really wished there was a bigger followup to this story, including if PCI allowed them to continue with this clueless "security audit"

</comment></comment><comment><USER45> I think this is a common trait of many large businesses. Recently I reset my Virgin Media password, only to receive an email with my password in plaintext right there.

I considered writing / emailing but didn't think it would do much good.

</comment><comment><USER46> Reminds me of the banks with their "enter the first and fourth characters of your password"-type enhanced login forms. How are they doing that without storing the plaintext, then?

<comment><USER20> Perhaps when you set the password it generates a bunch of combinations of password chars that might ask you to enter and then hash these. Of course that does make them more exploitable because you can leak information about the password 1 or 2 characters at a time.

However your bank will have so much information stored about you that if your bank gets owned you're basically fucked anyway even if they don't get your password.

I imagine the servers that actually store this data however are secure to a ridiculous degree.

</comment></comment><comment><USER47> You know a technical blog post was interesting and informative when it spawns 5+ tabs of other articles and Google searches on the topic!

</comment><comment><USER48> See

<http://news.ycombinator.com/item?id=4312128>

</comment><comment><USER49> I'm interested to know what everyone's take on the "use https always for everything" stance is. Does any site actually follow that rule? Even big names like facebook allow you to use http don't they? And what about the "don't put http elements in an https page"? Why not? What benefit is sending the images over https (thus making the page load slower) if they are on a seperate subdomain, so there's no cookies being sent with those requests?

<comment><USER50> >(thus making the page load slower)

The difference is tiny. If your images are on the same domain as the html, you'll have no extra overhead from the ssl handshake (thanks to http keepalive), and the symmetric encryption used in an existing ssl connection will have a negligible impact on performance.

I can think of two reasons you want https, even for just images:

1) Even though modifying an image in flight will _probably_ not have major security implications, you can't be sure. Perhaps a carefully edited and resized image could alter the layout of a form, tricking the careless user into publishing information they didn't mean to.

2) Perhaps your adversary is just a teenager bothering people trying to be productive at a coffee shop. Including a 10000x10000 image that makes the page unusable, or replacing your logo with porn isn't exactly something you want, even if it doesn't compromise anybody's bank account.

<comment><USER49> HTTP keepalives just means you only need to negotiate two extra SSL connections instead of n (n being the number of images in the page). The overhead of that is certainly noticeable. If there's no actual benefit, then it shouldn't be in his list of "stuff you have to do (and nobody actually does)".

<comment><USER50> But for most websites, it is something you have to do. Ruining the layout of your page is about as bad as any other DoS attack for most of the afflicted users.

</comment></comment></comment></comment><comment><USER51> I'll just leave this here... It's rather indicative of their general idea of "Security". Stumbled across this a number of years ago, told them about it, it's still wide open.

<http://www>. preprod.tescoentertainment. com/Store/Browse/Home/</comment>


One Laptop Per Child: Hackers Wanted - <AUTHOR> http://seeksift.wordpress.com/2007/02/28/one-laptop-per-child-hackers-wanted/ <comment><USER2> There are some open tickets for the Sugar environment (OLPC's desktop environment running on top Fedora). I admire their human interface approach, as to make an introduction to computing more intuitive and natural. However, even without prior experience with computers, I would think a child could easily pick up a standard OS-interface. Anybody else have any thoughts on that?

<comment><AUTHOR> I wish I'd recorded the talk: the whole Sugar environment is done completely differently from the OS conventions we're used to now.

Paraphrasing (and I may misquote him slightly), he said that using Sugar doesn't involving starting up an application but rather with "what do I want to do", and everything is built around that.

It's a powerful idea, one that has potential to transcend this project into how we interact with future operating systems.

Also, the mesh networking idea (every laptop is a router, that can forward packets even in suspend mode) has potential in how wireless networks of the future will work.

</comment></comment><comment><AUTHOR> A terrific presentation, and great opportunities for Python hackers (there are probably great hardware hacks, too, but I'm a software guy, primarily).

And don't let that talk about "all the action is in Cambridge or Silicon Valley" get you down -- NYC has plenty of great things brewing!

<comment><USER3> Uh-ok, I hope pg doesn't hear that!</comment></comment>


Ask HN: Why does Mozilla not ask the users to pay for Firefox - <AUTHOR> A genuine question, that's timely in context of the recent layoffs at Mozilla:
Why doesn't Mozilla take user's money for Firefox? I would gladly pay a few bucks per month for a browser. It could even be the same version that other people get for free.
I don't want to pay for other services that Mozilla has to offer, like Pocket or VPN. I just want a great open-source browser from someone who is not FAAMG. <comment><USER2> Because there are eleventy billion free browsers out there already --quite a few of which are at least as good [if not better] than Firefox-- so almost no- one would see the need to buy a browser.

</comment><comment><USER3> Mozilla already accepts what you've described (a fee for a product indistinguishable from the free version). The industry parlance for such a thing is a "donation."

<comment><AUTHOR> You are generally correct, however, the donations to the Mozilla Foundation do not go into Firefox development (see my other comment).

<comment><USER3> A distinction without a difference. There are few guarantees in life, death and taxes are two. And you don't have to look hard for someone willing to take your money.

</comment></comment></comment><comment><USER4> You can donate to the foundation - [https://donate.mozilla.org/](https://donate.mozilla.org/)

<comment><AUTHOR> Thanks, I suspected that but never really saw the opportunity. The information about donations is nowhere to be found in the Firefox browser, Firefox website, Mozilla website. So it seems like they are not even trying to get user's money through the donations channel.

Also, the donations seem to fund every other Mozilla Foundation effort _except_ Firefox.

Quote from FAQ: "Firefox is maintained by the Mozilla Corporation, a wholly- owned subsidiary of the Mozilla Foundation. While Firefox does produce revenue — chiefly through search partnerships — this earned income is largely reinvested back into the Corporation. The Mozilla Foundation's education and advocacy efforts, which span several continents and reach millions of people, are supported by philanthropic donations."

</comment></comment><comment><USER5> Donations have been tried as a way to fund other open source projects. It doesn't work. Almost nobody is like you.</comment>


Ask HN: Why are some research papers paywalled? - <AUTHOR> Isn't the objective of science to spread new findings?<p>So why are some research papers published behind a paywall ? <comment><USER2> The short answer is because it is a way for someone to make money.

Not trying to be trite, but it is the same rationale that is used to pay ICANN for domain name registration or GoDaddy for an SSL certificate: They are perceived as an authority (ICANN exclusively, GoDaddy as one of an elite few).

It's possible that arxiv.org would be the eqivalent of Let's Encrypt, both lack the "extended verification" of the paid service.

For reputable journals, the peer review process is far from trivial. This last year, I reviewed ~8 computer science papers. I only recommended 2 for publication. For all of them, however, I spent several hours going through the paper, the references, the algorithms, mathematics, experiments and methodology, etc. For all of them I gave a detailed writeup to support my recommendation. For all of them, there were 3-5 people doing the same. We are all experts in the field.

Most submissions are rejected, but the review process is the same. The authors (who worked several months on the paper) will probably take a failed submission and rewrite parts of it, taking the suggestions and criticisms into account, and re-submit it elsewhere, where the same effort is repeated by different reviewers.

All of this is to say that there is a lot of overhead to get a paper published.

Some journals charge a publication fee if your paper is accepted. If the journal is an open-access journal (which is what you are looking for), then the fee can be $2,000-$3,000!

Please note that I did not get paid a single cent to serve as reviewer for any of the papers. The money goes somewhere, but not to me, and not to the authors. Finally, being in CS and having a background in server management, I can honestly say that the technology side is not that expensive, either, so that is not a valid justification.

It should give everyone pause: Why does a conference cost $1,200 to attend (not including the hotel stay or transportation) when the research presenters don't get paid anything? Why does it cost such exorbitant fees to publish a paper? Why does it cost so much to buy access to a single paper? The authors and reviewers don't get paid any of the money.

Somebody _is_ making money on it, though.

</comment><comment><USER3> Research is largely conducted in two areas:

1\. In academic institutions where grants are the core source of funding. In order to get funding (and extensions of it) you need to have publications (the more the better) in "high impact" journals. Over the years these journals have become the property of big publishing companies - hence the profit motive and the paywalls.

2\. In industry labs, research findings are a source of competitive advantage and thus carefully guarded to maximise profit and to obstruct potential competitors. Patent protection is typically sought out as soon as any results from research are patentable.

In principle scientists share their findings, but the organisations that they work within are motivated by the usual business imperatives. Once you are employed in academia, you have good access to the paywalled material.

Depending upon your field of interest there may be some open access resources available. Furthermore, if you directly contact authors and ask nicely, they might send you copies of their work on a P2P basis.

</comment><comment><USER4> Because the objective of scientists is to get tenure, grants, and publish in top journals.</comment>


Multitasking is killing me (and probably you too) - <AUTHOR> http://www.stubbornella.org/content/2010/07/11/multitasking-is-killing-me-and-probably-you-too/

<comment><USER2> I'd recommend just turning off your phone and muting IM notifications. Tell people in the office that you need to work for a bit to get some stuff done. It's the little interruptions that keep you from getting big things done.

It's been working wonders for me over the last few weeks. BTW, I'm the geek in the NYT article. Here's my setup: [http://www.nytimes.com/interactive/2010/06/06/business/kord-...](http://www.nytimes.com/interactive/2010/06/06/business/kord- pano.html?ref=technology)</comment>


Ruby's Vulnerability Handling Debacle - <AUTHOR> http://www.matasano.com/log/1079/rubys-vulnerability-handling-debacle/

<comment><USER2> What disappoints me the most is that the RoR maintainers made almost exactly the same mistake a couple of years ago, trying to keep a security flaw under wraps rather than being forthright about it.

<comment><USER3> It's an ego thing. Nobody wants to admit the fact that they made a major mistake.

I look at it differently, though. It's your fault if you use open-source software that's insecure. The code is right there; if finding the vulnerability was so simple to find and fix, you could have found and fixed it yourself. Since you didn't do that, you really have no right to deride the developer for also missing it.

It's easy to play blogger pundit, but harder to write software that people find useful.</comment></comment>


Ask HN: How to sync up the experience for large number of users of a web app? - <AUTHOR>

What's a reliable method for making sure that if 1,000 people are all using my web app to participate in the same thing that what they're seeing is always within a second or two of being totally in sync?<p>I'm looking for kind of a generic solution, but in the simplest scenario: Over the course of a minute I want to show 3 different pictures and when each one changes it should update on every user's screen at the same time regardless of when they loaded the page. <comment><USER2> First, you need each instance of your running web app to be synchronized to the same clock, so they can make events occur at the same time.

Second, it would probably be best to upload your images from your server to your 1,000 clients before they need to be displayed. This can be done asynchronously, so you server doesn't struggle to get it all done within a few seconds.

Third, your web app clients could handshake they received the images, ... or you could just allow enough time to pass so you are confident they all have the images, ... and then they could all flip their displays at a pre-arranged time.

Voila. Synchronized image display.

<comment><USER3> "First, you need each instance of your running web app to be synchronized to the same clock, so they can make events occur at the same time."

Or you could just preload the delta between your clock and their clock onto the client and trigger a javascript event so the client does all the work.

<comment><USER2> Yes, "preloading the delta between the server clock and the client clock" is what I had in mind when I wrote "synchronized to the same clock". That is, synchronized to the server clock.

</comment></comment></comment><comment><USER4> You may want to take a look at comet and long polling. With this method, you can eliminate reliance on a clock (and all the associated headaches).

Using comet/long polling, you can sort of mimic pushing the new pictures to clients. This could be ideal because it wouldn't matter when users load the page. Your mileage may vary, however, depending on your specific requirements.

</comment><comment><USER5> Differential Synchronization: <http://www.youtube.com/watch?v=S2Hp_1jqpY8>

</comment><comment><USER6> Comet (<http://en.wikipedia.org/wiki/Comet_(programming)>) can be used to make sure that all your clients are in sync.

rupy (<http://code.google.com/p/rupy/>) might be a good place to start.</comment>


Microsoft sides with Epic Games in legal battle against Apple - <AUTHOR> https://www.androidpolice.com/2020/08/23/apple-says-it-will-cut-off-epic-games-from-ios-development-impacting-fortnite-and-unreal-engine-software/ <comment><USER2> Oh man I could really go for another big tech cold war, they've all been playing nicely for a while.</comment>


RustBoyAdvance-NG: GameBoy Advance emulator and debugger, written in rust - <AUTHOR> https://github.com/michelhe/rustboyadvance-ng <comment><USER2> Rust is a nice language for emulators in my experience, although managing the large global state emulators require while making the borrow checker happy and not damaging performance requires a bit of planning (unless you're willing to litter your code with unsafes).

My strategy in the end is simply to stuff the entire state in a struct that I pass around everywhere, using a more functional style instead of class methods. This way I don't have to borrow anything and I have access to the full state everywhere in the code. It doesn't make for clean OOP-style encapsulation but I found that doing that was too complicated in an emulator, you simply have too many interactions between the various modules of most consoles. For instance the DMA can write data to the GPU which can trigger an IRQ in the interrupt controller which can change the CPU state which can modify the state of a coprocessor which can lead to registers being banked into RAM etc...

Besides, the architecture of an emulator is generally constrained by the underlying hardware, so it's rare that you have to do big refactors. Having leaky interfaces is not much of a problem in practice because you don't really have to worry about "but what if tomorrow I need to emulate a Game Boy Advance with a very different GPU?".

While we're showing off Rust emulator projects I've spent the last few days writing an emulator for the PlayStation's CD-ROM sub-CPU: [https://gitlab.com/flio/psx_cd](https://gitlab.com/flio/psx_cd) . I hope to be able to integrate it into my PlayStation emulator when it's done, which would save me from having a super hacky high level CD interface like most other PSX emulators out there.

<comment><USER3> > using a more functional style instead of class methods

Does Rust even have classes?

<comment><USER4> `impl` methods with `self` parameters are basically class methods in feel.

</comment></comment></comment><comment><USER5> Great project! But other than it being 'written in Rust' can someone explain what is interesting about yet another Gameboy Advance emulator using SDL2? I'm guessing its WASM support?

I think we're all capitalising on the HN algorithm gearing towards Rust- related posts which can only be a great thing for those who absolutely love Rust <3\. Perhaps I should be a town crier for the Rust project to market all things Rust.

𝔒𝔶𝔢𝔷!, 𝔒𝔶𝔢𝔷!, 𝔒𝔶𝔢𝔷! 𝔄𝔫𝔬𝔱𝔥𝔢𝔯 𝔤𝔯𝔢𝔞𝔱 ℜ𝔲𝔰𝔱 𝔭𝔯𝔬𝔧𝔢𝔠𝔱!

<comment><USER6> > 𝔒𝔶𝔢𝔷!, 𝔒𝔶𝔢𝔷!, 𝔒𝔶𝔢𝔷! 𝔄𝔫𝔬𝔱𝔥𝔢𝔯 𝔤𝔯𝔢𝔞𝔱 ℜ𝔲𝔰𝔱 𝔭𝔯𝔬𝔧𝔢𝔠𝔱!

What the hell are those? I looked at each letter (Unicode 1D5{12,36,22,37}), and apparently it spells out Oyez?

<comment><USER7> [https://en.wikipedia.org/wiki/Oyez](https://en.wikipedia.org/wiki/Oyez)

Oyez (/oʊˈjɛz/, /oʊˈjeɪ/, /oʊˈjɛs/, more rarely with the word stress at the beginning) is a traditional interjection said two or three times in succession to introduce the opening of a court of law, especially in Great Britain. The interjection is also traditionally used by town criers to attract the attention of the public to public proclamations.

<comment><USER8> It's French in origin, FYI.

<comment><USER9> yes it is

</comment></comment></comment></comment></comment><comment><USER10> So another post about Rust. Nice.</comment>