Denial of Service Attacks - <AUTHOR> https://github.com/blog/1796-denial-of-service-attacks <comment><USER3> To GitHub and everyone: _please_ use UTC timestamps when there are potential readers outside of your timezone. Since every technical person should know their current UTC difference, calculating the local time is easy.

<comment><USER4> >Since every technical person should know their current UTC difference,

Awww, that's so optimistic.

<comment><USER5> Don't forget the ancient proverb handed down to us from the original neckbeards:

"At some point in their career, every programmer must pass through the fires of timezone hell."

<comment><USER6> Timezone hell is, of course, followed up with the three-headed hound of locales, charmaps, and keyboard layouts. And if you pass by that, you drop into the river of cache coherency...

(Esoteric software-engineering topics could make a wonderful video game, you know?)

<comment><USER7> Turkey Test: [http://www.moserware.com/2008/02/does-your-code-pass- turkey-...](http://www.moserware.com/2008/02/does-your-code-pass-turkey- test.html)

</comment></comment></comment></comment></comment><comment><USER8> You ever sit there and wonder who the person is on the other end of the attack? Someone sitting there, I guess with not much on that day, decides to command their army of infected bots to attack github.

Why github I wonder? Perhaps it provides a challenging target. Perhaps github is used as a testing ground for a more profitable future attack.

We often get technical writeups after a DDoS attack, however we very rarely get a writeup sumising the motive behind the attack. I can't believe _every_ attack is simply driven by 'because they can'.

<comment><USER6> There's a good piece of journalism (EDIT: see the reply to this comment for the link), in which someone who was being DDoSed went into the various black- market forums where such people as would DDoS hang out, to see if they could find their attacker.

What they found was that, at one forum, there was a convention where new, as- yet-untrusted sellers of DDoSing-as-a-Service are expected to take down some big, technically-respected target (e.g. GitHub) to prove their mettle, before anyone would hire them. And conveniently-enough, some new DDoSaaS seller was advertising right then, telling everyone to "look and see that _________ is down. That was me! Hire me now!"

It further turned out that the site-owner doxxed the account, found them to be a thirteen-year-old(!), and called their parents to tell them what their child was doing on the internet.

<comment><USER9> [http://krebsonsecurity.com/2014/02/the-new- normal-200-400-gb...](http://krebsonsecurity.com/2014/02/the-new- normal-200-400-gbps-ddos-attacks/)

</comment></comment></comment><comment><USER10> It just shows that we need some kind of distributed version control system.

<comment><USER11> Ha! This is good satire, but for me personally, github going down isn't a version control problem nearly as much as it is a project collaboration problem. I can't go review pull requests and discuss issues when github is down, but I can still do all the traditional version control activities. Github is so much more than distributed version control. If somebody started doing the non-version-control things that github does in a distributed fashion, I would be very interested in taking a look.

<comment><USER12> Take a look at Fossil, then. It's a distributed version control system, bug tracker, wiki and blog, from the author of SQLite.

<comment><USER11> Yeah, cool, thanks for the pointer. I remember looking at it before but never quite wrapped my head around it.

</comment></comment></comment></comment><comment><USER13> Call me naive but I fail at imagining why would someone want to DOS Github.

I mean, if you're into this, it's certainly fun to launch DOS attacks against large "evil" things such as government services, large corps and Micro$oft becoz w1ndoz sux0rz, but... Github? Why?

<comment><USER14> Can you think of an easier way to negatively impact productivity at nearly every tech startup? There might not be a reason other than simple bullying. In fact, I think these attackers might be the same ones behind that 2048 game.

<comment><USER15> Or bitcoin! I've always referred to it as a DDoS on engineers.

</comment></comment></comment><comment><USER16> If the attacks against Github are mostly proving grounds for fledgling DDoSaaS, I would assume write-ups like these only serve to elevate their status as a good proving ground.

Did this article contain anything particularly useful for anyone thinking about DDoS hardening? I didn't find anything. I guess it's not really supposed to be a technical article, just a smattering of buzzwords to let you know how hard they try.

The postmortem-half-apology has become quite an art form; as getting it right can actually draw a lot of positive publicity, and getting it wrong can be brutal. But I can definitely see how this post would feel like a pat on the back to whoever launched the attack.

<comment><USER17> I was going to disagree with you, but then I realized I didn't understand what you were saying: What do you suggest they should have done?

<comment><USER16> Github downtime (and subsequent postmortems) are a regular feature of the HN front page. The postmortems have come to command their own audience, similar to the CloudFlare reports.

It's actually a pretty bad position Github's being put in. They sit at the crossroads of playing defense against DDoS and trying to dispel or at least ameliorate any blame for the downtime.

My point was, if they have indeed become the internet's DDoS proving ground (as several others were speculating), then while you can see how much effort they're putting into these postmortems, I can see it becoming a vicious cycle.

Then the challenge is, how does Github placate their users without basically pinning a ribbon on the attacker? The funny thing is how the "best practice" checklist for a postmortem (say what happened, say how you thought you were safe, say how something unexpected broke your assumptions, apologize, say what you're doing differently in the future) basically ties their hands.

A pretty bad position for Github all around.

</comment></comment></comment><comment><USER18> I honestly feel bad for the engineers at GitHub for having to deal with stuff like this. GitHub is large, so they are a target, and the specifics of what they do means that caching is not a straightforward task. I imagine there are a lot more vectors of attack that have not been used yet and guarding against them is always going to be on a case-by-case basis. In the meantime, when GitHub is having downtime or even badtime it impacts its users pretty significantly. The private repo's I work on are a source of income for GitHub, but if this gets common enough the people in charge might just move away from it to a smaller competitor that doesn't have these problems just so that my time is not wasted on waiting on GitHub to come back up.

<comment><USER19> Isn't the whole point of git that you don't need to even have internet access to get work done?

<comment><USER20> You still have your local source code, but GitHub gives you issue tracking, comments, pull requests, and other things you could still use for work - <USER2> of which can be cloned locally.

<comment><USER19> Okay yes, but it probably isn't going to be down for more than a few hours at a time. I'm sure pull requests and issues can wait a few hours vs. actually fixing bugs or writing new code. Right?

<comment><USER21> No, they can't wait a few hours. Not when you have a 60 developer team on a private GitHub enterprise account, and it's the middle of the workday.

<comment><USER22> if all 60 are working together sure, but if it's a handful of devs working with each other, you can pull directly from each others repository.

PITB, yes. But you can still get work done.

<comment><USER23> You can pull from eachother, but since you know github will be up in a few hours and it would take more than that to really coordinate any workflow change, most of the time people just goof off until github is back.

Plus you are forgetting that lot of automated jobs get triggered on github changes. Many shops kick off all kinds of tests, deployments, and other things based on changes to the github repo.

<comment><USER22> If devs want to use that as an excuse to do other things, that's cool.

My point was simply that you can still be productive when github goes down, if you want to be.

<comment><USER21> Sure, _developers_ can still be productive. But what about QA, UX, Product Managers? They _rely_ on automated jobs that get triggered by GitHub changes.

I don't think you're "wrong" for the developer use case, but the reality is that it can bring large teams to a screeching halt.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Kudos to the folks at Github for such summary of the attack! Clear, with a decent amount of info and honest.

</comment><comment><USER25> I'm not sure why someone would attack GitHub. Extortion? But aren't there more valuable targets? Showing off their botnet, perhaps? These attacks seem frequent.

<comment><USER26> Unfortunately there may not be a "good" reason. It's not hard for me to imagine that someone could do it for kicks, or perhaps to test some new attack vectors against a reasonably hardened target.

<comment><USER27> _It 's not hard for me to imagine that someone could do it for kicks, or perhaps to test some new attack vectors against a reasonably hardened target._

Though when you try out a new attack vector, the community (hopefully) publishes enough details about the attack to help the next target more effectively deal with that particular attack.

If someone is attacking whitehouse.gov or a similar target, I somewhat understand their reasons why (though I don't agree with them). github.com, on the other hand, while a for-profit corporation, is also a valuable bit of Internet infrastructure that makes the world a better place. Attacking targets like github.com, Wikipedia, and others helps no one, and forwards no coherent political agenda.

So I'm going with the "for kicks" / jerkwad theory.

</comment></comment></comment><comment><USER28> GitHub has been targeted by the Chinese government hackers before, with a man- in-the-middle attack, and blocking GitHub with the Great Firewall. Maybe they are at it again?

[http://www.theregister.co.uk/2013/01/31/github_ssl_man_in_th...](http://www.theregister.co.uk/2013/01/31/github_ssl_man_in_the_middle_attack/)

[https://en.greatfire.org/blog/2013/jan/github-blocked- china-...](https://en.greatfire.org/blog/2013/jan/github-blocked-china-how-it- happened-how-get-around-it-and-where-it-will-take-us)

</comment><comment><USER29> I'd be interested to know who their "DDoS mitigation service provider" is.

<comment><USER30> Cloudflare is a very popular choice.

<comment><USER31> Very popular among consumers. I think large organizations are more likely to pay someone like [http://www.prolexic.com/](http://www.prolexic.com/)

<comment><USER32> I have seen the folks from prolexic at work and they service/platform is impressive.

On their spare time they take down botnets: [http://www.prolexic.com/knowledge-center-ddos- vulnerability-...](http://www.prolexic.com/knowledge-center-ddos- vulnerability-disclosure-dirt-jumper.html)

[http://arstechnica.com/security/2012/08/ddos-take-down- manua...](http://arstechnica.com/security/2012/08/ddos-take-down-manual/)

Shameless plug for hackmiami, if anyone is interested in learning how its done up and close they run frequent talks/meetups locally: [http://hackmiami.org/](http://hackmiami.org/)

</comment></comment></comment></comment><comment><USER33> What motive does the attacker have?

There are lots of articles on HN about DDoS attacks on various websites or online services. Most of the discussion is about the bandwidth used and the technical mechanics of the attack and defense.

This is interesting, but there's little discussion of the economic motivation.

I assume the kind of infrastructure used to launch this attack is not free. I understand people or groups might be using this as a way to further various political agendas or simply for bragging rights. I also understand DDoS attacks might be an extortion tool.

In the former case, wouldn't the attacker try to loudly and publicly claim responsibility? In the latter case, wouldn't the defenders take pride in their "we don't negotiate with extortionists" stance while they're in disclosure mode?

Or maybe this is just some rich guy's private hobby, and he does it for the amusement he gets out of reading about people's reactions when they can't figure out who's responsible?

It seems like the set of rich guys who have the technical skills to do this kind of thing without getting caught would be kinda small. And if they hire people, the bigger their organization gets, the likelier they'll hire a law enforcement plant -- or simply someone with a conscience -- and the game will be up.

Organized crime might be a possibility, but I assume those guys are interested in making money, not just committing crimes and wreaking havoc. So what's the business model that motivates these attacks? If it's extortion, why do the targets feel comfortable revealing the attack, but uncomfortable revealing they're being squeezed for money?

</comment><comment><USER34> > In addition to managing the capacity of our own network, we've contracted > with a leading DDoS mitigation service provider. A simple Hubot command can > reroute our traffic to their network which can handle terabits per second. > They're able to absorb the attack, filter out the malicious traffic, and > forward the legitimate traffic on to us for normal processing.

That's kind of awesome

<comment><USER32> This is what we use at our company. Recently bought by Akamai.

[http://www.prolexic.com/why-prolexic-best-dos-and-ddos- scrub...](http://www.prolexic.com/why-prolexic-best-dos-and-ddos-scrubbing- centers.html)

</comment></comment><comment><USER35> It is too bad ICMP Source Quench couldn't have been repurposed to help deal with these kinds of attacks. It would be extremely nice to be able to simply send a packet to each host involved in an attack and have them (and optimally routers in between) slow their rate to the target host.

</comment><comment><USER36> The smaller a service is the easier it is to mitigate such attacks. All kinds of tools that smaller services can use (whitelists, software based filters such as iptables, location based filters and so on) are not available once you cross a certain level of scale. So any simplistic solutions that you might think of for a smaller service will likely simply not be applicable.

</comment><comment><USER37> Wondering if, for a service like github, it would be possible to setup a whitelist of allowable ip addresses.

If an attack was launched only that whitelist would be allowed until the attack was mitigated.

So while certain legitimate traffic would be blocked for sure, people who connect through fixed ip addresses that were whitelisted would get through and be able to do what they needed to do.

Thoughts?

<comment><USER38> Seems like it'd be pretty trivial to circumvent that. Just have your botnet do a few regular old requests to the network a few days before launching. That way the IPs of the botnet members get white listed.

For a website of GitHub's scale, I don't think it would be very effective, though maybe it could be helpful in combination with other measures.

<comment><USER37> No, I'm specifically talking about clients who have signed up entering in their ip address that they access from.

"Just have your botnet do a few regular old requests to the network a few days before launching."

Not talking about "whitelist sites that have made access in the last x days".

For example on HN it would be easy to create a white list. They do it now recognizing new people who signed up and keeping track of activity as well (by points).

You could either have people identify the ip address that they accessed from and further limit the whitelist to a certain period of time and activity additionally.

The idea is not to be 100% perfect but enough so that if you are a regular user of github from an IP address at your office (as opposed to wifi cafe) you will be able to get through.

This is, by the way, how registries limit access to their system. It's all whitelist you have to pre identify the ip addresses that you will access the system from.

The whitelist only comes into play when under attack. And for sure yes if you are connecting from a new place you will be blocked. But others will not be blocked and there will be some access for some people.

<comment><USER39> There are ISPs who change your ip address every 10 seconds, not just on reconnection. This would complicate github too much, I'd rather have 2 hrs downtime every now and then, than have to input my ip address classes from all the locations :D

</comment></comment></comment></comment><comment><USER40> Is there any way to mitigate DDOS attacks systematically without sacrificing network neutrality?

<comment><USER41> If the majority of ASNs in the world followed BCP 38, these attacks would be more difficult because the origin would be easily identifiable. Today you can't tell where it's coming from because backwater networks see value in letting their customers emit forged packets however they like. So all you can do is mitigate and wait for them to move on.

BCP 38/RFC 2827 would change the DoS game, but it's been a best practice for longer than most of this audience has been alive and nobody yet gives a shit and/or they are too lazy to automate the implementation. So operators waste their lives cleaning up after bad actor ASNs that they can't even identify. I shouldn't be mitigating 65 Gbps destined for a controversial customer, the attacker should be removed from the Internet before I even notice.

You can tell from my tone that attacks are part of life for me. I'd venture that denials are the second largest problem facing the Internet today, behind the organizational structure of critical systems like DNS and ahead of spam and surveillance. However, there is now a sizable DoS prevention industry so I wouldn't be surprised if BCP 38 drifts into even more obscurity, but that's the cynic typing.

<comment><USER42> Actually, since this attack wasn't volumetric and was instead attacking GitHub's (TCP-based) applications, they have the rare ability to identify the attacker's drones and possibly hand the list off to someone that can get them shut down. Hopefully GitHub does the right thing here.

<comment><USER43> Most popular sites have huge lists of compromised machines. You can't really do anything with them though. If you block compromised machines, you'll blow up your support team by people complaining they can't reach your site.

It's not in my interest to "Citizen's Arrest" someone with a pwnt node.

</comment></comment></comment></comment><comment><USER44> I'm quite surprised this happened to github...Sometimes I'm trying to look at some repos, but I apparently click too fast and have to wait before I can do other things. I thought they had ddos attacks under control.

</comment><comment><USER45> I find it odd that github can even be subjected to DOS attacks, but it seems its only HTTP traffic. I also wonder why or if it is even possible to DOS the raw tcp layer of the git protocol.

<comment><USER46> You can DOS anything that has a network interface.

</comment></comment><comment><USER47> "A simple Hubot command can reroute our traffic to their network which can handle terabits per second."

Really? You have to round-trip through Campfire to control your network?

<comment><USER48> It's just the most efficient and visible way for us to do it, it's not the only way. Here's a couple of reasons why we like it:

1\. It's scripted so you don't have to think about it at 3am.

2\. The rest of the team can see it happening in realtime so you don't have to explain what you're doing via a side channel. They can see it happening.

3\. It doesn't require specialized knowledge of routing to enable it. If the on-call engineer sees an attack and calls someone for guidance, it's super easy to tell them "type /mitigation enable" for instance.

4\. Of course we can run the exact same script or login to our routers and manually change our BGP announcements if we need to.

</comment></comment><comment><USER49> WTF is wrong with people attacking github and meetup.

DDoSing a government site I can understand, sure. (Aaaand now I'm on a list.)

</comment><comment><USER43> tl;dr We're bad at detecting and handling layer 7 attacks. We're better now.

Dear github dudes, netflow is your friend.

</comment><comment><USER50> Am I the only person that gets slightly annoyed whenever I read "an order of magnitude" and the article doesn't mention whether it's binary or decimal. What do you people think they're talking about, I'm guessing decimal order of magnitude?

<comment><USER51> Doesn't matter to me, 2^X and 10^X are close enough to each other for pretty small to large values of X. When I say it, I usually mean something between x5 and x15.

I think avoiding the temptation to false precision is more important. Inconsistent units and the retention of insignificant digits in order to make numbers look bigger (or smaller) drive me up the wall, though.

<comment><USER46> 2^10 = 1000 10^10 = 10000000000

Not that close, if you ask me.

If you mean something between _5 and_ 15, you are using base 10. *16 are 4 orders of magnitude in binary, but 1 in decimal.

That said, everybody asking that same question, please, do not use binary orders of magnitude. Our language suffers every time somebody does that.

<comment><USER52> 3-5 orders of magnitude is a decent margin of error for things like astrophysics.</comment></comment></comment></comment>


Focus - <AUTHOR> http://phylab.mtu.edu/~nckelley/Focus/

<comment><USER2> Isn't the point larger than there are certain sites that are timesucks but that in general surfing the internet is counter productive? It's not about whether you are looking at HN, it's whether you're browsing aimlessly.

I have a question: what percent of the time is needed to be online or even just on a computer for doing all the pieces of a web software startup? I'd go with 20%, maybe less. And it would probably work better that way without a browser just a click away, ready to steal countless hours that would make the difference between making progress on a project and learning about HN members' workspaces.

(I have a theory that HN is really a devious ploy by pg to divert the attention of wannabe web entrepreneurs from getting stuff done so that his YCers don't have competition.)

</comment><comment><USER3> I just wasted 20 minutes looking at that, chuckling, tweeting the link, emailing it to everyone on my contact list and then having short "that was funny, ROTFL" conversations with the people who responded. Thanks a lot, pal.

</comment><comment><USER4> I am conceptualizing a personal home page that is a version of this but it fetches a task for me to do (from gmail tasks or Things) or it recommends me to read my most recently added boomark to delicious with tag todo. Any ideas on how to do this?

<comment><USER5> For delicious, have the site read the RSS feed for that tag (or just set that tag as your home page).

<comment><USER4> I wasn't aware delicious produced an RSS. Thanks!

</comment></comment></comment><comment><USER6> New homepage. (though I am taking the time to comment on it, so clearly it's not working as well as i'd like.)

</comment><comment><USER7> Similar: <http://www.merlinmann.com/rightnow/>

</comment><comment><USER8> It wouldn't have been noteworthy at all if I didn't sit down here to finish coding...

</comment><comment><USER9> for a while I used Charles as a system-wide proxy, with a "rewrite rule" that directs news.ycombinator.com to a similar page.

related question - are there mac utilities that can do this during configurable hours of the day?

<comment><USER10> RescueTime comes with a Focus mode and a pre-seeded but configurable list of distracting websites: <http://www.rescuetime.com/tour>

You don't set hours of the day, but you specify how long you want to "Get Focused". And you can't close the utility via the GUI to keep you honest; it takes a manual SIGTERM to close while in Focus mode.

I've found it very useful, though unfortunately browser support can be flaky. It seems like every major browser release breaks the website tracking and blocking functionality and it takes a few weeks to a few months for the RescueTime utility to catch up. If you don't like using uncommon OS/browser configurations, you'll probably have better luck, though.

</comment></comment><comment><USER11> yawn</comment>


We finally did something about [Ember on] Android Performance - <AUTHOR> https://eviltrout.com/2016/02/25/fixing-android-performance.html <comment><USER2> One reason this was kind of urgent for us is:

1\. The prevalance of low-end Android devices

2\. The dominance of Android worldwide, e.g. [http://www.idc.com/prodserv/smartphone-os-market- share.jsp](http://www.idc.com/prodserv/smartphone-os-market-share.jsp) shows 2015Q2, android 82.8%, iOS 13.9%, everything else ~3%

We've also been working with Google to see what they can do to make Android/Chrome performance better with complex JavaScript like Ember and Angular. Chrome 45 improved things about 25% which is great, but when you start 500 to 800% slower, there's a long way to go..

Complex JavaScript performance on iOS is, and remains, amazing and stellar. Problem is not much of the world is on iOS.

<comment><USER2> Adding insult to injury, 2015 was also an abysmal year for Android performance, largely due to Qualcomm, uh, how do I say this... _sucking_.

"I don't think there's any way to sugarcoat this, but 2015 has not been a particularly great year for Qualcomm in the high-end SoC business" \-- [http://www.anandtech.com/show/9837/snapdragon-820-preview](http://www.anandtech.com/show/9837/snapdragon-820-preview)

If you compare geekbench single threaded performance numbers, you can sure see why Google is anxious to build their own silicon.

<comment><USER3> >you can sure see why Google is anxious to build their own silicon

This can't come too soon.

Even for native development, the Nexus 6P is a bit disappointing. It does have a lot of pixels to carry around but still its real life performances are not up to what I would expect.

</comment></comment></comment><comment><USER4> Could not sign-in/create account to the blog comment thingy, so asking here:

Is there performance numbers available per browser in Android somewhere and to which browser the mentioned numbers apply?

Traditionally the vendor shipped browsers in Android are abysmal, out of date, probably insecure and not standards compliant. So what I am really interested about is stock Google Chrome or Firefox performance. And if these numbers are from either one of those, it would be nice to know.

<comment><USER2> Firefox on Android is much slower in every JS test I've ever seen. We only test against Chrome on Android. The 5x perf improvement is across the board but slower devices benefit much more. You may not notice a 200ms improvement on say an iPhone 6, but you will sure notice a 1000ms improvement, or more, on older and slower android devices.

</comment></comment><comment><USER5> Out of curiosity, why did you use a custom virtual-DOM implementation instead of one like React?

<comment><USER6> It's perhaps not as custom as I made it sound. The code we have is a wrapper around the [virtual-dom]([https://github.com/Matt-Esch/virtual- dom](https://github.com/Matt-Esch/virtual-dom)) library which does most of the low level work.

The "widget" framework is a series of simple ES6 classes that allow us to keep state around and delegate events as actions up to Ember controllers. We had a lot of pre-existing, battle tested code that was written using Ember idioms and was not a performance problem, so we kept that around and used the virtual dom stuff just for rendering HTML as fast as possible.

Why not React? Our main pain point was rendering, and we didn't need all the extra stuff React provided as those bases were already covered by Ember. Why include 26k min+gzip when we would only use a small part of it that was already provided by another excellent virtual-dom library?</comment></comment>


Duct Tape Programmers and the Culture of Complexity in Software Projects - <AUTHOR> http://www.25hoursaday.com/weblog/2009/09/27/DuctTapeProgrammersAndTheCultureOfComplexityInSoftwareProjects.aspx <comment><USER2> It's not a rehash. Dare uses "Worse is better" as a jumping off point to examine why Ted Nelson's Xanadu failed while the much less capable WWW succeeded. He says Xanadu was much too complex to even get out the door.

I remember visiting the Xanadu project sometime in the 80's. It was a bunch of hackers in an old house in Menlo Park, CA. I came away with the feeling that it wasnt going to succeed because it was too complex. I remember in particular the requirement for bidirectional links and thinking that it was going to require too much cooperation to maintain them. Think, every time someone linked to your site, you now had an outbound link to maintain. Did that mean that if you moved a page, you would have to update a thousand outbound links or a billion browser caches?

<comment><USER3> The thing is that seventeen rules of Xanadu, in themselves, aren't that much more complex than the WWW - The http protocol is not an uber simple thing.

Further the WWW _haphazardly_ succeeds at being everything that Xanadu wanted to be and more, _except_ for those characteristics which had to do with intellectual property (what is now "DRM"). Many people have described the impossibility and undesirability of DRM. One easy way to see the impossibility is to realize that a "transclusion" DRM system would require every protected piece of information to exert control over the entire system, a problem which gets _harder_ as the system gets bigger.

It does relate to duct-tape programmers in the sense that since the WWW doesn't have the fragile global requirements of Xanadu, it can be "duct-taped" to work. But it also should impel us to go a bit beyond Spolsky in the sense that it points to designs which avoid particular inherently difficult problems rather than using simplistic formula of 'avoid any complexity'.

<comment><USER4> "The thing is that seventeen rules of Xanadu, in themselves, aren't that much more complex than the WWW - The http protocol is not an uber simple thing."

I have to disagree. _Requiring_ secure identification of a web server means that _every_ web site must use an SSL certificate. Most likely, the way it was intended, it must also be an identity-verified SSL cert, i.e., "Verisign" et al, not just "some SSL cert I generated last night". _Requiring_ secure identification of the user at all times is very onerous when propagated throughout the entire stack, as it would have had to have been. Now you have to be logged in to all sites, all the time, with some sort of universally- agreed-upon protocol which would run smack into the problem that not everybody's identification needs are the same. "Every user can store documents" means you are not allowed to browse the Xanadu without paying for hosting privileges. Backwards links complicates every CMS, ever, horrifically, and also has to manifest in the protocol. And I'm not even all the way through the list, the problems keep going, but I fear boring the reader.

If you look at what they really mean (remember, these are summaries), it is _night and day_. An elementary HTTP server can be bashed out in an hour, and it'll work with modern browers to at least some degree. In college, writing an HTTP proxy server was a 2 hour lab assignment in networking class, to give an example of another piece of the stack. AFAIK, nobody has _ever_ produced a full Xanadu server, despite massive amounts of effort. This is not a coincidence; this is a reflection of the almost-impossible-to-overstate difference in complexity between the two ideas.

<comment><USER3> Actually, I think you're saying the same thing I at least _meant_ to begin with: Xanadu's requirements are fairly simple to state but extremely complex to implement.

My further point is this show a world where things are a bit muddier than Spolsky's simple/complex division.

</comment></comment></comment></comment><comment><USER5> I like the way this article treats Nelson as not that important. The constant hero worshiping is very annoying sometimes. We know [1] that there were people before and during Nelson's time that were just as creative on the "ideas" side. Berners-Lee got it working on the "rough consensus and working code" KISS principle side. I am sorry but the (albeit small) group of people who consider Nelson the "real" father of the web are wrong. To say nothing of the fact that journalism has by far overemphasized the web compared to the Internet. Even when a small number of journalists correct for that it's Kahn and Cerf with TCP/IP not Licklider, Baran and Davies.

[1] [http://en.wikipedia.org/wiki/Hypertext#Early_precursors_to_h...](http://en.wikipedia.org/wiki/Hypertext#Early_precursors_to_hypertext)

<comment><USER6> If anybody it ought to be Vannevar Bush or Doug Engelbart, not Ted Nelson.

But Ted Nelson had a bunch of stuff figured out that the web is still struggling with today (such as proper attribution and an automated royalty system based on fractional contribution and derivation).

</comment></comment><comment><USER7> Berners-Lee's design for URLs, etc. is spectacularly elegant and carefully thought through. It's not a good example to illustrate the alleged superiority of "duct-tape programming".

There are different kinds of design, useful in different situations, harmful in other situations. Whipping out small web sites, patching bugs in messy business apps, etc., don't call for great elegance. Seeking elegance would only get in the way. Duct tape wins. On the other hand, remember Gopher? Gopher was a simple, functional predecessor of the web, designed without much insight. The WWW needed the kind of simplicity that you can't get from duct tape.

<comment><USER8> Does "duct tape programming" mean "no design", "no elegance"?

How about those pictures that you can see on wikipedia in "duct tape" entry ?

Apollo 17 with duct tape <http://en.wikipedia.org/wiki/File:Duct_tape_apollo17.jpg>

Model ship made with paper and duct tape. <http://en.wikipedia.org/wiki/File:Modelshipmadewithpaper.jpg>

I think Joel Spolsky implied "duct tape programmers" to be those who are pragmatic and get things done, those who do not try to show off unnecessary techniques but focus on solving problems, those who do not try to play toy problems with all wonderful constructs but solve real problems with simple elegant lines of code.

Did I misunderstand what Joel's essay mean?

</comment></comment><comment><USER9> it feels like WWW is a kind of product that is worth designing better. why not take a little longer to make it simpler and more extensible? it doesn't mean it has to be built by a huge committee fighting over standards and trying to include every kitchen sink anyone wants, but it does seem more like a public good than some company's product.

as for "duct tape," maybe it conflates two concepts? i personally think "fast and simple" and "fast and crap" are two different ballgames. my first projects were over my head, so i built crap. then i built crap faster. these are good for throwaway demos, maybe prototypes.

at some point building crap became slow. good design simplifies problems. good abstractions and good framworks make it easier to add more with less code. it's faster to add features, and much less buggy. the upfront cost to building the first feature takes a bit longer to get right, but upon a strong foundation one can really roll. it's like being bound by linear v constant time. when one considers handling bugs in crap code, the worst case becomes exponential time.

i guess what i'm saying is that the complexity of the solution should be appropriate for the entire situation: the developer skillset and prior experience, the scope of the project, the time available, the importance of iteration, extensibility and maintainability, etc.

duct tape is good, but you still have to figure out where to draw the line between overzealous copy-pasting and meta-programming.

</comment><comment><USER10> I've had the displeasure of maintaining code written by duct tape programmers in the past. We called them combat programmers, and some of them worked at places like Netscape with people like jwz (who was mentioned in this article).

A thousand lines of un-commented Perl script (with few, scattered functions) that looks like it was written in cat(1), for example, is the kind of duct tape that fails quickly and makes life miserable for whomever ends up needing to fix a bug or introduce a new feature.

In my experience, this is the sort of thing duct tape programming (almost always) produces, and I think it's worth at least a little bit of actual design and documentation time to create something far better and more maintainable.

</comment><comment><USER11> Requirements != Expectations</comment>


Rate my app discover Facebook fallen friends. - <AUTHOR> http://friendrecovery.com Built this Facebook app today to discover who has deleted you! You have to sign in with facebook then check back when you notice your friend count drop. <comment><AUTHOR> The idea I had behind this came from noticing my friends count drop and there's no way on Facebook to see exactly who the user was.</comment>


German family granted political asylum in U.S. over home schooling - <AUTHOR> http://www.economist.com/world/international/displayStory.cfm?story_id=15469407&source=hptextfeature

<comment><USER2> I am a big proponent of smaller government and less governmental control, and I'm glad that we as Americans can choose whether or not we want to home school our children. With that being said, it's a lot of responsibility for a parent to take on themselves.

I was home schooled, as were most of my siblings, and I think that it really depends on the parents. Some parents actually teach their kids, spend the time with them, offer some sort of direction, and I think it can really give those kids a great start to life and a positive outlook towards learning.

My parents, on the other hand, didn't really put the effort necessary into teaching us, and as a result I didn't learn to read until I was almost 12, and than only because my mother finally put me into public school. Reading, writing, basic math, history, geography, you name it, I was missing it from my education. My poor 5th and 6th grade teachers had a heck of a time trying to catch me up to the other students. That doesn't do a whole lot for a kid's confidence, when he can see that he is obviously and severely behind academically compared to his peers. I just thought I was stupid. My mom thought I had dyslexia or something. Turns out I just needed someone to sit down with me and actually teach me.

There's also a lot of social development that takes place at school, and most of the time you can tell when a kid is home schooled by the way they interact with people. Or maybe it's just me, coming from that background, I can usually tell when I'm talking to a home schooler, they often have a certain social awkwardness about them. I know I was the same way until I met my wife and she straightened me out. I often had a hard time appropriately regulating the volume of my voice ("do you realize how loudly you're talking?), or knowing when certain things were inappropriate to say under specific social circumstances. And I totally fail at Trivial Pursuit (we didn't watch a lot of TV growing up either.)

Having said all that, I finished my college degree early, graduated with honors, and am a successful software engineer and wannabe entrepreneur. I have a strong hunger to learn, a well developed sense of curiosity, and I have a knack for teaching myself new skills. I don't know if I am who I am because I was home schooled (although you could probably make a pretty good case for it due to my unstructured upbringing), and given my success in life I don't mean to sound unappreciative. It just would have been nice to be able to read a little earlier in life, that's all. And I'm still not very good at math.

<comment><USER3> Here is the problem with public school – it seems that it is an anti- intellectual place. I was bullied quite a lot in school (I was skinny, academically inclined and have extremely bad eye sight).

It seems that bullies single out people who do well academically to bully. In a lot of public schools, it seems that the focus is more on sport (and other activities) than education. In some public schools, teachers are lazy – due to the lack of performance evaluation and strong unions.

I marked one of my own record exams because the teacher was too lazy to mark it himself. He was angry at me because I insisted to have the subject in higher grade (he pushed everyone to take standard grade so that he doesn't have to compose two tests).

Certainly, a private school would be better. But parents should have the choice on how their children are schooled (whether in private school, home school or religious school). It seems that every group wants children to be schooled in their public schools to teach them their ideology. This is BS.

The government should be forced to give vouchers to people who send their children to private school (instead of forcing to pay twice for education if they don't want the mediocre government education).

<comment><USER4> Private schools aren't a panacea either. I went to a private (Christian) school through 10th grade and my public school experience in my Junior and Senior years was like a breath of fresh air.

Granted private schools vary widely, but I felt I had more educational opportunities at the public school with the availability of advanced Math, Science, and English classes.

EDIT: I also wanted to say that bullying happens in ALL schools public or private.

<comment><USER3> Maybe. The advantage of private schools is more choice. The problem (at least here) is that public school teachers are unmotivated and discipline (of both teachers and students) is often lacking.

It seems that public schools cater for the lower 40% of the population.

My problem is not bullying per se, but the atmosphere around it. A school should not be sport centric (as many schools are).

</comment></comment></comment></comment><comment><USER5> Links to books that have shaped my thinking on this issue:

<http://learninfreedom.org/school_state.html>

I'm homeschooling four children. I try to cooperate with my friendly local public schools not only in meeting Minnesota's regulatory requirements, but also in offering to provide American Mathematics Competition

<http://www.unl.edu/amc/index.shtml>

and other math coaching opportunities to public school students throughout my community, some gratis and some on a nonprofit, cost-recovery basis. My community volunteer work consists mostly in being president of a statewide nonprofit organization dedicated to improving education of gifted learners in our state, most of the members of which are parents of children enrolled in public (that is, state-run) schools.

What got me interested in homeschooling was FLEXIBILITY. My oldest son would not have had the opportunity to take formal classes in C programming at middle school age in any public school I am aware of in Minnesota. He did make use of a state-run accelerated math program,

<http://mathcep.umn.edu/umtymp/>

but he got ready for that through a distance learning program that I found for him as a homeschooling parent.

<http://epgy.stanford.edu/courses/math/>

He developed a deep interest in literary writing, which is now leading to a start-up project he is coding for, through acquaintance with another family in our homeschooling support group, who have a daughter who is very advanced in writing.

It's best to leave the educational system as flexible as possible, to meet as many learner needs as possible. One size doesn't fit all, and parents ought to be able to shop for as many different models of primary and secondary education as they are able to shop for of automobiles or computers or foodstuffs.

</comment><comment><USER6> Why did they go to the US? As EU citizens they could have moved to a country that does allow home schooling quite easily. I'm in the UK and home schooling is legal here. I guess that the immigration judge didn't understand that as Germans the Romeikes have freedom of movement in the EU and so could easily have avoided persecution.

<comment><USER7> There are relatively few people the US - and other countries - grant political asylum who could _only_ relocate to the country in question.

This is a _good_ thing; otherwise each country can simply say, "Denied, as some other country will take you."

</comment></comment><comment><USER8> I find myself having a really hard time taking a side on this issue. If a government, for example, mandated the teaching in school that it's people were genetically superior to all others (say in North Korea), I would say parents were well within their rights to withdraw their students from school. If, however, parents wanted to withdraw their students from school so they could 'teach' them that evolution isn't real, or to keep them from having to go to a school that was too racially diverse (say, in the South right after Brown vs. Board of Education), I would say that the parents are doing their own children harm and their children should have to go to school. I suppose I come down on the side that a government should have a right to impose educational standards, but like any government power it should be monitored closely because it is very easy to abuse.

<comment><USER9> Who in the government is imposing these so called "standards".

<comment><USER8> Who in the government decides for what things citizens can be deprived of their personal freedom (i.e. arrested)? Who in the government decides when it is legally permissible to confiscate citizens' property (i.e. taxation, eminent domain)? Who in the government decides when it is permissible to force its citizens to force its citizens to attempt to kill other people (i.e. impose a draft)?

<comment><USER10> Are you in favor of expanding the governments ability and proclivity to do the things you list, or do you think it better if the ability of governments to do those things were further curtailed?

(Your answer, of course, will depend on the government you are living under, and the extent to which they can or cannot do those things currently.)

</comment></comment></comment></comment><comment><USER11> I am always in support of less government - why in the world should a government be in control of the education of children? Society doesn't progress by circumscribing all of it's member entities, it progresses when those boundaries are pushed by people that do things _different_.

I was home schooled most of my life, and I'm self educated; school was a failure for me because there was too much "authority" instead of "discovery" while learning.

<comment><USER12> This is not a "black and white" issue with one true answer. You have to see this in the historic context.

One of the reasons why the first German democracy (1918-1933) failed (and gave rise to Hitler) is because the German society was very much compartmentalized and split into "subcultures" at the time. In fact, large parts of the military chose to continue as "para-military" units after the end of WWI. These violent groups that saw themselves as above the law played a significant part in Hitler's ascent to power.

When the current Germany was designed after WWII, many safeguards were built into the system to ensure that there would be no more "parallel" societies. Two obvious examples are 1) the universal draft (flow all parts of society through the military to prevent the military from isolating itself) and 2) no home schooling (the public schools serve to promote democracy and western values; the public school system is designed to be the "melting pot" that integrates immigrants and fringe groups).

How would you feel about this case if the home schooling did not involve Christians (Note: I'm not religious myself.), but radical Moslems? What if it were about Nazis indoctrinating their kids with hate? What if it were about a sect that raises their kids to prepare for a collective suicide?

The German (mainstream) belief is that the government has to step in in these cases. It has to protect the kids from their own parents.

The family that was granted asylum may very well be fine parents and teachers (I don't know them), but for obvious reasons you can't have an effective law that says "you may only homeschool kids for Christian reasons, but other choices are not ok".

So, the German society, under consideration of its history, chooses to err on the safe side: no homeschooling. Period.

Of course, the particular circumstances may very much differ for other societies, so that other societies may reasonably come up with different rules (e.g., the US). But that does not invalidate the reasoning behind the German laws.

<comment><USER13> The ultimate question is who is responsible for educating their children? Historically it's never been the state. Government run education went hand in hand with the industrial revolution-- it's designed to create a reliable (and pliable) workforce. By this point the public education complex is just one more oppressive power structure motivated primarily by self-preservation.

<comment><USER14> Historically, education was something for the elite because there was no need to educate the poor who would spend their lives performing unskilled labor; when it comes to education there is not a lot of historical precedent to fall back upon. In the US the concept of an educated citizenry was a core principle of the founders -- when you divest power to the masses you want them to be relatively smart about what they do with it. Public education predates the industrial revolution and while industrialists may have wanted a better- educated workforce that was not why public education was established. If a "pliable" workforce was desired then simple apprenticeship after basic literacy would have worked fine. Mass education gives a country more engineers, but is not required for simple factory work. It is in the interest of the state and it's citizens to seek the former and not just settle for the latter.

</comment></comment></comment></comment><comment><USER15> As Americans who live in Argentina and who also homeschool, we've had no end to the social pressure to not do so. This as we are actually attending school, but only half-day, and homeschooling the other half. I've learned a lot about the ways in which individuals who live in societies with a significant amount of thought control find it personally offensive when you tell them your reasons for homeschool.

It pushes at taboos in terms of acceptable channels for dissemination of information; it feels uncontrollable; it causes fear related to one's own children, if any; and the list goes on.

</comment><comment><USER16> I guess it's fair enough. Homeschooling worked for my older son. If he had been forced to go to school he'd probably be an under educated cog at 18, instead of holding a Bachelor's and having the freedom to travel.

</comment><comment><USER17> It's interesting that home schooling is the example most often used to explain the "Overton Window" political theory:

[http://web.archive.org/web/20061020144127/http://www.swordsc...](http://web.archive.org/web/20061020144127/http://www.swordscrossed.org/showDiary.do?diaryId=53) <http://www.mackinac.org/article.aspx?ID=7504>

</comment><comment><USER18> I hope you do take the time to read up on the background of such stories before commenting on them.

The reason they wanted to homeschool their children is because they are religious fundamentalists and consider the mostly laizist school curriculum "anti-Christian".

This isn't about some poor oppressed fellows who weren't granted the right to educate their own children. This is about two religious nutcases enforcing their religious beliefs and refusing to let their children receive unfiltered knowledge from a public school system.

If Germany had fundamentalist Christian private schools, they would've been fine with sending their kids there.

</comment><comment><USER19> I hope they realize the huge responsibility they took upon themselves.

Home schooling kids is a full-time job, specially if you have more than one. I cannot imagine they being able to give adequate attention and educational resources to five kids.

Since many of the respondents in this discussion have been raised this way, I would ask what is the reason for such extraordinary effort.

<comment><USER20> So how do we expect 1 part-time teacher to give adequate attention to 30 kids?

<comment><USER19> I guess the fact the 30 are learning the same thing helps a little.

Is this lack of teacher attention the reason?</comment></comment></comment>


New Django Admin Actions - <AUTHOR> http://docs.djangoproject.com/en/dev/ref/contrib/admin/actions/#ref-contrib-admin-actions <comment><USER2> This is excellent, I've been waiting for batch actions like delete in the admin for a while now. Now when will 1.1 be a release candidate...</comment>


A Unified Finite Strain Theory for Membranes and Ropes - <AUTHOR> https://arxiv.org/abs/1909.12640 <comment><USER2> OK, I'll ask the dumb question: was there a particular computational disadvantage for the existing paradigms for solving for behavior of "membranes and ropes"? This seems like extraordinarily well covered ground (and, let's be honest, sort of a pedestrian problem area), and the abstract is talking about what sound like aesthetic improvements and not breadth or performance enhancements to the technique.

<comment><USER3> > _The numerical results show that the proposed finite strain theory yields > higher-order convergence rates independent of the numerical methodology, the > dimension of the manifold, and the geometric representation type._

From the abstract.

<comment><USER2> That just says that the algorithmic behavior is unchanged under this list of implementation choices, not that it converges faster. And I repeat the dumb question: these haven't been typical complaints about the kind of boring solvers we've been using for decades, so why do we care?

<comment><USER4> > these haven't been typical complaints about the kind of boring solvers we've > been using for decades

This statement is patently false. The "boring solvers" are computationally expensive, to the point that some applications, such as structural optimization, are practically impossible to employ. We're talking about models which might take hours to run a single simulation.

Not to mention the fact that the computational cost of running high resolution models typically grows exponentially with regards to refinement level.

Boring old solvers were adequate to provide approximate solutions without having to resort to precalculated tables, but times moved on and so did the tech applications.

<comment><USER2> So... can you rephrase that into an answer explaining why this is (was) on the front page? It's not a significant advance as I see it, but I'm willing to be educated.

Again, the abstract _does not appear to claim a performance benefit_ , so I'd love it if you could explain where that's coming from.</comment></comment></comment></comment></comment>


Oculus Quest 2 "Accidentally" Leaked by Facebook - <AUTHOR> https://hackernoon.com/oculus-quest-2-accidentally-leaked-by-facebook-536g3ukf <comment><USER2> I do enjoy my quest experience a lot. However, the big issue for Oculus is the lack of some big titles to get more people to the eco-system. If you look at the top charts, you will notice that the top ones stay there for a whole year. Maybe it is due to the form factor which limit the types of games on it.</comment>


So you are interested in deep learning - <AUTHOR> http://www.fast.ai/2016/12/18/favorite-posts/ <comment><USER2> It seems this post has been moved: the actual link is [http://www.fast.ai/2016/12/19/favorite- posts/](http://www.fast.ai/2016/12/19/favorite-posts/).</comment>


Ask HN: What was the most useful elective you took in school? - <AUTHOR> Trying to decide what upper year electives to take.<p>Which ones have you found to be the most practical? <comment><USER2> Unix System Programming. A course largely based around [https://www.amazon.com/Advanced-Programming-UNIX- Environment...](https://www.amazon.com/Advanced-Programming-UNIX- Environment-3rd/dp/0321637739)

An interesting side-effect of this course - I got _really_ good at using a console/command prompt and handling text with vim and pipes and filters and other text manipulation. I think this has helped me me productive at my jobs way more than I thought it would :)

</comment><comment><USER3> Various economics courses, such as macro/microeconomics and corporate finance. These gave me a foundation for understanding investing, once I had some money to invest. (I was a CS major.)

</comment><comment><USER4> The most useful one by a long degree for me was one where the professor was exceptional and one I related heavily with and learned from personally. At least at my uni there were very few of those. It was a capstone course in some humanities subject. I have come to believe that students often significantly underestimate the effect a professor can have, and it's very worthwhile to research and even meet potential future professors/mentors prior to signing on to a course where $100s-$1000s will be spent (it's actually kind of insane that most people don't spend more time on this given the cost.)

</comment><comment><USER5> Probably the two most useful courses I took period were electives as part of my business minor.

Financial Accounting has been incredibly useful to understand how businesses operate and why they make many of the decisions they do. Not to mention understanding a bit about finances helps with investing.

Marketing was also a very important course, though not as a direct application as it is taught. Finding a job, and indeed many things at work require you to market yourself and/or your ideas. Understanding the principles of marketing makes being successful at your career much easier.

</comment><comment><USER6> As a computer science grad, I am glad that I took few subjects from humanities stream like science technology and society, introduction to Plato etc. It equipped me to read much larger literature, taught me to raise right kind of questions and challenged me go out of my context and rethink my own opinion

</comment><comment><USER7> A really practical one is some type of finance course. It's amazing how few people understand basic finance, accounting, debt management, etc. An alternative could be a business or entrepreneurship course, if you're interested in going your own way.

</comment><comment><USER8> I was studying geology and took a course on programming for geologists. Getting a job as a geologist is very hard, instead I built an entire career on that one course.

<comment><AUTHOR> That's amazing

<comment><USER8> That was 50 years ago, and the barriers to enter the programming profession were much lower. I'm sure that I couldn't do it today.

</comment></comment></comment><comment><USER9> Japanese. Led me to study in Japan, get married and start a small business here.

<comment><USER10> What is your small business? How is it to setup and operate business in Japan?

<comment><USER11> Candyjapan

He has a blog about it.

</comment></comment></comment><comment><USER12> Quantitative Systems Neuroscience. I was pursuing an EE degree and while I like signals and embedded, this class introduced me to the idea of neurological circuits and machine learning, and I've since been pursuing a career in academic research around that.

</comment><comment><USER13> Symbolic logic 1, 2, and 3.

Years later I launched a career in programming and these classes gave me an enormous edge

</comment><comment><USER14> Journalism.

Specifically, basic journalistic writing practice. Taking a pile of info and turning it into a _very_ concise and efficient written report. Valuable beyond measure.

Psst, here's the secret (same as with breeding guppies): cull, cull, cull.

</comment><comment><USER15> Accounting, typing, psych class (human growth and Dev), graphic design and photography.

</comment><comment><USER11> Figure drawing.

It taught me how to see. The professor was absolutely amazing, and the stuff he taught us was as much about life as it was about drawing.

This led to later courses in painting and photography that expanded on this. I almost became a professional photographer, but I realized that the art was addictive for me in an unhealthy way. I would get lost in my art and forget to eat, sleep, etc. While exhilarating, that was not the life I wanted to lead.

Note that the quality of the professor matters much more than the specific medium for most art courses, imho.

</comment><comment><USER16> Typing in high school. Hands down most useful single elective I took.

<comment><USER17> Yeah I took typing in high school on those old mechanical type writers. I took the class because the football coach was the instructor. I had no idea how beneficial touch typing would turn out to be in my career.

</comment></comment><comment><USER18> Entrepreneurship, as a CS major. Only exposure to business, and has helped me a lot. Having some sort of process is invaluable to someone new to the (startup) industry.

</comment><comment><USER19> Probability and Statistics. Forms the basis of modern AI ;)

</comment><comment><USER20> Art History. Gives you new eyes. Also...if you're a boy—great place to meet girls. PG reccomend this and I followed and second his advice.

</comment><comment> tonic-music Spanish

</comment><comment><USER21> Technical Writing

<comment><USER22> Can you explain a bit more?

<comment><USER21> In grade school English classes there was always an emphasis on creative writing with rich imagery and a strong aesthetic sense. That is wonderful for entertainment and humourus conversation, but when taken too far makes your writing voice sound flowery, condescending or simply difficult to understand.

Technical writing teaches you to have a second voice which is simple, direct and unambiguous. It's a huge asset for business communication, documentation and SOPs.

</comment></comment></comment><comment><USER23> Interpersonal communication

</comment><comment><USER24> Political philosophy, intro to finance, and business law

</comment><comment><USER25> Speech. I learned I'm really good at speeches.

</comment><comment><USER26> Spatial Information Systems

</comment><comment><USER27> Distributed systems

</comment><comment><USER28> Computers</comment>


On the Quality of the iPad 2 Camera - <AUTHOR> http://daringfireball.net/linked/2011/03/08/ipad-2-camera <comment><USER2> On one hand, I feel like these are all just excuses, but then I have to ask myself the question: outside of FaceTime, what use cases do I see for the camera on my iPad? I'm certainly not going to walk around snapping photos with something the size of a small dinner tray. I'm even struggling with the concept that I'd even use the camera for FaceTime. I've got ready access to video chat on my iPhone and laptop through Skype, yet I rarely use it outside of introductions. I get the whole "see your kids" thing, but in most contexts, I just don't want to see the person.

The only use case I have much interest in is the virtual overlay possibilities. I've used a couple of demo apps on my iPhone, and while it's cool, the screen is too small to capture much of field of view. I'm hoping the iPad will remedy this a bit.

This is all speaking from my own perspective. Everyone is different, so priorities will vary. I definitely acknowledge that to the person that really _wants_ a camera, all this sounds like a bunch of excuses.

</comment><comment><USER3> It seems to me that the main difference between the two is the ISO setting. The iPad2 photo is rather grainy, but rather clear. The iPhone4 photo is less grainy, but instead it's blurred because of shaking hands.

You can imitate this by setting your camera at a low and then a high ISO setting - same result. It doesn't necessarily have anything to do with the hardware.

</comment><comment><USER4> The iPod touch camera (apparently the same as the iPad, says Gruber) is great for video and adequate for facebook and twitter.

I think having a better quality camera would be a far greater benefit to touch owners than iPad owners, owing to the form factor of the iPad -- it doesn't fit in your pocket, and is awkward to hold up to frame photos.

</comment><comment><USER5> It reminds me of the iPad (original) not having as much RAM as the iPhone 4. Does it make the iPad (original) impossible to use? No. But it's a shame in a new product to have a less-than-stellar component.

</comment><comment><USER6> Many people who have an iPad will also have an iPhone, at which point they'd be more likely to use the iPhone for photos.

(Many, not all, maybe not even most. But many.)

</comment><comment><USER7> Seems like yet more evidence that Apple's supply chain is less "magical" than people would like to believe.

Leaving things out, or using the bare minimum specs necessary for adequate functionality is a smart thing to do if you're trying to hit a price point or keep your device thin. But it falls far short of "magic", nor does it create an unbreachable defence against competition (which I believe is the subtext for people believing this somewhat far-fetched myth in the face of evidence like the Nook Color).</comment>


Spotify launches Play Button in bid to become the web's default music player - <AUTHOR> http://www.engadget.com/2012/04/11/spotify-play-button-launch/ <comment><USER2> Only problem is that half of the world is going to see "Sorry this service is not available" message unlike embedding something on youtube which available almost every where.</comment>


My weekend hack postmortem: Iterating - <AUTHOR> http://blog.oak.io/post/23812010432/iterating-my-weekend-hack-postmortem-part-1

<comment><USER2> I love the idea of realtime anonymous forums by accident some months ago. I was writing an updated library for Friendfeed's API and decided to write a client for testing, but while rushing through I had left out identifying information from the client.

It was one of the most interesting experiences I've had online; I noticed that I was liking/not-liking things specific people would say, that I normally wouldn't. I had somehow managed to surpass the internal biases I had built up about specific people. Obviously doesn't answer the question of how I'd change if I was acting anonymously, since everyone else could identify me. But for me looking out and interacting largely anonymously with people I already knew was profound.

Personally, I find the color's annoying and cluttered, but it is a decent idea to add some common identity inside a thread. I like the idea in general, and would love to see more things like it.

You're writing was great. I laughed several times during the "Then all hell broke loose" section.

<comment><AUTHOR> Thanks! I spent a couple of days on the article and was pretty nervous having not written anything but specs in a year or two.

I also am starting to find the colors cluttering, mostly because they're the first thing my eyes are drawn to on any given page. I'm not sure what the solution is here. If I make them any smaller, they look even worse.

<comment><USER3> I think you only need the colors inside a thread and not really on the front page... and then in one thread you could just add a unique picture/avatar per participant (but maybe something subtle, not like a usual avatar - I was thinking of replacing the color rectangle by a random picture of the same format)

<comment><USER4> This could be used with the poster's IP address. <https://robohash.org/>

</comment></comment></comment></comment><comment><USER5> I don't know if you were influenced by it, but anonymous text boards are somewhat common on the Japanese internet, and there are a small number of English (and Spanish and German) language derivatives. Unfortunately, even though there are several pieces of text board software, they're all very similar. Seeing something like this which is highly divergent is quite a treat.

Are threads ordered by most recent post or something more complicated?

<comment><AUTHOR> The threads are ordered by if they are sticky and then the most recent item.

I've looked into ("chan"?) text boards, but they're all in PHP and usually in some huge file with no separation of concerns.

</comment></comment><comment><USER6> If you hash the ip and then use that for colouring the hash function is likely to be surjective (rather than bijective) but perhaps you could still work back to "it was probably one of these x (255?) ips"? If you then open source the code too, do you make it more susceptible to working back to the original ip? Perhaps you'd need some form of salt too?

<comment><USER7> The hash should be salted with the id of each thread. Anonymity on all threads.

</comment></comment><comment><USER8> Hey there mate. I'm the one who was linking to the Underscore.js annotated escape function:

[http://documentcloud.github.com/underscore/docs/underscore.h...](http://documentcloud.github.com/underscore/docs/underscore.html#section-118)

If you use something like this when displaying messages, it should not allow any XSS.

<comment><AUTHOR> That is a very tall claim :) Thanks though, I'll read the code!

<comment><USER8> Also you need to watch out for Unicode control characters messing everything up! Certain characters (up to you to figure out which) should actually be stripped as they have no useful function for Western languages...

</comment></comment></comment><comment><USER9> I wonder what the cultural impact would be if realtime anonymous forums forced everyone to use proper spelling/grammar.

<comment><AUTHOR> Interesting thought. How would you implement that in an algorithm? Maybe a Bayesian filter?

<comment><USER9> It doesn't have to be enforced algorIthmically. It can just use a client-side spellchecking library that makes spelling errors very visible. When it detects > $THRESHOLD errors, then it shows a warning saying, "Your post will be partially hidden if you don't fix your spelling/grammar errors." Then, on the client-side, it changes the opacity to something like 0.5 for posts with > $THRESHOLD spelling/grammar errors.

</comment></comment></comment><comment><USER10> Please, please do not use ragefaces while writing. In addition to being an utterly exhausted internet meme, they take something out of the prose- it would be more compelling, better flowing writing if you were to try and describe your own feelings. I should add that, as prosody said, imageboard discussions are working anonymous communication models. Take 2channel, with the slogan 「ハッキング」から「今晩のおかず」まで (From "hacking" to "side dishes for tonight's dinner"): it generates revenue of around 100 million yen per year; or perhaps 4chan, which has either scarred the internet, or broadened it depending on your viewpoint, having once (I believe) produced those images you used in your post. I'd be really interested to see how you use similar projects to inspire yours, and as I've tried to show, innovation in this area could be influential or lucrative.

<comment><AUTHOR> Ragefaces are one of my favorite parts of Internet culture, and I did think about it before I inserted them into the post. I think they give it a certain feeling, that this is an experiment and I'm playing around.

I've tried to take the good parts of every service I could find, and leave out the rest. I don't intend to make any revenue from this site. It's only for fun :)

</comment></comment><comment><USER11> instead of the color (which personally I like), you could use numbers, so the first person who replies is #1, next is #2, and they re-use that number for the extent of that thread. That way if you're having a discussion with someone, you know it's still them

</comment><comment><AUTHOR> If you guys have any feedback on the site or my writing, I'd love to hear!

<comment><USER3> It's a really interesting concept! And nicely executed too.

That being said, I don't know if I'll come back after having played with it for 5 minutes...

<comment><AUTHOR> That's totally fine. I'm only intending this to be an experiment, and honestly something to hack on in my spare time.

I'm curious though, what would compel you to return?

<comment><USER3> That's an interesting question, and I don't think I have the answer... And if I did I wouldn't tell you and launch my own website ;)

Seriously though, I think it would be hard to get a sense of community on a website where you can't identify the persons that are interacting with you... But of course the whole point is to be anonymous.

PS: what about the pokeball there ?

<comment><AUTHOR> What gives 4chan a sense of community? I agree, just wondering.

<comment><USER3> You're right, I don't know. oak.io is indeed starting to look like 4chan a little...</comment></comment></comment></comment></comment></comment>


Ask HN: I am having a competation from bigger player. Please advice? - <AUTHOR>

Recently I launched http://doosracricket.com and currently working on getting users. It is a prediction site where you can compete with friends or world on cricket. I was counting on World cup 2011 series starting February 19th.
Now I see Yahoo cricket is also coming with Predictopus (more sophisticated with huge prizes)
Not sure if this is good or bad for my app. Looking forward to HN community for advice. <comment><USER2> The classic advice is pg's essay "How to Make Wealth" (<http://www.paulgraham.com/wealth.html>):

"At Viaweb one of our rules of thumb was run upstairs. Suppose you are a little, nimble guy being chased by a big, fat, bully. You open a door and find yourself in a staircase. Do you go up or down? I say up. The bully can probably run downstairs as fast as you can. Going upstairs his bulk will be more of a disadvantage. Running upstairs is hard for you but even harder for him.

What this meant in practice was that we deliberately sought hard problems. If there were two features we could add to our software, both equally valuable in proportion to their difficulty, we'd always take the harder one."

In addition, I would say: (1) provide extremely good customer relations (any post submitted to your site blog or email sent is answered in half an hour max) and (2) use your personal network, Yahoo is not a person, so it doesn't have any friends, you do. Use them and _their_ friends.

</comment><comment><USER3> If you have the cash, you could experiment with advertising Doosra cricket on Yahoo.

Your new homepage design is a lot better than your first. Get someone to edit your copy. "Compete with friends or world" should be "Compete with friends or _the_ world". A professional copywriter will probably write something like "Challenge your friends!".

Yahoo Predictopus gives users 1000 points to start with. I see most people on your leaderboard have 0. Give them 10,000 each.

Your target market is Indians. Use Hindi slang words where it's appropriate (without offending the south Indians!). I doubt Yahoo will do that. Your name is a good example.

</comment><comment><USER4> It will probably do you more good than harm. First of all, a competitor should spur you on to work hard on your product, lest everyone picks your competition instead.

Secondly, you can use it as a real marketing opportunity. What I mean is, with a product from Yahoo, there's going to be all sorts of press and many cricket fans talking about their product. That's your cue to show up (without being spammy), and get the word out about yourself. You could get some media attention at the very least, as well as word of mouth (people talking about Predictopus will be told by their friends about doosracricket).

</comment><comment><USER5> Your competitive advantage over a bigger player like Yahoo will be your ability to iterate much more quickly. As long as you have some sort of quantitative way of measuring your success, you'll have a pipeline you can use to optimize your users' experience and your goal conversions..

</comment><comment><USER6> An advantage you have is people who are already invested in your site. If they have a good ranking going or some friends on the site they won't be very interested in packing up and going elsewhere. You could try and make the site as viral as possible (wall integration, send to a friend, etc) to try and snowball your users into more users.

<comment><AUTHOR> I am also counting on it but the rewards Yahoo is providing to the winners is huge and will draw lots of attention.

<comment><USER4> You can try to direct some of that attention to yourself, since you're in the same space. You can't compete on prizes, but you'll have a different offering - you have to distinguish your product from Yahoo's product in other ways.</comment></comment></comment>


Why to engage into using Automatic Testing - <AUTHOR> https://cookingsource.wordpress.com/2015/02/26/why-to-engage-into-using-automatic-testing/

<comment><USER2> If you are hired to write code, that's the contract; your job IS to write code. Just like a plumber's job isn't to solve problems in general, just the problems involving plumbing, and that's what makes him a plumber instead of something else. Otherwise, there is no reason why we would call them plumbers, why they would get specifically educated in plumbing, and bring a plumber's toolbox. You don't call the plumber when you want a sandwich or a car repair. A plumber who lets clients jerk him around by having him make them sandwiches or answer their phones doesn't know his business.

If you are a plumber, please don't tell me that you offer solutions. Please tell me you are a plumber so I don't have to get confused about what it is you are actually offering.

<comment><USER3> I don't think this analogy is useful. I think understanding the why is important. The plumber knows why you want running water, has seen many homes with water systems similar to yours, and almost certainly owns a home himself. But introducing software into someone else's business has no such guarantee of familiarity. There has to be a discovery process, where you choose between several ways to fulfill the need, with a much larger problem space than home water systems. In my experience, a large part of software is automating processes, and I can't imagine replacing a process properly without understanding why it is done in the first place. Business owners can understand a problem at a high enough level to hire people to solve it, but software engineers in that position have to understand a problem so well that they can describe it to machines who will take every step at face value, executing it unthinkingly. Encoding a bit of the why something is being done, even if it's just in manual tests of the software, has been crucial for that software to do the job properly in my (limited) experience.

I'm not being jerked-around being told to make sandwiches. I'm being told, the water-operated sandwich making machine is too slow/doesnt work properly. I might just as easily recommend a sandwich catering service, or pick up a manual on building fancy electric sandwich makers, as repair/enhance the water pipes.

Disclaimer: I'm a young software engineer who, perhaps naively thinks I will always be able to join interesting projects and learn new things while being treated like a partner instead of a technician. This has been my experience so far, but perhaps you reach a point where, having specialized, you churn out the same solution for company after company in a niche for efficiency reasons.

</comment></comment><comment><USER4> In my experience unit testing has less value than end-to-end testing. Unit tests rarely break and the reasons it break is not something that you couldn't guess. In contrast end-to-end tests fail with a big surprise! I always enjoy seeing my end-to-end tests catching errors that I would never ever thought of.

The down side of end-to-end tests is that it's slow to develop and slow to run. Because in many cases, end-to-end tests should be sequential and involves network calls and browser rendering. In general it's worth it.

<comment><USER3> I often suffered from that problem with unit tests - if you thought of writing the test, you could have written that case into your code, making it only really useful for regression testing. It doesn't help you discover bugs that are there that you didn't think of. Integration testing helps with that because you test multiple parts together, which is hard to hold in your head and chances are you'll find problems you hadn't thought of while programming. But failing integrations tests can be tricky to diagnose the root problem, especially compared to unit tests, and require a lot of code to be written or stubbed before they can be used.

So, I've been trying to adopt "property" based testing where you test invariants of the output with pseudorandom inputs, a-la quick check in haskell. Big shoutout to [http://jsverify.github.io/#jsverify](http://jsverify.github.io/#jsverify) :)

While it can certainly be hard to apply to problems or find some useful invariants, It's been enormously successful in finding bugs I didn't think of, and shrinking is an elegant solution to making failures more easily diagnosable.

</comment></comment><comment><USER5> Modern software development has always struck me as trying to optimize the wrong thing. It tries to make change easy, but changing things is never easy. Just throw away your code and start again. If this a lot of effort, its probably doing too much.</comment>


Apple Marina Bay Sands Opens Thursday in Singapore - <AUTHOR> https://www.apple.com/newsroom/2020/09/apple-marina-bay-sands-opens-thursday-in-singapore/ <comment><USER2> Am I misremembering, or was this some kind of museum building before? Or was it specially built by Apple? Whatever it is, pretty amazing looking.

But what a shame, you can't even fantasize about going to see places any more without a little bit of stress/uncertainty right now. 17 hour flight? 2 week quarantine on arrival? ok...

Anyway, I'm also interested to know how Apple (or other similar retail) decides to put a store somewhere. Is it a straight potential mobile subscriber $ figure, or population disposable income within-x-radius kind of thing? Is it the same threshold across countries? Must be a ~$10M investment to build a store like this. Worth 10,000 customers?

<comment><USER3> It's interesting that this is Singapore's 3rd Apple store while other Southeast Asian countries don't even have one.

<comment><USER4> That is factually incorrect. In fact Bangkok has two Apple stores now: [https://www.apple.com/newsroom/2020/07/apple-central- world-o...](https://www.apple.com/newsroom/2020/07/apple-central-world-opens- friday-in-thailand/)

</comment></comment></comment><comment><USER5> With the modern interior design of Apple stores I feel the designers are actually so out of touch with the rest of the society and so firmly in their own bubble that they're accidentally designing something that looks extremely tacky without realizing.

I believe they described it as being a "town square" so we have the trees and the benches but I'm going to propose they have accidentally designed something that looks more like a cheap mall food court without realizing it because they probably haven't even seen a mall food court since their childhood. Almost feels like it has the same logic behind how mall food courts were designed, make the unnatural feel natural, add trees, add a nod to the affordances of community with benches around the trees.

Honestly couldn't believe how tacky it looked when I walked past the main Apple store in London.

<comment><USER6> > _With the modern interior design of Apple stores I feel the designers are > actually so out of touch with the rest of the society and so firmly in their > own bubble that they 're accidentally designing something that looks > extremely tacky without realizing._

Have you seen modernist / brutalist / modern / post modern architecture? From 1920 to today? There's nothing ugliest and more unlivable (in the pretenses of "high brow" BS concepts) than 99% of it.

In comparison, the Apple stores are a breath of fresh air. Tacky? Hardly...

> _Honestly couldn 't believe how tacky it looked when I walked past the main > Apple store in London._

You keep using that word, tacky. I don't think it means what you think it means...

This is the "unbelievable tacky" place, because it has trees inside?

[https://cnet3.cbsistatic.com/img/LDehHb_uk995yFKthCDfgOhboH8...](https://cnet3.cbsistatic.com/img/LDehHb_uk995yFKthCDfgOhboH8=/940x528/2016/10/13/05d89c8f-cf0b-46a5-90cd-2e877e757df8/apple- store-regent-street-london-6.jpg)

<comment><USER5> >I don't think it means what you think it means...

Hit a nerve I guess if you're gonna resort to that.

>This is the "unbelievable tacky" place, because it has trees inside?

Yes the overall design, the style of seating, the choice of trees, the choice of wood, the actual design of the furniture, looks like a mall food court [https://www.across-magazine.com/wp- content/uploads/2019/08/C...](https://www.across-magazine.com/wp- content/uploads/2019/08/CH-ogrody_1200x600.jpg)

<comment><USER6> > _Hit a nerve I guess if you 're gonna resort to that._

I resort to that all the time, so don't bet much money on it "hitting a nerve". Just bothered me enough to want to comment - which also happens all the time, even for minor pedantic corrections.

> _Yes the overall design, the style of seating, the choice of trees, the > choice of wood, the actual design of the furniture, looks like a mall food > court_

Well, that's a very pretty mall food court if I ever saw one. Great for the AS to look like a high end version of that (with superior exterior architecture to boot). If that's "unbelievably tacky" I'll have to re-use the Princess Bride line...

Because the ones I've actually seen in the wild in dozens of malls I've been look like this:

[https://i.pinimg.com/originals/c3/b1/fb/c3b1fbc6c0bfa52eb3cb...](https://i.pinimg.com/originals/c3/b1/fb/c3b1fbc6c0bfa52eb3cbc7c42ecf1d85.jpg)

</comment></comment></comment></comment><comment><USER7> "the first Apple Store to sit directly on the water. "

Lies! I once bought a mac onboard a ship in the early 2000s.

:)

<comment><USER6> Was it an Apple Store tho?

<comment><USER7> It was a store that I bought an Apple computer in.

</comment></comment></comment><comment><USER8> Is that the navy where they attack 3rd party repair people from? Is there anybody left who thinks Apple is cool because they have shiny buildings ?

<comment><USER9> Plenty of people like apple stores.</comment></comment>


A Break for Small Business - <AUTHOR> http://www.bloombergview.com/articles/2016-01-04/a-break-for-small-business <comment><USER2> This is huge for companies that do anything with their own hardware. $2M in capex per year a is pretty good sized company. That's a lot of servers or senors or computers.

This also probably mimics a start-up's actually valuation of their equipment. It costs money to buy, but after it goes in use, there's nothing that a banker can sell or mortgage against--not to say it isn't a economic asset, but when has tax accounting ever been about that?

<comment><USER3> Also huge for companies who have to decide between their own hardware and AWS or other cloud providers.

Previously, you'd pick a cloud provider because the cost is considered opex and you could write it off in the same year (let them do the depreciation, you get the tax savings immediately). Now, you might be more willing to consider buying your own gear if your cloud provider spend is under half a million dollars a year (perhaps even more).

Yeah, sure, cloud providers make scaling easier (but then again, you're probably not Reddit, needing to scale on a dime to thousands of VMs). But you get to spend $500K/year on gear and that gear is YOURS for its life.

Disclaimer: Devops/Infrastructure Admin/Tech Consultant who does this math all the time.

<comment><USER4> Maciej Cegłowski recently addressed this decision in his "Website Obesity" talk:

[http://idlewords.com/talks/website_obesity.htm](http://idlewords.com/talks/website_obesity.htm)

The whole talk is worth a read, but here's the key part about servers:

>But where the projects differ radically is cost. ACME hosts their service on AWS, and at one point they were paying $23,000 (!!) in monthly fees. Through titanic effort, they have been able to reduce that to $9,000 a month.

> I pay just over a thousand dollars a month for hosting, using my own > equipment. That figure includes the amortized cost of my hardware, and sodas > from the vending machine at the colo.

> So while I consider bookmarking a profitable business, to them it's a > $4,000/month money pit. I'm living large off the same income stream that is > driving them to sell their user data to marketers and get the hell out of > the game.

</comment></comment></comment><comment><USER5> One of the biggest things that personally has affected me is that the section 179 deduction is applied _after_ the 15.2% self employment tax hits. Does this change that at all?

</comment><comment><USER6> What drives me crazy about things like this is the law passes Dec 18th and you have to buy equipment by Dec 31st to take advantage of this in 2015. Every year congress waits until the very last minute to set tax code which makes it impossible to actually plan for purchases as a small business.

</comment><comment><USER7> We have something like this in the UK called the AIA (Annual Investment Allowance). The amount seems to vary every year but is currently £200,000. It certainly makes life a lot easier to know you can immediately get a deduction for buying office equipment, etc. (You still need to do normal depreciation calculations for accounting and balance sheet purposes, but tax paid reflects a 100% deduction.)

</comment><comment><USER8> This is good for manufacturers. I wonder if it will incentivize companies to create shells to get around 500k limit?

</comment><comment><USER9> this seems good but bigger businesses will just abuse it. It was a good idea to limit the dollar amount to 500k. Now all corporations are going to write off 500k of equipment every year. Possibly even writing off 1 million as they just buy 500k worth of computers write off the purchase then donate the computers to a local school and write off another 500k. This was one of the reasons that the deductions previously was based on the yearly depreciation to prevent companies from just buying new equipment every year to avoid paying taxes

<comment><USER10> > Possibly even writing off 1 million as they just buy 500k worth of computers > write off the purchase then donate the computers to a local school and write > off another 500k.

You can't deduct anything for donations of fully depreciated property, so this trick wouldn't be legal.

And buying equipment that you have no use for just to avoid taxes wouldn't make any sense, since you're spending $X to save 0.35 * $X in taxes.</comment></comment>