Major sites including New York Times and BBC hit by 'ransomware' malvertising - <AUTHOR> http://www.theguardian.com/technology/2016/mar/16/major-sites-new-york-times-bbc-ransomware-malvertising <comment><USER2> Sadly, I've always considered adblocking software a form of security software rather than a mere convenience. Years ago I had to remove a mess of malware from my parent's PC due to a malvertisement received via MSN[1]. Since that point I've installed privoxy _and_ uBlock Origin or similar on all PCs that I am asked to help with.

Despite all of the talk about "blocking the ad blockers", I've yet to receive a phone call from anyone saying this or another web site didn't work, "Can you fix it?" I'm guessing their usage is limited enough that they don't encounter it (my dad does visit Forbes, but I haven't heard complaints).

There's no way I'd surf the internet these days without ad blocking enabled and I rarely white-list sites out of concern for my data. It's becoming as important as personal firewalls / antivirus once were.

[1] There was a brief period during the time that they received the malware that MSN had been hit by malvertizing and they had that as their homepage, but it could have come from elsewhere. The bottom line was that there were no sites in the riskier categories that were in their browsing history and my parent's proficiency does not include a good understanding of "incognito browsing".

<comment><USER3> uBlock Origin, or some of its filters, can block whatever mechanism sites use to detect blocking.

A while back I had a few sites warn me about ad-block, but I haven't seen it in a while.

<comment><USER2> I just switched back to that, actually. Months ago, my default browser was Firefox Developer Edition and uBlock Origin had a bug related to LastPass that caused LastPass to hang the browser so I had switched to ABP.

Unfortunately, LastPass started acting up in FireFox a few weeks ago and I decided to give in to Chrome, again, so I've happily returned to uBO.

I go back and forth on which to install for people that routinely come to me for help (I'm a developer, not a helpdesk, dammit!). I'm not sure if it's still the case, but months ago I _actually did_ receive a call from my father when he attempted to install an open-source PDF creation tool that he uses at work on his home PC. It was hosted by SourceForge which uBlock had large swaths of in its blacklist. The installer _did_ contain a bull$#*+ toolbar (several, actually), but he's familiar with avoiding crapware directly placed within installers (and to avoid "Express Installations").

</comment></comment></comment><comment><USER4> This kind of exploit is going to keep happening. The most egregious cases involve PageFair, which offers a tool to publishers that circumvents ad blockers. They too have served malware, for instance at The Economist. [http://www.theverge.com/2015/11/6/9681124/pagefair- economist...](http://www.theverge.com/2015/11/6/9681124/pagefair-economist- malware-ad-blocker)

Sometimes I think we ought to have civil liability for software security. A few lawsuits would shut stuff like PageFair down.

<comment><USER5> It would be nice if the sites themselves took some responsibility. If your ad contract includes strong SLAs with massive penalties for malware distribution, the company providing you with ads will probably take a bit more time to vet them.

It baffles me that that isn't already boilerplate in advertising contracts. Sites whine about having their revenue impacted by ad blockers, but they make no effort to ensure the security of their users. Why is nobody ever held accountable for these sorts of breaches? Shifting risk to your customer is a horrible idea - nobody would buy a new car without a warranty, so why on earth are we expected to play Russian roulette with our bank accounts, personal data, and often our employer's assets?

I guess the market will teach them sooner or later, but I really do not understand why the current state of ads is so widely accepted by the people who are trying to sell them.

<comment><USER6> It seems like a circular argument you're having with the parent, but you haven't yet realized it.

The profit motive is the ultimate incentive. If it takes too much time, reduces revenue by too much, or increases expenses, the ad publishers and networks will find ways to mitigate those issues.

If there aren't waves of lawsuits from users who received malware from ads, there is no direct cost. If vetting ads before they are hosted costs money or reduces the bids for those ad placements, networks are incentivized against doing so.

In my experience, most ad networks have blacklists for bad actors but no vetting and thus no whitelists. Blacklisting means there necessarily will be end-users that get infected and only a percentage of them will know it, a percentage of those will know where it came from, a percentage of them will report it, and only a percentage of those reports will culminate in advertiser blacklists.

It's a numbers game and currently the expenses from lawsuits (the only perceived expense for publishers+networks) is much less than the revenue lost + expenses from pre-vetting all ads before they are used.

</comment></comment></comment><comment><USER7> Another good reason to use ad-blockers. If I can't use your site with an ad- blocker then bye bye ... looking at you Forbes.

<comment><USER8> Yes. It's funny how more and more sites act like it's morally wrong to block ads, but obviously aren't willing to do the work to protect their visitors from this sort of thing.

<comment><USER9> They could deal with advertisers themselves and manually approve and display text/image ads from their own domain (as it was done in printed newspapers), but isn't it easier to just leave a div+javascript and have the right of arbitrary code execution in a chunk of your page get auctioned off to the highest bidder by several shady ad network?

Just go to www.bbc.com and look at what domains your ad-blocker denies: edigitalsurvey.com, chartbeat.com, googletagservices.com, scorecardresearch.com, effectivemeasure.net, iperceptions.com, krxd.net, optimizely.com... now imagine if your printed newspaper shot at you a GPS receiver with a mic, a cam, etc. Surely it wouldn't be morally wrong to duck and avoid that bug?

<comment><USER10> You're still susceptible to ad-blocking if you serve an plain image ad from your own domain though, which sucks for those of us who do it. If there is a way to alert users that you vet, self-serve, and don't use animated ads, I'd love to know about it :)

<comment><USER9> Uhm, I use uBlock Origin and when going to the site in your profile I don't see any image blocking (just google analytics and social media plugins). The ads in the sidebar (id="ws_widget__ad_codes-3"?) display just fine, and I would say that your site is the perfect example of how ads should be: highly relevant, static, well designed, correctly integrated in the look and feel of the page...

<comment><USER10> The last time I checked with Adblock or Adblock plus (I don't remember which) I seem to remember it filtering out commonly used indicators of ads like divs with ad-related names or filenames containing _300x250_ etc... I could be mistaken though.

Thanks for the kind words too, I've really tried to make the site a place that I would personally like to browse and am glad to hear other people feel the advertising is nicely done.

<comment><AUTHOR> I happen to disagree with that method of blocking ads because of false negatives and false positives; isn't the solution simply to remove the offending patterns from your filenames?

I'll add to the praise for your site. Your ads remind me somewhat of those from The Deck [1], although yours are nicer because they're 1st-party. Are you able to share any info. about the model? Do advertisers pay per click or per impression? If the latter, how do you prove your traffic figures to them, or have you built up a suitable level of trust?

[1] [http://decknetwork.net/](http://decknetwork.net/)

<comment><USER10> Yeah, filename changing is what I would end up doing.

As far as the model is concerned, a lot of the industry is familiar with magazine advertising so I just go with a monthly rate to keep things simple. There is trust involved, though most run a trial before committing to anything longer-term so they are able to see if the level of generated activity meets their expectations.

It is much easier to do this kind of advertising because the content itself is so narrow that the readership ends up being narrow, whereas a general site like BBC or CNN you end up having a wide audience and then end up needing tracking tools to help narrow the audience into smaller groups.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> It's weird to me that we keep treating the sites that run malvertising as victims instead of fully complicit. If the print edition of the New York Times ran, say, a full-page ad for the KKK,* and responded to the outrage with "haha, sorry, we outsourced our advertising to a third party with no oversight," they'd be crucified. But somehow websites are exempt from responsibility for the things that they publish.

Has anyone proposed getting sites that serve e.g. ransomware to pay the ransoms for everyone affected? That seems entirely reasonable.

*Or insert your own offensive ad concept here.

</comment><comment><AUTHOR> Shocking that the BBC is affected by this, given that it should be advertising-free. Presumably, this affected non-UK residents[1], but as a public service the BBC should have much higher standards when it comes to advertising.

[1] With the obvious caveat that a website can't reliably determine that.

<comment><USER12> Aren't all world-facing websites "a public service"? BBC within UK has a special remit because of the funding structure (thanks to the increasingly- inaccurately named "TV" licensing fees), but BBC [Worldwide] is just another content provider in the big old crazy world.

It doesn't seem surprising that BBCW use an external advertising network: it would be a pretty huge investment to operate their own advertising markets throughout the world ... and surely if they did, they'd then on-sell those services!

Seems that the notable part of this attack is that several high-profile websites were affected, so BBC (and NYT, and AOL, etc) suffered some damage to their brand, so they'll have to work on that. The article notes that "malware was delivered through multiple ad networks", which speaks to failures by those service providers. Reckon there will be some very heated conversations and perhaps fee renegotiations with the networks happening over the next few weeks ;-)

<comment><AUTHOR> > it would be a pretty huge investment to operate their own advertising > markets throughout the world

It is becoming clearer and clearer to me that this is one of possibly two options left for businesses wishing to make money online via advertising. Self-hosted adverts are probably the best way to regain trust and circumvent ad-blockers. A quality, trustworthy third-party network is the only other possible option I can imagine, but that seems far less viable.

<comment><USER12> > A quality, trustworthy third-party network

I'm sure that most networks start off with such lofty ideals, maybe they even believe them ... :-o

EDIT: To expand a little on the previous thought: you were shocked that the BBC website was serving up dodgy ads, presuming maybe that they'd have their own curated advertising portfolio. Closest comparison I can think of is perhaps the Economist website, also London-based, and no small prestige branding that they make sure to protect by only showing ads for Lexuses and Rolices (Rolexen?). The major differences of course are that Economist is somewhat more up-market, and the ads are seen locally in the UK.

I can't readily find any figures on how much cash BBCW makes off website ads, but I'd have to assume that it's burger money -- a few quid here and there for negligible effort, and after all who cares if the brand is tarnished abroad?! If on the other hand BBCW went into the ad curation business, and even if it happened to be profitable, there's every chance that voters or MPs would get stroppy about it, and BBC gets a hard time going into the next licence fee negotiations. Ultimately, BBC's brand outside the UK isn't something that the UK public necessarily worries about.

</comment></comment></comment></comment><comment><USER13> > The vector of attack, through compromised ad networks, will also serve to > inflame the debate around adblockers.

This is the largest reason I install adblockers on my own laptop and phone as well as everyone in my family. I allow zero exceptions for ads. I'm willing to pay for content via other means (for example google contributor), but attack surface is simply too large.

<comment><USER14> I actually use adblockers on my phones for a different reason. On my phone I'm reasonably sure I won't be affected by malware (up to date Nexus and I know not to install unknown applications), but ads take up data and slow down browsing.

</comment></comment><comment><USER15> I was wondering how long this would take.

One of the things I've long known as a programmer for the web is that when you let a third party put content on your web site, you don't have control over what they do.

Whether it's a person entering content and you fail to sanitize it, or pulling in ads from an external network, the end result is that you get something like this eventually.

I don't have a solution, really, because nobody wants to pay for content, so sites have to use ad networks. But I'm surprised this hasn't happened much sooner.

<comment><USER16> What are you talking about? This is far from the first time malicious software has been delivered through advertising.

<comment><USER15> Ransomeware on the NFL or NYT website has been done before?

<comment><USER16> Ransomware specifically, no. But malicious software on major, reputable Web sites? Yes.

</comment></comment></comment></comment><comment><USER17> Interesting to note that a number of these sites were recently also serving ads vulnerable to XSS: [http://randywestergren.com/widespread-xss- vulnerabilities-ad...](http://randywestergren.com/widespread-xss- vulnerabilities-ad-network-code-affecting-top-tier-publishers-retailers/)

</comment><comment><USER18> an example of the power of phrasing in journalism, perhaps? the title could have also been: "Reckless media sites serve malware to visitors".

<comment><USER19> _Major sites including New York Times and BBC caught peddling 'ransomware' malvertising_?

</comment></comment><comment><USER20> If it's not served from the domain I've visited, I don't want it. If it is served from the domain I've visited but not over SSL, I don't want it. Then the certificate owner should be responsible for any damage resulting from the stuff signed by their key.

<comment><USER13> This gets tricky with things like imbedded youtube and twitter content. I would be right with you blocking content not from the same domain, but I will constantly be clicking off page to watch a video or view a tweet, etc.

<comment><USER21> IMO: Those should just be offsite links anyway. I personally hate watching youtube videos shrunk down to fit in a small blog-column. YMMV, of course

</comment></comment></comment><comment><USER22> One more example of why users should have:

\- an adblocker

\- javascript disabled

\- addins disabled (click to play)

<comment><USER23> I don't like the no JS approach, it kills an important part of the potential in the web, including polyfills for things like srcset.

Instead, I'm using Policeman ( [https://addons.mozilla.org/en- US/firefox/addon/policeman/;](https://addons.mozilla.org/en- US/firefox/addon/policeman/;) similar to uMatrix [https://github.com/gorhill/uMatrix/releases](https://github.com/gorhill/uMatrix/releases), but the first is easier to use for me ) which blocks 3rd party anything by default.

If they serve their own JS from their own servers, let it be. Others (Facebook connect, GAnalytics an Twitter seems to be _everywhere_): walk away.

This obviously renders most of the sites to bare HTML due to the excessive and unneeded use of CDNs, and is a massive pain to use for the first weeks, but after a while the whitelist gets you to a friendly web level.

uBlock also runs in the background, just in case things leak through, or I quickly want to check something and I need to turn Policeman off.

<comment><USER24> FYI, the first link is broken because the semicolon was included as part of the hyperlink. Should have been [https://addons.mozilla.org/en- US/firefox/addon/policeman/](https://addons.mozilla.org/en- US/firefox/addon/policeman/)

</comment></comment></comment><comment><USER25> A lot of this has to do with these sites using ad networks instead of/along with selling ads directly. Ad networks are very common with consumer sites, but many B2B sites don't use any at all. When you work directly with the agency or company (and you know they're a real agency or company), this doesn't happen.

</comment><comment><USER26> Whenever I read stuff like this, I first wonder if my setup would be vulnerable to the attack, and if not, how much stuff I would have to turn off to be vulnerable? Chrome Stable + uBlock Origin + plugins disabled by default seems to be safe from everything but targeted zero-days. At least, I hope.

</comment><comment><USER27> Adblocking is immoral, but malware filtering is not :-)

<comment><USER28> Ad blocking is indeed very much moral.

</comment></comment><comment><USER29> BBC's ads appear to come from Google's ad network. I'm curious how much effort Google puts into monitoring/policing the landing urls for this sort of thing.

</comment><comment><USER30> I hope AdBlock (and/or similar) works out a deal with respective companies involved (Mozilla, Apple, etc) in order to be pre-installed in future downloads of major web browsers. In addition to visual chaos and privacy concerns, the risk of compromised systems due to malware via ads is too damn high and non-tech savvy users shouldn't have to suffer for it.

</comment><comment><USER31> Yes, I tried to get around the WSJ paywall for the WeLive article and some crummy site tried to hit me with a beastie.</comment>


Six Percent of All Web Traffic Goes to Google - <AUTHOR> http://lifehacker.com/5381700/six-percent-of-all-web-traffic-goes-to-google

<comment><USER2> Real article: [http://www.nytimes.com/external/readwriteweb/2009/10/13/13re...](http://www.nytimes.com/external/readwriteweb/2009/10/13/13readwriteweb- google-accounts-for-6-of-all-internet-traff-90323.html)</comment>


Children and Gender Inequality: Evidence from Denmark [pdf] - <AUTHOR> http://www.henrikkleven.com/uploads/3/7/3/1/37310663/kleven-landais-sogaard_gender_feb2017.pdf <comment><USER2> Back when I worked for the Aus bureau of stats, I picked up the name of this phenomenon as "the nappy valley".

The name stemmed from plotting various demographic and performance stats against each other split by gender.

Male and female trends often moved in lock step, except for the child bearing years where female metrics dropped away as though falling into the metaphorical valley.

After the child bearing years, females would "climb out" and start on an upward trend again, much like the males who never entered the valley, but they could never catch up again against the opportunity cost of spending that time in the valley.

/anecdote

<comment><USER3> As an Australian, I wonder why I've never seen this published on the ABS website?

<comment><USER2> My knowledge could be a few years out of date now, but in all parts of the ABS dealings, there's always been a public policy debate and tension between what I'll call the philosophy of "statistical and policy interpretation of data" and "straight-up statistical reporting with no policy advice or interpretation".

That is to say, the tension between being a data collecting and reporting agency, and making interpretations and comments on government policy and context using the data to draw conclusions and comment.

The argument for "just report" is that we should strive to let the population interpret the numbers while the ABS just reports certain key figures. This emphasizes the apolitical and independent nature of the ABS. It can also be argued to be the cheaper option. The downside is that arguably the public is less informed.

The argument for the later is that numbers and statistics need expert interpretation and contextualization, and who better to inform the nation than the people on the front line with expertise in the subject mattesr and experience with the data. It is seen by many public servants as their job to not only collect and report data, but interpret it and comment on policy as well. The downside is that pushes against the tension of being/appearing apolitical, potentially makes enemies and encroaches upon private enterprise, and expands the scope of the ABS from just being a data collection agency. It also costs more money and time.

Over the years, various governments and various statisticians and various subjections have had differences of opinions and different philosophies as to which to fund, support, emphasise and de-emphasise.

Now, a phrasing like "nappy valley" would probably not make it into the final reports, but one publication involving investigating of such things called Australian Social Trends. I would say this fell more into the "interpret" camp.

See the Nov 2013 edition below for one on pregnancy and return to work.

[http://www.abs.gov.au/AUSSTATS/abs@.nsf/allprimarymainfeatur...](http://www.abs.gov.au/AUSSTATS/abs@.nsf/allprimarymainfeatures/5849F483A2C5646ECA257C9E00177D59?opendocument)

You will notice that the last Australian Social Trends publication was in march 2014.

Another similar publication I remember from that time was called Measures of Australia's progress: [http://www.abs.gov.au/AUSSTATS/abs@.nsf/mf/1370.0](http://www.abs.gov.au/AUSSTATS/abs@.nsf/mf/1370.0)

and

[http://www.abs.gov.au/ausstats/abs@.nsf/Lookup/1370.0main+fe...](http://www.abs.gov.au/ausstats/abs@.nsf/Lookup/1370.0main+features672013)

Again, i'm not aware of a refresh since 2013/14.

I leave it as an exercise for the reader to use wikipedia and see if they can figure out what Australian political events correlate with such dates and the ending of such reports...

</comment></comment></comment><comment><USER4> The article suggests that remaining gender inequality in Denmark is due to women leaving the work force (for a period of time) when they have children, and other factors related to bearing children.

It seems that one way forward might be to extend paid parental leave for both parents. It depends on access to childcare, but I feel it's hard to be back to 100% at work within the first 2 years of a child being born in any case.

This might help level the playing field. It might also help fathers take a more active role in raising children (unfortunately fathers still appear to be generally less active in this area):

[https://www.theguardian.com/lifeandstyle/2013/jul/05/childca...](https://www.theguardian.com/lifeandstyle/2013/jul/05/childcare- men-pull-weight)

<comment><USER5> one of the most controversial comments that i have left on HN suggested the same: [https://news.ycombinator.com/item?id=14334325](https://news.ycombinator.com/item?id=14334325)

<comment><USER4> Your comment was interesting, I think I mostly agree.

Culturally the work that is raising children still seems to be devalued (particularly, during the early years, which is arguably when it's hardest).

So, it's unlikely that we will see gender normalization in this area unless cultural norms shift (and it's seem as important and valuable). And it doesn't have a stronger economic impact on males than females (I.e. longer paid leave for both parents is available).

</comment></comment></comment><comment><USER6> I think the comments about labour supply with respect maternal grandparents are a really interesting note. Or, I can imagine your upbringing would shape a lot of our subtle inclinations and decisions with regard to things.</comment>


Fixing Unix/Linux/POSIX Filenames (the case for UTF8 and fewer special chars) - <AUTHOR> http://www.dwheeler.com/essays/fixing-unix-linux-filenames.html

<comment><USER2> I was expecting an uninformed rant, but got an informed essay (however it is still rantish in parts).

Much of the position for greater restriction in allowed characters is based on shell scripts. I can definitely get behind this, but have a hard time resolving it with my irrational love of the simplistic current restrictions (almost none) which is based on tradition and having run into these kinds of filename problems maybe a handful of times in over 16 years of daily UNIX use. In my own experience, it's so rare that "how do you remove a file that starts with a dash?" is one of those trivial system admin job interview questions. Interfacing with other even more braindead systems, like DOS, CIFS and ISO, with their filename codepage support, who try to do The Right Thing(tm) (well, ahem, One of The Right Things(tm)) and fail at it, is really the regular sticking point.</comment>


Two held for brutal attacks on Uber passengers - <AUTHOR> http://www.iol.co.za/news/crime-courts/two-held-for-brutal-attacks-on-uber-passengers-2066912 <comment><AUTHOR> The quality of South African reporting is not particularly great, but it seems like Uber allowed two major lapses to occur, allowing a criminal rapist to drive for them, and then allowing the same person using a "stolen" Uber vehicle to pick up passengers. No comment from Uber in the article, but this is pretty shocking.

It's also interesting that the first attack was initially reported as a "false Uber taxi", but it turns out it was the real thing: [http://citizen.co.za/1206095/uber-condems-kidnapping-rape- in...](http://citizen.co.za/1206095/uber-condems-kidnapping-rape-in-false- uber-vehicle/)

And another two alleged cases in another part of Johannesburg: [http://www.heraldlive.co.za/news/2016/09/08/obstacle- course-...](http://www.heraldlive.co.za/news/2016/09/08/obstacle-course- kidnappings-rape-assault-robbery-taxis-become-ride-hell/)</comment>


Show HN: Ultimate Japanese – a japanese-german-english dictionary - <AUTHOR> https://play.google.com/store/apps/details?id=com.cal.pas.ultimatejapanese <comment><AUTHOR> I made this app, since I wanted to have something similar to imiwa on android. You can drop in anything e.g. japanese in romaji, conjugated japanese verbs, japanese sentences. It will analyze the text and find the best entries according to similarity and word frequency. Underlying dataset is JMDict from Jim Breen. It's free.</comment>


Free iOS Designing Sketch Paper - <AUTHOR> http://www.ideatoappbook.com/sketch-paper/

<comment><USER2> Thanks!</comment>


DARPA head resigns, moving on to industry - <AUTHOR> https://www.defensenews.com/breaking-news/2019/12/17/darpa-head-resigns-moving-on-to-industry/ <comment><USER2> To the folks reaching immediately for the "revolving door" observations:

DARPA is one instance where churn is a feature, not a bug. Or if not a feature, at least an intentional design choice rather than an accident of corruption.

Various rules about the way the USG works make it really challenging to innovate in the way private industry can. DARPA isn't perfect, but it's a pretty good effort to engineer an ecosystem within the USG that optimizes for "wild idea pursuit" rather than "Spec'ed hourly labor" (which governs the rest of the defense complex). Part of that ecosystem is regular rotation of leadership to bring in fresh ideas and agendas. Another part of that ecosystem is the acknowledgement that you have to spend money on 99 bad ideas before you find the one nugget of gold. Basically, the same observation that governs VC portfolio math but the DARPA is interested in capability unicorns rather than economic unicorns.

When I worked in DC, the joke was that DARPA was the only agency in town that would pull your funding for SUCCEEDING. The reason being that if you succeeded, it obviously meant they had set their ambitions too low and needed to re-frame the work to be impossible before funding it any further.

<comment><USER3> Revolving doors are a policy anti pattern when the proverbial door separates industry from industry regulators. DARPA doesn't fit that category.

</comment></comment><comment><USER4> "The Dream Machine" by by M. Mitchell Waldrop ([https://www.goodreads.com/en/book/show/722412.The_Dream_Mach...](https://www.goodreads.com/en/book/show/722412.The_Dream_Machine)) is a really good book about J.C.R Licklider, one of the perhaps lesser-known individuals who helped create the modern computer revolution, in no small part as an ARPA (later DARPA) director. By reading the book, I learned that the changing of directors is by design, and an 8 year tenure looks like a problem with finding a suitable candidate to fill the role. 2 years seems more in line with how it was set up. I really recommend the book for anyone interested in the history of computing, the internet, or DARPA.

</comment><comment><USER5> What does this mean for DARPA / the state of DARPA? I just searched and see that Walker was head of DARPA for about 2 years, which seems like a short time.

Previous heads' tenures:

1\. A. Prabhakar: ~5 years

2\. R. Dugan: ~3 years

3\. A. Tether: ~8 years

<comment><USER6> Walker had been acting director of DARPA since January 2017 (eventually formally becoming director in November 2017), so, when his resignation takes effect, he'll have been in the position for three years-- actually a few months longer than Dugan.

Historically, Prabhakar and Tether's long tenures in the position are unusual [1], with most directors staying anywhere from one to four years. This mirrors how DARPA works at the lower levels: the revolving door for DARPA Program Managers (and their programs) is very much real _and_ 100% intentional: DARPA PMs are typically recruited from academia or industry, serve 3-5 year terms and then return to work in academia or industry. This keeps fresh talent and fresh ideas moving through the organization, and provides a sense of urgency and time-sensitivity to their work (successful projects get transitioned either commercially or into longer-term programs under other branches of the military-- they don't languish forever within DARPA by design).

[1] [https://www.darpa.mil/attachments/DARPA_Directors_Sheet- web....](https://www.darpa.mil/attachments/DARPA_Directors_Sheet-web.pdf)

<comment><USER7> Seems like a smart way to do business. (Or, research, as it were.)

Too many orgs end up resting on their laurels - either getting too focused on research and not executing on technical advantages generated by that research, or too focused on execution and not enough into research.

</comment></comment></comment><comment><USER8> This seems pretty normal. I worked at a startup company founded by ex-DARPA people and I got the impression that it's standard procedure there to move in and out of the agency and while in private business receiving funding from the agency.

<comment><USER9> This is a bit tangential to the topic at hand, but do you believe that their previous experience at DARPA made the company's culture/workflow distinct from other startups in any significant way?

<comment><USER8> They were very hands off. Probably the same way they operated as DARPA project managers. It often felt that the CEO and CTO watched us from a distance. But they were excellent at writing, presenting and talking to people.

</comment></comment></comment><comment><USER10> DARPA is pretty neat. Pitty it's part of the defense department and not something shared between them all. Tech isn't just good for war and ads, ya know.

Make it ARPA again in name and flesh!

<comment><USER11> There are also ARPA-E[1] for Department of Energy and IARPA[2] for Intelligence Community.

[1] [https://arpa-e.energy.gov/](https://arpa-e.energy.gov/)

[2] [https://www.iarpa.gov/](https://www.iarpa.gov/)

</comment></comment><comment><USER12> > _Walker will move on to a position in industry, though a DARPA spokesman did > not reveal where._

Any ideas as to where? Lockheed, Palantir, Google?

<comment> the-dude How about Boeing

<comment><USER13> With a PhD in Aerospace Engineering, that would make more sense.

</comment></comment></comment><comment><USER14> > Walker will move on to a position in industry

It's really hard to read this and remain non-cynical. Were any big contracts signed recently?

<comment><USER15> There are SO MANY laws preventing this sort of thing. I take the training occasionally; just the refresher takes half a day. The full training to be a Contracting Officer's Representative (a "COR") takes a full week.

Suffice it to say: having Walker's experience and contacts will secure him a nice position, and rightly so. But if that position regards a government action in which he had any role he would likely end up in prison, and the contractor would be heavily fined and maybe barred from competing for government business.

<comment><USER16> There may be laws but are they actually enforced?

<comment><USER17> US Federal laws are enforced vigourously enough that I think the burden of proof is on those who claim they are not enforced.

Whether the laws are _effective_ at preventing the behavior they are designed to prevent is another story.

<comment><USER18> Why do you assume (or know) US federal laws are enforced vigorously? I see almost no evidence of this, and an abundance of evidence to the contrary. As another commenter pointed out - there is an entire book describing this epidemic in detail.

<comment><USER19> >and an abundance of evidence to the contrary

Then please provide us with a little. It's interesting you're able to see evidence of major federal offenses and no major news outlets or law enforcement agencies have done anything about it. Sounds like quite the conspiracy.

<comment><USER18> I don't even need to bring up obscure cases or examples, just look to the president. Do you honestly think he's going to be prosecuted (I realize he has been impeached) for any of his offenses?

<comment><USER20> So you don't need obscure examples but the first one you reach for is highly political and applies to one of the most protected federal workers? No one with any habit of studying us law is under the illusion that the POTUS is bound by the same rules as other federal employees specifically because the law itself has many exceptions for that specific role. If there's so many examples then surely you can find another that isn't tied to the Trump administration.

<comment><USER18> I gave an example which you don't dispute and I referenced an entire book full of specific examples - it seems unlikely I'm going to persuade you of anything (the fact that you made an account just to reply to this comment doesn't make me think you're going to stick around either) since the goalposts keep moving.

But sure - how about the Scientologists being given a pass for tax fraud, extortion, and a litany of other illegal activities? Or is this another unfair example, because Scientologists are also untouchable by regular laws? My entire point is that the "untouchables" are the problem - there should be no untouchable class of people _at all._ The fact that the elected leader of the US is considered above the law is moronic. He should face higher scrutiny, not less.

[https://en.wikipedia.org/wiki/Tax_status_of_Scientology_in_t...](https://en.wikipedia.org/wiki/Tax_status_of_Scientology_in_the_United_States)

I'm done responding to comments in this thread.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> It's DARPA, not Darpa. It's the Hacker News submission title replacement code again, it's not the first time that the acronyms in the titles has been replaced improperly. To those who didn't know its existence...

1\. It properly capitalizes the title, making it more pleasant to read, and it also automatically removes the ALL CAPS titles. But from time to time, it makes the title worse by removing the proper acronyms.

2\. It removes buzzwords from the title, which is generally good for anti- karma farming, but sometimes it does this even if such use is technically appropriate. For example, "massively parallel" becomes "parallel".

Submitter, please change the title back manually. And moderators, please update your code to recognize more acronyms, such as DARPA, CSAIL, etc.

<comment> the-dude [https://english.stackexchange.com/questions/51924/proper- cap...](https://english.stackexchange.com/questions/51924/proper- capitalization-of-commonly-used-acronyms)</comment></comment>


A bookmarks program I wrote - <AUTHOR> http://dl.dropbox.com/u/31828432/Bookmarks%20-%20Beta.zip Its a simple program that reads in bookmarks and passwords from plain text files written in VB.NET source code available upon request I`m just looking for any deign or program direction <comment><USER2> For future reference, people would be a lot more likely to comment on or be interested in this if:

\- you had a website (or at least a GitHub account) where we can read about the project

\- source code was included

Most of us don't even run Windows, so a .exe file in a zip with no page of explanation is not attractive in the slightest.

Hope that helps you for the future though :)

EDIT: Also, this comes under "Show HN"

<comment><AUTHOR> Thanks I will resubmit once I have a repo setup and I will repost it under "Show HN" (I thought there was more windows users then linux,But I guess times have changed)</comment></comment>


Top 5 Categories of Employment (Industry/Skill) in 2020? - barry-cotter

My guesses.
1. Data Analysis - Statistics, graphical interpretation of
information, data mining and such
2. Intermediation, management - so broad as to be almost useless to you, but... the Web, the Net, globalisation, all of these probably make the long run average size of the efficient firm, on average, smaller. If you know a lot about an industry or an industrial niche you can connect people and take a cut or a fee for introducing them. This is basically the extension of the import-export firm model to services.
3. Biotechnology - This area is now in something analogous to the stage the IT industry was in in the late 50s, early 60s with the giant semiconductor companies. No one knows what's going to happen but it's going to be BIG. Aiming to be the Intel, Microsoft or Google of the industry is a bad bet but there will be money here in spades.
4. Professional services - Lawyers, Accountants, Bankers, all businesses need these people eventually, they're all skilled profesionals with hard to commoditise skills, with a possible exception for Bankers, a great deal of whose value is in reputations, connections and trust. The Law is a frankly horrible career but if you can provide a service or product lawyers want, you're golden.
Don't go to Law School unless you can get into a Tier 1 School <comment><AUTHOR> You should have enough karma to turn this into a poll, I think you should do so.

I'd simplify your professional 6services into independent professionals since these are individuals that are either in business for their self or for in business for either some type of firm or agency. Independent professionals would not only incorporate bankers, lawyers, accountants, etc. (as providers of service) but also creative professionals as well.

Interesting start nevertheless, I personally would add education, nanotech, and possibly robotics to that list as well.</comment>


Wi-Fi over Coax - <AUTHOR> https://en.wikipedia.org/wiki/Wi-Fi_over_Coax <comment><USER2> What the article didn't mention is the possibility to build a "wired wireless" network using leaky feeder [0]. Unlike a normal coax feedline, a leaky feeder is a special coax feedline that is designed to leak a bit of RF along its way, thus providing wireless coverage on everywhere the coax runs. It's useful in areas when using antennas at fixed points is difficult to provide a throughout coverage, such as a building complex or a tunnel.

[0] [https://en.wikipedia.org/wiki/Leaky_feeder](https://en.wikipedia.org/wiki/Leaky_feeder)

<comment><USER3> That's also how you get mobile phones working in elevators

<comment><USER4> I recently installed an access point in an elevator. All that we did was put a cat6 into the umbilical cord that contains the elevator power, controls, etc.

</comment></comment></comment><comment><USER5> Back in the day, almost all cell phones had a miniature coax port on them. They were "hidden" in that you probably had to pry off some nondescript part or open the battery cover up or something.

This is how we tested mobile networks. It works great. The only problem is when someone forgets to make a tight connection or attach a signal attenuator. Since the first thing you always test is emergency calls, once in a while your call ends up on the real mobile network and the fire department shows up in your parking lot. This happened about once or twice a month where I worked. They knew what our business was so they were never mad at us, but we had to pay a fine each time.

<comment><USER6> It's not only how they tested mobile networks.

The old Nokia and Ericsson phones as well I think as some Motorola's had a rubber plug in the back just below the external antenna with a coax port that you had to remove when you plugged the phone into the a car speaker phone system the phone would then hook to an external or a larger antenna glued to the windshield.

<comment><USER5> Interesting, that must be why the coax port survived from engineering to production.

<comment><USER6> The external port was a requirement for kits like this

[https://images-na.ssl-images- amazon.com/images/I/411PQXERG6L...](https://images-na.ssl-images- amazon.com/images/I/411PQXERG6L._AC_.jpg)

But signal testing kits also used it.

This survived until 2G the 5110 still had it.

When 3G came out the coverage was good enough and I'm guessing that issues with signal strength in cars was more or less solved.

<comment><USER7> What a blast from the past... I remember installing that exact kit (plus antenna) in my own car some twenty years ago. It worked great.

</comment></comment></comment></comment></comment><comment><USER8> The possibilities here with sufficiently sophisticated software and tunable hardware (deep learning of RF propagation characteristics in a building using data from portable sensors) are fascinating! But honestly, MOCA already solves this problem. The MOCA 2.5 standard ([https://en.wikipedia.org/wiki/Multimedia_over_Coax_Alliance#...](https://en.wikipedia.org/wiki/Multimedia_over_Coax_Alliance#MoCA_2.5)) already delivers 2.5gbit total (time-multiplex) throughput which is more than enough for real-world no-compromise bidirectional gigabit ethernet on isolated runs or distributed backhaul to multiple wifi APs. I'm using this in my (115 y.o.) house now where new cable runs are impractical and the coax plant is unused.

<comment><USER9> Happy to see MoCA get a shout- out. I spent most of 2003-2015 working on the design of MoCA chips, starting before the v1.0 spec release up through v2.5. AMA

<comment><USER10> Why is MoCA still so rare and expensive? Is there a technical reason or is it just some combination of business reasons?

It seems like it's been the obvious choice for no-new-wires home networking for years but you basically can't find it at retail and have to look for it even online.

<comment><USER11> For what it's worth, you can buy the DirecTV DECA adapters for like $20 on Amazon. They're actually just MoCA adapters, but they run at a lower frequency than regular MoCA so they don't interfere with the DirecTV signal. They work fine by themselves.

The only downside is that they're 100 Mbit/s.

That said, they really do give you a rock solid 100 Mbit/s.

If you need more bandwidth, I think Verizon sells a MoCA 2.5 adapter for like $60 which should give you GigE.

<comment><AUTHOR> They're actually ~91Mbit/s, but yes, very, very stable. They also seem to add about 4ms of latency.

<comment><USER9> The 4ms of latency is a product of the MOCA protocol.

As a fully scheduled network, each packet must wait for a timeslot to send a reservation packet, wait for the schedule to be updated (map packet), and then wait for the actual scheduled time.

The reservation timeslots and mail packets are on a fixed schedule (approximately- there are cases where the timing changes if you have a poor link) with a consequence of an unloaded MOCA network having a transit time of ~2ms going from the master node, or ~2.5ms going anywhere else (master node transmit is faster since it gets to skip the reservation step. Times are averages, as the exact time depends on the alignment of the time of arrival to the scheduling period). Round- trip ping times should go up by roughly 4.5ms.

Under ideal conditions, it is possible to get 100Mbps UDP throughput on a pair of MoCA nodes (1518 byte packets). The physical media can support up to 110Mbps (MOCA 1.0), 140Mbps (MOCA 1.1) or 450Mbps (MOCA 2.0) user throughput per channel (up to 5 channels in MOCA 2.5), but that's shared bandwidth (all traffic summed together). Throughout will fall off in bad channels (minimum 40Mbps), or if you use smaller packets (higher scheduling requirements per packet) so YMMV

</comment></comment></comment></comment></comment></comment><comment><USER12> Everybody hates punching holes in walls and running new cables, but this is almost certainly the wrong solution for almost every problem, outside of the weirdest of edge cases.

For starters, you're going to lose MIMO, so you've substantially downgraded your network's ability to handle multiple clients. It's also really unlikely that your weird old coax system is clean and not a rat's nest of splitters and unterminated ends (=interference).

Attaching multiple antennas to a single AP in a non-MIMO configuration is not a cost effective way of doing DAS with current technology, if it ever was. More, lower-powered APs all over the place is where you want to be spending your budget. If you want to save money on install, do PoE.

<comment><USER6> Ethernet over power line (basically DSL) has become quite good these days, you can get fairly cheap 1gbe units today and unless you have some really crappy wiring with noisy appliances they don't have many issues.

<comment><USER13> Latency. Sadly, Ethernet over powerline (IEEE 1901) made the same unfortunate choice as WiFi and the (analog phone line) modem V.4x standards in including error correction. This is not what you want or need for TCP/IP. It's better to drop a packet than to deliver it late. IEEE 1901 tries to mitigate this by using forward error correction, but succeeds in that only to a degree.

Bandwidth is alright-ish at about estimated 2MiB/s here (single pair, about 50ft apart), but RTT of ~4ms with occasional spikes in excess of 1s (at a different location, I've seen spikes in excess of 5s). This is only barely noticeable for accessing the WWW, but unpleasant for interactive GUI work (e.g. via NX or VNC) and a deal-breaker for cluster communication protocols.

<comment><USER14> 1\. There are still some devices designed for lan-only use that assume packet loss will be extremely rare.

2\. TCP throughput suffers when non-congestion related packet-loss exceeds a fairly low value

<comment><USER15> Only an idiot would design a device to assume no packet loss, unless they were _also_ allowed to design the network. If you buy such a device and put it on a janky power network, then you have only yourself to blame.

Standards decisions should never be made to accommodate designers that want to assume there's effectively no packet loss.

Some degree of error correction is totally reasonable, but your first point is irrelevant to discussion.

</comment></comment></comment></comment></comment><comment><USER16> So.. WiFi cables do exist?

I feel a little bit bad about some discussions I've had over the years. They could have even been more complicated(;

<comment><USER17> Defining it as a Wi-Fi cable is a bit narrow. It's just a coaxial cable between an antenna and the router. Just make sure your cable is matched to your antenna and using the correct connectors.

<comment><USER18> And an attenuator.

<comment><USER19> You'd only need an attenuator if you're connecting two WiFi adapters directly through coax. In what is discussed here, waves always travel through the air at some point, which does the attenuation.

</comment></comment></comment></comment><comment><USER17> This is just extending the antennas using 50-ohm cables.

By using couplers and multiple cables, you can connect multiple antennas to the same access point.

It's a way to physically separate the antennas from the router by using a coax cable.

<comment><USER20> Home TV coax has a characteristic impedance of 75ohm. If you just plug consumer devices in directly you will get a pretty significant SNR loss from reflections and other impedance mismatch effects.

<comment><USER17> Sure. But I would bet that most Wi-Fi access points use a 50-ohm system. (Plus, the connectors on a home tv coax cable probably won't mate with the router connectors.)

If you want to use a 75-ohm cable, you'll have to use impedance converters to convert to 50 ohms.

Bottom line: just make sure the components you're connecting in your system are properly matched to avoid a lot of reflections and power loss.

<comment><USER18> This confused me but I think you mean "Most WiFi Access Points use a..."?

<comment><USER17> Thanks! Corrected

</comment></comment></comment></comment></comment><comment><USER21> By turning a Coax cable inside out you get a radiating cable. This is used now in every train tunnel in Norway to get good 4G coverage.

</comment><comment><AUTHOR> I'm curious to know, at what frequency in a pair of wires is it considered to be EM waves travelling through it? I know that Ethernet is changing voltage (electric field) at frequencies of ~30MHz, while WiFi travelling through a pair is an EM wave at a frequency of 2.4 GHz. At what point does it change to EM?

<comment><USER22> At frequencies greater than 0 Hz (DC) structures of two or more conductors can support transmission of TEM electromagnetic waves. At microwave frequencies and above it is more efficient to switch to waveguide (a conductive tube).

<comment><AUTHOR> Thanks for clearing it up for me!

</comment></comment></comment><comment><USER23> [https://en.wikipedia.org/wiki/Leaky_feeder](https://en.wikipedia.org/wiki/Leaky_feeder) might be interesting too - essentially using a cable to act as the actual antenna.

</comment><comment><USER24> I'll bite: how is this superior to MOCA? [https://en.wikipedia.org/wiki/Multimedia_over_Coax_Alliance](https://en.wikipedia.org/wiki/Multimedia_over_Coax_Alliance)

</comment><comment><USER25> I think it would be pretty awesome to inject the WiFi RF into the coax of my home from the distribution panel. I only use the 1 line for my Comcast internet and ethernet/wifi to connect everything else. All of those other coax lines to each room are sitting entirely unused right now...

All you would need is a WiFi router that has a bunch of RG6 connectors on it. Wire in where the coax splitter/amplifier would normally live for CATV/satellite service. And then in each room where the coax feed ends up, simply screw on an antenna with matching RG6 connector.

</comment><comment><USER26> Too bad we ripped out all those 50-ohm cables years ago:

[https://en.wikipedia.org/wiki/10BASE5](https://en.wikipedia.org/wiki/10BASE5)

</comment><comment><USER27> The article mentions 802.11r for fast roaming between APs and how this avoids it. I've seen mentions of networks where the APs just forward WiFi packets and a central router does all the actual negotiation to achieve the same effect. It's too bad something like OpenWRT doesn't include it.

</comment><comment><USER28> Ericsson has something similar for cellular signals over CAT5 called Ericson Dot [0]. Though I believe they have it at baseband or intermediate frequency in the cable and then shift it up in the Dot. Disclosure, I worked at Ericsson when the first Dot was released, but never with it myself. But they were really proud of it I remember.

[0] [https://www.ericsson.com/en/portfolio/networks/ericsson- radi...](https://www.ericsson.com/en/portfolio/networks/ericsson-radio- system/radio/indoor/radio-dot-system)

</comment><comment><USER29> Also, modulation of light waves with radio signals to send them over fiber: [https://en.wikipedia.org/wiki/Radio_over_fiber](https://en.wikipedia.org/wiki/Radio_over_fiber)

</comment><comment><USER30> Small example [https://hackaday.com/2018/10/19/wired-wireless-over- coax/](https://hackaday.com/2018/10/19/wired-wireless-over-coax/)

</comment><comment><USER31> I'm struggling to see how this is anything but using feed lines to the antenna. We've done this for decades to attach rooftop high gain antennas to an equipment closet or if you are a HAM radio operator and want to have an outdoor antenna while your rig remains inside.

If this were node-to-node, doesn't this just fit the definition of old school ethernet over coax?

<comment><USER32> It is easier and cheaper to use 50ohm compatible WiFi when dealing with situations like trying to communicate with equipment inside an enclosure through a slip ring.

</comment></comment><comment><USER33> Running 2.4ghz or 5.8ghz over run-of-the-mill coaxial cable will introduce a lot of losses. It'll have to be low loss stuff similar to LMR400 to really be useful, I'd think. This would only be feasible if such coax already exists. Otherwise it's cheaper to run multiple access points.

</comment><comment><USER34> Wifi over coax could have usage for trains.

You would connect wifi access point to fibre from the ground. Wifi signal is output to coax cable running along side with the power lines or from the ground next to the track. Wifi is beamed into the train. Local Wifi access points spreads the wifi signal in the train.

<comment><USER35> Some automated train systems already do this for control such as some of the Vancouver SkyTrain lines.

From the SelTrac wikipedia page:

"in newer versions of SelTrac, the control signal is transmitted inside the running rails at radio frequency using IEEE 802.11 (WiFi) access points. "

[https://en.wikipedia.org/wiki/SelTrac#Communication](https://en.wikipedia.org/wiki/SelTrac#Communication)

</comment></comment><comment><USER36> Pardon my ignorance on the topic, but are there any commercially available (enterprise grade) products for Wi-Fi over Coax?

If this is used for "back-haul", what is the key differentiator between this and MoCa (or similarly Ethernet over Powerline)

<comment><USER37> Well if you want one difference this won't throw RF hash all over the spectrum like ethernet over powerline does.

</comment></comment><comment><USER38> This is a very timely post for me. My contractor mentioned this to me last week. It caught me totally off guard and seemed counter intuitive to my knowledge of wifi connections. Pretty neat and thank you for sharing.

<comment><USER39> Wouldn't it be more "future proof" to use something like cat7 rather than coax?

<comment><USER40> I think what Wifi-over-Coax is trying to get around is having to coordinate multiple access points. Wifi breaks down particularly horribly when some of the stations and APs can't hear each other. By only having 1 AP, you avoid some of that problem. (Of course, stations can still interfere with each other. So I'm not sure how useful this is in practice.)

</comment></comment></comment><comment><USER41> That article is only written for experts. It'd be great if someone here that understands what it's actually about could update the article and contribute a better description for the laymen.

</comment><comment><USER42> Alternatively you can use HomePlug protocol over coax cabling. (HomePlug is normally used to Ethernet-over-mains)

Instead of buying complete mains units there also smaller modules too, eg. LX200V20

</comment><comment><USER43> 10base2: [https://www.youtube.com/watch?v=82E7vhtLxNs&t=9](https://www.youtube.com/watch?v=82E7vhtLxNs&t=9)

</comment><comment> globular-toast I wasn't aware of coax usage other than for TV. I guess I assumed that twisted-pair cables were far superior for data transmission, but maybe not?

I recently moved in to a home that has been pre-wired with Cat5 and also coax to each room. The wiring was left unterminated but I assumed the coax was just meant for TV reception. But I did discover there is a second coax cable that has been left unterminated at both ends and I wonder if this is meant for data? I really don't like not knowing but I'm unable to get hold of the people who did the wiring during lockdown!

<comment><USER44> A typical satellite receiver has two or sometimes three coax connections to the dish (or to the inhouse distribution platform). They could have built for that.

Or it's a spare pull in case the cable fails mid span. Or to be able to get cable + antenna. Or to be able to use a centrallized powered splitter for two uses at one location, which would be better than using another splitter in the room, but probably not needed.

</comment></comment><comment><USER45> Is this just coax as backhaul? Or is signal actually emanating from the shielded coax cable? I haven't had my coffee yet.

<comment><USER46> It's sticking the Wifi antennas at the end of a long cable. A "feedline" in the usual terminology.

How this interacts with beamforming and antenna diversity is .. not specified.

The basic idea seems simple enough: rather than stick an AP on one side of a wall and accept a 15-20dB loss through the wall, or use two APs, cable one antenna through the wall so the AP has a clear line of sight on both sides of the wall.

<comment><USER47> That was my interpretation as well. I feel like this is another case of someone new to the industry creating a "standard" for something that, had they been around for a few decades, they would have realized already existed in a different context.

Case in point: we have had "external" uni- and omni-directional antennas, even for plain old 802.11, for decades.

<comment><USER48> Isn't this exactly reusing old technology that has existed for decades (well, over a century now) in a slightly different context? I mean, a lot of pre- existing coax is there exactly for the purpose of running a signal between an antenna and a device…

<comment><USER47> Of course. But would you call that "WiFi over coax"? No one I knows would...</comment></comment></comment></comment></comment>


Website visitor free trial registration rate? - <AUTHOR>

What percentage of the visitors to our website is it reasonable to expect will register for a free trial?  We're running about 4% at the moment.  Is that good, or is something broken?  What additional information about the market would be relevant to answering this?  (Are the rates wildly different across industries, market demographic segements, etc.?) <comment><USER2> It will vary widely depending on what you're offering, and the terms of the "free" trial etc. (Eg, if you require credit card details or some other commitment, or if it automatically converts to a paid membership automatically etc etc)

Not knowing anything about the site or how your traffic is reaching you, a 4% conversion rate sounds pretty good.

The real question I think is how many of that 4% can you convert to actual paying customers...</comment>


Checklist for Creating a Landing Page - <AUTHOR> http://unbounce.com/landing-pages/checklist/ <comment><USER2> Too many of these items are redundant...variations of saying "Is your message clear?" I guess some startup creators need that question drilled into their head?

But the main issue of this checklist is that its items are too broad in scope and too subjective...The bullet points of a checklist should be concise and easy to answer with "yes" or "no".

I'm thinking along the lines of the famous hospital checklists written about by Atul Gawande in the New Yorker:

[http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_...](http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_gawande)

The checklist is not full of items like: "Does the patient seem healthy?", "Is the patient overly nervous?" "Do you feel well-rested?", but "Did you wash your hands?" "Are you wearing a sterile mask?" "Did you apply antispetic onto the patient's skin?"

<comment><USER3> So less on vague questions that need some thought and more on concrete details that can be easily checked/fixed.

Yeah, the questions on unbounce are a bit too wordy.

</comment></comment><comment><USER4> "If the counter isn't going up when you check all those boxes, give the page a refresh. It's finicky."

Mere words cannot express the emotions that reading this made me feel.

<comment><USER5> It seems a simple script to tally all `:checked` elements using jQuery is too much for this blog to handle.

<comment><USER6> The javascript involved does seem overly complicated for such a simple task. Maybe it was originally intended for something else and somehow found its way onto this page?

<comment><USER7> For anyone reading: [http://unbounce.wpengine.netdna-cdn.com/wp- content/themes/un...](http://unbounce.wpengine.netdna-cdn.com/wp- content/themes/unbounce2/js/scorecard-ultimate-lpo.js)

<comment><USER7> Can't seem to edit my comment. Anyone know why?

Anyway somebody asked me how to do it, but delete their comment. Paste this into your console, they already have jQuery loaded.

jQuery('.blog-post input').change(function() { console.log("Score: " + jQuery('.blog-post input:checked').length + "/50"); });

</comment></comment></comment></comment></comment><comment><USER8> What I don't understand is why some services don't just show off the product right away, instead of showing a landing page. This is obviously not applicable to everything but in many cases I don't want to see your polished pitch, have to input my email and sometimes phone and address. I just want to see what it is and what I can do with it. Just as an example, let's say I've built an amazing email client, even better than gmail. Why not make the landing page an actual email account with fake data? Or at least give the user a small piece of info, a button for logging in, and a button straight to said demo?

<comment><USER9> I agree with this completely. I don't care about how you think about your product, I care about what your product _is_.

Why am I so often tasked with the work of wading through all fifty of these bullet points someone tried to mash in to a single page instead of simply seeing what the thing does?

<comment><USER10> When I see a page like that my first thought is, "Oh, it's not ready."

</comment></comment></comment><comment><USER11> I put up a landing page and "Showed HN" a few weeks ago created on unbounce. The general thought was that it seemed spammy. Yet, many of the items on the checklist were covered...what gives?

<comment><USER12> Is it possible that Unbounce landing pages themselves are considered spammy? You're asking "I followed most of Unbounce's advice when I created a page with Unbounce... why did it fail?" before asking "is Unbounce's advice correct in the first place?"

I don't know the answer either way, to be completely honest, but my personal view is that that particular style of landing page gives the notion that "this site is such a new idea in my head that I haven't even begun it!". That's my opinion, anyway.

<comment><USER13>
       I don't know the answer either way, to be completely honest, but my personal view is that that particular style of landing page gives the notion that "this site is such a new idea in my head that I haven't even begun it!". That's my opinion, anyway.

I feel like that in relation to LaunchRock pages now that so many throwaway projects are using it. Same feeling I get from unthemed Bootstrap sites too.

</comment></comment></comment><comment><USER14> Better yet, 86 the landing page entirely. Build web technology that doesn't need an artifice on top of it to dramatize itself. The product is the thing.

<comment><USER15> Why don't you A/B test your theory?

It is tempting to think that a better mouse trap does not need marketing. But a better mouse trap + marketing beats a better mouse trap every time.

</comment></comment><comment><USER16> Only if the post followed it's own checklist. I get this is not a landing page with the intent of capturing new users. But it kind of is. I think the page layout is funky (I can undertand it's a template), the paragraph's are too long and the actual list is below the fold. So if you're going to tell the world how to do a landing page, then show by example.

</comment><comment><USER17> 'And finally, have you ever used Unbounce? (Had to ask).'

Really?

This makes it difficult to take the list seriously; when that is weighted the same as 'Is it clear who your company is and what you do? (a logo and tagline)?'

</comment><comment><USER18> \+ Is your page accessible to those with disability? \+ Is your markup/CSS/JS correct? (especially when selling your idea to a tech crowd)

</comment><comment><USER19> Degradability would probably be a good feature to have as well. It's a NoScript/Ghostery/RequestPolicy world.

<http://imgur.com/d2q3s>

<comment><USER20> _It's a NoScript/Ghostery/RequestPolicy world._

Sorry, but no, it isn't. Whether it's building their own PCs or running a custom Linux kernel or installing privacy utilities or using three factor authentication with a telepathic failsafe for their security system, geeks tend to _vastly_ overrate their collective importance. In reality, they tend to represent tiny fractions of any market that isn't specifically built around geeks by its nature. Most people aren't like geeks.

Now, suppose your new interactive web app doesn't offer a good user experience without things like JavaScript. Maybe you could make it work up to a point, but realistically it's never going to be a polished presentation or do everything the full app could. Now put yourself in management's position, considering the cost/benefit of implementing a second-rate fallback vs. allocating the same time and resources to improving the core experience for almost everyone. Can you imagine how little they care about geeks who deliberately nerf their own browsers in a way that means they couldn't use that service anyway and therefore aren't likely to pay the service provider money either?

(Edit: Incidentally, people in glass houses etc. Your own web site's home page, under the amusingly ironic headline "passenger: Rails deployment that just works", appears to be doing anything but working. HTH.)

<comment><USER19> It does, thanks, though it's not my main concern.

I'm not overrating (really, overestimating) anybody's collective importance, I simply think degradability is a good idea. When I said it was a "world" like that, it was that these things exist, and coupled with disability concerns I work accessibility into everything I do. What is the downside? What of a contemporary web app is impossible to degrade?

As far as penetration of these plugins go, a comparison of Google Analytics numbers with raw logfile analysis makes that very clear.

<comment><USER20> _What is the downside? What of a contemporary web app is impossible to degrade?_

I think there are two major downsides.

Firstly, there is the opportunity cost. Any time and money I spend catering to a niche group who choose not to support modern technologies properly is time and money I didn't spend improving the experience for everyone else.

Secondly, a lot of web apps are about convenience or entertainment. Beyond a certain point, a degraded experience isn't quantitatively worse, it's qualitatively worse, possibly even to the point of effectively making the entire service worthless.

 _As far as penetration of these plugins go, a comparison of Google Analytics numbers with raw logfile analysis makes that very clear._

Yes it does. Having done that analysis for the businesses I run, the people blocking Analytics specifically are a small but noticeable minority, but the people blocking JavaScript entirely are noise, and quiet noise at that.

Based on that data, when it comes to so-called graceful degradation, we are far more interested in supporting the significant minority of visitors who have older versions of IE that don't support things like HTML5 and CSS3 well than we are in supporting those who nerf a perfectly good modern browser. YMMV, of course.

</comment></comment></comment></comment><comment><USER21> This section resonates with me so much "Interface iteration is more cumbersome", I am currently working on a project where I have begged and pleaded to get some type of overall app design/workflow... only to have that idea thrown out and every other week having to deal with design changes that means I have to fix several views worth of work.. needless to say its a very depressing time in my life.

</comment><comment><USER22> I think this is a great list. But just because you follow the list doesn't mean you won't look like a spammer. This is not an attack on ajjuliani.

<comment><USER23> Spamming usually means bombarding some communication channel, email or craigslist for example, with advertisements or deceptive links to get a visitor to your landing page. It's all about what happens prior to seeing the LP.

Once the visitor is on the landing page they are "post-spammed" (if they were even spammed at all, not all advertisement is spam). Proper landing page design has zero to do with spamming.

<comment><USER22> I agree but something can still "look like spam" without being spam.

</comment></comment></comment><comment><USER24> > Have you optimized your landing page to get a paid search quality score > above 7?

Anyone can explain this? What's the "paid search quality score"?

<comment><USER25> "Quality Score is an estimate of how relevant your ads, keywords and landing page are to a person seeing your ad." [http://support.google.com/adwords/bin/answer.py?hl=en- GB&...](http://support.google.com/adwords/bin/answer.py?hl=en- GB&answer=2454010) It only matters if you promote a page via Google Adwords.

<comment><USER26> bing has the same thing, I'd guess it's common.

</comment></comment></comment><comment><USER27> Are people really paying $50-$200/month for landing page testing and optimization? I get that there appears to be a lot of features, but seems like overkill to me.

<comment><USER28> If it produces a benefit, that cost is trivial for any business with a reasonable amount of sales.

1% boost in conversion in a business with $100,000 annual sales = $1000, which is almost double the price of the lowest plan.

</comment></comment><comment><USER29> How about doing some sort of usability testing on the landing page? It might be a bit scary putting infront of a REAL customer.

</comment><comment><USER30> Custom headline + no navigation menu + big call to action = big conversion rate!</comment>


Screencast: Basic Unit Testing in Objective-C with XCTest - <AUTHOR> https://www.youtube.com/watch?v=amSApTmxqrc

<comment><AUTHOR> If you want to learn the basics of testing with the XCTest framework in Objective-C, this screencast is a good way to start.</comment>


Open Compute Project - <AUTHOR> http://opencompute.org/

<comment><USER2> At first, I thought it was pretty ballsy of them to open this all up, but then I realized that this isn't really where their competitive advantage lies. Plus, I think they probably felt that there was still plenty of room for improvement since it had just been a small team working on it (whereas I have a feeling that Google has a much larger team working on these things). In the end, the community wins by getting to see their designs, and Facebook wins by continuing to iterate on them as the community discussion leads to improvements.</comment>


Show HN: "yin-yang" call/cc puzzle ported from Scheme to JavaScript - <AUTHOR> https://gist.github.com/michaelsbradleyjr/5655300

<comment><AUTHOR> I've just revised the gist, in case anyone is interested. I decided to decouple the sync and async variants as I had done originally, so that it's hopefully a little easier to follow and play with.</comment>


Plurk Comet: Handling of 100.000+ open connections - <AUTHOR> http://amix.dk/blog/viewEntry/19456

<comment><USER2> Being a python programmer I am a bit worried that one (In this case) needs to use java to overcome a scaling problem. From my experiences with twisted, which is on much smaller scale than the article, I have never found twisted to be anykind of bottleneck.

It may be that since twisted(python) can only use one cpu effectively per interpreter(GIT et al) that it got left behind java which can easily use multiple CPUs for threads.

A slightly different architecture might be required then where multiple python processes are used.

<comment><USER3> So far at Plurk we have struggled to overcome scalability issues - - and none of them are due to Python, even thought we use Python a lot.

Most of the problems we have seen have been related to the database. It was and still is the biggest bottleneck. And all the people I know that drive big sites will confirm this.

This all said, one should evaluate problems and not blindly use Python for everything. Python is a great language, but some other language is a better choice for some problems. And here Java and specially Java's NIO library is a much better choice for doing a server that should handle tons of open connections.

</comment></comment><comment><USER4> This is a nice writeup that gives some good insight into what you're up against if you want to implement Comet today. It's a cool idea, but there's really nothing out there that you can use to do it off the shelf. It's great that he's gone through and actually tested out a bunch of these candidate technologies under load, so the next guy will at least know what not to try.

I have faith that Comet will have its day eventually, but clearly it's not quite time. With the current crop of production quality web servers, handling 100k requests per second (polling) is a solved problem. Keeping 100k simultaneous connections alive (comet) is by no means solved. It'll be cool when it happens though.

<comment><USER5> >> "I have faith that Comet will have its day eventually, but clearly it's not quite time."

??? Many many big sites are already using comet, and have been for some years, so I'm not sure I understand your comments.

<comment><USER4> Correct. If you're Google, and can devote a team to build and maintain a webserver specifically designed to handle Comet, then you can use Comet.

If you're small and need to use off-the-shelf tech to get your thing up and running quickly, you're still best off going with Polling today.

A quick example would be to look at Thinkature vs. Twiddla. They had a team of two, one of which spent an entire year building a web server from the ground up so that they could use Comet. Twiddla only has me as a developer, and I'd rather spend my time improving the product, so we use Polling.

One year later, Twiddla has a ~300ms lag between when you draw a line and when it appears on a remote screen, whereas Thinkature is out of business. I don't think it's that black and white of a tradeoff, but hopefully you see the thrust of what I'm saying.

One day soon, there will be a mod_comet for Apache, or IIS 9 with Comet support built in. That will be the day it makes sense for small, lean teams to build a business around it.

<comment><USER5> I spent a year or so building my own comet server. Because I did that, I'm able to finely control every single element of it. I know in absolute detail how it works, what sucks, what rocks, etc.

Obviously you have to decide how important things are to your success, and decide if you should build it yourself, or use some existing code out there. For me, it was a no brainer decision.

mod_comet is missing the point. Apache is the issue when using comet. Apache is what needs fixing/replacing.

If Mibbit was using polling, my bandwidth bill would be through the roof.

<comment><USER4> Sounds like we're in agreement then.

If you want to use Comet today, you need to build something custom, and it will probably take a lot of time, but it will pay off as you describe in terms of flexibility.

<comment><USER6> Im cetainly not, iserve, yaws and mochiweb are all "off the shelf" web servers that can handle comet pretty well. I cant believe erlang has the monopoly on lightweight web servers either.

<comment><USER4> Fair enough. Like you said elsewhere on this thread, we're down to defining "off the shelf" now, so I think we should probably call it a day.

      http://code.google.com/p/mochiweb/issues/detail?id=2
      http://www.google.com/search?q=comet+site:http://yaws.hyber.org/
      http://frihjul.net/iserve

Those are the available docs for the technologies you mentioned. Yaws has some real documentation, but not for its Comet implementation. The others give you some source code and tell you to have fun.

So yeah, it's right there on the shelf (how 'bout we settle on "perched on the edge of the shelf?") I'm just not smart enough (or motivated enough) to actually use any of it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This article seems relevant, BTW:

<http://news.ycombinator.com/item?id=334506>

</comment><comment><USER8> SPEED :: In defence of Java, it is very quick when done right. See Kilim[1] for examples.

SUPPORT :: On top of the speed Java has a supported hardware stack (Solaris). So if doing 100K connections is _important_ to you, you can find engineers who can diagnose difficult problems on your whole stack.

\</comment><comment></comment><comment>--

[1] <http://www.youtube.com/watch?v=37NaHRE0Sqw> at 23:23 . Java is quick without Kilim too, this is just an example with stats.

</comment><comment><USER9> Has anyone had any success with orbited?

<comment><USER5> afaik orbited is written using twisted, in python.

</comment></comment><comment><USER10> There was a nice write up on Erlang based Comet apps here: [http://cometdaily.com/2007/12/14/getting-started-with- comet-...](http://cometdaily.com/2007/12/14/getting-started-with-comet-on- erlang/)

Has anybody tried comet using Yaws?

</comment><comment><USER5> Number of open connections is a little bit meaningless until they're actually under load, sending and receiving packets in a real world situation.

I'd agree, Java+NIO is a great system. Extremely fast+scalable.

<comment><USER7> Not knowing much about Java's NIO, how do you handle 'long running calculations'? One of the great things about Erlang is that you can sit there doing some big huge long loop, and it won't block the rest of the system because it's got an internal scheduler. One way to do that kind of thing with C or Java is simply to manually divide your big long calculation into smaller chunks that yield control at regular, brief intervals. Does Java provide anything higher level?

<comment><USER5> What sort of long calculations? If you're doing massive number crunching, you could just have a queue->thread->callback for it if it's not easy to break up into bite size chunks...

I don't know of anything else built in.

<comment><USER7> Ok, fair enough. What's neat about Erlang is that you just write your code and don't have to worry about divying it up, or sending stuff of to a queue. I suppose one possible disadvantage of the Erlang way is if the scheduler is divying resources up equally, you could be 'thrashing' between too many "processes", rather than working your way through a FIFO queue that's going to only work on so many things at one time. But at that point you could just write a queue system in Erlang...

</comment></comment></comment></comment><comment><USER11> <http://www.alexa.com/siteinfo/douban.com>

AFAIK douban.com seems to be the largest (pure) Python site.

<comment><USER12> Douban uses a lightweight python framework called Quixote. <http://www.mems- exchange.org/software/quixote/>

Here's the mail sent about two years back to the quixote users list: <http://mail.mems-exchange.org/durusmail/quixote-users/5657/>

</comment></comment><comment><USER13> Hmm, was twisted not the next big thing that everyone was rewriting their app in? What does he mean, it does not scale?

<comment><USER14> Not a python programmer here and I'm only guessing after a cursory look recently. Twisted developers are layering a higher-level "architecture" over the basic system calls they have wrapped. It's just a few calls down there (serial and scatter-gather I/O, multiplexing, etc.) but twisted adds higher level data structures, and design-patterny conceptual models to shield the pythonista from Unix.

Some of that gotta add some fat; which might be OK for the great majority of the people, but the few who need raw performance might end up cutting some bacon off.

That dude at amix.dk actually knows his stuff.

</comment></comment><comment><USER15> For the non UK people 100.000 = 100,000 or 100 000 if you want the ISO version.

<comment><USER16> We use 100,000 in the UK too - 100.000 is used by some European countries (Spain is one, not sure about the others).

<comment><USER17> FYI, in Norway we use 100,000 for 100 and 100 000 for 100000 (no dots).

</comment></comment></comment><comment><USER18> Interesting. I'm writing a comet server right now, using Ruby's EventMachine. I might do some tests to see how many connections I can stretch it out to; unfortunately I have the feeling that local connections are not going to quite match up to real live outgoing ones.

If I was doing it For Realz™ I reckon Erlang would be the go, still haven't gotten up to anywhere near that level of proficiency though. 37Signals recently rewrote their push server in Erlang and reported great results.

</comment><comment><USER19> Is an actual c++ implementation of the java's nio is strictly better than nginx's one? Is it using epool() and sendfine()? Isn't all those java's abstraction leyers are overhead?

It seems like yet another attempt to put some more air into java's bubble.</comment>