A secure way to store website users "offsite" but still own them. - <AUTHOR> http://autho.me <comment><USER3> With a normal SRP implementation, I'd ask questions like "why aren't you checking _B_ mod _N_ " (you're using Wu's libs so thankfully you're not automatically boned on the server) and "why don't you hardcode _N_ and _g_ so you don't have to check them for safety every time you run the protocol". That's presumably the kind of feedback you're looking for.

But that's all kind a moot point because you're delivering this over Javascript. Making sure _g_ doesn't generate a tiny subgroup, or that _N_ isn't (say) 2 is past the point, because how can a client trust any of this?

You're not delivering the Javascript over HTTPS, but that'd be a fig leaf anyways, because the idea is to embed this in other people's websites. Every one of those those sites would need to load this script on a page that is (a) itself HTTPS, (b) with every page component also delivered over HTTPS, (c) referencing no active content from the site that could have been loaded and cached previously without HTTPS, (d) absolutely free of cross-site scripting flaws. Otherwise, the attacker you are considering when using SRP can trivially snarf users passwords.

Javascript cryptography sucks. SJCL is a very nice library, and it might even be useful in a setting like Node.js, but it does nothing to make content- controlled code a safe place to do crypto.

This system is, right now, strictly worse than an HTTPS login prompt that simply sends a username and password. I don't understand your idea well enough to say whether it can be better than asymptotically as good as that same HTTPS login system.

I get it, by the way. The idea is just "make it easier for sites that are scared by Coda Hale's blog post to implement better - than - <USER2> authentication". But even stipulating that all of this scheme can be made to work securely (I don't think it can): this is an awful lot of moving parts for an awfully small value proposition.

<comment><USER4> Wow, longer than a single line comment. I'm impressed. :-)

I agree totally on all your points, and this still needs work, as I said.

But that age old boogeyman from the 90's of "javascript cryptography is flawed" has to go. It works just fine, and most of the complaints people have you can leverage against any language. Sure, it blows, but the SJCL has really good solutions to many of the encoding issues. After that it's pretty much just as lame as most languages.

Also, your attacks are valid on all existing sites, and I'm not claiming it solves any of those. If an attacker can get to the browser, then you're screwed always. I am not even trying to claim this solves any attack in the browser, and in fact I'm saying that _all_ websites are vulnerable no matter what people use. Even with OpenID I can use evil UI tricks to get your password.

What this is solving is only the problem of people not wanting to setup their own auth system and get it right. It doesn't stop a determined evil web site from abusing it, because no solution would. It doesn't stop an idiot from using it wrong, because no solution would. It just helps them not store passwords, and that's it.

<comment><USER3> I know that serving up ribeyes carved off sacred cows is your schtick and all, but on this issue you're just wrong. Browser javascript is the most hostile environment crypto is deployed in today; it's worse even than microcontrollers that have to use CBC-MAC because SHA1 won't fit in code space. _It doesn't work._

I'm writing up a document about this now, as luck would have it, but in the meantime you could try not taking my word for and instead read Nate Lawson, who is smarter than both of us put together:

[http://rdist.root.org/2010/11/29/final-post-on-javascript- cr...](http://rdist.root.org/2010/11/29/final-post-on-javascript- crypto/#comments)

Here's a hint: it's not about "encoding issues". SJCL is nice work, but SJCL is to a working cryptosystem what mixed oxide U/Pu fuel pellets are to a working nuclear reactor. Don't be like that boy scout who irradiated his whole suburb building something in his garage.

<comment><USER4> You know what Thomas, you're right I'm being douchey. I'll work on making this a bit better, and report on what I find.

Thanks for your comments so far.

<comment><USER3> I had it coming. But for what it's worth: I'm a net admirer of your work. Call me out for being unfair any time, but don't think I'm throwing darts at a Zed Shaw picture on my wall.

</comment></comment></comment></comment></comment><comment><USER5> It's an interesting concept, but I am concerned about the closed-source nature of the project. OpenID and OAuth have gotten as far as they did because they use a verifyable mechanism, all parts of which can be re-implemented and checked at will. Autho.me on the other hand is just asking for the trust of users and developers. I'm not insinuating that the code can't be trusted, but there are issues to be aware of such as very sparse documentation and the risk of investing a lot of work and goodwill in a single, private provider.

<comment><USER4> The source I have is just like the Lua that runs the website. Everything else is standards based and totally open source. As I say in the about page, I'm using:

<http://srp.stanford.edu/> as the protocol, specifically SRP6a but with a SHA256 since I couldn't get a MGF1 to work in javascript. Probably change that later.

<http://srp.stanford.edu/download.html> as the actual implementation. Yes, I'm using that C library.

<http://crypto.stanford.edu/sjcl/> for the javascript crypto, also written by the same people doing SRP.

And you can read the javascript files on the site to see what it's doing.

So, it's based on entirely standards based (even has an RFC) open source protocols and uses implementations from the actual authors of said protocols.

The closed source part is just my lua Tir stuff and whatever else I make.

<comment><USER6> I've collected a few links related to JS cryptography, might be useful: <http://disattention.com/13/javascript-cryptography/>

There is another SRP implementation in JS+PHP: [http://www.denksoft.com/wordpress/web-development/secure- aja...](http://www.denksoft.com/wordpress/web-development/secure-ajax-channel- srp-hermetic/)

We definitely need more SRP implementations, glad to see more people working on it.

<comment><USER3> Clipperz also has a PHP SRP implementation, but it accepts any _A_ = 0 mod _N_ and thus allows people to log in without knowing their passwords, which is a nice feature but maybe not what you want in a secure auth scheme.

</comment></comment></comment></comment><comment><USER7> I created an account for a user with a common name. Obviously, such names will be used up quickly. If a user wants multiple accounts, it would be nice to support realms, so the user portion of the name can be reused. But when I tried "firstname.lastname@example.com" I got an error: _Only letters and numbers in your login._ Any chance of supporting "@" & "." so I can have easy-to-remember logins for different sites/purposes?

<comment><USER4> Sure. I'm thinking it'd probably be up to the site using the service what their login policy is.

</comment></comment><comment><USER8> Hi Zed, I had this idea recently which might somehow be related to yours (or complement it, to be more precise). I was thinking about making various password managers (KeePassX, etc.) work better with web sites and about storing your passwords on your mobile device and use this device to easily log into services (for example when you're away from your PC). So the idea was basically this:

\- show me a 2d barcode (QR-code, datamatrix, whatever) on your Sign-in page;

\- I scan this code with my mobile phone application (or simply use desktop application that takes a screenshot);

\- this application (password manager) makes a request to your service and authenticates me (using SRP);

\- your Sign-in page uses AJAX in the background to check if I'm already authenticated;

\- if the auth process was finished - I'm redirected to login-only area of your site;

So this 2d barcode would contain some kind of nonce that would uniquely identify current Sign-in page (we obviously can't use cookies because we're using different channels).

This whole idea could also make sign-up process much more simple (you could, for example, encode password requirements for your site, and my password manager would automatically generate the password according to these requirements, and would sign me up and record credentials in itself).

Just an idea. I'm not sure if it's viable at all (there might be some hard-to- overcome security issues), it would be nice if you let me know what you think about it.

<comment><USER4> I'd have to look at it more, but I think doing the 2nd factor auth before a simple password auth will have problems. What you really want is they login like normal, but then they get a txt message or use an app on their phone to do the 2nd factor.

2 factor auth though is very much possible with this, actually with any service. I may try to hack that up as a demo this week. Maybe use twilio for it and have it call you. Fun!

<comment><USER8> I wasn't thinking about second factory actually (unfortunately I can't easily express my ideas in English, I haven't made it clear enough). The barcode would make a first (and only) factor. Of course username/password would stay there for backwards compatibility.

Once again, I'll try to express myself more clearly:

\- we show a username/password input boxes and 2d barcode (QR/datamatrix);

\- the user may simply enter his username/password and then everything works your way;

\- he may also choose to use some kind of password manager that is compatible with this protocol;

\- in this case we encode some data in the barcode (it could be some login URL, e.g. [https://example.com/srp/yourservice.com/?nonce=some_random_n...](https://example.com/srp/yourservice.com/?nonce=some_random_number_here));

\- this password manager scans the code and performs full SRP authentication on the above URL; if it's successful we simply send some kind of notification to your service - or you poll our service for the result;

\- we check the result on the actual login page as well (e.g. using AJAX): we may simply poll some other URL, like: [https://example.com/srp/yourservice.com/result/?nonce=the_sa...](https://example.com/srp/yourservice.com/result/?nonce=the_same_nonce_used_above) (of cource results signing/etc. comes into play here);

\- if the result is OK we simply set session data in the cookie as usual and from now on the user is authenticated;

This has additional advantage of the actual crypto going on in the password manager and on the server. It also gives the possibility to perform the sign- up process semi-automatically as well (think of password generation - the user doesn't have to know it at all). And then think of public wifi or other networks you don't trust: you may perform the auth via GSM using your mobile. But the biggest improvement, in my opinion, is the usability aspect. You could have your password manager lying in the background and when you are shown a login page you could simply double-click an icon in your tray area and you are immediately logged into the app. Or you could use password manager on your mobile phone to take a shot with its camera.

I hope this time it's clearer.

<comment><USER4> Hmmm, yeah that's possible, but I'd have to actually implement it and then try to hack it before I could give it any kind of blessing.

</comment></comment></comment></comment><comment><USER9> Zed, you really should jslint your javascript code. Not trying to be overly critical, but it's really a mess- not even sure where to begin- well, I would start by not defining everything in the global namespace. Take a look at "Javascript, the Good Parts" for info on javascript's quirks and best practices or Pro Javascript Design Patterns.

On the more positive side, congrats on releasing yet another useful project. This is definitely an interesting concept.

<comment><USER4> I'll do that, and have read that.

</comment></comment><comment><USER10> I don't understand.

It's "single sign-on", but each individual website stores its own secrets, there's no centralised website, when I want to change my password I have to change it on each website.

OR

It's "single sign-on", but I have to enter my password directly into each website I log in to, and trust that they process it in javascript instead of surreptitiously logging it on their server.

<comment><USER4> I'm not sure yet since I haven't got the API designed, but I will aim for autho.me to be a centralized web service that your clients and/or webservers use to auth people. Most likely you wouldn't even know they're using it unless they choose to tell you.

As for "surreptitiously logging your password", no matter what you do, they can anyway. Just no way around it without handing all your users to some other website, and even then clever UI evil can still trick most folks into giving the password up.

Autho.me would be less about magically protecting you from some imaginary evil site, and more about making it easy for sites who aren't evil to do the right thing with their auth.

But, I still have to figure out how it will really work. This is just a test to make sure the crypto works right.

<comment><USER10> Ah, so it's not single sign-on really. It makes more sense now, thanks.

</comment></comment></comment><comment><USER11> You can tell a website was designed on a Mac when its fonts are nearly unreadable in Windows browsers other than Safari.

<comment><USER12> No need for the snark.

Zed used a cascade of Adobe Caslon, Hoefler, Georgia, Garamond and Times for the body. Good fonts, all of them. Whose fault is it that all except Times render poorly?*

"The crazy colors should tell you that this is only for the brave."

Maybe the same goes for the fonts.

* I checked Firefox, Chrome and IE on an XP3 system. With Chrome's Developer Tools, I removed fonts from the front of the cascade until the type looked "right", and arrived at Times. Bah.

<comment><USER11> Why is there no need for the snark? Do you think there is never a need for snide remarks? _Choosing_ to use fonts that don't render well as your body font deserves contempt! It is bad for the people reading the site, and it's bad for the site owner.

It's neat and all that it's finally possible to use more fonts in webpages, but this is one trend that should be avoided until someone (Microsoft or the browser makers) figures out how to do the text rendering correctly.

</comment></comment></comment><comment><USER13> Nice choice of words. Web sites usually own your accounts, even if the internet is open.

Magazines cater to advertisers by claiming to sell "eyeballs" and carefully picked "readers", while acting all nice to their customers. I imagine websites do the same when it comes to exiting, talking to advertisers, etc.

<comment><USER7> It's not just that. While there is much justified concern about user privacy and security, it's easy to forget that the site also has assets to protect. Giving up control to a third party is a very scary prospect for some organizations.

</comment></comment><comment><USER14> Argh! Well, he managed to get something tangible out first, but I still think I've got a shot with V13.

<comment><USER4> Haha, suck it! :-)

<comment><USER14> My design totally looks cooler though, my mom said so.

</comment></comment></comment><comment><USER15> Pink on yellow. Nice.

On an unrelated note, I'm off to satiate my sudden urge for Battenberg cake.

<comment><USER4> You like that? I was going for a "this shit is crazy" motif. Just to make sure it's clear that it's new and not tested yet.

<comment><USER15> No. It is horrific. You have done your job.

Maybe chuck in a few blink tags.

</comment></comment></comment><comment><USER16> This has existed for some time already - FOAF+SSL. It uses X509 certificates and user owned FOAF files that can be provided by themselves or served from another resource. What's even more cool, is, the user doesn't need to "log in" nor create a "profile" since the cert authenticates the user against their FOAF file and the FOAF file provides their profile and friend connections.

</comment><comment><USER17> Maybe I'm missing some information, but if there was a library for plugging in SRP easily, why would a page want/need to use autho.me to do this? Why not just use the same mechanism locally? (apart from the ability to change the password for multiple services in one place, I'm not sure if that's a great feature really...)

<comment><USER4> It took me a week+ to get this far with it, and it's still not totally right. It is definitely not "easy" to do.

But, I'm thinking the main reason someone would do this is if they wanted to not be responsible if there was a break-in, and to trust a 3rd party who specializes in it.

</comment></comment><comment><USER18> Nice to see someone actually using SRP. And understanding what's actually possible in Javascript (note that Zed very carefully doesn't say that this is "host-proof" or something along those lines.)

<comment><USER3> Help me out here, Joachim, because you know where I'm coming from: what's the setting in which this Javascript SRP implementation could improve things over stock-standard HTTPS login?

<comment><USER4> You'd use both HTTPS and this, as I mentioned before. This just means that a site using the service, if they use it right (big if), doesn't have to worry about password storage or securing them and leaves it to autho.me. Otherwise, everything else is pretty much the same as what you got on existing websites.

<comment><USER3> You read my whole comment. You know you can't just use HTTPS for _your_ part of it; that you have to have clean-room purity for every piece of content that builds any page that ever deals with any of the mechanics of this code.

Everybody who ever thought "oh, I'll just AES encrypt passwords in Javascript instead of using HTTPS" later came up with "oh, then I'll serve just the JS for this crypto off some HTTPS site somewhere" when someone pointed out how crazy that was. It is nowhere near that easy.

<comment><USER4> Like I keep telling you, this isn't any more or less secure than any existing solution because the browser is not secure in the face of an attack. Even with HTTPS if I can inject some javscript then it's a one-liner to get your password.

So no, even with HTTPS and your proposed solution you'd still be screwed.</comment></comment></comment></comment></comment>


Minimal explanation of the CAP theorem - <AUTHOR> http://blog.foundationdb.com/minimal-explanation-of-the-cap-theorem

<comment><USER2> This is a very good explanation actually.

> Pro tip: If an article includes a diagram with a triangle, stop reading

Exactly. I've seen many explanations that try to turn it into a trade-off between three things analogous to the maxim "resources, features, schedule: fix any two and the third must change".

</comment><comment><USER3> > Choosing (C) only requires stopping the machines that got disconnected, not > the whole system!

This post is generally good but I take exception to that statement. Partitions can occur between nodes. If nodes A and B are partitioned from nodes C, D, and E, but they all still receive requests, it's not clear which machines have been "disconnected." Generally you use a quorum of greater than 50% of nodes to decide which nodes should die. It's a more complicated picture than whether the network interface is up or down on the server.

<comment><AUTHOR> Totally agreed that I glossed over how you actually resolve the split-brain scenario and that it's not just about the network interface being up.

There are a lot of options for how to deal with the issue. For example, in FoundationDB, a server needs to be able to talk to a majority of user- designated "coordinator" nodes that are running PAXOS to be a part of the cluster.

</comment></comment><comment><USER4> Unfortunately, this "correction" itself isn't quite correct. "Availability" in CAP doesn't require that _all nodes_ remain up (point 1b) but only that all _non failing_ nodes remain up. The article also fails to provide even a minimal definition of consistency, but those definitions are critical to understanding what Gilbert and Lynch actually managed to prove. Without that, I think this fails Einstein's test.

"Everything should be as simple as it can be, but not simpler"

<comment><AUTHOR> Clearly in 1b a node cannot be up if it is failed--we are talking about the case nodes remaining "up" when they are disconnected. (There aren't many interesting tradeoffs available for completely failed nodes!)

Also, the post does define consistency: "Normally, the system is consistent (a read sees all previously completed writes)."

<comment><USER4> Yes, clearly a node cannot be up if it's failed, and yet you refer to "perfect" consistency and "all" nodes. That's the inconsistency (heh) that you need to fix.

Speaking of consistency, I stand corrected that you did define it . . . incorrectly. That's a definition of consistency, but it's not the operative one when it comes to CAP. Gilbert and Lynch specifically refer to atomic or linearizable consistency in 2.1, and that's a stronger requirement than yours as it also precludes reading still-in-progress writes. The definition of consistency is central to the proof, so if you want to put down others for not understanding CAP it helps to get it right yourself.</comment></comment></comment>


Use Bank Account in Port Rico for Transfers in Stripe - <AUTHOR> Hello everyone, I need to know if I can use a bank account in Puerto Rico like a bank account in Stripe  for transfer of funds?, I have a Delaware Corp., and my local bank allow me to open bank account in Puerto Rico. I'm not from USA. <comment><USER2> Yup, you can sign up with Stripe as a US business if you're based in Puerto Rico. You can get in touch with me at email@example.com if you need help getting started!

</comment><comment><USER3> Stripe support is very responsive to questions: [https://support.stripe.com/](https://support.stripe.com/)</comment>


Snapchat is the social media spring, clothing optional - <AUTHOR> https://medium.com/geek-empire-1/40395957ad8b

<comment><USER2> Not quite that ephemeral: [http://valleywag.gawker.com/heres-how-cops-get- your-snapchat...](http://valleywag.gawker.com/heres-how-cops-get-your- snapchat-history-573064832)</comment>


Do Not Install Your WSL Distro from Microsoft Store - <AUTHOR> https://medium.com/rkttu/do-not-install-your-wsl-distro-from-microsoft-store-a322b94e8e2 <comment><USER2> Nice distro manager and perhaps also the download process could take place within the tool</comment>


Against Big Philanthropy - <AUTHOR> https://www.theatlantic.com/technology/archive/2018/06/against-philanthropy/563834/?single_page=true <comment><USER2> I am not sold either way on the concept of "big philanthropy", but I definitely agree that we should get rid of the charity tax deduction. A big chunk of these funds is money that should have been paid in taxes, rather than directed how the wealthy see fit.

</comment><comment><AUTHOR> A relevant HN comment: [https://news.ycombinator.com/item?id=15024018](https://news.ycombinator.com/item?id=15024018)</comment>


Interactive map of Linux kernel - <AUTHOR> http://www.makelinux.net/kernel_map_intro <comment><USER2> Kind of cool - would be great it the zoom actually was levels of detail though.

</comment><comment><USER3> Very cool - does anyone know how they generated the image map?

By which I mean, was it loving crafted by hand or did they have a tool that could at least create the raw data?

</comment><comment><USER4> It would be nice be able to zoom down to the point where you are viewing the actual source code.

<comment><USER5> You can click on the function names and it opens a tab with the code.</comment></comment>


Dick Costolo: Why tech firms are set to face complex ethical issues - <AUTHOR> http://www.theguardian.com/technology/2015/jul/01/twitter-dick-costolo-jun-granada

<comment><AUTHOR> Pretty uplifting message for a guy's last day on the job...</comment>


TiDB releases version 1.0, finally ready to replace MySQL! - <AUTHOR> https://pingcap.github.io/blog/releases/2017/10/16/ga/ <comment><USER2> The following link is for the TiDB best practice: [https://pingcap.github.io/blog/2017/07/24/tidbbestpractice/](https://pingcap.github.io/blog/2017/07/24/tidbbestpractice/)</comment>


Ask HN: Using .org domain for an educational but for-profit startup? - <AUTHOR> I'm building an educational startup that, for various reasons, works better as a for-profit corporation than a nonprofit.
I own DOMAIN.com and DOMAIN.org. For branding reasons, I'm considering using the .org and just having the .com redirect to it. The .org seems more authoritative and trustworthy to me, especially for an educational startup.
Are there any long-term downsides to doing this? <comment><USER2> The .com seems less misleading to me, because I'd suppose there is a non-for- profit organisation behind a .org domain.

</comment><comment><USER3> I believe Coursera is a for-profit company as well. You might want to ask them why they chose to use a .org domain.

</comment><comment><USER4> I would go with the com. It conveys more authority.</comment>


Show HN: My Shop Heroes – WP Curve for Shopify - <AUTHOR> http://myshopheroes.com/

<comment><AUTHOR> FYI: we built this using the 7 Day Startup method that was used to build WP Curve. We blogged about the whole experience each day: [http://retromocha.com/7-day-startup/](http://retromocha.com/7-day-startup/)

If you are wanting to do a startup and get validation fast, it's probably worth a read.</comment>


Reddit launches image uploads, ditching alliance with Imgur - <AUTHOR> http://techcrunch.com/2016/05/25/reddit-image-uploads/ <comment><USER4> Having a third party host Reddit's images gave away a bunch of control to the point that imgur has its own community based upon the site . At the time Reddit didn't have the resources to make a competitor but this seems to be a good move now that imgur is doing dark patterns.

<comment><USER5> What dark patterns are they implementing?

<comment><USER6> "direct" links to an image uploaded sometimes/usually redirect to imgur page, with lots of ads and shitty content, obnoxious, animated overlays that block out part of the image on mobile, etc

<comment><USER7> None of that is a dark pattern.

A dark pattern is an UI design that motivates users to use the program/site in a way profitable to the site, but contrary to users' interest. To trick people, see [http://darkpatterns.org/](http://darkpatterns.org/). Redirecting to the whole page instead of the link is just a hotlink protection (as debatable as that is for an image hoster). Animated overlays in mobile is just shitty advertising and UX. But no dark pattern here.

I saw that multiple times here on HN now that people misuse the term. It's a pity, the original idea is something to be aware of, and diluting what dark pattern means hinders that awareness.

<comment><USER8> Having links that used to be hotlinks no longer be hotlinks is a dark pattern; also URLs that look like hotlinks (ending in .jpg or similar) but aren't. I'd argue that serving ads sometimes but not always is a dark pattern (particularly if they use cookies or similar to never serve ads to the original uploader).

<comment><USER7> Again, no. A dark pattern is an UI that makes the user do something he does not want. The best example is linkedin trying to get people to spam their contacts with invites. The pre-checked "subscribe to the newsletter" checkbox is a dark pattern. Same is the checkbox you need to check to _not_ subscribe to the newsletter.

A hotlink is no user interface, changing its behaviour is not a dark pattern. Serving ads never is one (though ads itself can use dark patterns), regardless whether the uploader sees them or not. Those are different kind of tricks that have ( _edit:_ almost) nothing to do with what the term dark pattern describes.

 _Edit:_ I'd argue that links that used to be hotlinks not being hotlinks can maybe be part of a dark pattern. If an UI tried to get people to share a site, and the people do that only because they think the links are hotlinks, then that UI could be a dark pattern and the non-hotlinks a part of that. But the dark pattern is then the UI presenting the hotlink, the "share this image directly" widget, not the hotlink itself.

<comment><USER8> > Edit: I'd argue that links that used to be hotlinks not being hotlinks can > maybe be part of a dark pattern. If an UI tried to get people to share a > site, and the people do that only because they think the links are hotlinks, > then that UI could be a dark pattern and the non-hotlinks a part of that. > But the dark pattern is then the UI presenting the hotlink, the "share this > image directly" widget, not the hotlink itself.

I'd say the URL itself can be UI - users know what a URL to a direct image looks like and how that differs from what a URL to a page tends to look like.

<comment><USER7> That does not matter. An URL alone does not entice users to do nothing. You need more to get a proper dark pattern, to get the "convincing the user to do things" part of the definition of what makes something a dark pattern in the first place. Please, look as well at the website [http://darkpatterns.org/](http://darkpatterns.org/) to see what a dark pattern is about.

<comment><USER9> So you're saying if it's not on that website it's not valid?

Come on.. If I see a URL that ends in JPG, my understanding is that I am about to load an image. If the site then shows me a page full of ads with my image somewhere on there, that's _exactly what you described_.

The site is tricking me into doing something that is to their benefit and to my detriment. Showing me a URL that _looks like a link to an image_ is absolutely encouraging me to do something. It's telling me "hey click here you'll see the image right away"..

I did not want to see a page full of ads, I wanted to see a single image, but now the site has monetized me without my consent.

It feels like you're arguing for argument's sake here.

<comment><USER7> One last try. I'll stop then.

If you are really arguing that you are inherently more likely to click on the direct link, and it is this click impulse that is used to manipulate you, and that going to a page containing that image plus ads instead is the big negative outcome, then I understand why it is a dark pattern for you.

I did not see that direct link have a higher affordance (that might stretch the term a bit too much) to be clicked on. I still don't – but if you think that there are people that are conditioned to click on those direct links, but would not click on the normal link, then I'll have o give you the point that the heuristically changing of the result page might be a dark pattern for those people.

I'm not aware of that effect, but I can't be sure that for example on reddit for people without adblocker or on mobile for some time the direct link wasn't a positive click signal that conditioned them.

I think that explains why I'm arguing. Dark patterns are a manipulation, and simply showing another page is not something I can count as a manipulation – it is not the same thing as in a window making people click on the wrong button (even though I understand that there is a similarity if you follow a specific line of thinking).

<comment><USER10> Direct link is a significant "positive signal" for the following reasons:

\- you implicitly expect it won't load _code_ to your browser

\- you implicitly expect it will serve the one and _only_ one resource that you need

\- you implicitly expect that after receiving the resource no further data will be exchanged between the client and the server

\- you implicitly expect it will work well with the standard UI of your viewing platform - for instance, it will be pinch-zoomable on mobile, or zoomable with mouse in desktop browsers

\- you expect to work well with applicable context; for instance, a direct image link should work in "href" attribute of "a" tag (resulting in an image being embedded on a website), it should work with curl or wget (resulting in a single image file being created on your hard drive), or just browser's "save" feature (again, resulting in a single image file being created)

I'd call breaking these things a dark pattern. A particularly nasty one at that, since it's poisoning the well. Breaking users' trust in that URLs do is one of the many subtle ways of fucking the Internet for everyone for personal profit.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Imgur forgot its roots as a dumb image host, rapidly crufting-up its service with things that were not only annoying but _interfering with its basic function_. If you _can't_ easily see an image as soon as you click on it — on mobile or otherwise — then the image service has completely failed.

The sad thing is, they could have added non-intrusive ads. DaringFireball does it; write a single line of text such as "This image brought to you by FooBar, Inc." and SHOW THE LINKED IMAGE. No pop-ups, no tricks, no obscurity; ad+image, done.

<comment><USER12> "Daring Fireball does it" has to be the worst possible comparison imaginable. Gruber has super differentiated, high editorial value content that folks will pay a premium to put their message next to. Imgur is about as far away from that as possible. They have to try to make money, it's crazy to sit here and think you know better than they do on this. Don't you think if they could make enough money doing what you think, they would do that instead? They are in a tough industry. They host images (relatively expensive), they have almost no user information for targeting, most visitors never come back to a page again, and most of the content posted is super low value. Unfortunately, this is the result.

<comment><USER13> I wish an image service existed that did some image recognition on the picture and provided you with relevant, but subtle 'Learn more about this thing' links.

<comment><USER14> Or even links sending you to the original source of the image (comics especially)

<comment><USER13> Hey, yes! If reverse image search is possible now, it should be easy to automatically give credit to original creators, connect them with audiences and bypass blogspam!

<comment><USER15> How would you determine which reverse image search result is the original content creator? Just curious.

<comment><USER16> Finding the oldest image would probably work for most cases, as long as you found every instance of the image on the internet.

It might work ok for some of the larger comics/image producers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> It seemed like Imgur has been getting ready for this for awhile. The experience using it hasn't been that great since direct linking stopped working on mobile.

<comment><USER18> Last time I've opened an imgur link on mobile I got served with an ad popup and a "virus warning" dialog. That is something I haven't seen in a long time. Imgur seems to go the way of SourceForge.

<comment><USER19> This seems like a common pattern

1\. Realize you need to make a lot more money (to meet investor expectations, pay for the fat the company has accumulated, etc)

2\. Panic

3\. Apply dark patterns ([http://darkpatterns.org/](http://darkpatterns.org/))

4\. Something better comes along and eats your lunch

5\. Repeat.

It's sad because imgur was originally created as the "something better".

<comment><USER20> I'm sure they made mistakes but when you see massive growth like imgur did someone's gotta pay the sever bills somehow. Plenty of image uploading sites have come and gone because of server costs.

<comment><USER18> Dear lamb, we had a great time but now I have to eat.

</comment></comment></comment></comment></comment><comment><USER21> > At this time, the Reddit community can still choose to use Imgur or other > sites for image hosting.

The fact that they used the phrase "At this time" makes it sound like they are planning to disable external image links in the future.

<comment><USER22> Or just convert all image links automatically. Some websites do it.

<comment><USER23> There can be very good reasons for this. Gmail, for example, rehosts embedded images with google to protect users against invisible pixel trackers.

</comment></comment></comment><comment><USER24> Looks like it's backed by S3

      x-amz-storage-class: REDUCED_REDUNDANCY
      Content-Type: image/jpeg
      Server: AmazonS3

Can't imagine that AWS bill...

<comment><USER25> What are some better alternatives to s3?

<comment><USER26> Colocation hosting your own servers around the world... you know, the original way.

<comment><USER27> Is that really cheaper than S3, though?

<comment><USER28> Even at Amazon's cheapest posted bandwidth tier you're paying $50+ per terabyte for bandwidth.

Any dedicated hosting company (OVH, Hetzner, etc...) will cost less than 3% of that (and that's on the high end).

Bandwidth is cheap, but AWS marks it up roughly 30x-50x what you'd pay in a dedicated environment.

<comment><USER29> Then why isn't anyone running an AWS-like service focused for bandwidth- intensive applications hosted on "OVH, Hetzner, etc..."?

<comment><USER28> Many people do. S3 is convenient though. It handles durability, replication, uptime, etc... and even with the insane markup on bandwidth many startups / companies can afford a $10k/mo bandwidth bill because it's cheaper than hiring some devops and a team to build out the appropriate infrastructure.

<comment><USER27> That's what I meant with " _really_ cheaper". Sure, bandwidth costs are lower with Hetzner, but that's not everything.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> Here's a thread that led to people's hate of imgur: [https://www.reddit.com/r/iphone/comments/46cjo5/i_just_want_...](https://www.reddit.com/r/iphone/comments/46cjo5/i_just_want_to_say_fuck_imgur_for_overpowering/?ref=search_posts)

It was really annoying on mobile.

<comment><USER31> The hate seems to go both ways. Imgur community dislikes lame images from Reddit appearing on Imgur front page and would like them to go away.

<comment><USER32> That's funny, when the quality of imgur images and comments is similar to that of 9gag and reddit itself.

At least on the default subs of reddit you can find a handful of good comments if you only read the parents. If you go to the children, they all become obnoxious.

</comment></comment></comment><comment><USER33> Searched this entire thread and no mention of DMCA or Safe Harbors. Linking to a 3rd party is good to avoid worrying about that sort of stuff. Not that I'm an advocate for illicit rehosting, but just commenting as an observer.

It gets briefly touched on at the very end of the article, but self-hosting may carry with it a whole lot of extra work to avoid getting a big bullseye painted on the company. I'm sure more than a few content creators - <USER2> in the adult business - have their lawyers on speed dial. Will be interesting to see how this plays out.

It's not just a PR thing, it's a _legal_ thing.

<comment><USER34> Wouldn't this give Reddit more control though? If the files are hosted somewhere else they have to rely on that service to handle takedowns. It means they can still show up all over Reddit and to a lot of users come across like Reddit is hosting them; speaking from the stand point of your average user, not Reddit/HN user.

I would imagine Reddit wants to have control and be able to more quickly take down things versus waiting for moderators to automod or manually remove posts.

<comment><USER35> Reddit having more control and being able to take things down may be a mixed bag at best as far as many users and mods are concerned.

A lot of users are very twitchy about anything that even hints at censorship right now.

</comment></comment></comment><comment><USER36> When you're growing as fast as Reddit was, you don't change the recipe, you just keep cooking it. They already had the ingredients for exponential growth, so change in general just introduces unnecessary risks. They had no need for a larger exponent.

The outcome of that is:

-Alien Blue beat Reddit to mobile optimization of Reddit's own platform

-Imgur beat Reddit to sharing images on Reddit

-Reddit and Imgur now exist as pseudo-sister-sites with features that overlap on a fundamental level, and Reddit is cannibalizing its own equity in Imgur

Now that they can't just hire site reliability engineers and watch their graph go up like a volcano, their only play is to improve their product, but now they're running uphill.

I think it's generally correct to play it safe and maintain organic exponential growth if you have it, but when it comes to things as obvious as mobile optimization and image sharing, maybe it's ok for a company to come out of their shell and iterate on obvious stuff (even though they don't have to).

</comment><comment><USER37> From 2014 When Imgur took $40MM in Funding : [http://techcrunch.com/2014/04/03/after-five-years-of- bootstr...](http://techcrunch.com/2014/04/03/after-five-years-of- bootstrapping-imgur-raises-40-million-from-andreessen-reddit/)

"In addition, the Reddit investment will finally formalize the already friendly relationship between the two sites, making them more symbiotic and maybe even more integrated in some way, though Schaaf declined to go into details as to what's ahead for the two, only saying that there's no promise of Imgur being Reddit's "official" image host at this time."

</comment><comment><USER38> The imgur hate in here is odd. It seems like people are just assuming the worst based on one critical comment thread that got turned into a techcrunch article. Which is understandable, I don't understand how they can offer a free unlimited image hosting site (and they've offered it for so long that, well, you can see the backlash they got when direct linking is taken away). Still, their management seems savvy enough to know that they would have to carefully manage that change.

There's at least two distinct types of imgur users, those who only use imgur as an image host and "imgurians." The huge usage numbers come from the former while the actual value (IMHO) is in the unpaid labor of the latter group (like most social media). That means imgur can piss off their freeloaders as long as they don't upset their community, but this is really no help at all because the community is far more critical than the freeloaders. Freeloaders don't care about imgur's community drama.

<comment><USER39> People who have negative opinions of things you clearly like often found those opinions in experiences you are unaware of. My opinion on Imgur involves eight years of context, remembering pre-Imgur Reddit as well as Quickmeme, watching Imgur rise and fall, observing the psychology of i.imgur.com leading to upvotes of Reddit, knowing a pretty religious Imgurian who goes to meetups, etc.

However, because I disagree with you, according to you I reacted to a TechCrunch article; there's no better way to get me running to share that opinion than by poisoning the thread with the assumption that naysayers are misinformed or oblivious.

Assume people are informed and you'll end up on the right side of disappointed when they aren't, instead of being embarrassed when they are.

<comment><USER38> I would very much like to be informed of those opinions, hence my post, although apparently not in a mild enough tone to avoid a scolding.

Regardless, I'm a daily user on a variety of platforms (mobile w/o adblock being one of them) so I am confused that I haven't encountered the highly annoying behaviors people are describing: direct image links being hijacked or super annoying browser-highjacking mobile ads (which I have run into in the past). If I had then I would be rightfully pissed as everyone else seems to be.

</comment></comment></comment><comment><USER40> I don't know why reddit would want to take on the burden and cost of dealing with images. It might make it incrementally easier, but with something like RES the entire thing was seamless. Seems like a misplaced focus on a feature that doesn't bring that much value, and a lot more cost. I'll be curious to see how successful this ends up being. If they wanted to concentrate on making the site easier to use, they should have hired the people who made RES.

<comment><USER41> Reddit basically needs an image hosting service to succeed, and Imgur is now at least as obnoxious as all the previous generation of hosts that lead to it being created in the first place

<comment><USER42> While I agree with Imgur being obnoxious and a far cry from their early days, they are not as awful as the previous de-facto image sharing site - <USER3> it was with the green frog as their mascot.

<comment><USER43> Do you mean imageshack? It's exactly like that.

Though imageshack's biggest crime was delete everything (maybe except stuff from paid accounts) at one point in time.

<comment><USER42> Yup, that was it. Thanks for the name reminder.

And I still stand by my earlier statement: Imgur has declined, but they have not yet stooped to the level of end-user abuse shack did. (Granted, hijacking direct image URLs is sleezy as hell.)

Imageshack made even uploads a chore. Sure, picking the image from _your_ drive was easy - but then they made every attempt possible to force their inline branding into all inbound links.

Getting a hot-linkable image from shack uploads required extra effort. _And_ they tried to trick you into using their quality-degraded downscaled versions everywhere. It was dreadful. I even remember couple of cases where after the upload there was _no_ way of getting the image link out. At all. All you got was a 80x80 thumbnail and a link to their shitty pages where you could, MAYBE, view the image. (Which was, of course, downscaled and further compressed. The original was gone.)

So no, as far as I am concerned, Imgur has not yet reached the imageshack abusement park level.

</comment></comment></comment></comment></comment><comment><USER44> Spotted this was happening nearly two months ago - surprised it's taken the tech blogs a while to cotton on

[https://news.ycombinator.com/item?id=11453224](https://news.ycombinator.com/item?id=11453224)

<comment><USER33> Nicely put; cool to read the tea leaves, so to speak, and see the outcome unfold. Good call.

</comment></comment><comment><USER45> I bet Reddit will finally be blocked in China because of this. Imgur has been blocked for years but Reddit's never been blocked.

<comment><USER46> s/China/<every large company on earth>/

</comment></comment><comment><USER47> It was inevitable. Not because of imgur going bad (did they? They did take some questionable moves regarding direct image links, but can't blame them considering volume). It's because of ye olde adage here on HN. If you your business relies on someone else, be prepared for their moves (to not use harsher words). Large volume of popular reddit-submitted content is imgur based. They have to get (back) that under control. Smarter move would be to outright buy or merge with imgur, considering their content and user base, but that probably have been considered.

</comment><comment><USER48> I think it'll be the same when StackOverflow introduced snippers and everyone thought JSFiddle would fade away because of it... In reality there was zero impact on the traffic from SO.

I'm pretty sure the same will be for Imgur.

</comment><comment><USER49> The community on Reddit can get pretty salty at times, but the open ugliness of Imgur comments gives "vintage YouTube" a run for its money.

<comment><USER50> It's a shame because there was a few months where Imgur was brilliant.

</comment></comment><comment><USER51> Can reddit clone the pics previously uploaded on imgur or does it have its eggs in someone else's carriage?

<comment><USER52> The announcement Reddit thread contained a Reddit employee mentioning that they already have a cache of the majority of Imgur images because they've been using it to create thumbnails Reddit displays alongside the headlines.

Apparently they've been storing the full size images too and not throwing it away after creating thumbnails (wise move).

</comment></comment><comment><USER53> Turns out a S3 bucket in itself isn't a website.

<comment> shawn-butler Fairly easy to serve a static website from a S3 bucket...

[http://docs.aws.amazon.com/AmazonS3/latest/dev/HowDoIWebsite...](http://docs.aws.amazon.com/AmazonS3/latest/dev/HowDoIWebsiteConfiguration.html)

<comment><USER53> My point was supplying an S3 bucket as a service, and putting lipstick on it to make it look like a website isn't valuable in the long term, on its own.

</comment></comment></comment><comment><USER54> Bad news for Imgur...

<comment><USER18> Bad news for the current shareholders of imgur.

All we want is an easy and reliable image hoster. You upload an image, they host it, you can link it, fin.

Perfect plan!

Except for the plot hole of not generating any money this way. That's where the suits creep in. First they finance you to grow and grow quickly you must. Imgur did it. Then you experiment with some methods of generating ad views or other revenue. People realize they hit on a gold mine and business starts to grow like cancer. Then there are some minor changes to optimize revenue. Then some founders start to cash out and jump the ship. Then the suits, loudmouths and ginas slowly but surely take over the company and due process replaces the dictatorship of the personal union of owner and leader. There's guitars and barbecue as the corporate drones dance around the firepit of burning money as they hurry to please the gods of corporate capitalism. A spiral is forming like a siphon circling around itself pulling everything in like a black hole. And it's great.

If you listen carefully in the storm of excitement you can hear a faint voice who still remebers the core of the business: _Provide the service and don 't fuck with the customer._

Or as some politicians said: You can fuck over some of your customers all the time and you can fuck over all of your customers for some time. Both is a great business plan. But you cannot fuck over all of your customers all of the time. Especially not if you don't have a stranglehold on their necks like a dictator or monopoly has.

The imgur we have today deserves to die.

It may redeem itself by remembering its roots and not wanting to become more than it is. That would be great!

One thing that is more important over the whole debacle is to watch reddit closely and be ready to jump ship quickly as they stumble deeper into the corporate trap. Having a plan B "just in case" for everything important will cost you resources but it pays out for itself in the long run.

<comment><USER55> >If you listen carefully in the storm of excitement you can hear a faint voice who still remebers the core of the business: Provide the service and don't fuck with the customer.

The people looking at images for free are NOT THE CUSTOMER.

Hint: the customer pays for service.

</comment></comment></comment><comment><USER56> I'm surprised one of the big companies (Facebook, Google, Microsoft, Amazon), or one of the world's governments doesn't start up a simple image hosting site with direct linking, and foot the bill in exchange for tracking everyone, and having more of the world under their umbrella, visiting daily.

I'm assuming those companies also have the infrastructure to reduce bandwidth expenses, and they could accept the loss in the short term, to have a well established service and community for when imaging hosting becomes more profitable in the future.

A simple image hosting service is relatively quick to develop, and it's almost guaranteed to be one of the most used services on the internet. Why are these companies wasting hundreds of millions of dollars on all sorts of failed projects, when they could easily win this market?

<comment><USER57> Hosting an image site means you're responsible for its content. That means you need to have some policy for dealing with all the copyright infringement, child porn, racial hatred, leaked celebrity nudes, shock images, etc. It's a potential lightning rod for brand damage.

Note that all of Facebook, Google, Microsoft, & Amazon already allow you to host your own photos but aren't used in this way.

(Everyone has more or less given up on copyright enforcement for images, possibly because there's no central enforcement mafia, but that doesn't mean it's not still the law)

</comment></comment><comment><USER58> I think this is a good move. Imgur got used only because it was convenient and that it didn't have any stuff brewing around the service. That it was created by a redditor probably also helped. Now it is a service with a lot of stuff going on around it, and a competitor to Reddit in a sense, being its own community oriented around discussing trending topics or creating memes.

Since Reddit has their own service for this now, hopefully they can use their revenue to keep it clean and at least reasonably ad free and focused on its simple mission. If that can happen, I think this is a step forward from what Imgur has become. Not anything bad per se if you want a different community, but not optimal if you already are on one and just want to view the pictures.

</comment><comment> tech-no-logical and it uses cloudflare, so browsing for pics gives me another gazillion captchas because I'm on a vpn. well thanks al lot...

at least imgur didn't use cloudflare.

<comment><USER59> This is the life you have chosen.

</comment></comment><comment><USER60> No matter where your personal beliefs put you on the subject, Reddit has been taking a lot more interest in the quality and nature of its content lately. This means subreddit bans, shadow bans, and similar activity. I wonder if this will see an increase once Reddit has complete control and monitoring over its Image hosting. It also opens them up to DMCA and other complaints.

From an engineering perspective Reddit had frequent crashes and severe lag for years. They've improved a lot in the past two, and seeing them confident enough to launch a service like this says something about their progress in that regard. However I could see it be a complete flop as well. Time will tell.

</comment><comment><USER61> Viewing images on reddit has always been broken. Without RES (Reddit Enhancement Suite) the UX on the site is horrendous. And even with RES, images not hosted on imgur wouldn't work most of the time.

It was so bad I took on myself to aggregate images from /r/funny and put them in a mobile friendly and fast website. [http://www.pixpit.com](http://www.pixpit.com)

unfortunately every time I tried to talk about it on reddit, they deleted it.

<comment><USER62> Quite this.

I use reddit more-or-less as a blog ([https://dredmorbius.reddit.com](https://dredmorbius.reddit.com)). What I particularly like is the extended community, Markdown, mod tools, Wiki (though it's underpowered), search (though it's posts-only, no comments), and, through RES, some nice features for composing, and viewing images in posts.

But that last applies to a _very_ small subset of readers. And as I make a fair bit of use of images (to illustrate and document points in my essays), that's a considerable pain point.

Ello, whilst lacking many other features, and having broken Markdown (notably: no blockquote support), _does_ have phenomenal image support.

Other options are fairly thin, though Medium might be worth another look.

</comment></comment><comment><USER63> [https://docs.google.com/spreadsheets/d/1kh1TZdtyX7UlRd55OBxf...](https://docs.google.com/spreadsheets/d/1kh1TZdtyX7UlRd55OBxf7DB- JGj2rsfWckI0FPQRYhE/edit#gid=0)

There are and have always been plenty of simpler alternatives with a variety of features. I stopped using imgur when direct links stopped working.

Personal fav: [https://uguu.se/](https://uguu.se/)

</comment><comment><USER64> doesn't reddit have a stake in imgur? [http://techcrunch.com/2014/04/03/after- five-years-of-bootstr...](http://techcrunch.com/2014/04/03/after-five-years- of-bootstrapping-imgur-raises-40-million-from-andreessen-reddit/)

</comment><comment><USER65> Of course Imgur could take revenge by breaking all images that are still linked to from Reddit.

Did Reddit make backup copies?

<comment><USER66> This exact thing happened with Something Awful and some other image host.

</comment></comment><comment> yc-kraln I posted a version of this comment seven years ago in the original reddit launch thread for imgur: I have server resources and happy to host any reasonable attempts to make a quality image host, that have a (to me) valid business plan.

<comment><USER67> How can I contact you?

</comment></comment><comment><USER68> This is what you get for relying on someone else's centralized platform.

</comment><comment><USER69> > I saw that multiple times here on HN now that people misuse the term. It's a > pity, the original idea is something to be aware of, and diluting what dark > pattern means hinders that awareness.

Sorry long post TL/DR Fighting people on word definitions is frustrating and words change meaning when one aspect gets popular.

I have fought this war over and over again over the following words:

Troll - Everything is a troll now. It use to be just someone that tried to ruin other people's fun. Now if anything that makes anyone laugh is a troll.

Hacker - This site is case in point. Hacker was a person who would make inventions with pieces that didn't normally get take apart and put back together into something different then its original intent. Then it became criminals. Now it's start up coverage websites were if you use terms of Hackers of long gone days (i.e. M$) you get down voted for being unprofessional. :)

Humanism - Means Atheist? Humanism was founded by the leaders of the Renaissance and the Reformation Movement Leaders would self-identify as Humanist. I went on a 5 day Reddit AMA with the President of the American Humanist Society (Secular Humanist) saying they can't hijack the word and change its meaning.

Humanism and related terms are frequently applied to modern doctrines and techniques that are based on the centrality of human experience. In the 20th century, the pragmatic humanism of Ferdinand C.S. Schiller, the Christian humanism of Jacques Maritain, and the movement known as secular humanism, though differing from each other significantly in content, all show this anthropocentric emphasis. [http://humanism.ws/featured/a-history-of-humanism- robert-gru...](http://humanism.ws/featured/a-history-of-humanism-robert- grudin/)

<comment><USER70> We detached this subthread from [https://news.ycombinator.com/item?id=11776314](https://news.ycombinator.com/item?id=11776314) and marked it off-topic.

<comment><USER69> Well maybe this is the wrong place for actual communication and talking. I really see "Hacker" News as less hacker and more Start Ups trying to look professional.

</comment></comment></comment><comment><USER71> > One last try. I'll stop then.

This is the least believable thing you've said.

<comment><USER70> No nasty swipes on HN, please.

We detached this comment from [https://news.ycombinator.com/item?id=11778568](https://news.ycombinator.com/item?id=11778568) and marked it off-topic.

</comment></comment><comment><USER72> Maybe I'll turn out to be right after all.</comment>


Todos: a Backbone.js example Single-Page-App (with LocalStorage) - <AUTHOR> http://documentcloud.github.com/backbone/examples/todos/index.html

<comment><USER2> A little backstory...

With the help of jashkenas, I created this app to test my implementation of Backbone.js for MooTools (<http://github.com/jeromegn/backbone-mootools>) and my localStorage adapter (<http://github.com/jeromegn/Backbone.localStorage> for those interested). It just so happened that jashkenas had been aching for a decent example app, so he reported it to jQuery and included it in the repository.

My own version of this demo is available here (with an extra sorting feature, and built on MooTools) <http://localtodos.com/> (source: <http://github.com/jeromegn/localtodos>)

Hope you like it.

<comment><USER3> Can you describe your experience with backbone? Now that you have built an app with it, do you recommend it? Or perhaps wait till it matures a little?

<comment><USER2> Since I'm no programming nor javascript wizard, I needed some help from Jeremy. I know my way around MVC since I've been doing some Ruby on Rails in my time.

My experience with more advanced Javascript is with MooTools, so I found it familiar to build Class-like objects. I rather enjoyed the experience and I'll be using it to replace the codebase for my more complex project.

The documentation is exhaustive and with that example app, annotated et al., it's even better. I also am very confident in Jeremy's skills as the project maintainer, he helped me a lot and has proven he creates great Javascript libraries.

The API seems stable enough. From Backbone 0.1.2 to 0.2, there weren't that many differences in the API, mostly nice additions.

</comment></comment></comment><comment><USER4> That annotated source is a thing of beauty.

<comment><USER5> jashkenas has single-handedly redefined literate programming for me. I've always considered it somewhat useful, but never very practical until seeing his annotated sources.

More examples:

Underscore: [http://jashkenas.github.com/coffee- script/documentation/docs...](http://jashkenas.github.com/coffee- script/documentation/docs/underscore.html)

Backbone: <http://documentcloud.github.com/backbone/docs/backbone.html>

CoffeeScript: [http://jashkenas.github.com/coffee- script/documentation/docs...](http://jashkenas.github.com/coffee- script/documentation/docs/grammar.html)

I believe they're all generated with Docco: <http://jashkenas.github.com/docco/>

<comment><USER6> same! there is also a docco fork on node called dox. <http://github.com/visionmedia/dox>

ever since seeing Dox I have made a much larger effort to essentially create a reference for everything I write (in a perfect world this would be a given).

</comment></comment></comment><comment><USER7> This is really nice and lightweight. Kind of a Backbone.js => Sinatra, as SproutCore => Rails. I mean, checkout SproutCore's Todos tutorial (<http://wiki.sproutcore.com/Todos%C2%A0Intro>)

</comment><comment><USER8> More than anything else, javascript programmers need a way to structure large codebases. Very few frameworks (including backbone.js) help with that and the build process of complex RIAs.

That said, I do like the simplicity of backbone.js.

<comment><AUTHOR> In my opinion, the build process of a JavaScript application should be a separate thing from the libraries you choose to make it with.

That said, we (DocumentCloud) have also open-sourced Jammit -- the library we use to build JS, CSS, and JS templates into asset packages for production:

<http://documentcloud.github.com/jammit/>

Here's a screenshot of what it looks like to have a bunch of Backbone Models and Views that will get Jammit'd into a single file at deploy time:

<http://cl.ly/803f3e67692572d76abb>

</comment></comment><comment><USER9> Thanks for the great example. I'm already using Backbone.js in a project, it's a beautiful piece of code (along with underscore.js). One small thing, wouldn't it be better to create a new application specific namespace instead of adding so many globals ?

<comment><AUTHOR> Yes -- a single hidden namespace would be cleaner, but then you miss out on all the fun of playing around with this stuff in the console! Here's some one- liners to try with a full Todo list:

        Todos.pluck("content");

        Todos.first().toggle();

        Todos.last().clear();

</comment></comment><comment><USER10> Funny, I created something very similar couple days ago based on rocket.js: <http://github.com/k7d/rocket_todo>

(only it uses web SQL DB instead of local storage)</comment>


Amazon rolls out a social network for Kindle - <AUTHOR> https://kindle.amazon.com/

<comment><USER2> The biggest problem with this is that my wife and I share our Amazon account. Although we have our own Kindles, we use the same Amazon account because we're not going to buy two copies of every book that we both want to read. If we had to do this, we would probably buy the paper version. So, my "stats", highlights, and my account information include everything she has done with her Kindle.

Until Amazon lets us have separate accounts (or somehow separate our reading), this will be relatively useless for us. We can't even separately rate books, or mark books as "hope to read", "reading", etc. and we're not going to buy double copies just for that purpose. I suspect this is the same for many others.

<comment><USER3> why don't you just strip the DRM on the books you buy? It won't help with the social network stuff because Kindle doesn't "see" the stripped versions of the book, but it would allow you to have two accounts for the purposes of 'hope to read', 'reading', etc

<comment><USER2> These comments are specifically about the "social network stuff" and my point is that Amazon's "social network" is useless to me because my wife and I are required to share the same Amazon account if we don't want to double purchase Kindle books.

What benefit would stripping the DRM of the books we buy bring us? We can currently read the books on both our Kindles (allows up to 5 devices), we just can't separate our accounts. How would we get our DRM-stripped Kindle books to show up on separate kindle.amazon.com accounts (putting aside the hassle of not being able to just directly download them on our Kindles)?

</comment></comment></comment><comment><USER4> It's been out for a while, and although it's really promising, a large number of obvious features are completely missing. For example there's no RSS feeds of a user's activity and there's no "per-book" pages (it'd be nice if you could point friends to a page that shows your review of the book, plus the passages you've highlighted/noted). There's a list of books you own, but there's no way to search the list. Also, the "Daily Review" feature is broken (I get the same book every day).

I think it could be a really useful site if Amazon would invest in it a little. But it seems as if they've given up on it, since nothing seems to have change since the site was launched. (Also, I haven't seen any review mention it, so perhaps people don't care.)

</comment><comment><USER5> Why does everything have to be social? Reading for me is a profoundly private experience. I get away from the world, I get away from people, and I sit alone and read. It's a way of relaxing and refreshing myself without worrying about the kinds of things that Amazon is attempting to inject into the Kindle with this.

<comment><USER6> I think the actual reading is a private experience, but finding what to read next is often a social experience.

<comment><USER7> Yes, I don't want anyone talking in the cinema while I'm watching a film, but I may want to talk about it afterwards.

</comment></comment></comment><comment><USER8> I'd rather they released their SDK publicly instead of this. It has been in beta for a year now, I think.

<comment><USER9> No kidding. And it seems to be a _very_ private beta. I'd _love_ to write something for a Kindle, I'd run out and buy one in an instant if I could, but they've been dragging their heels for a very long time. Heck, I wouldn't even mind if the entire system changed every couple months, breaking API changes and all - _something_ is better than nothing.

</comment></comment><comment><USER10> I have yet to try out any book-reading software, but this looks like the killer social app that will convince me to choose Kindle rather than Nook. If the new Google book reader links tightly with Google+, as one would expect to happen soon, then I will commit to the Google product.

(I still read books the old-fashioned way, and my house is decorated in the Industrial Bookshelf style. One of the things I like best to do online is to discuss books and the ideas found in them.)

P.S. Thanks for the reply about Goodreads. I was an early adopter of Goodreads, starting an account at the suggestion of a friend in another state, but I stopped using it right away, because of its somewhat tedious interface, and no longer trust Goodreads at all since I saw Google results from searches on my name that included spurious Goodreads pages that appeared to promote books that I've never read. (I ego surf on the major search engines from time to time precisely to see what spoofing is being done in my name. I reported the Goodreads fake page problem to Google last year.) I do have friends who still like Goodreads a lot, but I'm thinking a tighter integration with an ebook reader has to be a beneficial feature for an online social network, and vice versa.

<comment><USER11> There is also <http://www.goodreads.com/>, a feature packed (maybe too much) and a generic (as in not tied to any reading app/device/mode) ... how shall I put it? reading management solution with a social flavour to it.

</comment></comment><comment><USER12> I wonder why Amazon decided not to incorporate Kindle support into already existing Shelfari [1], which seems to have much prettier UI and bigger user base.

[1] <http://www.shelfari.com/>, Amazon's social network for readers

<comment><USER13> Amazon seems to take a hands-off approach with almost all of their acquisitions.

</comment></comment><comment><USER14> This has been out a while and I always thought it had a lot of potential, but they haven't really pushed it.

One barrier to more use of the service myself is their URL strategy. I don't know my own link and, in the past anyway, it wasn't easy to navigate to my profile.

<comment><USER15> Yeah, this has been around for months with no push from Amazon for some reason. I'm not sure many Kindle owners are even aware that kindle.amazon.com exists and that they can view their highlights and notes there.

Seeing what your friends are reading and highlighting would be interesting.

</comment></comment><comment><USER16> What's the news? What's new? kindle.amazon.com has been around for months, why is this posted now?

<comment><USER13> It actually launched over a year ago, this probably ended up posted here because Tom Anderson just discovered it and posted about it on Google+ in the last couple of days.

</comment></comment><comment><USER17> I hoping for full integration with Goodreads, or we fall into the classic problem of redundant social networks.

</comment><comment><USER18> Hopefully this will encourage not just book learning, but knowledge sharing and vigorous discourse!

</comment><comment><USER19> I'd rather they "rolled out" cheaper ebooks tbh (or at least encouraged publishers to do so)

</comment><comment><USER20> If they had bought Lendle or even just implemented the idea, it might actually be useful.</comment>


Apple is now Nintendo's biggest problem - <AUTHOR> http://business.timesonline.co.uk/tol/business/industry_sectors/technology/article7118570.ece

<comment><USER2> Nintendo hit a homerun with the Wii and the DS and will continue to innovate with their Nintendo 3DS, stereoscopic 3D handheld, out Q4 2010 or Q1 2011. Apple doesn't have a console and games on the iP*d devices does have a leg up with multi-touch. When you try to game on the iPod or iPod touch, your fingers cover part of what the only viewing screen.</comment>


Linus Torvalds: Security is no more important than anything else - <AUTHOR> http://article.gmane.org/gmane.linux.kernel/706950

<comment><USER2> If you're using a language like C that makes terrible obsolete compromises, it's hard to definitively say any bug can't be exploited to defeat your security. Attackers are getting better because the consequences are getting more severe (and more rewarding for them).

</comment><comment><USER3> As usual, truncated title for sensationalism. Also it's 5 years old.</comment>


Discovering my inner curmudgeon: A Linux laptop review - <AUTHOR> http://www.onebigfluke.com/2017/04/discovering-my-inner-curmudgeon-linux.html <comment><USER2> I recommend to take a look at some compatibility reviews before purchasing a laptop.

<comment><USER3> I did and things mostly worked as one may expect them to. That wasn't the problem.</comment></comment>


Yammer annoucement vs Netvorx idea ..well I am happy :) - <AUTHOR>

Few days back I posted this
http://news.ycombinator.com/item?id=451494
And there is similar news on Tech Crunch.
Well my English has grammatical mistakes but it seems like my idea doesn't have that much issue. Yammer has announced what i had said in my posting ( point 2 - 2. If any organization wants to deploy netvorx within their network rather than using http://www.netvorx.com then we will charge for maint & support. If organization wants to just use as-is version then there won't be any charge.)
lets see whether today's Yammer  annocement has any relation with Hacker News Posting or my email to TechCrunch just before Yammers annoucement ... :)
In either case I am feeling better that my brain is still working in right direction to generate idea
http://www.techcrunch.com/2009/02/12/yammer-reaches-beyond-corporate-firewalls-open-sources-iphone-application/#comment-2623930 <comment><AUTHOR> By the way now half complete Netvorx.com is on ebay

[http://cgi.ebay.com/netvorx-com-site-on- sale_W0QQitemZ300293...](http://cgi.ebay.com/netvorx-com-site-on- sale_W0QQitemZ300293448140QQihZ020QQcategoryZ46689QQssPageNameZWDVWQQrdZ1QQcmdZViewItem)

but let me know if someone with connection wanna be partner ( like PG ;) ) .. It seems like you need connection more than idea</comment>


Salesforce Certification and User Training Portal - <AUTHOR> https://mikewheelermedia.teachable.com <comment><AUTHOR> I've taught Salesforce to over 18,000 students on the Udemy platform. I am now launching my own learning platform, powered by Teachable. Through the month of May, to get things started, I am running a beta-sale - use promo code BETA to get any of my courses, or all of them in a bundle, for 96% off. 42 hours of in-depth video training, covering both the Administrator and Platform App Builder Certifications, as well as Lightning Experience, Salesforce1 and Salesforce Classic user training for Marketing, Sales, Service and Analytics. [https://mikewheelermedia.teachable.com/p/bundle/?coupon_code...](https://mikewheelermedia.teachable.com/p/bundle/?coupon_code=BETA&preview=logged_out)</comment>


Packet Capturing MySQL with Rust - <AUTHOR> http://www.agildata.com/packet-capturing-mysql-with-rust/ <comment><USER2> > Enter regex macros! While it is presently slower, and requires a Rust > nightly, it has the very appealing property that if your regex is not a > correct expression, your program won't compile!

To be clear, it's not just slower, it's _much_ slower. See the benchmark comparison here: [https://gist.github.com/b0f6a17744dd1df60752b6e8ced47afd](https://gist.github.com/b0f6a17744dd1df60752b6e8ced47afd) <\-- That's why the `regex!` macro isn't even in the docs any more.

It looks like `regex!` is the only thing preventing your project from compiling on stable Rust, right? FWIW, the Clippy lint tool will check your `Regex::new` calls at compile time for you (assuming it's a string literal, which it is in your case).

Also, I'd recommend not using `*` as a version constraint in your `Cargo.toml`. You do have a `Cargo.lock` so it's not as bad, but with better version constraints, you'll be able to run `cargo update` and get semver compatible updates.

<comment><USER3> Both good suggestions for improvement, Andrew. I saw the performance notes, and admit I was a little torn. Quite simply, the regex! macro was interesting for the reason stated, and I left it in there for the purpose of showcasing something (a little bit) unique in Rust.

Regarding the asterisk for versioning in Cargo.toml, I also agree. When quickly putting things together, I usually start with it just to see if the default version pulled works. The great utility of Cargo.lock, effectively storing the working versions of all the crates, allows scraping the versions out of there at any time, and putting them into the .toml.

I hope you noticed the extensive links in the post, as one of the goals was to bring more people into the Rust ecosystem. The Spyglass utility does work quite well. None of us claimed it has reached a state of absolute perfection, so your comments are appreciated (and pull requests will be as well)!

Thank you.

<comment><USER2> No worries! And yes, regex! is a pretty cool thing to showcase---it's a pity that it is so slow. :-( Very nice project though! :-)

</comment></comment></comment><comment><USER4> I feel kind of uncomfortable with that regular expression for scrubbing data. It seems to be fail-open rather than fail-close and does clearly not cover the full lexical structure (e.g. hex numbers or MySQL's disgusting hex-encoded strings, including the numeric digits, are not caught by any of those cases, and thus would leak in ful. Or there's the possibility of string escaping with backslashes being turned off with a config setting, which would screw up the escape handling in the regular expression).

Am I missing some subtlety that makes it safe?

<comment><USER3> I have no doubt that there are some cases which won't match. This particular utility does not need to be 100% on for every possible corner case, to produce the desired result. That said, all improvements, whether pull request or posted suggestions, are much appreciated.

My comments regarding the regex was the very high number of cases that _are_ correctly handled, with such a small amount of code.

Thank you for your comments. I appreciate it.

</comment></comment><comment><USER5> VividCortex has an agent that works similarly, which I believe they've written in Go using libpcap. It would be nice if they open-sourced it.

[https://www.vividcortex.com/resources/network-analyzer- for-m...](https://www.vividcortex.com/resources/network-analyzer-for-mysql)

</comment><comment><USER6> Interesting - I hadn't seen libpnet before. I was recently working on an experiemental project doing deep packet inspection in Rust using libpcap, which doesn't have very mature Rust bindings yet - the basics work, but it's a bit rough around the edges. libpnet looks like it has a much nicer Rust interface, and does some more things for you as compared to libpcap, which gives and takes &[u8]s and nothing else.

However, libpnet doesn't have two very useful things, as far as I can see: Reading/writing packet capture files, and the ability to use BPF filters. The first in this case might be useful mainly for testing, but the latter seems like it might simplify a fair amount of their code.

<comment><USER7> I was just thinking about writing a minimal traffic-analyzer and libpnet looks way more suitable for this task than libpcap.

And adding the functionality for a pcap like fileformat doesn't seem that difficult.

The filters are a major pain point, I don't know how libpcap handles this, but at least it says it won't copy packets from kernel- to userspace that are not matching. Thus avoiding alot of overhead, maybe it's possible to introduce some rusty kind of filtering in libpnet, too.

Going to log into Github now and see if I can do something.

EDIT: fixed spelling

<comment><USER8> If you want to avoid libpnet or libpcap, you can use socket and recv directly.

Here's a quick example demonstrating socket & recv capturing all packets on all interfaces.

[https://gist.github.com/fkautz/0104084fd79cee5608d8e3fc6e729...](https://gist.github.com/fkautz/0104084fd79cee5608d8e3fc6e729a0f)

</comment></comment></comment><comment><USER7> > To run Spyglass, you need extra permissions above that of a normal user in > order to capture network traffic at the data-link layer, below IP, and > without having to alter or interfere with the regular data flow between the > client app and database servers. We recommend running it using "sudo."

Wouldn't it be better to use some kind of privilege separation? I think there is a reason WireShark does this... And even saying Rust is a safe Language won't save you from programming errors, it just makes them more diffcult.

<comment><USER3> Thank you for the suggestion. Spyglass went from concept to a working product which met the project goals, in a little over 5 weeks.

And, you're correct it won't save you from all programming errors. It does, however, make it far more difficult to accidentally encounter whole classes of them which constitute, on average, quite a high percentage of debug time in other systems languages.

</comment></comment><comment><USER9> Why are you not encrypting your MySQL connections with SSL? If you're in the cloud, you absolutely should be encrypting. Even if you're in your own colos, you should be encrypting (in the chance of inter-colo queries). Seriously, why aren't you encrypting this traffic? Query intelligence isn't an valid excuse. Turn on query logs instead. Percona has shown that the logging impact is very minimal (even if the link is 7 years old now) [0].

[0] [https://www.percona.com/blog/2009/02/10/impact-of-logging- on...](https://www.percona.com/blog/2009/02/10/impact-of-logging-on- mysql%E2%80%99s-performance/)

</comment><comment><USER10> I hope to one day understand how a post, with 4 points only, by a newly created account, gets promoted to the front page.

<comment><USER11> Please don't post comments like this. If you're worried about voting on a story, send an email to firstname.lastname@example.com and we'll look into it. (In this case, the voting looks largely legit. Rust is popular on HN these days, so that may be why.)

Oh, and nothing is wrong about posts by new accounts making the front page. We welcome new users!</comment></comment>


Ask HN: 3 important questions to collect product feedback - <AUTHOR>

If I had to collect feedback from my users about my product http://www.teamgum.com (Browser Extension for team based sharing, discovery and discussions on web pages), what should be the 3 important questions Should it be
on-boarding process? downloading extension? UX? Gaps? I have lots of area to cover but want to focus on important ones <comment><USER2> I would ask people to spend 2 minutes with the website/product and then answer: 1) To what extent you understand what this product is? (scale 1-7) 2) To what extent do you understand how you could use the product? (scale 1-7) 3.1) How probable is it that you will start using the product? (scale 1-7) 3.2) Please explain why/why not? (open ended).

Having people understanding what the product is and does and how and why they should use it is the first gate you need to pass.

<comment><AUTHOR> Thanks for instant reply. I was not clear in my description. I want to put across this feedback questions to users who have already signed up and logged into the system once.</comment></comment>


Can the HN community work to build out a nice homebrew NAS - <AUTHOR>

For some time now I have wanted to hook up a NAS to my home network for storing my music, video, and data.
There are projects like FreeNas, Nexenta, and a handful of other OSS NAS software/hardware.  Of course, there are the off the shelf products like Drobo which I personally do not feel fits the bill at all.
I was hoping that as a collaborative effort, the HN community could come up with a spec sheet of hardware and software that could be put together to make a really nice NAS for the slightly above average home network hacker.
Off the top of my head, I would love to see it meet these criteria, though would also love to hear the pros and cons of these ideas.  Not to mention the valuable input everyone in this community can provide.
* What OS would it run? * What motherboard would be ideal? * Can it be kept it fanless? * Would it be good to also try to shove in a full blown router and firewall, replacing two devices at once? * Serial ATA specs. * Minimum CPU that can be used. * ZFS?  I certainly desire for it to be ZFS. * What software would be best to control it, rather than writing our own, which would slow things down.  Ideally this would amount to putting parts together, not reinventing the wheel. * This is home to Small/Med Business, do not even try to hit the enterprise. * How many drives * What is the best box/case for something like this? * How low of a power consumer can we keep it?
And whatever else people can add.  I really would love to see this be a ZFS based system, with the ability to support Mac OS X, Windows, and Linux out of the box without any fiddling.  All over GB Ethernet. If it can act as a portable home directory destination for other OS's, support sparse images/bundles, Time Machine backups from Apple's kit, etc.  And all that, with the ability to pop in a new drive at any time and absorb that storage.  Not to mention knowing your data is safe by choosing the right ZFS RAID methodology.
To date, I have not seen this done without hitting costs that are far too much to put into home use.  The second you go enterprise, it is a noisy rack mount or a Drobo, both of which I am not a huge fan of.
If dialogue can be opened on this to get specs together, I think I can drum up the funds to make a first generation prototype, and find the time to write up the instructions on how to make it all come Together.
What do you think? <comment><USER2> > ZFS? I certainly desire for it to be ZFS.

NetApp seems to be threatening to sue people who ship devices based on ZFS and suing Sun itself. Might want to stay away from that.

> What software would be best to control it, rather than writing our own, > which would slow things down. Ideally this would amount to putting parts > together, not reinventing the wheel.

Just need to create a web interface to the underlying tools.

> Time Machine backups from Apple's kit

Possible with Netatalk.

As far as hw specs and whatnot, you could do a basic 2 disk atom server if you just want storage and minimal NFS/CIFS sharing over the network.

My preference would be a Core i5/i7 4 disk system so you could real-time transcode HD video for streaming to UPNP media devices.

<comment><AUTHOR> Yeah, the ZFS stuff is getting a little out of hand. However, I am not wanting to get into the business of selling a hardware device, I only want to make the plans for the community to solve all the issues surrounding it.

FreeNAS is almost there, and they do seem to support ZFS now that I was looking into it more today. It looks like it is now just a matter of finding the right hardware. I think I do need 5 disks, 4 for backup and one for parity.

Hopefully it will support Time Machine right out of the box, since Time Machine backs to a sparse bundle, which by nature, can handle all the Mac OS X meta data.

Are you aware of anything that is 5-6 disks, GB, 5-6 SATA ports, or 2-3 multiplied, that is not huge, ugly, and massively expensive?

Thanks for the pointers, I will start looking into the core if/i7 stuff too.

<comment><USER2> > Are you aware of anything that is 5-6 disks, GB, 5-6 SATA ports, or 2-3 > multiplied, that is not huge, ugly, and massively expensive?

Nope but you might be able to find an eSATA card and enclosure. That would give you more choice over the server.

Another reason why I mentioned Core i5/i7 is because the newer models have AES instructions so you could do AES encrypted backups at gigabit wirespeed.

Maybe something like this on the low end:

\- Supermicro Atom D510 - $360

\- 4GB RAM - $40

\- PCI-E Riser - $20

\- eSATA card - $20

\- Areca ARC-5020 - $450

\- 5 x 1TB drives - $450

\- Total: $1340 USD

[http://www.newegg.com/Product/Product.aspx?Item=N82E16816101...](http://www.newegg.com/Product/Product.aspx?Item=N82E16816101332&cm_re=supermicro_atom_d510-_-16-101-332-_-Product)

[http://www.newegg.com/Product/Product.aspx?Item=N82E16816151...](http://www.newegg.com/Product/Product.aspx?Item=N82E16816151046&Tpk=areca%20esata)

[http://www.newegg.com/Product/Product.aspx?Item=N82E16815158...](http://www.newegg.com/Product/Product.aspx?Item=N82E16815158093&cm_re=esata_card-_-15-158-093-_-Product)

[http://www.newegg.com/Product/Product.aspx?Item=N82E16822136...](http://www.newegg.com/Product/Product.aspx?Item=N82E16822136284&cm_re=western_digital_caviar_black_1tb-_-22-136-284-_-Product)

</comment></comment></comment><comment><USER3> Why bother with hardware, why not use the cloud? Hardware gets expensive, plus some sever fans can sound extra loud in a home. Maybe someone can give you a heads up on how to do it in Amazon or RackSpace.

<comment><AUTHOR> I have tried ever one of the clouds I can get my hands on, Amazon, BackBlaze, mozy, carbnonite, sugarsync, a few more I can't remember...

I am on OS X, and not one of them can handle the all the extended attributes, resources, and other much you get with Mac OS X Files. Now, most are not claiming to, most will not claim to give you a bootable backup at all. Some do, and they are sorely mistaken.

DropBox is the only one making efforts to, but they are also not even trying to be a backup solution.

Just pointing rsync with a patch on it for the attributes is not enough from what I have tested. Not that I am even shooting for a system level backup. This is more home NAS stuff, and I really don't want to stream a HD video down from a remote store.

Thanks for the comment though.</comment></comment>


Netizenship – A Tool to find the membership of a given username in popular sites - <AUTHOR> Hi all,
This is my first submit. Apologies for any mistakes.
I have written a small tool for finding out the membership of a given username with popular websites like Facebook, Twitter, etc. Around 30+ websites are covered as of now.
The tool is open-sourced at https://github.com/rahulrajpl/netizenship
It can be tested/used via 'pip install netizenship'
Regards, Rahul <comment><AUTHOR> for system wide install use 'sudo'</comment>


Neutron – A Full-Blown Windows PC in the Palm of Your Hand - <AUTHOR> https://www.kickstarter.com/projects/atomcomputer/neutron-a-full-blown-windows-pc-in-the-palm-of-you

<comment><USER2> See also [http://liliputing.com/2014/10/windows-compatible-hdmi-tv- sti...](http://liliputing.com/2014/10/windows-compatible-hdmi-tv-stick-intel- bay-trail-cpu.html)

</comment><comment><USER3> How is this different from an Intel NUC ?

<comment><USER4> I think it IS Intel's NUC in an acrylic box and wouldn't be surprised to see Kickstarter end this project

<comment><USER3> They have addressed this in the updates page but frankly, I am now lost:

"We make no secret in saying that our insanely small Neutrons are made possible with Intel's ultra-small form factor NUC boards. We are working directly with a distributor to make sure to get the best pricing for Next Unit of Computing boards we can. Where the Neutron shines is that it is one of the only fully integrated NUC based computers in the world, meaning using one is just as simple as taking it out of the box and plugging it in" [1]

So, they are charging a premium to literally install the RAM, SSD and Windows 8.1 (in some pledges only).

[1] [https://www.kickstarter.com/projects/atomcomputer/neutron-a-...](https://www.kickstarter.com/projects/atomcomputer/neutron- a-full-blown-windows-pc-in-the-palm-of-you/posts)</comment></comment></comment>