The Minsky circle algorithm - <AUTHOR> https://nbickford.wordpress.com/2011/04/03/the-minsky-circle-algorithm/ <comment><USER2> The pair of equations can be expressed succinctly as

        y -= x >> 4;
        x += y >> 4;

and is basically a very rough approximation of a step in the CORDIC[1] algorithm, which computes the sin and cos of an angle by rotating a vector; it's then quite natural that successive rotations would trace out an approximation to a circle.

 _As such, many of the first programs of the PDP-1 were "Display hacks": Programs using only a few lines of code, but when run, create intricate patterns on the screen._

The demoscene has carried on that tradition, and in particular the sub-512b categories produce very interesting graphics from tiny programs.

[1] [https://en.wikipedia.org/wiki/CORDIC](https://en.wikipedia.org/wiki/CORDIC)

<comment><USER3> and this formula is simply an expression of the fact that given a circle:

x = sin t , y = cos t

the derivative is

d(sin t) = (cos t) dt , d(cos t) = -(sin t) st

so it's interesting that it was "stumbled" upon.

</comment></comment><comment><USER4> I think that the key lies in the fact that we are creating a numerical solution to a differential equation: y = y - 1/16x actually means that we add an amount to y that is dependent on the value in x, i mathematical terms, it means that the derivative (approximated here) of y is equal to deltat _(1 /16)_x

Assuming deltat=16, we have:

y' = -x

x' = y

Which is solved with y=cos and x=sin or with x=-cos and y=sin.

The fact that one line adds and the other substracts may be explain why rounding errors will compensate each other over time, but we need a more detailed working of the PDP arithmetics to be really sure about that.

Actually, many CS students may recognize a prey-and-predator model, that creates very simply sinusoids that are dephased of pi/2\. That is, if one is a sine, the other is a cosine.

</comment><comment><USER5> I was curious to see that first demo in action, so I quickly whipped up a shadertoy

[https://www.shadertoy.com/view/Mtsyz2](https://www.shadertoy.com/view/Mtsyz2)

<comment><USER6> Sweeeeeeeeeeeeeet!

I noticed this doesn't run on my iPhone (SE), because XOR is unsupported in GLES 2.0, so I hacked the shader up a bit to be compatible. (and because I'd never had the opportunity to implement XOR using integer arithmetic)

For whatever reason, I could not get my hacked ShaderToy version to work on my phone (possibly a Shadertoy uniform bug?), even though it compiled in the iPhone's browser without issue, and even though it works just fine on my laptop. A slightly modified version of my hacked shader works as expected on my phone in the Book of Shaders editor. I had to "guess" at a reasonable iFrame value by dividing u_time by 60.0, and since the BoS editor doesn't support "resetting time" without reloading, I made it "loop" with a hardcoded loop time of 9 seconds.

shadertoy: [https://www.shadertoy.com/view/Mlscz2](https://www.shadertoy.com/view/Mlscz2)

book of shaders (code): [http://thebookofshaders.com/edit.php?log=170917091706](http://thebookofshaders.com/edit.php?log=170917091706)

book of shaders (player): [http://player.thebookofshaders.com/?log=170917091706](http://player.thebookofshaders.com/?log=170917091706)

<comment><USER7> For some reason it gives me Unknown Error: ERROR: 0:? : '' : syntax error

<comment><USER6> I had a bizarre issue like this in the BoS editor, where it seemed to convert my backslash character inputs (used to spread the definition of that xor_step macro across many lines) to something non-ASCII, which caused a shader compiler error. This error was printed only in the browser's developer tool console.

</comment></comment></comment></comment><comment><USER8> See also here (PDP-1 emulation, running the Minskytron, Munching Squares, and more; includes a description of the program and a link to the annotated source code): [http://www.masswerk.at/minskytron/](http://www.masswerk.at/minskytron/)

David Mapes invented the same algorithm, also on the PDP-1, at Lawrence Livermore National Laboratory (LLNL). While Minsky came across this algorithm by accident, Mapes arrived there by design. See [http://www.masswerk.at/minskytron/davidmapes.html](http://www.masswerk.at/minskytron/davidmapes.html)

<comment><USER8> P.S.: Traces of the Minskytron circle algorithm are also to be found in Spacewar!, the first digital video game (also for the PDP-1): In the main code, there's a parameter controlling "torpedo warpage" (normally set to a value causing no effect), which displaces the trajectory of a torpedo by the help of a modified version of Minsky's circle algorithm. Then there's also the first hyperspace patch (for Spacewar 2B) by Martin Graetz, displaying a special, Minskytron-inspired animation, called "warp-induced photonic stress emission", also known as the Minskytron-hyperspace. (For the latter, see [http://www.masswerk.at/spacewar/inside/insidespacewar- pt8-hy...](http://www.masswerk.at/spacewar/inside/insidespacewar- pt8-hyperspace.html#hyperspace_patch) )

</comment></comment><comment><USER9> The book _Minskys & Trinskys_ referenced in the article can be previewed here [http://www.blurb.com/bookshare/app/index.html?bookId=2172660](http://www.blurb.com/bookshare/app/index.html?bookId=2172660)

The third co-author "R.W. Gosper" is Bill Gosper [https://en.wikipedia.org/wiki/Bill_Gosper](https://en.wikipedia.org/wiki/Bill_Gosper), who discovered the glider gun and the hashlife algorithm (linked from the Wikipedia page).

<comment><USER10> are they going for a worst website prize or something?

</comment></comment><comment><USER11> The alternating updating of x and y is analogous to a leap-frog numerical solution of a harmonic oscillator (with y=dx/dt). If they are updated at the same time then it's explicit Euler.

</comment><comment><USER12> The circle algorithm seems to come from the trigonometric identities with small value approximations for b -> 0\. ie. cos(b)~=1 and sin(b)~=b.

sin(a+b)=sin(a)cos(b)+cos(a)sin(b)

cos(a+b)=cos(a)cos(b)-sin(a)sin(b)

<comment><USER13> Yes, that explains why it's correct to first order.

But the mystery is that experimentally it's more correct than that. Why does it seem to join up with itself exactly after 360°, and not spiral slightly inward or outward due to accumulated error? Why does it stop working if you use a temporary variable so that x and y are updated simultaneously instead of alternately?

<comment><USER2> Due to the addition and subtraction, errors introduced in the x step are effectively canceled out in the y step, and vice-versa. This is also the reason why the path is slightly elliptical --- at some points there is slightly too much y and not enough x, at other points not enough y and too much x, and the other two combinations (for the other two quadrants) too. However, all the errors cancel out so the path goes back to where it started.

</comment></comment></comment><comment><USER14> Are there any good books on coding elementary functions with integer arithmetic? I've got a couple books that cover it a little but they mostly use floating point.

</comment><comment><USER15> I remember seeing circle drawing code, written in Basic, on an Atari 400/800\. I have remembered that code until this day, because it was simple and elegant.

Now that I have read this article, I can recognize that code was the Minsky Circle Algorithm.

Fantastic!

</comment><comment><USER16> i see more and more people blogging on some-hacker-name.wordpress.com is it because you don't want to purchase a domain or something? what is the reason? (mere curiosity). why not for example then on blogger.com? why not on medium? I wonder if there is some specific reason i'm not aware of.. thanks.

<comment><USER17> Wordpress is (imo) the best way to get started if you want to put your effort into writing and not dealing with website setup and maintenance. Plus the UX is top notch.</comment></comment>


Microsoft uses open-source software to create Windows - <AUTHOR> http://www.zdnet.com/article/microsoft-uses-open-source-software-to-create-windows/ <comment><USER2> > Git version control system to build Windows itself.

ZDNet ...</comment>


Marking HTTP as Non-Secure - <AUTHOR> https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure <comment><USER3> I think the best time to do this would be soon after the Let's Encrpyt free CA [1] starts handing out certificates. There's no more good reason not to have HTTPS, so that's a good time to start applying a little pressure and adding the incentive for website authors.

Does google already reward secure sites with higher search rankings? I can't decide if I think that's a good idea or not, but if they want to push for a more secure and free web, that's definitely another avenue.

[1] [https://www.eff.org/press/releases/new-free-certificate- auth...](https://www.eff.org/press/releases/new-free-certificate-authority- dramatically-increase-encrypted-internet-traffic)

<comment><USER4> I still haven't heard a reason why it's important that my blog is on https. Waiting.

<comment><USER5> 1) Sometimes it's not about _you_.

Currently, the NSA (and others, presumably) consider the _presence_ of encryption as part of their is_suspicious() heuristic. Other people do have need for encryption, and by saying "I (currently) have nothing to hide", you are saying that you are fine with a high correlation between "uses encryption" and "is doing something suspicious". More than any other reason, we need to dilute that correlation until all data looks similar to remove the possibility of this kind of categorization.

2) [https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html](https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html)

As Zimmermann said, we need to socially normalize the use of envelopes instead of the postcards that are currently used. Without that social expectation, it will be possible to legislate against the use of encryption in the future.

3) It lets us (in the very long term) simply retire 80/tcp

...and plain HTTP servers in general. Sure, this is a minor benefit, but it would still be nice.

<comment><USER6> While those are all valid reasons they land on the "greater good" side of the scale, which doesn't have the obvious "what's in it for me" I think many people are looking for.

My thoughts

1\. Not having secrets - MITM isn't necessarily conducted by malicious attackers, but that doesn't mean it's bad. Consider for example a company that wants to identify usage behavior and buys traffic data from an ISP. While the data may be anonymized it's still someone's usage. With https, a webmaster is limiting the info those companies can get so instead of being able to run a complete analysis on the type of text a user reads and images they see, over https they could only tell what websites you go to. It's still pretty bad, but not as bad.

2\. Cost - I do see the value of cheap hosting on S3 and getting redundancy. I've been hosting servers from the days before AWS existed (I started young) and know one thing - if you can't afford something you probably don't need it.

Why does you $0.06 site need to have a multi node setup? I don't mean to sound like a jerk but if you had the kind of traffic a multi node + DSL site needs you'd probably have the funds to invest in it. It's really not very expensive considering a cup of Starbucks coffee costs 100 times what you currently pay for hosting...

If your content isn't secret why not go with a cheap SNI that can host your certificate and put that behind cloudflare (which is free)?

<comment><USER5> > "What's in it for me"

I'll ignore he obvious selfish nature of this question and simply point out that you may need to take advantage of that "culture of always encrypting everything at some point in the future. It is incredibly short-sighted to assume that you're not _ever_ going to be a target.

> "not having secrets"

You can look the numerous rebuttals for this very well-known fallacy.

> Cost.

It's probably worth mentioning that I am currently living on SSDI (social security disability income) thanks to some unfortunate medical issues. I _cannot_ actually afford _any_ PKI cert and related costs, even $20 costs.

Well, the EFF may soon have a free solution for this, and almost all of the benefits I list are still valid even when the crypto is relying on an self- signed certificate automagically generated by apache on first use.

I would love to see more options that address the cost issue - <USER2> communications should not be limited to those that can afford various economic barriers, but for now at least some solution exists.

<comment><USER7> What's wrong with StartSSL for your use?

<comment><USER5> You assume they are always available and always do business with everybody? I had an account with them once, but they declined to reinstate it shutdown the account. I don't know why.

So no, they are not an option for everybody.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> On a related tangent:

In the new secure-by-default world, what happens if a website has some large assets (e.g. video, game files) and would like to opt into caching by any transparent proxies that may be on the user's network? The site could embed hashes of the assets in question, and use ServiceWorker to transparently inject a hash check into any fetches (no matter what HTML thingy initiated them), but I think requests to http: from https: are always blocked as mixed content - let me know if I'm wrong. Also, this would still send things like user-agent, language, any non-secure cookies, etc., and allow the unauthenticated server to set them; it would be good to have a way to opt out of all these things, just sending a minimalist HTTP request instead.

Of course, even if these issues are fixed, any system allowing caching of assets must allow tracking of what assets were requested; for some sites this is unlikely to provide much info beyond what the domain name already indicates, but for others it would be best to avoid. On the other hand, if assets have sufficiently distinctive sizes, a proxy might be able to guess this information over HTTPS anyway through simple traffic analysis, so it wouldn't be that harmful to run it over HTTP instead.

<comment><USER9> One of these days, I'd like to have a scheme for referencing secure third- party content that includes hashes. I'm never going to link to a third-party server for some JavaScript file that could be changed out from under me, but if I can link to it on a CDN along with a sha256 or similar, and have it grabbed from my own server instead if the hash doesn't match, great!

I've seen a few attempts at that, but nothing that has actually taken off. It needs an appropriate polyfill, so that in browsers that don't support it, either the content gets downloaded and hashed client-side, or the content just gets downloaded from the same origin.

> In the new secure-by-default world, what happens if a website has some large > assets (e.g. video, game files) and would like to opt into caching by any > transparent proxies that may be on the user's network?

The whole concept of a "transparent" proxy will hopefully die in a secure-only world. If you want some server on your network to MITM your traffic (for caching or any other reason), use a non-transparent proxy. (Or, install a CA certificate from your proxy, but hopefully widespread use of certificate pinning will kill that too.)

<comment><USER10> For what it's worth, [http://w3c.github.io/webappsec/specs/subresourceintegrity/](http://w3c.github.io/webappsec/specs/subresourceintegrity/) is actively being worked on, and implementations in Chrome and Firefox are on the way in the near future. The polyfill issue is handled in that proposal as described in <[http://w3c.github.io/webappsec/specs/subresourceintegrity/#f...](http://w3c.github.io/webappsec/specs/subresourceintegrity/#fallback-1>): Your "src" attribute points to a server you control, but your "noncanonical- src" points to the CDN, and a browser that knows about "noncanonical-src" is also supposed to know about the "integrity" attribute and ensure that the content it gets hashes to what you expect.

<comment><USER11> This is very interesting; thanks!

I am not very familiar with hashing algorithms, but why isn't the length of the content specified in the `integrity` attribute? Wouldn't it help avoid length extension attacks?

<comment><USER9> A good digest alorithm should already handle length extension attacks with just the digest. HMAC algorithms handle that as far as I know, and I _think_ modern hashes don't suffer from the length extension problem in the first place.

<comment><USER8> In any case, length extension attacks apply to (hashes misused as) keyed message authentication codes - a scenario where you give a message and its authenticator to a server knowing the key, and it checks whether someone knowing the key generated them. The attacks let you, given a message and its authenticator, calculate the authenticator for a different message. However, in this case, the hash cannot be tampered with; breaking integrity would require finding a different message with the _same_ hash, which is a straight- up collision, considered to totally break a hash algorithm. At the moment, the only commonly used hash algorithm with known collisions is MD5; SHA-1 will probably follow in the next several years.

<comment><USER11> I perhaps used the wrong term. I meant straight-up collision with a modified length.

The known MD5 collision attack needs to modify the length of the message; finding a collision with the same length is extremely difficult. It would be reasonable to assume that attacks on other hashing algorithms would suffer the same constraint.

Wouldn't having the length specified in the integrity attribute help reduce chances of a future attack? The cost of specifying the length is negligible; about 12 bytes for a base-64 encoded 64-bit unsigned int.

<comment><USER12> You're essentially using the length as a(n extremely weak) secondary hash in that case. That might be sufficient to disable one known MD5 exploit, but if you're worried about vulnerabilities in your primary hash algorithm it would make more sense to use another real hash algorithm for your backup.

<comment><USER11> Thanks for the answer. I am really not familiar with the mathematics of hash algorithms and I ask just to learn.

Why is length essentially a weak hash? Isn't it an additional constraint that works orthogonal to the hash? It serves to restrict the space of collisions and hence directly reduces the exploit surface. Moreover, the length can be independently verified of the hash function, and its space & time complexity is negligible.

<comment><USER13> > Why is length essentially a weak hash?

It's utterly trivial to match by itself. Adding length to a real hash is a mild difficulty increase. Adding a second hash is a massive difficulty increase.

> Isn't it an additional constraint that works orthogonal to the hash?

Yes. But so is a second hash.

> It serves to restrict the space of collisions and hence directly reduces the > exploit surface.

Very inefficiently.

> Moreover, the length can be independently verified of the hash function, and > its space & time complexity is negligible.

A second hash is independent of the first hash too. Hashing a second time compared to downloading and hashing the first time is pretty close to negligible.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> One of the surveillance attacks pointed out in the post is the NSA piggybacking on advertising cookies. Details in the Snowden leaks were scant, so we did some research to figure out just how far the NSA could go with this technique. Very far, as it turns out. Here's a blog post with a link to our research paper: [https://freedom-to-tinker.com/blog/dreisman/cookies-that- giv...](https://freedom-to-tinker.com/blog/dreisman/cookies-that-give-you- away-the-surveillance-implications-of-web-tracking/)

One of our conclusions was that tracking companies switching to HTTPS would help, but a large majority would have to switch to make any difference, because of the sheer number of trackers (Section 4.1). This proposal or something like it is probably necessary if we're to see that magnitude of change.

</comment><comment><AUTHOR> Previous discussion in

Firefox: [https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...](https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/iU86qMOwvWs)

[https://bugzilla.mozilla.org/show_bug.cgi?id=1041087](https://bugzilla.mozilla.org/show_bug.cgi?id=1041087)

Chromium: [https://groups.google.com/a/chromium.org/forum/m/#!topic/sec...](https://groups.google.com/a/chromium.org/forum/m/#!topic/security- dev/DHQLv76QaEM)

[https://groups.google.com/a/chromium.org/forum/m/#!topic/sec...](https://groups.google.com/a/chromium.org/forum/m/#!topic/security- dev/rGM2oiKZqZU)

</comment><comment><USER15> If you make a change like this too quickly, you run the real risk of users seeing the "warning" so often that they just get trained to ignore it (even more than they already do).

<comment><USER16> A fair argument, but what's the gradual approach? It has to be all or nothing.

The idea behind this is to use it as an impetus for sites and services to move to SSL/TLS.

<comment><USER17> There's a very interesting idea at the end of this proposal: that the more- aggressive warnings arrive based on telemetry of the preponderance of secure interactions. By changing over time, and in a manner sensitive to the real mix of user interactions, there's less risk of habituation to "oh, all sites show that warning".

You could even make the switch based not on the entire browsers' usership, but an individual user's recent past. (Not sure this is a _good_ idea, but it's an interesting one.)

</comment></comment></comment><comment><USER18> _Excellent_. While they're at it, maybe they should stop marking self-signed SSL as more of a security risk than plaintext HTTP.

<comment><USER19> They currently _are_ more of a security risk because if you tell the user their connection is secure when it's not (no verification of self-signed certs) you impart a false sense of safety.

<comment><USER20> If you perform certificate pinning, self-signed can be just as secure. I wish the message was slightly less scary, perhaps saying as SSH does, "you've never visited this site before, do you trust this certificate?"

<comment><USER21> (user clicks "yes" and proceeds oblivious)

<comment><USER22> as opposed to unencrypted HTTP?

<comment><USER23> I can teach my computer illiterate grandma simply _" never do email unless the address bar is green"_, she can remember that.

As opposed to: _Never do email unless unless the address bar is green, except when:_ \- It's the first time you visit the web site \- You use another browser \- You bought a new computer/tablet/phone, reinstalled your computer etc. \- You accidentally cleared your browser history \- You are on a public wifi the very first time you visit a web site. \- The website changed their certificate since last time you used it. \- You happen to be unlucky and even at home you are under a MITM-attack the very first time you visit the page.

The last bullet is especially troublesome because even a programmer would have a hard time to judge that one.

</comment></comment></comment></comment></comment></comment><comment><USER24> This is just pointless scaremongering.

Remember what happened when msie added warnings for this a decade ago?

People got so fed up with "security"-warnings that they just clicked "OK! OK! Whatever. Get the fuck out of the way!". And they did it to ALL warnings, serious ones too.

Glad to see history repeat i itself.

<comment><USER25> Agreed.

There are so many websites on the internet which do not gather sensitive data from the users but display read-only content.

<comment><USER26> If you had checked my web-browsing over the last week it wouldn't be very hard to make an argument that I should be in psych facility, based on the number of suicide related searches I did. In all cases it was purely static content, but in the wrong hands it could be a huge issue for me.

I am only posting it here to prove a point: even static content can reveal a lot.

<comment><USER27> I don't think SSL is all that great for protecting broad interests.

If you are going to ten different domains in the same span of time that all contain suicide content and someone is snooping your connection, they can correlate what you're doing from the server names (especially if one of the domains has the word 'suicide' in it), even without seeing the page content or path portions of your web requests.

For exclusive content sites, it's a dead giveaway. If someone went to my domain (byuu.org) in HTTPS, then it's pretty obvious that they were interested in emulation, regardless of the encryption. There's already tons of services out there categorizing domains on the internet.

SSL's primary benefit is for form submissions, not for static content pages.

For something like that, your best bet at the present time is a service like Tor. Which even that isn't really perfect.

</comment></comment></comment></comment><comment><USER28> Synthesis: Chrome Security Team would like to put :( for all non-secure HTTP connections. With gradual deployment, and increase of all active sites moving to HTTPS, it is assumed that users won't become trained to ignore this as a warning signal.

| Then, in the long term, the vendor might decide to represent non-secure origins in the same way that they represent Bad origins.

The biggest disadvantage of the proposal, as it stands in current CA climate, is that it's psychologically successfull deployment will impose a liability for site operators to touch their sites at least once per CA renewal timeframe. There are many sites where this isn't desired, feasable, or even possible at all, but which despite non-security, still serves giant heaps of high-quality information. So, this will increase SEO, and accessibility gap between sites run by geeks, and sites (attempted to) run by everyone else. Whether this is a desired future of the web is left to an exercise for the dear reader.

<comment><USER29> The Let's Encrypt project will have a daemon that automatically renews the certificate.

</comment></comment><comment><USER30> From the article:

 _" We'd like to hear everyone's thoughts on this proposal, and to discuss with the web community about how different transition plans might serve users."_

...

 _" You do not have permission to add comments."_

<comment><USER31> It's pretty obvious they're intending the discussion to happen on mailing lists.

        We'd love to hear what UA vendors, web developers, and users think. Thanks for reading! We are discussing the proposal on web standards mailing lists:
        firstname.lastname@example.com
        firstname.lastname@example.com
        email@example.com
        firstname.lastname@example.com

You make it sound like they're eschewing discussion.

</comment></comment><comment><USER32> Great. So with this proposal all website operators that don't pay their due to the Certificate Authority cartel will be marked as "bad" sites. I'm all for restoring trust but not before the CA issue is resolved.

</comment><comment><USER33> Ever since I realized there will be a persistent log of my browsing history maintained by one or more government agencies, I have mentally-marked http as risky. I cannot wait for something like this to happen, and encourage the wider less-informed community that TLS is critical for both trust (properly implemented, TLS will provide protection against tampering and data leakage) and to provide a minimum level of privacy (I can see you visited site x, but not what sections of it). Bring it on.

</comment><comment><USER34> Hmm, there are a _lot_ of sites out there. So many small sites with their own domain name. Local establishments, projects, clubs, communities... that will be hell to migrate, with non-obvious benefits to most site owners.

This might force more centralisation of the web again... just move your content to ESTABLISHED_GLOBAL_PLATFORM_X instead of that vhost at SMALL_LOCAL_PROVIDER_Y.

<comment><USER35> If LetsEncrypt comes pre-installed with cPanel and when creating the domain name it's https by default, then as long as shared hosting providers update the cPanel then all small sites will be updated to be ssl by default. But then we'd have the problem with people continuing to use '[http://'](http://') in <a> tags.

</comment></comment><comment><USER36> Really not happy with the way Chrome is going on these things. As a web developer, sometimes the best thing for my users is an HTTP media file off a non-SSL CDN closest to their home and cacheable by things like Squid stuck in front of them in my HTTPS otherwise page. But I can't do that now because Chrome will display the page as broken. They are just taking useful tools away from developers to improve the lives of users and not really improving anything except for a few privacy nuts who care about every tiny image on every page possibly being tracked.

<comment><USER26> That is easily solvable: make internet connections fast enough that caching is no longer an issue.

<comment><USER37> It is rarely the speed of the connection that makes caching an issue, but much more frequently the cost of the generation of the data and the cost to maintain that data post generation.

</comment></comment></comment><comment><USER38> Marking HTTP as non-secure implies that HTTPS is secure. The large company where I work has quietly rolled out the Zscaler HTTPS proxy and my colleagues are unaware that, despite the assurance given by the green padlock in their browser, their connection is most definitely not secure.

<comment><USER26> That is because browsers obey the false root certificate installed locally, even when they otherwise pin the certificate down. This is a deliberate choice, but that doesn't mean HTTPS isn't secure, it means that you can't trust a computer you don't control.

</comment></comment><comment><USER39> My vote for the icon to use would be a small frown or disappointed face. It's different than the icons for broken https, but still gets the point across that something isn't so great.

Here's what I'm thinking of: [https://cdn0.iconfinder.com/data/icons/smile- emoticons/78/Em...](https://cdn0.iconfinder.com/data/icons/smile- emoticons/78/Emoticons_smile_smiley-03-512.png)

<comment><USER23> Why not a postcard for insecure and envelope for secured? Might be hard to distinguish in small icons and can be confused with email too easily but otherwise the message should go through.

Can't be worse than padlocks with different shades of green as we have today anyway. Does anyone actually understand them? Here on HN i get a gray padlock, on some other site i get a green padlock and on yet another site i get a padlock and a nice fancy badge with the website name in it. Doesn't help that every browser keep changing their looks with regards to this every 6 months also.

</comment></comment><comment><USER40> > _We know that people do not generally perceive the absence of a warning > sign. Yet the only situation in which web browsers are guaranteed not to > warn users is precisely when there is no chance of security: when the origin > is transported via HTTP._

That is a very strong point. User perception of the browsers' current UX treatments of the various security scenarios poorly represents the true level of security. An insecure HTTP site (no warnings) looks safer than an HTTPS site which happens to reference a single non-HTTPS image (mixed content warning). The absence of a warning for the HTTP site is not fair, because despite the mixed content, data submitted in a web form to the HTTPS site is still encrypted, yet the UX treatment affords it less trust.

Separately, how should Extended Validation (EV) certificates fit into this plan? Especially after the final proposed transition phase, _T3: Secure origins unmarked_. Personally, I think EV certs have become kind of a racket in the CA industry. But they exist nonetheless, and we should push for more consistent browser treatment of site security in general, including consistent treatment of EV certs.

</comment><comment><USER41> I think that can be scary for the wrong reasons. Like a whole part of the web will be marked as "non-secure" where it should be marked as "non-encrypted."

Security-wise, MIM (Man in the Middle) attacks using HTTP are a fraction of the real security threats (Phishing that can use https!, Keyloger, Malware, Browser Vulnerabilities...)

It will give too much weight to HTTPs websites or too little to HTTP websites.

Moreover, SSL certificates are expensive!

</comment><comment><USER42> Maybe showing the "http-is-insecure" warning in the address bar only when the user fills form inputs?

<comment><USER43> This would be a great first step, maybe a new T0.5 in the transition plan. Get people on board by securing the data they are sending around, and the secure the pages they are reading later.

</comment></comment><comment><USER44> Great move. We also need free/cheap wild card certs.

</comment><comment><USER45> Even with HTTPS if you compromise the server, or the client you can do whatever you like... so my awesome server with all ports open and with login (on everything): admin password: 123 serves some content, but has a valid certificate, and the browser says: "This Connection Is Secure!"

Meanwhile a well managed server with no open ports, private key auth etc, but serves content without HTTPS, the browser says "This Connection Is Insecure!".

Seems a bit misguided to me. Also feels a little corrupt and profit driven (by CAs)... Why don't google offer free Certificates... seems an obvious (and trusted) way to spread more "Certified websites".

<comment><USER46> I'm not sure I follow your argument. You do realize that you are talking about two different kinds of attack channels right?

Cleartext-based attacks and snooping (middleman, network peer) are simply far easier and far more likely.

You know those happen all the time, right? Literally all the time for certain users in certain places. A cleartext exploit is source-based (or route-based) and the server owner can't _ever_ do anything to fix it besides forcing encryption (or shutting down completely to that source).

In contrast, a server compromise is destination-based and will theoretically only exist for the time that it is not known to the server provider.

<comment><USER47> On the other hand, cleartext-based attacks are also more easy to _detect_ since the traffic is plainly visible. The maliciousness doesn't always have to be outside, despite all the focus on surveillance recently; and when it isn't, a "secure" connection makes it even harder to detect until it's too late.

Here's a recent demonstration of this principle - "smart TVs" phoning home via an unencrypted connection: [http://arstechnica.com/security/2013/11/smart-tv- from-lg-pho...](http://arstechnica.com/security/2013/11/smart-tv-from-lg- phones-home-with-users-viewing-habits-usb-file-names/)

If that was over HTTPS, would such data collection have been as obvious or even discoverable? It would be completely indistinguishable from any other "phoning home" \- e.g. to legitimately check for software updates. The same encryption technologies that purport to protect us from mass surveillance... can be used to do it even more stealthily, and this is the main concern I have with making encryption ubiquitous.

<comment><USER46> Interesting, though I don't know how this is really relevant to the debate about whether it's appropriate to tell a user that HTTP is insecure but HTTPS is secure (the comment I was replying to questioned that exact point).

That's because the technology clearly exists to hide the type of phoning-home you are talking about. Any move toward more HTTPS for end users doesn't seem to increase that risk to me.

</comment></comment></comment></comment><comment><USER48> Some one explain this to me. If I use Https would I still be protected from my own service providers (isp/carriers).

Surely anyone who can see the handshake can also decrypt what follows. I ask this because I'm assuming this move is a reaction to all the NSA buzz that's been in the media(assumption).

And I would figure the only way all the spying was going on is because one of the parties we depend on for our internet services anywhere from the ISP to the end server were compromised.

So how would HTTPS make a difference?

<comment><USER49> > Surely anyone who can see the handshake can also decrypt what follows.

If I understand your claim here, it seems that you aren't yet familiar with key pair cryptography.

It's not enough for someone to witness the handshake - they need to actually possess the 'private' key of one a party in order to decrypt traffic that has been encrypted with that party's 'public' key.

It's an amazing feat of mathematics; the fact that it is possible suggests, at least to me, that the physics of the universe in some sense favor the evolution of verifiable private communications.

Here's the wikipedia article on key-pair crypto (often simply called "public key crypto"): [http://en.wikipedia.org/wiki/Public- key_cryptography](http://en.wikipedia.org/wiki/Public-key_cryptography)

<comment><USER48> Thanks!

</comment></comment></comment><comment><USER50> This sounds like a good idea and a step on the right direction. However working in the embedded world, no one has yet created a system for using https that does not involve a lot of complex steps to prevent the browser from warning of an insecure link.

It would be nice if all browers worked more like Firefox where it is easier to add exceptions.

Going forward I can imagine the conversion I am going to get, "why does the brower say that my traffic controller is insecure?"

</comment><comment><USER51> I hope they'll label mixed content pages the same way as plain HTTP, it might motivate all the big websites that still get this wrong to get their act together.

</comment><comment><USER52> A better approach would be, in my opinion, to only show insecurity when a <form> or user input is requested, i dont really see the use in https everywhere for small static websites.

DNS will still leak most of the websites you visit, so anonymity in this case is not really the issue that will be resolved.

<comment><USER53> DNS will only leak which hostname you visit, not which pages you access on that hostname. You hereby definitely resolve a privacy issue.

Furthermore, the presence of a <form> element also looks like a very bad measure for 'protectworthy' information to me. Websites that require a user session to be established, need users to send a cookie for every request. Those requests need to be secure, or the sessions can be stolen.

<comment><USER52> Then, if there are sessions too, <form> was just an example.

You're right for the path though, but for a majority of users, this doesn't matter, that is because a website often has a specific subject (porn, warez, etc), so if one DNS lookups the website, then that pretty much gives it all if the middle man is interested.

Read: My opinion is that it's useless for most people, and is problematic for old infrastructures. Therefore there are as much benefit as negative effects, or more negative effects, so it doesn't seem worth it.

</comment></comment></comment><comment><USER54> Noooooooo! Why must the entire web be secure? I might run some micro news site for my local church that I update manually with (S)FTP and html files - why on earth should that connection be encrypted.

Bad security _should_ be marked as bad. No security is not inherently bad.

<comment><USER55> I disagree. No security really is as bad as broken security.

I'm guessing you think your church website isn't worth securing because it doesn't have any sensitive content. But in a world where surveillance is pervasive, that's not something you should depend on. For example, if religious discrimination were to lead to members of your church being harassed because of their viewing habits, then the argument that the content isn't sensitive doesn't seem so strong anymore.

<comment><USER56> Securing is different to encrypting.

Most tracking of people is done by advertising, and marketing companies. Should we mark all websites with advertising as insecure?

<comment><USER57> As much as I'd love that (seriously, not advertising per se of course but most types of cross domain tracking), something tells me that initiative is not going to originate from the Chrome team...

</comment></comment></comment></comment><comment><USER58> I have been looking into setting up SSL for my blog. There currently no free way to get SSL certificates. There are some free ones but they tend to come with strings and lure you into paid plans. I am not sure if this proposal is the best.

<comment><USER59> StartSSL is free and simple to use unless they changed recently. The only downside is that certain UAs don't trust the StartSSL CA, notably Java.

<comment><USER58> The free version doesn't come with wild card. So if you run multiple stuff off your VPS you will have to upgrade. I currently use self-signed certificate for everything except when I serve content to public I switch to http.

<comment><USER59> You could use SNI and support the majority of clients.

</comment></comment></comment></comment><comment><USER60> This seems to describe a situation where sites served over plain 'http' would pop a red 'x' or other distinguishing UI element to connote untrustworthiness.

This is almost the case already where a good number of browsers will show no positive (green indicator or lock icon) for domain validated certs - showing a preference for the much more expensive EV (Extended Validation) certs.

Screenshots of the different browser SSL level representations: [https://www.expeditedssl.com/pages/visual-security- browser-s...](https://www.expeditedssl.com/pages/visual-security-browser-ssl- icons-and-design.html)

</comment><comment><USER56> Sites with advertising should be marked as insecure. Since they have been known to serve trojans, and also are used to track people without their consent.

Will Google and Mozilla both do this? No. Because their revenue depend on it.

<comment><USER61> Google and Mozilla have no problem blocking sites that use non-Google ad networks as malware [http://marketingland.com/googles-chrome-browser-issues- malwa...](http://marketingland.com/googles-chrome-browser-issues-malware- warnings-for-major-news-sites-32520)

</comment></comment><comment><USER62> To all those arguing that HTTP is still fine, please go ahead and drop ssh in favor of telnet. Go ahead, I will wait. If you cannot figure out why HTTPS is more secure than HTTP and why we should drop HTTP support from all browsers entirely, then please go read about it. HTTP should be used no more than telnet these days.

I am not saying HTTPS is perfect as is, but I am saying that HTTP is fundamentally and practically broken at this point. It is exploited daily in many different ways and your and your users' experience is worse because of it. Stop using it, and help other stop.

</rant>

</comment><comment><USER63> > Secure (valid HTTPS, other origins like (* , localhost, * ));

Does this notation refer to any protocol and port on localhost? That's my guess, but the meaning of the notation wasn't immediately clear to me.

</comment><comment><USER64> Can someone explain this part?

        Secure (valid HTTPS, other origins like (*, localhost, *));

Are parenthesis-asterisk and asterisk-parenthesis some kinds of special origin?

<comment><USER10> In modern W3C and WhatWG specs, an "origin" is either a (scheme, host, port) triple or a nonce value. The asterisks in this case are being used as a shorthand for "any origin which is a triple and whose host is localhost, no matter what the scheme and port are".

</comment></comment><comment><USER65> This is a great idea, and I say this as the webmaster of many sites that are not secure. I should be forced to get my but in gear and fix that.

</comment><comment><USER66> So, looking at their screenshots...

How about prefixing the non-secure URLs by "[http://"](http://"), so that, you know, people will be sufficiently warned that it's not "[https://"](https://")?

</comment><comment><USER67> I think this is a good start.

But it is also important to educate users that even you are using HTTPS, some companies' internal network might not be fully encrypted and therefore it is not fully secure against some three-letter government agencies :)

</comment><comment><USER68> Related discussion with and in between W3C TAG members

[http://lists.w3.org/Archives/Public/www- tag/2014Dec/0098.htm...](http://lists.w3.org/Archives/Public/www- tag/2014Dec/0098.html)

</comment><comment><USER69> They should also mark as Non-Secure the situation when you are being MITM attacked by your employer - custom root CAs on Windows boxes are quite common.

</comment><comment><USER70> HTTP is not always insecure. Some environments (eg: LAN), can have network- level security (eg: IPSec).

</comment><comment><USER37> Since when is HTTPS secure?

</comment><comment><USER71> Google and others rarely ever mention DNS/DNSSEC, even though just as much information is being sent insecurely in the form of DNS queries/responses.

Learn more:

[https://github.com/jedisct1/dnscrypt- proxy](https://github.com/jedisct1/dnscrypt-proxy)

[http://dnscrypt.org/](http://dnscrypt.org/)

Check if you already have it enabled (unlikely if this is the first time you're learning about this) [http://test.dnssec-or- not.com/](http://test.dnssec-or-not.com/)

<comment><USER72> Is this working for everyone else? I get a "server not found" message.

[http://downforeveryoneorjustme.com/http://test.dnssec-or- not...](http://downforeveryoneorjustme.com/http://test.dnssec-or-not.com/) tells me that the server is up.

<comment><USER71> working fine here

there are others to check if you have it (I'm pretty sure you won't unless you have explicitly set it up yourself)

google 'DNSSEC test'

btw setting up DNSCrypt-proxy takes all of 10 minutes on Windows

</comment></comment></comment><comment><USER71> can someone explain how we can save threads within our HN accounts? it's not immediately obvious

</comment><comment><USER73> um...

</comment><comment><USER74> Finally...

</comment><comment><USER74> Long overdue. :)</comment>


Show HN: Argskwargs, flexible python lib for positional and keyword arguments - <AUTHOR> https://argskwargs.readthedocs.io/ <comment><USER2> Pretty neat API there. I don't see obvious use cases where I would need this though. Can you share some real life examples? Or simply share why you created this?</comment>


Photographers' anger at law change over 'orphan works' - <AUTHOR> http://www.bbc.co.uk/news/technology-22337406

<comment><USER2> So, yes, we've found a way to look at this law and find an issue that needs addressing - claiming these individual small works.

The aim of this though is to rescue all of the orphaned works that should be in the public domain but are wrapped up in all kinds of mess. If you are contactable as the owner of a work then your rights are not in question. But there are tons of orphaned works that are locked up because of the complexity of assigning copyright and identifying holders.

The real enemies of this bill are big media companies who recognize it as a first step at revitalizing the public domain after decades of encroachment by industry friendly bills. They'll couch the arguments like this when lobbying - it hurts the little guy - but they don't care about the little guy.

If your pictures are on your instagram account there's a simple way to contact you. You are clearly identifiable as the content rights owner.

The constantly increasing levels of copyright are a far bigger threat to our freedoms than figuring out how to meta-data tag instagrams to clearly identify the copyright owner to stop some mythical entity reproducing your picture of your cat farting.

<comment><USER3> Your missing the point of this. It's supposed to protect large companies when they use a photograph withought permission. Because piracy is bad unless your newscorp ect.

<comment><USER2> Thank you for explaining what I'm missing from your point of view. However, I've been following this legalization since it was being discussed a long time ago and it's absolutely about returning works to the public domain. Sure there might be some areas to iron out but it was not conceived as a gift to big corps but as a way of slowly eroding their ability to use copyright to crush competition. Their ability to use the odd photo unpaid is a far smaller issue, it's just one they've discovered resonates so are pushing it as a phony grass roots issue which people are jumping on. This is how big corporations always attack restrictions.

The balance of benefits to society will outweigh the negatives if we can increase the ability to recla orphaned works for the public domain. People reacting against this miss the point that right now if they want to use your photo they will and you'll probably never even find out and have little recourse if you do.

</comment></comment></comment><comment><USER4> This is a very dangerous law.

One will believe that now with digital cameras, everybody will took their own photos before taking someone's else. But not.

This is very serious, Big companies will use the web services in other countries like China or Russia to automatically remove copyright info from pictures or text and post them. Then you can just take those documents legally "as there is no copyright metadata" in the picture.

New legislation is making Big companies benefit and small ones to be crushed by them.

If you are from UK, it is time to do something.

<comment><USER5> Tineye is a simple prevention. If the photo is indexed online, the owner is findable.

</comment></comment><comment><USER6> How does this interact with existing international copyright law?

For instance, if a professional US photographer's work was infringed and a mere fraction of their going rate were held in escrow by the "independent body", would they get paid a pittance and told "tough luck"? Or could they pursue a more proper recompense?

</comment><comment><USER7> Terrible law because it further tips the balance in favor of the big copyright owners.

</comment><comment><USER8> How about a national db of photos that's free for artists to register low res works on. If someone wants to publish with media they don't have a license for you're required to do an image matching search. If you get a match you pay a buck for the contact info of the artist and have to get a license. If the artist finds you used it without paying them a licensing fee and it's registered you pay a fine based on what you made off the usage. So a newspaper maybe has to pay 10% of revenues for the day they ran the image on the front page. I honestly don't know what kind of penalty is appropriate here, but obviously it should be more than can be absorbed as the 'cost of business'.

<comment><USER9> My first thought as well, but what about photos that aren't in the database?

Either you consider those orphan works which would mean everybody has to submit every photo (or implicitly "license" them as orphaned).

Or you consider them non-orphaned and fall back to all rights reserved, which would make the database little more than a public version of a photo licensing catalogue, several of which already exist.

<comment><USER8> Yes, I think it becomes THE licensing site, at least in the UK. I guess in my mind it would leave less wiggle room for infringers. NOTE: not a copyright maximalist at all but I can imagine it sucks to finally get your one great shot out there and . . . no credit given. So yeah puts a burden on artists to register there works but if it's free to do so, seems like a reasonable way to protect your work.

<comment><USER8> Also you'd really have to register first then you could publish your own works to prevent others from snapping up orphaned works and trying to pass them off as their own by registering them. The whole thing is probably hugely impractical, but you'd really have to run estimates for coding, storage, admin etc. and since it would be a govt. project it would likely cost way more then it should ;).

</comment></comment></comment></comment><comment><USER10> Does that mean from now on, rather than "Copyright © 2013 Kailuo Wang", I have to say Copyright © 2013 my Email address ? Does it mean that if someone steal my photo without permission and removed copyright information, other people can just use download it from there and legally use it however they want because they cannot contact me?

<comment><USER11> > Does that mean from now on, rather than "Copyright © 2013 Kailuo Wang", I > have to say Copyright © 2013 my Email address ?

No. You can put in whatever copyright information you wish as long as you are able to be contacted based on that information.

> Does it mean that if someone steal my photo without permission and removed > copyright information, other people can just use download it from there and > legally use it however they want because they cannot contact me?

Yes.

</comment></comment><comment><USER12> Note that this law was passed in the UK, but it might inspire politicians in the US to pass similar legislation.

</comment><comment><USER13> I don't know why people are getting so upset about this.

Canada has had a very similar law for decades and it only really gets used when people want to legally duplicate architectural drawings and land surveys where the original person who drew it is out of business or dead.

I hardly see this as opening the flood gates to mass legal copying of photos from the Internet. People who are going to copy and repost photos without regard for copyright are already doing it today. This law won't change that, and I doubt they will go though the hassle of following these proposed rules.

</comment><comment><USER14> I'm a non-professional photographer and a hacker. I've made a very small amount of money when people bought my photos ($4 I think :D).

This is an amazing law. Diligent search includes using Tiny Eye so there should be no concern about stealing others photos, putting them up on a Chinese site and then claiming not to be able to find them.

Also, if you ever want to get in touch with someone you can easily contact, say, 500px, flicker or Instagram to get someones contact info if you want to use the photo for commercial use.

Anyway, this is awesome.

</comment><comment><USER15> So what's stopping someone from taking a picture of say a book, putting some instagram filters on it, and calling it a "photograph"? Is there anything in the law preventing such a slippery slope?

</comment><comment><USER16> Pretty amazed that they would make it legal to steal... The law is too vague on how they would attempt to contact the owner and it does not state how much they have to pay to license it.

<comment><USER17> It's not stealing. It's copyright infringement. It's pretty important that we not let this distinction slip entirely from the public consciousness, because they're very different concepts.

<comment><USER18> It's stealing if you infringe my copyright. It's sharing if I infringe someone else's.</comment></comment></comment>


Thoughts About Sparrow UI - <AUTHOR> http://tumblr.charaveldesign.com/post/4729610738/thoughts-about-sparrow

<comment><USER2> That's so rough. The current UI scales kinda awkwardly for multiple accounts, and has definite usability issues. This makes it more unwieldy and potentially impossible to scale past small numbers for accounts _or_ tags, while adding two levels of information above the main content you want to view in the app - your messages.

At the same time, it loses the clean and simple aesthetic of Sparrow, instead deciding to add superfluous iconography, colors and labels.

That's just the main window though. Some of the additions to the message preview view are quite clean and in keeping with the app's demeanor, though potentially unnecessary, as the current interface accomplishes the same clarity with fewer buttons and toggles.

</comment><comment><USER3> My biggest pain is when you select an account on the side and it marks the first email as read.

I only want the email marked read once I click on it.

</comment><comment><USER4> from the article: "While it worked fine with Tweetie because most of its users probably only use one or two Twitter accounts, Sparrow built it's UI around it without thinking it through: What about people with several email accounts?"

Since it's a gmail client, I have setup one master gmail account that proxies to all other accounts (configured through the web browser client), and have setup aliases in Sparrow. It works great

<comment><USER5> This is something I also do. I have more than 5 accounts proxied.

</comment></comment><comment><USER6> I used sparrow for months and really enjoyed it but eventually had to switch back to mail for exactly these reasons. I agree whole heartedly with all of the points against sparrow but I'm not sure about the solutions...not that I have better suggestions.

Either way, I won't bother opening or even updating sparrow until it gets a universal inbox. I love the UI for the most part and I'm anxious to switch from mail.app but for now the problems sparrow introduces are worse than the ones it solves.

</comment><comment><USER5> Doesn't the icons on the bar limit the amount of accounts the user can have?

Also note that Apple has some kind of regulations (and they're very strict) regarding the UI.

I personally love the fact the docked mail listing expands to the right since I have a dual 27'' setup. So it would make me sad if they changed this.

The preview part basically breaks what Gmail has polished over the years, and to me it doesn't feel that useful to have the title on the messages, since most of them are RE:

I like the easier access to "tags"; but I'm concerned that the approach you're using would become problematic since I have many tags (I'm a gmail power user who gets around 50 mails avg. which get filtered through different tags via regexp).

But overall good job! I like when people expose their ideas. It's a good way to get lazy people like me to debate on decisions.

Kudos.

</comment><comment><USER7> I have several email accounts and I'm overall pretty happy with the way Sparrow works. I generally know which mailbox to search in, since each email account has a definite purpose (personal, business, and one account for each client that I help handle support emails for).

As for some of the other complaints, maybe it's just the way I handle my email that prevents me from running into them. I use the keyboard shortcuts to inbox zero every time I check my mail (going down the list and either archiving, deleting, or starring emails for followup).

The only real gripe I have after using it since beta is the "All Mail" box being buried in the labels instead of in the sidebar where it used to be. Other than that, I can't say that any other gripes come to mind.

</comment><comment><USER8> My biggest issue with Sparrow is failure to support "Unread" count across a set of labels. Those with a high volume of mail often set up filters to pre- file that mail. I then use Apple Mail's "Smart Mailbox" to roll up the unread messages from only those labels that matter, while ignoring the labels containing mostly bulk content.

For me, any program that interacts with Gmail and doesn't support seeing unread count across labels, can't be used.

Disappointed. I paid for Sparrow, and wish it could be used. The update wasting more screen real estate to let you choose between Inbox and another label could so easily have been the killer feature it failed to be.

</comment><comment><USER9> Does Sparrow still force "Sent with Sparrow" to the end of signatures on outgoing mail?

Edit-- I just confirmed for myself that it does at least in Sparrow Lite <http://dl.dropbox.com/u/7400069/sparrow_lite_signature.png>

<comment><USER10> You can change that. Like the iPhone, the signature just defaults to a promotional message.

<comment><USER11> Except that there's far less reason for Sparrow to advertise itself like that.

<comment><USER11> I love it when people with vested interests down vote on HN.

If Thunderbird or Mail.app advertised itself on emails you send out by default, people would be up in arms.

Do you see Gmail doing that? No. And even then, these three programs are _free_.

If I pay for Sparrow (and I did, and it was disappointingly slow and had poor UX -- but it sure did look pretty in the screenshots!), I don't want it to advertise itself to everyone I email -- because I'm not here to do your marketing for you. Let me opt-in to your poorly thought out self-promotion instead of pissing me off.

Down vote away!

<comment><USER12> It's a new pricing model. I think they're calling it "shareware." The idea is that they release "free" versions of software that are almost fully functional but have small nags or annoyances to encourage you to purchase if you enjoy using them…

<comment><USER11> I think you missed the point.

I did buy it. It still advertises itself _by default_.

<comment><USER12> I apologize for missing the point. You're right; that is annoying and no, they should not do that by default.

Side-note: I just re-read my comment and I sounded like a jerk. I would also like to apologize for that. The sarcasm didn't age well (to my ear anyway).

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I bought Sparrow the first day I had a Mac, thinking, "this will be awesome."

Day four: I installed the offline Gmail app in Chrome, and Sparrow never, ever gets opened. I would dearly like a native app, because the web app does have its own issues, but this isn't it. I'll take functional over pretty any day.

</comment><comment><USER14> The lack of search across multiple accounts is a huge pain.</comment>


XOS: Build your own operating system - <AUTHOR> http://xosnitc.github.io/index.html <comment><USER3> _The machine simulator is known as eXperimental String Machine (XSM). It is an interrupt driven uniprocessor machine. The machine handles data as strings. A string is a sequence of characters terminated by '\0'. The length of a string is at most 16 characters including '\0'. Each of these strings is stored in a word. (Refer Section: Memory) The machine interprets a single character also as a string._

What an... odd architecture. Fun for experimentation, I'm sure, but I think it's too different from contemporary CPUs to give a good taste of what the "real" thing is like.

<comment><USER4> Yeah, that has me scratching my head as well. Especially once I realized there's no way to index _into_ a string...

<comment><USER5> Caveat: I haven't read the spec. But at that level wouldn't you just be doing pointer math to access specific parts of the word?

</comment></comment></comment><comment><USER6> Should use x86/ARM/MIPS so that students get real world experience. You might never have to write an OS, but knowing x86 assembly will help you debug and optimize code.

See the following course: [https://courses.engr.illinois.edu/ece391/](https://courses.engr.illinois.edu/ece391/)

<comment><USER7> I don't think you "should" use anything. There's plenty of x86/ARM/MIPS projets out there. I applaud the fact that they went with something different.

Isn't building what you consider fun what hacking is all about? I think it's healthy to completely ignore "usefulness" at times and doodle along :)

<comment><USER8> Also, if we're talking about theoretical "students," quality is often more important than subject. Academics often recommend undergraduates "choose your course by the teacher, not the subject." Same principle here, if they work on something fun and they have fun, they will learn more.

</comment></comment></comment><comment><AUTHOR> "Project XOS or eXperimental Operating System is a platform to develop a toy operating system. It is an instructional tool for students to learn and implement OS data structures and functionalities on a simulated machine called XSM (eXperimental String Machine)."

XOS is used at the National Institute of Technology Calicut, India to teach Operating System principles [0]. The OS Lab essentially consists of students designing and implementing a kernel for XOS, starting from scratch:

"Cross compiler, debugger, file system interface and other supporting software tools are provided. The student will implement the scheduler, memory management, process management, exception handling and file system management functions of the OS."

[0] [http://athena.nitc.ac.in/~kmurali/os/index.html](http://athena.nitc.ac.in/~kmurali/os/index.html)

</comment><comment><USER9> Enough for operating systems and compilers. I'm still waiting for some "Build your own ACID compliant database system".

<comment><USER10> You might want to look at the blog of H2 database author. He wrote 2 DB from scratch.

<comment><USER9> Hm, not easy to find. Could you please share the link of that blog?

</comment></comment></comment><comment><USER11> Someone should tell them that the names "XFS" and "APL" are already taken.

</comment><comment><USER12> Most people enticed by this headline probably actually want xv6 (a modern simple implementation of UNIX v6) or {buildroot, OpenEmbedded} (frameworks for generating Linux distros).

</comment><comment><USER13> I think that a more simple machine were anyone can program it on assembly (and eventually on C) could be better :

[https://github.com/trillek-team/trillek-computer](https://github.com/trillek- team/trillek-computer)

[https://github.com/trillek-team/trillek-vcomputer- module](https://github.com/trillek-team/trillek-vcomputer-module)

<comment><USER3> That's the first "toy architecture" I've seen that attempts to define a PCI- like plug-and-play scheme... and a set of device classes that are suspiciously reminiscent of USB. :-)

What's really unique is the option to use Notch's DCPU-16 or a MIPS-like TR3200 as the main processor. The whole system has a good "real computer" feeling to it, which I think is especially important for educational use.

<comment><USER13> _That 's the first "toy architecture" I've seen that attempts to define a PCI- like plug-and-play scheme... and a set of device classes that are suspiciously reminiscent of USB. :-) _

Yeah, it get details of both. Also, we did take a look to Amiga's autoconfig and Z80 and 8086 interrupt handling schemes.

The TR3200 itself is inspired on MIPS and ARC (a simplified SPARC cpu for using on computer architecture courses )

</comment></comment></comment><comment><USER14> On the topic of experimental OSes:

[https://github.com/ayourtch/ayos](https://github.com/ayourtch/ayos)

a little experiment of my own to see what happens if I put Lua on bare metal (currently KVM-only) in x86_64 mode.

Lots of fun to toy with, though it does not do much yet.

<comment><USER15> How are you handling libc? you have your own (or is this even an issue with Lua)? I've been thinking of putting a Common Lisp implementation on bare metal (initially thinking of SBCL, but I think MKCL may be a easier challenge), but haven't found the time to start yet.

<comment><USER14> I've grabbed the missing routines from musl libc (and culled some parts of the Lua standard library for the sake of reducing the number of requirements, e.g. io.*), and used venerable Doug Lea's malloc for memory allocations.

The stock Lua 5.1 has the least number of dependencies, so I picked it - <USER2> idea is to practice and then to eventually have LuaJIT run on bare metal.

<comment><USER16> Good luck with it. You are on the path of having Smalltalk. :)

</comment></comment></comment></comment><comment> li-ch Don't we already have Nachos for students?

[http://en.wikipedia.org/wiki/Not_Another_Completely_Heuristi...](http://en.wikipedia.org/wiki/Not_Another_Completely_Heuristic_Operating_System)

</comment><comment><USER17> At my University (Imperial College London), our operating systems coursework was built around a toy OS called Pintos ([http://en.wikipedia.org/wiki/Pintos](http://en.wikipedia.org/wiki/Pintos)), which is written in assembly and C and runs on x86. The project was to fill in the blanks in the implementation (more advanced scheduling, memory management, swapping etc) and I think most people thought it was one of the most fun projects we had. Being more realistic wasn't really a problem as the really arcane parts were already implemented.

</comment><comment><USER18> This is nice. I'm going to try this out over the weekend. Thanks!

</comment><comment><USER19> Or you could just go pick up a series of JOS exercises like they do in every operating-systems class ever.</comment>


Airbnb could "scan your online life" to see if you're a suitable guest - <AUTHOR> https://www.standard.co.uk/tech/airbnb-software-scan-online-life-suitable-guest-a4325551.html <comment> scottie-sch Seems like a step towards what China is up to with their social credit score concept. I can see this would be useful from a safety/business risk perspective, but have concerns as to what this means from a personal perspective. Who draws the line between what's good and bad, and how does this take into account people change? IE., what was on my facebook feed 10 years ago has no relation to who I am today.

<comment><AUTHOR> Agreed, people change; what you did 10 or 5 years ago may not be a good representation of who you are today.</comment></comment>


CSS 2.1 becomes a W3C Recommendation - <AUTHOR> http://www.w3.org/2011/05/css-pr.html.en

<comment><USER2> I guess we can all start using it now. Heh.

<comment><AUTHOR> Yea, most people are already using it because of CSS 2.0. The problem was that it had many problems, leading to no browsers that fully implemented CSS 2.0 (and keep in mind when IE6 was released, CSS 2.1 did not exist at all even as a draft).

</comment></comment><comment><USER3> Anyone know the timeframe of which standards are going to be set in CSS3 and we can develop without the need for:

-moz-...

-webkit-...

Etc.?

<comment><USER4> it's a module by module basis. For example, backgrounds and borders module hit CR (candidate recommendation) which is when vendors can officially drop their prefixes.

You don't really need to use prefixes on border-radius or box-shadow anymore. Not for the most part. css3please.com has extra detail on when you need 'em.

</comment></comment><comment><USER5> I can't wait for them to endorse CSS3 in 2019.</comment>


Why Common Sense Is Not So Common in NLP - <AUTHOR> https://sujayskumar.com/ <comment><USER2> This problem of inferring something's truthfulness based on the number of times it's written down is nicely explored in the paper "Reporting Bias and Knowledge Acquisition".

[https://openreview.net/pdf?id=AzxEzvpdE3Wcy](https://openreview.net/pdf?id=AzxEzvpdE3Wcy)

</comment><comment><USER3> I ran into this roadblock when trying to use NLP to analyze Yelp reviews for restaurants. A phrase like "they served me a well-done steak" can sound like a compliment but actually be a complaint.</comment>


Are you wasting your AdWords budget on in-app ads? - <AUTHOR> http://successfulsoftware.net/2014/06/25/are-you-wasting-your-adwords-budget-on-in-app-ads/ <comment><USER2> I mean, isn't this advertising 101? If you put an ad for something in front of an audience that won't buy it, you're going to get terrible performance. If you're selling $1000 b2b software, don't advertise on flappy bird.

[https://support.google.com/adwords/answer/1722057?hl=en](https://support.google.com/adwords/answer/1722057?hl=en)

edit: I guess the contentious point here is why they enable non-specific in- app ads by default.

<comment><USER3> Not only did they enable non-specific in-app ads by default, they apparently also automatically enabled it for all existing ad campaigns. I think that's the key takeaway?

</comment></comment><comment><USER4> Right now, I'm wondering how anyone gets any sensible results out of Google Display Network advertising at all. I had my first and, for the foreseeable future, probably last experience with them recently.

Despite running ads in a style that worked well on other ad networks, using highly specific terms to target the site's niche audience, for a site that generally gets excellent engagement once people find it, there was literally 0% engagement from GDN visitors. Not a single person so much as visited a second page, according to Google's own statistics.

It turned out that most of the ads were being shown on pages that seemed to have little if any obvious connection to any of the targeting terms. The top referrer even had the small print, low contrast, keyword spam at the top of the page (Viagra, payday loans, that kind of stuff) that I thought everyone gave up on years ago. And Google had the audacity to charge us for that traffic.

Our solution is simple: We no longer have an AdWords budget, and we've cancelled all our other Google-related to-do items in favour of various other on-line channels.

<comment><AUTHOR> There are thousands of scammy websites trying to game the system. It would be very hard for Google to keep on top of it, even if they really wanted to.

There is also the issue that Display ads are 'old school' interruption based advertising. They are never going to get the same sort of engagement and conversion rates that well targetted Search ads get.

Also I guess most of the websites with good quality content charge advertisers direct, rather than getting chump change from Google Display ads.

<comment><USER4> _There are thousands of scammy websites trying to game the system. It would be very hard for Google to keep on top of it, even if they really wanted to._

Sure, I can understand one or two getting through. But just looking down the top referrers from Google's own stats, _almost none of them_ appeared to be related to the chosen target terms in this case.

 _There is also the issue that Display ads are 'old school' interruption based advertising. They are never going to get the same sort of engagement and conversion rates that well targetted Search ads get._

Yes, GDN is "old school" advertising, but that doesn't explain a _total_ lack of engagement from the visitors. Other on-line advertising channels have been used to promote the same site, including multiple variants of display advertising using almost exactly the same ad styles and targeting strategies. Some seem to be more successful than others after the first few experiments, but all of them consistently achieve fair to very good engagement levels.

I almost have to think that something went wrong here, because I don't understand how Google can still be in business if our experience is typical of the results they can offer. Perhaps it works better for sites with less specific audiences or for big name brands. Still, if that is the best Google can do for a niche site with very targeted terms, it has literally no value as an advertising channel for us.

<comment><AUTHOR> Maybe a significant proportion of the clicks you got were from click farms or bots, who were working for the benfit of the site hosting the ads (and incidentally making lots of money for Google)?

I have had much better results with Search ads.

<comment><USER4> _Maybe a significant proportion of the clicks you got were from click farms or bots_

Given the obvious keyword spam I mentioned on one of the top referring sites, that wouldn't surprise me at all. But again, if Google are that bad at dealing with fraudulent clicks, we're going to make that their problem rather than ours!

 _I have had much better results with Search ads._

Google search ads are actually our second worst-performing experiment by some way as far as on-line channels go. However, in fairness to Google, we already rank on the first page for almost all the targeted terms in our current strategy anyway, so it is entirely possible that any keywords generic enough to be useful on top of that are also broad enough to be the wrong scale for our needs.

A more interesting contrast for us is the results from advertising say via Facebook (targeting similar interests/demographics) or via individual ads we've placed directly with a few established sites relevant to our target audience. Those channels should be directly comparable to GDN, yet all of them have consistently performed vastly better.

<comment><AUTHOR> Have you check the 'Dimensions>Search terms' report to check the phrases your ads appear for (which won't be the same as those you bid on, unless you are only using exact match) are well targetted?

Another common mistake I have seen is to advertise expensive English-language products to people not searching in English in poor countries.

It is so easy to make mistakes in AdWords.

<comment><USER4> Thanks for the suggestions, but I don't think anything like that could explain our poor results specifically with Google. We did keep an eye on the actual terms in the search ads and knock out a couple of genuinely related things that aren't any good for this specific site, and similarly we started looking at manually removing bad placements with the GDN ads until it became obvious that it was futile. Also, all the ads were targeted by country (and similarly for the other channels I mentioned, where applicable) so again there's no reason performance on Google should have been so much worse than every other on-line channel we use.

I've just noticed that Google e-mailed us with a phone number we could call for "free support and advice from an AdWords expert". Might be good for a laugh (or a refund, not that we let them near very much money anyway).

<comment><AUTHOR> I have heard from others that the quality of advice from their AdWords 'experts' is very variable. So I would be skeptical about whatever they suggest.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> We went through exactly the same thing ([http://blog.aha.io/index.php/pissing- away-our-money-with-goo...](http://blog.aha.io/index.php/pissing-away-our- money-with-google-display-ads/)).

You can opt out of the in-app ads completely by adding "adsenseformobileapps.com" to the excluded domains.

<comment><AUTHOR> Useful to know there is a (rather obscure) opt-out and also that you were able to get money back from Google. Thanks.</comment></comment>


BitShares re-org: BitShares 2.0 - <AUTHOR> http://bitshares.github.io/blog/2015/06/08/announcing-bitshares-2.0/

<comment><USER2> The dynamic hierarchical permissions are huge improvement to multi-sig from a user experience perspective.</comment>


YC Ivy League Bias - <AUTHOR> http://davidduey.typepad.com/weblog/2007/09/ivy-league-bias.html#isError:false I enjoy reading Paul Graham's essays.  He's obviously a smart guy and usually has thought provoking and interesting essays.  He often looks at things from a different perspective and I like that a lot, although I don't always agree with his conclusions.  I've also followed along with his Y Combinator "seed investment firm."  However, I've never applied to Y Combinator or even considered applying because I've always felt like he leans heavily toward the Ivy League crowd.
<comment><USER2> Speaking from someone who attended one, it is very easy to go to an Ivy League school and not excel simply because you (and everyone else there) are assumed to excel because you attend one.

As a point of a comparison take China. China's most acclaimed school Peking University is fiendishly difficult to get into but gives a ridiculously easy education once you are there. Still, Peking U grads are able to go most places they want. Schools with a science/math/engineering focus seem to do better at maintaining a higher standard, but their students frequently come out looking like they just popped out of a cookie-cutter - not even a hint of an independent idea.

A fuller exploration question is of course more complicated than this, and would have to address at least the following questions: Why did the core curriculum of the West die? Could it be replaced with a broad and rigorous humanities education or are broad and rigorous contradictory? If not, how can they productively be combined?

<comment><USER3> I think the more important thing is depth and rigor. To have truly original ideas, we need to understand the underpinnings of our current civilization. Otherwise, many 'innovations' are merely going back down the path we came from.

I had an undergrad education like this. We went through the main books of the Western canon, and instead of being lectured at all the time, most of what we did was creative and rigorously scholarly. We'd read a couple classics a week, with a couple class debates/discussions concerning the works. Then, we'd have to write a thesis every semester. Finally, we were highly encouraged to do important extra-curricular activities such as acting or music. Probably one of the best educations you can get in the US.

<comment><USER2> St. John's?

<comment><USER3> No, it was at Biola University (private Christian college) with the Torrey Honors Institute. Probably not quite up to par with St John's and the other one (Thomas Aquinas?), since THI only started about 10 or so years ago.

<comment><USER2> Fascinating. Were the THI students segregated from the rest of everyone? Sounds like you enjoyed it? Any criticisms?

I suppose it doesn't surprise me that a conservative Christian would offer a Western classics program. Still I am surprised I never heard of it before, especially since it is based on D. Sayers philosophy of teaching (whom I adore).

FYI my university's English program followed the reverse track, recently removing Bunyan from the curriculum.

<comment><USER3> Check out scriptoriumdaily.com for the tutors' blog.

<comment><USER2> Subscribed. Thx.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> It wouldn't surprise me if a very large majority of YC applicants did NOT go to the Ivy League.

Regardless of whether students/graduates of those schools are smarter, from what I've heard there is much less of an entrepreneurial spirit in the Ivies.

If anything, I would think YC has a bias towards schools like MIT, Berkeley, CalTech, Stanford, UIUC, etc., none of which are in the Ivy League.

(And by bias I don't mean an admissions bias, simply that a greater percentage of accepted teams go to these schools)

<comment><USER5> People from the 'top-tier' schools are shooting for a multitude of things besides entrepreneurial success. I graduated from UChicago, and it seemed as if a massive majority of my fellow students were going after law, banking, or academia. At my five-year reunion I was one of the only people I met _not_ pursuing one of these paths. In addition, many students at these schools have some kind of anti-business ideology or another, so subtract them from the picture as well.

I agree that there are probably more great teams from the technical universities and high-end state schools than from the ivies and famous private universities.

</comment></comment><comment><USER6> I'm a data point on the side of YC not having an Ivy League (or "top tier") school bias. I went to community college. For audio recording and music--I've never taken a single computer class after high school AP classes. My co- founder went to a good school in Australia, but I didn't know what it was when filling out the application so I just said, "some school in Australia, probably a good one, and probably for computer science".

That said, the number of Stanford, CMU, UC, MIT, etc. students and graduates is quite high in YC, and I can't think of any other community college bums in the bunch.</comment>


Fed has abandoned monetary policy, critic says - <AUTHOR> http://uk.reuters.com/article/companyNewsMolt/idUKTRE50306H20090104?pageNumber=1&virtualBrandChannel=0 <comment><USER2> I wouldn't say that they've _abandoned_ monetary policy, it is that their primary tool in the past has been manipulating interest rates. Now that interest rates are effectively zero, they've painted themselves into a corner. Their only other significant tool, loaning money to "member banks" isn't useful because the funds needed to keep the banking industry afloat need to be largely astonishing numbers. I contend that the $700B bailout is just the beginning, and the final butcher's bill will end up being closer to $5T.</comment>


Top academic institutions in 2018: normalized - <AUTHOR> https://www.nature.com/articles/d41586-019-01924-x <comment><USER2> This is a fairly bizarre way to rank academic institutions. First of all, the methodology almost entirely neglects computer science because its metric of success is papers published in top tier journals; computer scientists tend to submit to conferences (e.g., NeurIPS) and hence get no credit for their work in this count. However, other fields seem over-represented from the list of journals---this is likely why Cold Spring Harbor, a very good biological lab where probably the vast majority of the papers are published in Nature- approved venues seems to be so elite.

The "normalization" they use divides the proportional count of authors that have contributed to an article in the "Nature Index" to the total output of the institution in the sciences, measured by a company called Dimensions. This has the odd effect of penalizing institutions for publishing outside their listed journals.

Finally, as an academic, there are some journals on the index that I have published in, but many venues I have published in did not make their cut. Sometimes more specialized journals are necessary---one cannot easily publish, for example, a detailed proof of a theorem in Nature, even if the result is very important.

List of journals: [https://www.natureindex.com/faq#introduction1](https://www.natureindex.com/faq#introduction1)

<comment><USER3> The lists, and Nature index, seem like a pretty transparent ploy. Want your institution ranked well? Make sure you publish with us.

Departments and institutions already fret over US News rankings. I wonder if we'll see memos encouraging publication in NPG journals if these rankings become regular.

</comment></comment><comment><USER4> As an Austrian, I'm very happy that the just ten year old IST Institute made it to second place. What really sets this institute apart is its lack of departments and thus its organic multi-disciplinary approach and culture. An approach I personally find very fruitful in my social relationships as well, as I learn so much from people who do different things than I do. It's enriching in more ways than I imagined.

<comment><USER5> As a non-Austrian doing fairly well at a top university, IST has put Austrian academia in my list of possible next stops and far higher than much more prestigious places.

From what I've heard from some fellows, they are doing a really good job at creating a nice academic place sans all the bullshit that comes associated with that lately i.e., politics. Probably a fresh start helped.

<comment><USER4> I wish you all the best!

</comment></comment></comment><comment><USER6> I'm uncomfortable that number of papers was considered part of the quality of the institution as a whole...

<comment><USER7> It was published by Nature. The number of papers is the only metric they care about.

</comment></comment><comment><USER8> One potential concern with this normalization is that it could boost institutions with a single world class research group. That group could be pumping out papers while the rest of the school is average.

</comment><comment><USER9> Not at all surprised to see Brandeis on there.

<comment><USER10> Is Brandeis supposed to be that good ?

</comment></comment><comment><USER11> I've just finished reading "DNA: the story of a genetic revolution" by J. Watson, Nobel prize winner, who was a long time director of Cold Spring Harbor laboratory (number 1 on that list). It is an awesome and very easy overview of the field which I highly recommend (one of the best books I've ever read)

<comment><USER12> Watson is a very good writer - and funny.

I've heard a lot of unsavory things about him but I've also heard that his unique perspective led directly to the climate at CSHL which positioned the lab to be at the center of so many breakthroughs.

<comment><USER11> more importantly than a good writer, he is great scientist and scientific leader. It takes a special person to create and/or lead the growth of a team/lab/institution to world-class level. Somewhat reminds me of M. Kelly from Bell Labs

</comment></comment></comment><comment><USER13> I wonder if a calculation similar to the h-index measure could be used rather than giving each submitted paper equal weight.</comment>


Books Every Entrepreneur Should Read - <AUTHOR> http://davidcancel.com/10-books-every-entrepreneur-should-read/ <comment><USER2> Link dead for me. Found the list republished here: [http://thenextbigtechthing.com/10-books-every- entrepreneur-s...](http://thenextbigtechthing.com/10-books-every-entrepreneur- should-read/)

"The Entrepreneur's Guide to Business Law" -- LLC vs C-corp vs S-Corp? Founder's vesting? Liquidation Preferences? Equity vs Debt financing? This book will educate you enough to be able to answer these and many other important questions.

"Bootstrapping Your Business" -- From the founder of RightNow. The amazing story of how a geographically-challenged (Montana) entrepreneur built a world class business.

"Purple Cow" -- Dead simple premise, the key to marketing is to build something remarkable.

"The Art of the Start" -- The Art of Pitching, Marketing and Funding your Startup.

"The Innovator's Dilemma" -- If your startup beats all the odds and becomes hugely successful prepare yourself for the innovator's dilemma, cannibalize your product before someone else does.

"The E-Myth Revisited" -- How-to create a business not a job.

"Permission Marketing" -- The greatest marketing asset your startup can build is the permission to market to your customers and prospects.

"Growing a Business" -- Sincere advice for creating a company culture that your team and customers will love.

"The Cluetrain Manifesto" -- Successful marketing is a conversation.

"Bottom-up Marketing" -- Pure bottoms-up execution. Marketing tactics to grow your business.

<comment><USER3> I'm sure it's a good list of books, but you can't really talk about entrepreneurship without mentioning Steven Gary Blank's "Four Steps to the Epiphany"

<comment><USER4> Any entrepreneurship reading list without "Four Steps to the Ephphany" or "Crossing the Chasm" is suspect.

</comment></comment></comment><comment><USER5> <http://ycombinator.com/newsguidelines.html>

> If the original title begins with a number or number + gratuitous adjective, > we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to > "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is > meaningful, e.g. "The 5 Platonic Solids."

Could we crop the title please?

</comment><comment><USER6> If I read every 'must read' book I'd never have any time to actually do the thing in question!

<comment><USER7> Skip over the anecdotes, then most self-help business books are about 50 pages of text…

<comment><USER8> And the points they make are even less than that. I've worked places with a subscription to get abstract:

<http://www.getabstract.com/>

Very nice; you can just subscribe to the business books feeds, read the 3-page PDF summaries, and decide if you care to read any deeper.

<comment><USER7> I really liked Kindle's samples in this regard. Most of it is a few pages from the introduction, and most of the time that's _very_ representative for the those types of books. If it starts with a recollection of the author's childhood or the experiences of a client, you can ditch it most of the time…

</comment></comment></comment></comment><comment><USER9> I would add personal MBA by Josh Kauffman to that. It's a high level summary of all areas an entrepreneur should know about.

<comment><USER10> Meh, I didn't find it that great. I thought the reading list was great but 'skin deep generalizations' is equivalent to 'high level summaries' in my opinion.

</comment></comment><comment><USER11> Someone please add "Building Scalable Websites" to that list, as his site appears to have stopped doing so and the link is now dead

</comment><comment><USER12> Start Small, Stay Small

<http://www.startupbook.net/>

</comment><comment><USER13> Prehaps entrepreneurs should stop reading and start doing. Some things are just impossible to learn from a book, and even the things that can be learned from a book can be learned faster and better through personal experience.

<comment><USER14> That's way too broad and general. The problems that hit entrepreneurs along the way are often things they don't know they should be learning before it's too late. By that point, the only thing you're learning from is your mistakes, and that's no way to learn if you can avoid it.

</comment></comment><comment><USER15> Didn't care much for Purple Cow, but Art of the Start and Innovators Dilemma are solid.

Just finished reading Good Strategy Bad Strategy by Richard Rumelt. Very good book.

</comment><comment><USER16> The Intelligent Investor by Benjamin Graham.

<comment><USER3> Great book for investment principles, not sure how good it would be for entrepreneurs except in a very circumstantial way

</comment></comment><comment><USER17> This is a list of books for people who wanted to know how Entrepreneur works.

Entrepreneur should do 2 things:

1) Work

2) Stop doing stupid things.</comment>


Unlock Apartm.net by checking in on Foursquare - <AUTHOR> http://www.fastcompany.com/1709781/foursquare-door-guys-say-they-might-start-selling-their-system

<comment><USER2> We've thought about making the white-list functionality time-based, but the need hasn't come up for our internal use. The product version of this would have greatly expanded features though, if we make one.

</comment><comment><USER3> That is an awesome idea and would be fairly straight forward to develop..

Though you would have to incorporate some sort of timer for office hours only!

</comment><comment><USER4> Wow. Thanks.

I'll check back in after I implement this in my dorm room. So much parts to get this break before I go back to college.</comment>


D P T H | Get a 3D photo from any picture using AI| - <AUTHOR> https://www.dpth.app/ <comment><USER2> Which platforms does it support?

<comment><AUTHOR> Both iOS and Android. But Android is in beta now and only supports Depth Of Field effects. 3D photo is in dev and will be released within couple weeks.</comment></comment>