I Too Was Raised On Processed Foods.. - <AUTHOR> http://1x57.com/2011/02/16/i-too-was-raised-on-processed-foods/?sms_ss=hackernews&at_xt=4d5c28ce9397f589%2C0 <comment><USER2> "With all this variability in farming a single item of broccoli could either contain all you need or nothing at all." Uh, no. It's not going to contain all the protein I need.

<comment><AUTHOR> @mmagin - you would be surprised what the real story on this is. Protein in this sense is a made up word. The original term comes from biology and refers to cell walls and the like. In the world of nutrition it has been co-opted by marketers to define quality foods. The truth is that it doesn't define quality at all.

In fact, the latest accepted research shows that the body needs 23 amino acids to survive (this is most likely what the marketers call protein). Broccoli and many other foods contain several of these amino acids. Meat also contains these amino acids.

What's been corruptedly marketed is that some meat contains around 18+ of the amino acids so they say eat meat for "protein". Of all foods, meat contains the most amino acids, but it also contains other things that reduce the value of the 18+.

They have been finding that eating vegetables/fruits/nuts is much better because they don't have the other bad things that meat does.

(with that being said I am not a vegetarian, I do eat meat, just not a lot because I like to be fit and in shape)

<comment><USER3> > but it also contains other things that reduce the value of the 18+

What, in specific?

<comment><AUTHOR> @Derleth - thx for asking. Here is one source, the Harvard School of Public Health:

(intro)...Surprisingly little is known about protein and health...

(from the section: Protein Package)

Animal protein and vegetable protein probably have the same effects on health. It's the protein package that's likely to make a difference.

A 6-ounce broiled porterhouse steak is a great source of complete protein—38 grams worth. But it also delivers 44 grams of fat, 16 of them saturated. (2) That's almost three-fourths of the recommended daily intake for saturated fat. The same amount of salmon gives you 34 grams of protein and 18 grams of fat, 4 of them saturated. (2) A cup of cooked lentils has 18 grams of protein, but under 1 gram of fat. (2)

The bottom line is that it's important to pay attention to what comes along with the protein in your food choices.

</comment></comment></comment></comment><comment><USER4> This reminds me of the post about avoiding Ramen and Pizza while getting Ramen-profitable - take care of your body to keep your mind at its best

</comment><comment><USER3> Does this guy have any evidence or just his unsupported assertions?

<comment><AUTHOR> @derleth - yep - I cited two popular and well accepted (in the scientific community) studies.

<comment><USER5> You might try using a distinctive color for links. I didn't even see them until I read your comment, said "bullshit" under my breath, and went back to look for them. Only then did I notice links are #000 and the text is #555.

<comment><AUTHOR> lol, i know. They came with the theme..

I keep experimenting with the colors but can't find one that isnt obnoxious!

<comment><AUTHOR> Ok, I bolded them, not perfect but it's better.

<comment><USER5> The bold helps, it calls attention to the link, but is still a little unconventional. Have you tried #007, it's a subtle dark blue, might not be too obnoxious.

<comment><AUTHOR> @Thomas, Original - I agree completely. The boss chose the theme for other style elements. The main problem I am having is adding a element (CSS?) that styles the content links differently than the sidebar links. Since everything on the sidebar is a link making it blue would totally change the style of the page.

I need to do some research on how to make just content links underline/colored.

thx!</comment></comment></comment></comment></comment></comment></comment>


Ask HN: How much would you pay to keep your local newspaper afloat? - <AUTHOR>

I asked my roommate this question today.  We both decided $20.00/year (in addition to any normal subscription fees). How about you? <comment><USER2> In an interesting side note to all the death of the newspaper stories, our local NPR station (KPCC) just opened its own Washington DC bureau! It also has its own iPhone app, and widgets for embedding its feed on your website.

<comment><AUTHOR> Wow that is amazing. I have the NYTimes Iphone app but I haven't been using it much. My roommate and I both listen to Wait Wait Don't Tell Me on NPR...hilarious!

</comment></comment><comment><USER3> $0 my newspaper isn't going anywhere. It's just going to bring 3 major papers in my area down to 2 and get rid of some of the smaller papers.</comment>


The Treadpad - <AUTHOR> http://www.avc.com/

<comment><USER2> I don't know about you, but when I lay sole to mill, I turn into a hydrant of perspiration and saliva that graces a good 3 foot zone of terror around me.

Might want to get a small umbrella or something, just in case.

</comment><comment><USER3> I do this exact same thing. However, the speakers aren't loud enough to overcome the sound of the treadmill + walking. Hooking up a pair of external computer speakers was essential (especially since Netflix doesn't have captions).

I also cover up the time and LED display on the treadmill, makes the time go by "quicker".

</comment><comment><USER4> Permalink: <http://www.avc.com/a_vc/2010/12/the-treadpad.html></comment>


Stack Overflow Outage Postmortem - <AUTHOR> http://stackstatus.net/post/147710624694/outage-postmortem-july-20-2016 <comment><USER2> Perfect. Awesome bug. Awesome Post Mortem. This was just fun to read.

While this might have been caused by mistake - these types of bugs can be (and are) abused by hackers.

[https://www.owasp.org/index.php/Regular_expression_Denial_of...](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_- _ReDoS) [https://en.wikipedia.org/wiki/ReDoS](https://en.wikipedia.org/wiki/ReDoS)

The post also links to this video: [https://vimeo.com/112065252](https://vimeo.com/112065252)

<comment><USER3> Well in this case a post contained 20K whitespaces, so I wouldn't jump to the conclusion that it was a mistake rather than intentional.

<comment><USER4> Yeah, I'm trying to figure out how you even get 20,000 spaces into a Stack Exchange post, and how it would render in your browser.

<comment><USER5> It was in a multiline code block, so it just had a tonne of horizontal scroll.

See the edit: [http://stackoverflow.com/revisions/38484433/2](http://stackoverflow.com/revisions/38484433/2)

<comment><USER6> If he had used tabs instead of spaces this wouldn't have been a problem.

<comment><USER7> Or at the very least, trim whitespace on save :)

</comment></comment></comment></comment></comment></comment><comment><USER8> Ha! The same bug happened internally at my company. In that case it was a regex matching a URL taking so much CPU as to cause a DOS of a proxy server. I won't be surprised if it's happened to someone here too.

This is very timely, because minutes ago, I made a link to Russ Cox's articles in my Kernighan awk repo:

[https://github.com/andychu/bwk](https://github.com/andychu/bwk)

[https://swtch.com/~rsc/regexp/regexp1.html](https://swtch.com/~rsc/regexp/regexp1.html)

If you are not familiar with this issue, basically Perl popularized bad computer science... "regexes" are not regular languages.

They say that this particular case triggered quadratic behavior, not exponential, but the point is that there is a linear time algorithm to do this.

The file b.c in the awk repo implements the linear time algorithm:

[https://github.com/andychu/bwk/blob/master/b.c](https://github.com/andychu/bwk/blob/master/b.c)

(and rsc's site has some nice sample code too, as well as caveats with regard to capturing and so forth)

<comment><USER9> The key quote here is:

"Regular expressions are one of computer science's shining examples of how using good theory leads to good programs ..."

"Today, regular expressions have also become a shining example of how ignoring good theory leads to bad programs. The regular expression implementations used by today's popular tools are significantly slower than the ones used in many of those thirty-year-old Unix tools."

The alarming thing is that regex are supposed to be compiled before use, and the class of expressions that need quadratic or exponential time is distinct from the class that needs linear time. Why don't these popular, widely-used regex implementations perform any optimizations?

<comment><USER10> FWIW, the conversion from NFA (non-deterministic, i.e. backtracking) to DFA (deterministic, linear time) can take exponential space. So there's another avenue for DDOS; it's a lot harder to exploit, though, because it requires the attacker to control the input (i.e. regular expression) to the NFA->DFA transformation, rather than merely provide a string that takes a long time for an NFA to recognize.

<comment><USER11> I'm actually not aware of any popular DFA based engines that suffer from this vulnerability. grep and RE2, for example, build the DFA lazily and cap the size of the DFA such that matching is still linear time even if generating the full DFA would take exponential space. (This is because at most one DFA state is generated for each byte in the input, so technically, you only ever need space for one or two states. In practice, you give a little more room to avoid constantly recomputing states, but it's still bounded.)

<comment><AUTHOR> Random side note... Recognized your name, we use your TOML go package in a bunch of our tools. Thanks and keep up the great work!

</comment></comment></comment></comment></comment><comment><USER12> "This regular expression has been replaced with a substring function."

This should be the title of a book on software engineering.

<comment><USER13> I've fixed so many bugs using regex, only to have to fix several bugs later.

My current stance is, avoid regex if at all possible. Turns out, many of the things we use regex for is possible without. Often times, .Substring, .IndexOf, and using LINQ over strings is sufficient.

<comment><USER14> Regexes are almost always a massive code smell. They should almost never be used, bad idea, bad implementation, hard to grok, hard to debug, hard to test, hard to spot.

Whoever came up with them has surely been given the same honorary place in hell with Jon Postel, who invented the utterly disastrous "be liberal in what you accept", that has plagued all web developers for the last 20 years.

<comment><USER15> How are they hard to test? Given input x, expect output y. It's one of the easiest things in the world to test.

<comment><USER16> The point of this post is that even though the regex behaves correctly (input x produces expected output y), you also need to consider performance constraints.

Without fuzzing, it's going to be pretty difficult to come up with enough test cases to thoroughly test a regex.

<comment><USER17> Wouldn't the same apply to a custom method? Why would code using a combination of indexOf(), substring() and trim() be any less foolproof on arbitrary data?

</comment></comment></comment></comment></comment></comment><comment><USER18> I'm surprised that a developer was able to fix StackOverflow without being able to look up the error message on StackOverflow.

<comment><USER19> Well, StackOverflow devs are able to cheat and load up the site on their local machine if they want to

<comment><USER20> I'm not sure I like the idea of being able to connect to a prod db from a dev instance, but whatever floats your boat.

<comment><USER21> I doubt they'd allow that either - but database exports are a thing or they could just query the database or elasticsearch themselves.

</comment></comment></comment></comment><comment><USER22> In the past, I have done Load Balancer status checks against a special /status endpoint. I queried all the connected services (i.e. DB, Redis, etc) with a super fast query (i.e. `SELECT version();`). Monitoring CPU/MEM usage for scaling was separate.

Comparing this to checking the home page, what is the best way to setup a health check for your load balancers?

<comment><USER23> I'd be VERY careful about including external dependancies in an HTTP health check which results in a web server being removed from service - it's usually an invitation for cascading failures.

1) If you do have a back-end failure, this setup can cloud the root cause during recovery because your downstream web servers are down as well.

2) Transitory back-end failures can cascade, and your health checks can make this worse as things flap around. You need to be VERY careful with your timers and retry logic, and tune them appropriately. eg, how does `/status` handle a single TCP reset from the DB? When does it decide to timeout if the DB doesn't respond? It's hard to get this right - network errors vs protocol errors vs timeouts are often handled differently at different layers of the controller, and the load balancer has its own retries and timeouts.

3) If this health check is being used for an API, recovery can be more difficult because of thundering herds. eg, 5/5 API servers go down because of a temporary DB failure. Queues and requests backup. 1/5 API servers is restored to service a bit earlier than the others, and immediately goes down again because it's not degrading gracefully under heavy load. Wash/rinse/repeat until you figure out how to load shed.

4) Are you absolutely positive that your app is worthless without a DB/redis/backend-baz, and every endpoint is broken? Ideally, the app will degrade gracefully if certain request can be served from cache, or don't require the failed backend.

5) The failure case where this type of thing might be useful (network partition affecting DB connectivity from a subset of your webservers) isn't very common in the environments I've been involved with.

A far more productive approach if you absolutely need this sort of thing is to implement circuit breakers[1] at the app level, and explicitly make certain tripped breakers a hard failure for the /status endpoint. This has the advantage of not depending solely on synthetic queries, and having very explicit restoration logic.

For _load balancer_ health checks, I prefer ones that hit the controller and expect a 200, and nothing more. (The DB and overall health of the service cluster are monitored through more organic instrumentation.)

I was laughing to myself when I read the Stack Overflow post mortem because I have a healthy pile of healthcheck-too-expensive war stories, and their experience resonated.

[1] [http://martinfowler.com/bliki/CircuitBreaker.html](http://martinfowler.com/bliki/CircuitBreaker.html)

<comment><USER24> You make a good point about health checks. Its easy to conflate single node health with overall service health. The LB check should really be about "can this node serve HTTP traffic", even if the non-health check requests can only send back 5xx responses because their dependencies are failing.

I've also had the opposite problem where the health check would answer 200 OK, but the real app itself had a corrupted internal state because of a poor design/threading bug. If the health check had been the home page the node would have been pulled from the LB. While a more in-depth health check would have helped here, I think its better to alert/monitor/kill any node with a higher than normal error rate and leave the health check simple.

</comment></comment></comment><comment><USER25> I remember the day I learned that Python's "re" module uses backtracking for non-extended regexes. My tests covered lots of corner cases in the regex logic, but were too short for me to notice the performance penalty. Luckily I only caused a partial outage in production.

I actually got to talk to Raymond Hettinger (Python core team) about why re uses a potentially exponential-time algorithm for regexes when there is a famous linear-time algorithm, and (I suspect) most programmers would assume linear complexity. As it turns out, there was an attempt to re-write re to fix this, but the re-write never managed to present exactly the same (extremely large) API as the existing module. He advised me that "the standard library is where code goes to die."

<comment> mark-r I vaguely remember a replacement for Python's re module, but I can't remember the name, and Googling for it is an exercise in frustration.

Edit: it's "regex" \- [https://pypi.python.org/pypi/regex](https://pypi.python.org/pypi/regex). I have no idea if it behaves better with backtracking, a cursory glance at the documentation doesn't indicate any changes in that area.

<comment><USER26> regex module shows the same behavior as re module in this case:

      $ python -mtimeit -s "s=' '*20000; import regex as re" "re.search(r'\s+$', s)" # ends with spaces is fast
      10000 loops, best of 3: 201 usec per loop
      $ python -mtimeit -s "s=' '*20000+'non-space'; import regex as re" "re.search(r'\s+$', s)" # ends with a non-space is slow
      10 loops, best of 3: 3.39 sec per loop

</comment></comment></comment><comment><USER27> This is why I always do:

      s/^\s+//;
      s/\s+$//;

Instead of:

      s/^\s+|\s+$//;

Weirdly, I've "known" this since I started writing Perl in the mid-'90\. Not sure where I originally read it (or was told it). Funny how that works.

I try to write my regexes such that they anchor at the front of the strong or the back, or they describe the whole string; never an either-or anchoring type situation like this example.

Spaces at beginning of string (100,000 iterations):

                 Rate onestep twostep
      onestep 62500/s      --     -2%
      twostep 63694/s      2%      --

      real	0m3.093s
      user	0m3.066s
      sys	0m0.018s

Spaces at end of string (100,000 iterations):

                 Rate twostep onestep
      twostep 55249/s      --     -9%
      onestep 60976/s     10%      --

      real	0m3.453s
      user	0m3.421s
      sys	0m0.022s

Spaces in middle of string (only 500 iterations because I don't want to sit here for four hours):

                 Rate onestep twostep
      onestep  7.11/s      --   -100%
      twostep 16667/s 234333%      --

      real	1m10.741s
      user	1m10.207s
      sys	0m0.228s

<comment><USER11> You can see in my other post that this doesn't always work. For example, Python's regex engine chokes on `\s+$` if you use `re.search`, but works fine if you use `re.match`.

It's likely that Perl has an optimization for `\s+$` but not `^\s+|\s+$` (the former regex only ever matches at the end of the string, which is amenable to optimizations).

<comment><USER27> I did see your other post, and upvoted it. This rule of thumb has served me well between different regex dialects and implementations, but it's not surprising that there are some specific cases that are "broken" for lack of a better word.

I haven't done much Python but the documentation for re.search() and re.match() is very clear: use search to find an expression anywhere in a string, use match to find an expression at the beginning of a string. It appears to ignore anchors in both cases? Left undetermined then is how to anchor an expression at the end of a string. You say re.match() works, but this is pretty confusingly described, and it's easy to see how the ambiguity can lead to problems for even the most experienced programmers.

<comment><USER11> Anchors aren't ignored. For re.match, `^abc$` is equivalent to `abc`, so the anchors are just redundant. (N.B. `^^abc$$` will match the same set of strings as `^abc$`.) For re.search, `^abc$` is equivalent to `re.match(^abc$)` but `abc` is equivalent to `re.match(.STAR?abc.STAR?)`.

But yes, this is a very subtle semantic and different regex engines handle it differently. My favorite approach is to always use `.STAR?theregex.STAR?` and don't provide any additional methods. Instead, if the user wants to match from the beginning to the end, they just need to use the well known anchors. (Go's regexp package does this, and Rust borrowed that API choice as well.)

<comment><USER28> Correction: re.match anchors at the start, but not the end, so `^abc$` is equivalent to `abc$` but _not_ `abc`.

</comment></comment></comment></comment></comment><comment><USER29> I don't understand something: the regex expected a space character, followed by the end of the string. If the last character wasn't a space, this could never match. Why did the engine keep backtracking, even though it's easy to figure out that it could never match the regex?

<comment><USER30> Most simple regular expression evaluators are basically state machines. They hold a few variables:

a) what part of the regex am I currently trying to match

b) what point in the string am I currently starting at

c) how much of the string has this piece of the regex consumed so far

Then the state machine basically has three transitions:

* if (b+c) terminally matches (a), increment both (a) and (b) and reset (c)

* if (b+c) matches (a), but more could be consumed, increment (c) and check again

* if (b+c) doesn't match (a), increment (b) and reset (c)

So yeah, you could put in short cuts for things like "well this didn't match because the next piece of the regex is matching on a line ending", but keeping it simple is straightforward and generally smiled upon.

<comment><USER11> If you are really using a state machine and every match in the regex is at the end of the haystack, then you can reverse the state machine and use the same algorithm you described in reverse. :-)

(Rust's regex engine does this.)

</comment></comment></comment><comment><USER31> Is this the sort of thing that [https://github.com/google/re2](https://github.com/google/re2) was made to solve?

<comment><USER32> Also implemented in the go stdlib [https://golang.org/pkg/regexp](https://golang.org/pkg/regexp)

<comment><USER33> And it doesn't have any problems with this particular regex: [https://play.golang.org/p/7UFkG3qrpS](https://play.golang.org/p/7UFkG3qrpS)

<comment><USER34> It's been mathematically proven that engines of the form that Go has will always run in linear time for any regular expression, on any input. It's one of the more famous things about regex in general.

</comment></comment></comment></comment><comment><USER35> I think this might have been the post they quoted.

[http://stackoverflow.com/questions/38484433/in-corona-sdk- ho...](http://stackoverflow.com/questions/38484433/in-corona-sdk-how-to-join- tiles-into-one-word-using-matrix-game-breakout)

<comment> Nick-Craver Yep.

<comment><USER36> Odd that this was the first post by the user.

Mere coincidence?

<comment><USER37> I imagine that's very common on SO (users with very few, or just 1, post)

</comment></comment></comment></comment><comment><USER38> A few months ago, a Stack Overflow representative asked me if their presence at a dev conference was justified. My positive answer more or less revolved around the importance SO took in the daily life of programmers everywhere.

If only she was there to witness the effect of a 34 minute downtime on an open space full of mobile/back/front developers.

<comment><USER39> Google's cached versions of SO answers are generally up to date, no? Nice try, lazy developers!

<comment><USER36> Alternatively, you can refer to StackPrinter [0] (especially if arriving via a search engine).

[0] [http://www.stackprinter.com/](http://www.stackprinter.com/)

</comment></comment></comment><comment><USER40> Nice bug. I tried to replicate this and indeed, the time to notice that no match is found is growing very fast with the length of the input. Using a substring check is a good fix, but I tried to change the regex to fix this and: if instead of an end anchor, you can add an optional non-whitespace character at the end of the pattern, then you only have to check whether the optional part is empty. Testing with very long strings which respectively match and don't match shows that the result is immediate in both cases.

        (defparameter *scanner*
          (ppcre:create-scanner
           '(:sequence
             (:register
              (:greedy-repetition 1 nil :whitespace-char-class))
             (:register
              (:greedy-repetition 0 1 :non-whitespace-char-class)))))

        (let ((length 40000))
          (defparameter *no-match*
            (let ((string (make-string length :initial-element #\space)))
              (setf (char string (1- (length string))) #\+)
              string))

          (defparameter *match* (make-string length :initial-element #\space)))

        (defun end-white-match (string)
          (ppcre:do-scans (ms me rs re *scanner* string)
            (when (and ms
                       (= (aref re 1) (aref rs 1)))
              (return (values ms me)))))

        (time (end-white-match *match*))
        0, 40000
        ;; Evaluation took:
        ;;   0.000 seconds of real time
        ;;   0.000000 seconds of total run time (0.000000 user, 0.000000 system)
        ;;   100.00% CPU
        ;;   25,139,832 processor cycles
        ;;   0 bytes consed

        (time (end-white-match *no-match*))
        NIL
        ;; Evaluation took:
        ;;   0.000 seconds of real time
        ;;   0.000000 seconds of total run time (0.000000 user, 0.000000 system)
        ;;   100.00% CPU
        ;;   11,105,364 processor cycles
        ;;   0 bytes consed

<comment><USER41> So, you're saying that if you enjoy tricky gotchas and puzzle-solving over reliability, then the perl-aping regex implementations have your back?

<comment><USER40> I am saying that I have been nerd sniped. Actually I tend do stay away from regexes.

</comment></comment></comment><comment><USER42> Hmm. I wonder why one of the followup mitigations is not to move to a non- backtracking regex engine by default.

Most of what you want to do with a regex can be done with an NFA or DFA based engine. That which can't be done with an NFA or DFA based engine is generally better handled with a parser than a regex.

There are plenty of good DFA based regex matchers out there; RE2, the Rust regex crate, GNU grep, etc. At a glance, it even looks like glibc uses a DFA, though it supports POSIX REs which support backreferences so it must use backtracking at least for REs that contain backreferences.

Predictable hash collisions were a big sources of DOS attacks in web scripting languages which use tables a lot, until they started rolling out randomized hashing algorithms to prevent easily predictable hash collisions. It seems like it would be best for languages and libraries to move to DFA based regexps, at least for anything that doesn't contain backreferences, to mitigate these kinds of issues from being easy to exploit.

</comment><comment><USER43> > It took 10 minutes to identify the cause.

I'm impressed they were able to do this so quickly.

<comment><USER44> System not responsive. Look at the CPU load. Look at the process peaking at 100%. Force dump the stack track of the process couple times. Hmm. All of them stuck in the regex engine. Look back up the stack track to see who calls it. Oh, it's on the home page's text cleansing code.

Something like that.

<comment><USER45> This is exactly what we did to diagnose (source: I was on the call). The only tricky part was figuring out which post it was, since it wasn't in the stacktrace. To do that, we grabbed the 3000 most recent posts and ran the regex against them. By that point we already had the code fix (another dev working on it in parallel), but if we hadn't we also could have gotten back up by just deleting the post.

<comment><USER46> Any idea if it was a malicious attempt? It kind of sounds like it was.

<comment><USER47> Nah, [https://en.wikipedia.org/wiki/Hanlons_razor](https://en.wikipedia.org/wiki/Hanlons_razor)

If it was malicious they would have made a bunch of them, not just one. I personally have seen many files with unreal amounts of whitespace at the end.

<comment><USER48> Yeah, that's kinda what we're thinking. If it were malicious, the question itself would be unlikely to actually look like a real honest question, too. It'd just be a bunch of garbage input.

</comment></comment></comment></comment></comment></comment><comment><USER49> Time to pop this old chestnut out:

[https://blog.fastmail.com/2014/12/14/on- duty/](https://blog.fastmail.com/2014/12/14/on-duty/)

"At one stage, we decided to try to avoid having to be woken for some types of failure by using Heartbeat, a high availability solution for Linux, on our frontend servers. The thing is, our servers are actually really reliable, and we found that heartbeat failed more often than our systems - so the end result was reduced reliability! It's counter-intuitive, but automated high- availability often isn't."

One of these days we'll finish our new system and I'll blog about that, which is that the automated systems are allowed to take ONE corrective action without paging, at which point they flag that the system is in compromised state. Any further test failures trigger an immediate wake of the on-call.

</comment><comment><USER50> I wondered about this for some time.

Simple regex (as in formal language theory) are matched in O(n) time by finite automaton.

Extended regex like PCRE are more powerful, but most of the time are implemented by backtracking engines, where really bad regex pattern might go exponential, but even simple pattern as in postmortem can go O(n^2).

Do implementations optimize simple regex patterns to O(n) matching? Even I wrote x86 JIT regex compiler for fun some time ago. Compilation time was really bad, but matching was O(n).

<comment><USER51> There are a few implementations that are linear, but compilation time is then exponential instead.

<comment><USER50> Which is still a big win because

* regex pattern is controlled by site, while regex input is external

* regex pattern is compiled once, while it is being run for every input

</comment></comment></comment><comment><USER52> As perlfaq4[1] shows:

        > You can do that with a pair of substitutions:

        >         s/^\s+//;
        >         s/\s+$//;

It then notes, in an understated manner:

        > You can also write that as a single substitution,
        > although it turns out the combined statement is
        > slower than the separate ones. That might not
        > matter to you, though:

        >        s/^\s+|\s+$//g;

[1]: [http://perldoc.perl.org/perlfaq4.html#How-do-I-strip- blank-s...](http://perldoc.perl.org/perlfaq4.html#How-do-I-strip-blank-space- from-the-beginning%2fend-of-a-string%3f)

<comment><USER53> In light of the given issue, it might be a good idea to update the example code to use \s++ instead...

</comment></comment><comment><USER54> Experienced something similar myself. Was even thinking about creating regular expression library which just allow "safe" and fast expression.

The trick would be to not allow only expression that can be translated easily to state automate.

Good regex: "Phone number [0-9]* "

Bad regex: ";Name=. _; " as . can also match ";" and it can lead to bad backtracking. You should rewrite this regex to ";Name=[^;]_;"

RE2 is probably best implementation so far, but because it's tries so hard to preserve backward compatibility with all regular expression it is not that fast in average case: [https://swtch.com/~rsc/regexp/regexp1.html](https://swtch.com/~rsc/regexp/regexp1.html)

</comment><comment><USER55> "the entire site became unavailable since the load balancer took the servers out of rotation." I don't care about the regexp, this is bad SRE, you can't just take servers out of rotation without some compensation action.

Never mind that it looks like all web servers where taken out of rotation, even one server down could cause a cascading effect (more traffic directed to the healthy ones that end up dying, in a traffic-based failure). One action for example after n servers have gone down, (besides getting up other m servers) is to put (at least some) servers in a more basic mode (read only/static, some features disabled), not guaranteed but that could have prevented this and other type of down times.

<comment><USER56> I have the same concern - including with our own system. As far as I know, all LBs are designed with this faulty logic. That's the case with our in-house F5 BigIPs, and I believe also for AWS's ELBs.

Sure, it makes sense to cut malfunctioning servers out of the production pool when discovered. But at the point where you've dumped out _every_ production server, you've just created the worst possible situation - you're absolutely guaranteed not to be able to serve any traffic. At the point you get to zero functioning servers, a better response would be to restore all servers to the pool and just hope. That would be bad, but less so.

What we've done on our internal systems is to set things up so that when the last server is dropped, it fails over to a passive pool that is really just the normal production pool with no health checks. But I'm not aware of any LB that supports this directly, we had to glue together some ugly configurations to get this to work.

</comment></comment><comment><USER57> Yesterday I couldn't use hipchat for a couple hours because it would lock up a cpu and fail to load. After doing some free debugging for them I realized they were locking up trying to extract urls out of some text with a regex. Simplified code: [https://gist.github.com/shanemhansen/c4e5580f7d4c6265769b0df...](https://gist.github.com/shanemhansen/c4e5580f7d4c6265769b0df61d6d8759)

Pasting that content into hipchat will probably lock up your browser and webview based clients. Beware.

Lesson learned: don't parse user input with a regex.

</comment><comment><USER58> Google cache saved me during these 34 minutes.

<comment><USER59> Mac app Dash allows downloading & browsing Stack Overflow offline by language. 834 MB for Python.

[https://kapeli.com/dash](https://kapeli.com/dash)

<comment><USER58> Funny, I was coding on a Chromebook with 525M left in "/".

</comment></comment></comment><comment><USER60> It seems like there should be a way to determine whether a regex can be compiled using the classic O(n) DFA algorithm or with whatever madness PCREs use to support backtracking and so on.

Anybody know if any regex engines attempt this?

Obviously you can still shoot yourself in the foot, but it's somewhat more difficult to do so in a situation like this where the regex in question "looks" cheap.

<comment><USER61> > It seems like there should be a way to determine whether a regex can be > compiled using the classic O(n) DFA algorithm or with whatever madness PCREs > use to support backtracking and so on.

Obviously. If the "regex" includes a backreference, it requires backtracking. If it includes only regular operations (I can't call any other nonregular operations that people might expect to mind), it doesn't. This is information that can be trivially surfaced by a parser.

<comment><USER60> I wonder why regex libraries don't do this then? Isn't /\s+$/ backreference free? Or does including the anchor change that?

<comment><USER61> It's backreference free. Backtracking to process it is just bad design.

Here's a state machine that recognizes /^.*\s+$/:

1: initial state (non-matching)

2: matching state

all states transition to 2 on \s, and to 1 on \S. Done.

Taking this a little further, we can observe that since the transition table is identical for every state, there's no real need to have states at all -- you get the same effect by just checking the last character.

</comment></comment></comment></comment><comment><USER62> Regex was not the main issue. The main issues were:

1\. Rendering a page fails/does not terminate if some non essential subtask (rendering a single code block) fails/does not terminate.

2\. They do not try to detect bad data (the way they certainly try to detect bad code)

3\. Load balancing based on the rendering time of a single page

Code bugs triggered by bad data will happen again, with or without regular expressions.

<comment><USER63> _> 2\. They do not try to detect bad data (the way they certainly try to detect bad code)_

It was actually the sanitization function regex that became unresponsive. So they killed the page by trying to stop bad data coming in.

Agreed on your other points though.

</comment></comment><comment><USER64> Could this has been a deliberate/malicious act? Why else would someone post 20,000 consecutive characters of whitespace on a comment line?

Also, the "homepage" of StackOverflow does not show any 'comments' \- it is just the top questions? Why was the page loading any comments in the first place?

<comment><USER65> We don't think it was intentional. Maybe copy and paste, or something an editor did.

To clarify the "comment" was not a Stack Overflow comment, but rather a comment in a code block inside a question.

<comment><USER66> I am genuinly curious: how did you fix it? Did you remove the spaces first and then tried to use substring / trimming with proper testing done, or did you just implement it in place? I have faced similar dilemmas in the past, but I usually go with "put out the fire, then find the correct solution" approach.

<comment><USER65> Implement in place to put the fire out. Pushed to half the web servers, made sure it fixed the problem, then rolled it out the rest. Coding under fire :P

<comment><USER67> How did you test this on half? Accessing the single web server directly I'm guessing? Probably not public

</comment></comment></comment></comment></comment><comment><USER68> We had a similar issue arising from regex parsing of our SES routes on our SaaS Platform. We had made some changes to our generated SES file which caused it to balloon to 4x in size (tens of thousands of lines). Our only clue that something had gone wrong was suddenly extremely high IIS usage. With some help from Microsoft support, we managed to trace the stack during the high-cpu event to an ISAPI filter and ultimately our 3rd party SES plugin. We managed to fix the problem by being more efficient with our regex generation and reduce the number of rules the plugin was processing but it was eye-opening how much CPU was being consumed by regex processing.

</comment><comment><USER69> I like this because it shows how important it is to understand the inner workings of the tools in your toolbox. It could serve as a nice example in some 'Languages and Grammars' course at the University for additional motivation.

</comment><comment><USER70> They implemented trim with a regex? Neither Java nor .NET do that.

The postmortem here should probably be "why are you reimplementing trim".

<comment><USER71> Most likely answer: The built-in trim isn't Unicode aware or has buggy behavior when dealing with Unicode.

<comment><USER3> Assuming they're still using ASP.net 4+, it is very unicode aware/safe. I don't know why a developer would reinvent Trim() but I do know it isn't a .Net limitation.

<comment><AUTHOR> This code was written 5 years ago, and back then the trim function was different.

</comment></comment></comment></comment><comment><USER72> Easy to reproduce [1]. Just remove the a in the end and your timeout disappears. Anybody knows which regex engine they used?

[1] [http://regexr.com/3drn3](http://regexr.com/3drn3)

<comment><USER71> I had a tough time reproducing it in Perl, although I think I managed to get it.

      % perl -v
      This is perl 5, version 18, subversion 2 (v5.18.2) built for x86_64-linux-gnu-thread-multi
      % ls -l testfile
      125380092 Jul 20 16:41 testfile
      % time ./regextest testfile
      ./regextest testfile  0.36s user 0.03s system 99% cpu 0.398 total
      (Remove the a at the end)
      % time ./regextest testfile
      ./regextest testfile  0.13s user 0.03s system 99% cpu 0.156 total

I had to make a much larger input file than I expected before I was able to really see the difference. Given the O(n^2) nature of the bug, I was expecting it to take much longer.

</comment></comment><comment><USER34> I'm still confused why people would use a backtracking regex engine in cases when they don't need recursive regex extensions (or other questionable extensions like back references). A "correct" (from the CS perspective) regex engine wouldn't have had this or many other problems that people encounter when doing regular expression matching. If they had piped out to sed or awk this wouldn't have happened, since GNU grep, sed and awk use a proper regex engine.

</comment><comment><USER73> My blog post[1] on how to test for catastrophic backtracking using RegEx buddy.

[1] [https://blog.mozilla.org/webdev/2010/11/15/avoiding- catastro...](https://blog.mozilla.org/webdev/2010/11/15/avoiding-catastrophic- backtracking-in-apache-rewriterule-patterns/)

</comment><comment><USER74> Backtracking regexes matchers are a Bad Idea.

It's true you need them to implement backreferences. But I've never used such a thing. If I were creating a runtime for some new language, I would simply ignore that part of the POSIX standard.

</comment><comment><USER75> The whole postmortem focuses on a regular expression bug and how that bug was fixes and completely ignores the fact that if the home page becomes unavailable, the load balancer logic will shut down the entire site.

</comment><comment><USER76> I still haven't figured out why regex engines font use state machines where possible (i.e. in the absence of back references and such). Is that not an obvious optimization?

</comment><comment><USER77> ugh. i would've just sat there wondering WTF. then proceed to initiate daily backup recovery.

<comment><USER78> Haha, really!

Maybe I'm less-experienced (1.5 yrs), but it would have taken me significantly more than the 15 mins(was it?) that it took them to diagnose the problem.

Props to the team, and Thank All 0.33G Gods I was not on call!

</comment></comment><comment><USER5>
        > It took 10 minutes to identify the cause,

Impressive, considering:

        > cause was a malformed post that caused one of our
        > regular expressions to consume high CPU ... called on
        > each home page view ... Since the home page is what our
        > load balancer uses for the health check, the entire site
        > became unavailable since the load balancer took the
        > servers out of rotation.

</comment><comment><USER79> Not understanding why backtracking happened. Once it hit a non space, non end character, move on. Nothing before can match the regex.

<comment><USER80> It finds a space, tries to match the rest of the string, fails, rolls back to it and goes forward one, finds a space...

The trick is that there's no guarantee, in general, that a match failing at character N is due to character N, so the regex engine backtracks.

<comment><USER79> I guess I need to buff up on my automata, but I would have thought that for positional delimiters, there would be optimizations. If the pattern is \s+$, then I can look from the back of the line, see if there is a space, and if so, go backward until I find a non-space character.

<comment><USER81> That's just special casing the end of line. If it was "\s+x" you'd still have the same problem.

</comment></comment></comment></comment><comment><USER82> Seems like there is still no better way to deal with these kind of mistakes than preemptive Erlang-style lightweight processes.

</comment><comment><USER83> Someone wiser than me said once that if you have a problem and want to fix it with a regex then you now have two problems :-)

</comment><comment><USER84> By the way, this is the post that broke StackOverflow: [http://stackoverflow.com/questions/38484433/join-tiles-in- co...](http://stackoverflow.com/questions/38484433/join-tiles-in-corona-sdk- into-one-word-for-a-breakout-game-grid)

</comment><comment><USER85> For me awesome part is cliché that is quite popular on SO takes down SO. And resolution to replace RegExp with substring completes the picture. Just cannot stop laughing.

"Some people, when confronted with a problem, think 'I know, I'll use regular expressions.' Now they have two problems."

</comment><comment><USER86>
        > 20,000+19,999+19,998+…+3+2+1 = 199,990,000

= 200,010,000, not that anyone's counting :)

</comment><comment><USER87> In reading this post, I realised this was the first time I'd ever visited the Stack Overflow homepage.

</comment><comment><USER88> > Add controls to our load balancer to disable the healthcheck – as we believe > everything but the home page would have been accessible if it wasn't for the > the health check

Wouldn't regular users, trying to access the homepage have yielded the same effect?

</comment><comment><USER89> > This regular expression has been replaced with a substring function.

I always cringe when I see regex used for such simple string checks. In fact, Stackoverflow is full of accepted answers that "solve" problems that way.

</comment><comment><USER90> paging jwz. something something two problems.

</comment><comment><USER91> The Stack status page contains 3 script tags _before_ the HTML tag.

This is what I saw on my Kindle 3 Keyboard:

This page contains the following errors:

error on line 2 at column 36: Extra content at the end of the document

Below is a rendering of the page up to the first error.

var __pbpa = true;

</comment><comment><USER92> They have limits on everything (comments per second, edits per second, upvotes per day, reputation earned per day, etc), it seems like they should have an upper bound character limit on what they accept too.

<comment><USER93> There are some very long Stack Overflow answers that contain a wealth of information. If there were a limit, it would likely need to be far greater than 20k characters anyway (the number of whitespace characters that caused the outage).

</comment></comment><comment><USER94> For more bugs caused by quadratic complexity:

[http://accidentallyquadratic.tumblr.com/](http://accidentallyquadratic.tumblr.com/)

</comment><comment><USER95> Any more proof needed that caching should become a system-provided service over the next 10-20 years, the same way memory management did in the past 10-20 years?

</comment><comment><USER96> If it was in a comment, why was the home page loading it?

preemptive caching?

</comment><comment><USER97> " This regular expression has been replaced with a substring function." I came to rely on Regex so much that I almost feel we'd be the next.

</comment><comment><USER98> This is great. I just want to add something that might not be well-known: StackOverflow is all hosted from ONE web app server! It handles all the writes.

</comment><comment><USER99> Productivity plummets worldwide (regex attack vector)

</comment><comment><USER100> Correct me if I'm wrong, but couldn't this could have been fixed by making the match possessive:

^[\s\u200c]++|[\s\u200c]++$

That should stop any runaway backtracking?

</comment><comment><USER101> 200010000 not 199990000 probably the author looped on a 0-based index. n*(n+1)/2 is even better ^^ Nice post mortem though

</comment><comment><USER102> TIL what language Stack Overflow is written in.

<comment><USER103> what language is that? Couldn't find it in the post.

<comment><USER104> C#

</comment></comment></comment><comment><USER105> Yes, one of the best postmortems, especially the technical part.

Am sure it was simple but curious to know what the replacement substr code is.

</comment><comment><USER106> Favourite comment from the Reddit thread on the matter:

"Well, that should stave off the imposer syndrome for another couple of days."

-u/minno

</comment><comment><USER107> Very interesting bug. People forget some times how expensive a regex can be compared to simple pattern matching.

</comment><comment><USER108> Why isn't the trim applied when the post is created and not every time that it's displayed?

</comment><comment><USER109> Regex: ruining your life since 1956.

</comment><comment><USER110> I want to believe that a cat fell asleep on the space bar. Then eventually woke up and posted.

</comment><comment><USER111> This is great- regex errors always reminds me of this classic Jeff Atwood post (cofounder of StackOverflow): [https://blog.codinghorror.com/regular- expressions-now-you-ha...](https://blog.codinghorror.com/regular-expressions- now-you-have-two-problems/)

</comment><comment><USER112> Hmmn, if it was one request, how did it cause other web servers in the farm go down?

</comment><comment><USER113> Wow, I didn't notice today! I must not have been coding very much.

</comment><comment><USER114> But... how did they search for a fix without resorting to Stack Overflow? :)

</comment><comment><USER115> > If the string to be matched against contains 20,000 space characters in a > row, but not at the end, then the Regex engine will start at the first > space, check that it belongs to the \s character class, move to the second > space, make the same check, etc. After the 20,000th space, there is a > different character, but the Regex engine expected a space or the end of the > string. Realizing it cannot match like this it backtracks, and tries > matching \s+$ starting from the second space, checking 19,999 characters. > The match fails again, and it backtracks to start at the third space, etc.

That's not how backtracking works. A regex engine will only backtrack to try and make the rest of the regex match, i.e. it will take characters of the RHS of the string, not try and start "from the second character off the start of the string". I mean, if the engine tried matching from the second space, what would be matching the first space? Something has to.

Which meant, that even if the regex engine was incredibly stupid and could not figure out that a greedy block of \s was never going to contain a non-\s, it would only have to check 20,001 times, not 199000 (or whatever it was).

I can't reproduce this "bug" in either Perl or Python. The time taken to match a 30,000 block of space either followed by $ or XX$ was basically identical for \s+$.

There does appear to be normal backtracking going on, roughly doubling the search time for large strings terminating in non-\s. This is expected, as it has to check 20,000 during the first gobble, then 20,000 as it backtracks _from the right_ 20,000 times.

        $ time perl -e '(" " x 100000000 . "X") =~ /\s+$/ && print "MATCH"'

        real	0m0.604s
        user	0m0.509s
        sys	0m0.094s

        $ time perl -e '(" " x 100000000) =~ /\s+$/ && print "MATCH"'
        MATCH
        real	0m0.286s
        user	0m0.197s
        sys	0m0.089s

<comment><USER11> > I mean, if the engine tried matching from the second space, what would be > matching the first space? Something has to.

Some regex engines provide an API call that puts an implicit `.STAR?` at the beginning of the regex so that the semantics of the match are "match anywhere" as opposed to "match only from the start of the string." (This is in fact the difference between Python's `match` and `search` methods.) Assuming the OP was using this type of method, then this difference exactly explains why you can't reproduce it. I can:

        >>> import re
        >>> haystack = (' ' * 20000) + 'a'
        >>> re.match('\s+$', haystack) <-- is wicked fast
        >>> re.search('\s+$', haystack) <-- chugs a bit

indeed, this chugs a bit too:

        >>> re.match('.*?\s+$', haystack)

So technically, the OP left out this little detail, but it's a pretty common thing to find in regex libraries. In fact, Rust's library treats all searches as if they were re.search and provides no re.match function, instead preferring to require an explicit `^` to remove the implicit `.STAR?` prefix.

<comment><USER59> For anyone else who wants to time the examples without copying & pasting each line:

        python3 -m timeit -n 1 -r 3 -s "import re ; haystack = (' ' * 20000) + 'a'" -c "re.match('\s+$', haystack)"

1 loops, best of 3: 467 usec per loop

        python3 -m timeit -n 1 -r 3 -s "import re ; haystack = (' ' * 20000) + 'a'" -c "re.search('\s+$', haystack)"

1 loops, best of 3: 4.23 sec per loop

Options

        -n  how many times to execute statement
        -r  how many times to repeat the timer
        -s  setup code (run once)
        -c  command to run n times

</comment></comment></comment><comment><USER116> > So the Regex engine has to perform a "character belongs to a certain > character class" check (plus some additional things) > 20,000+19,999+19,998+…+3+2+1 = 199,990,000 times, and that takes a while.

199,990,000 isn't really _all_ that many. I'm a little surprised it didn't just cause a momentary blip in performance.

edit: whoops, i guess that's per page load

<comment><USER117> SO is I/O bound most of the time. If you've set up your system to handle high workloads of I/O bound traffic, then hitting CPU bounds throws a real wrench in your cogs.

To put this another way, SO is one of the most traffic'd sites on the internet. So a page that's loaded 10k+ times a second is going to push that number much, much, higher. If the CPU can't clear 10k+ req in under the regular time it takes, everything starts to back up.

<comment> mh- _> To put this another way, SO is one of the most traffic'd sites on the internet._

I've seen this said several times here, but never bothered to ask.. by what measure is this true?

<comment><USER118> Alexa has it at #50:

[http://www.alexa.com/siteinfo/stackoverflow.com](http://www.alexa.com/siteinfo/stackoverflow.com)

Quantcast has a similar ranking for it: [https://www.quantcast.com/stackoverflow.com#trafficCard](https://www.quantcast.com/stackoverflow.com#trafficCard)

</comment></comment></comment></comment><comment><USER119> The lesson seems to be "Always run trim() before running regex" and "validate content as much as possible before running regex".

<comment><USER70> Or just reject this input. The server isn't the time and place to do data cleanup.

Can always fix this on the frontend with JavaScript for free if it's an actual problem.

<comment><USER118> You can't trust that the user has JavaScript enabled; and since you can't trust user input anyway, you'd have to do this server side.

<comment><USER70> "You can't trust user input" means to _not_ fudge with user data in the first place!

If your code cares about unicode spaces at the beginning of user input, there is your problem.

(Also, you missed the _reject_ part)

<comment><USER120> How would you suggest running a user-created-content site without ever fudging/sanitizing the data being posted to the server?

</comment></comment></comment></comment></comment><comment><USER121> This seems like a hard-to-expect edge case for real. I think catching edge case is needed (means more rigorous testing). This is the equivalence of algorithm complexity analysis. How bad can my algorithm be? But regular expression, to be honest, is usually something I hardly think about performance. I don't know about others, but most of the my input are small enough. How big of an input should I test? If I were to deal with a lot of characters, I would be doing substring replacement.

<comment><USER122> > But regular expression, to be honest, is usually something I hardly think > about performance.

This is actually not an uncommon problem. I recently experienced a backend system going down because of catastrophic backtracking. There is a reason why proper regex libraries have a timeout on the match methods.

For example: [https://msdn.microsoft.com/en- us/library/hh160204(v=vs.110)....](https://msdn.microsoft.com/en- us/library/hh160204\(v=vs.110\).aspx)

<comment><USER70> A _time_ limit on something like this is so extremely awkward to use. My first problem would be that I'm concerned the implementation doesn't have the resolution; a "reasonable" time limit would be what, 1us for a regex match?

Which brings us to the second point: what's this, wall clock time, CPU time? I risk testing this with low load on my dev computer only to have it fail in production because high CPU load means the match just took longer (but wasn't running into a corner case).

I think a reasonable "timeout" would be to give an upper limit for _character array accesses_ , like 20*strlen.

</comment></comment></comment><comment><USER123> My rephrasing of their follow-up actions:

* "Audit our regular expressions and post validation workflow for any similar issues"

* ==> "Not even people who've worked for years on the guts of regex engines can easily predict the runtime of a given regex, but somehow our engineers will be expected to do that".

* "Add controls to our load balancer to disable the healthcheck – as we believe everything but the home page would have been accessible if it wasn't for the the health check"

* ==> "Our lb check was checking /index, that failed because /index was slow: Lesson learned, let's not lb check anything at all"

<comment><USER124> I don't think they're disabling health checks in general, just adding a way to temporarily disable checks when they are misbehaving.

<comment> Nick-Craver Correct. I'll be adding this functionality into Opserver so that we can override the health check in HAProxy when we know better.</comment></comment></comment>


Popular press wildly overblows "gene for humanity" - <AUTHOR> http://whyevolutionistrue.wordpress.com/2012/11/24/popular-press-wildly-overblows-gene-for-humanity/

<comment><USER2> Interesting topic. Being human probably involves a whole house of cards of genes; this one may be critical but isn't the only card in the house.

Interesting speculation: eventually we may edit our genome each generation, to add useful/interesting variation. But they may not be viable/inheiritable features (lack of redundancy; no guarantee cross-breeding in the similarly- modified population has a good result) leaving us with a fragile human genome. As long as our technology continues to allow editing of each offspring, no problem. But a true human genome may cease to exist.</comment>


Ask HN: Show Me a Fast React/Vue/Angular Site - <AUTHOR> Hi HNers!
Can someone point me to a fast non-trivial React/Vue/Angular website?
I don't mean hide-the-latency "fast". I mean, don't-waste-my-battery-or-bandwidth fast. I'd like to record a DevTools perf timeline and see < 100ms of total JS execution and < 500ms for full page load (excluding images/media).
By non-trivial I mean a real-world, deployed app/site (not demo/mvp). An e-commerce site would be ideal but anything like Github, Airbnb, Facebook, Instagram, etc.
I'm asking because I've literally never encountered one; they all seem to load 500KB+ of js, make 200 HTTP requests and execute 1500ms+ of js during page load (on a desktop browser). Then I look at the DOM via `document.querySelectorAll("*").length` see there's only 1,000 total DOM nodes rendered. <comment><USER2> Yes, many people over-develop their sites. That doesn't mean a fast, small site is impossible. But most people are not trying to build the fastest most elegant site in the world - they are trying to solve a problem, and < 100ms isn't likely to be a requirement for most real-world solutions. Likewise, what does it matter how many DOM nodes there are, if it gets the job done?

If you are trying to argue that people should think about whether or not they need a framework, I'd agree. I'd also agree that framework-supported sites do make it difficult to use resources efficiently on mobile devices.

But this post feels analogous to criticizing a parent because their minivan isn't as cool as your convertible roadster. It isn't supposed to be. It just is supposed to get a job done.

<comment><USER3> There's a lot out there where the loading time is several seconds long. Battery drain is really high too. I left my phone with a Vue site active and it drained down to 30% from 80% overnight.

There are plenty of situations where websites need speed - Google, social media type sites, anything with user exploration like wikis and IMDB, games.

I'd actually love to hear the question answered because my main concern with most frameworks is speed.

<comment><USER4> Facebook is the extreme counter example lol, its slow as hell and make my web browser hangs if I leave it for more than 15 minutes

</comment></comment></comment><comment><USER5> VuePress is pretty fast: [https://vuepress.vuejs.org/](https://vuepress.vuejs.org/) It's relatively early in development. Runs on Vue JS and Markdown

<comment><AUTHOR> not sure generated static sites fit the bill.

</comment></comment><comment><USER6> To have a fair discussion about this, you should probably also consider subsequent page loads after the first. With something like next.js, you get almost instant page loads after the first, because they are routed client side.

If the app is designed properly, the 500kb bundle is only loaded once, and cached until a new one is released. Subsequent requests are for data only.

Also, be sure not to conflate react performance with degradations due to third party marketing scripts.

</comment><comment><USER7> I know you said nodemo but their demo store is quite complete and close from a real world website, it's a ecommerce solution built on react. They open sourced it, it's called cezerin. [https://store.cezerin.com/](https://store.cezerin.com/)

EDIT: didn't check if it was online but apparently they stoped it

</comment><comment><USER8> I am not sure if you want to make a point or if it is a genuine question. If it is a genuine question, why do you need to find such site?

<comment><AUTHOR> > I am not sure if you want to make a point or if it is a genuine question.

it's both. i'm almost finished writing an SSR'd e-commerce site that easily surpasses these metrics using a not-the-big-three vdom layer and thinking about documenting the experience in a web-perf article(s) once it's deployed.

i don't want to make the claim that such websites don't currently exist (for a multitude of reasons) without asking for some help in finding at least one counter-example; i've searched for a long time already and have come up empty.</comment></comment>


Ask HN: What should our value proposition be? - <AUTHOR>

If you're a freelance developer, we'd love your feedback here: https://matchist.com <comment><AUTHOR> Clickable link: <https://matchist.com></comment>


Synchronizing Documents with PSPDFKit Instant - <AUTHOR> https://pspdfkit.com/blog/2017/pspdfkit-instant/ <comment><USER2> If you use apps like Dropbox, Box or Evernote on your phone you've already used PSPDFKit - We released our Web product last year and with PSPDFKit Instant we want to connect all three.</comment>


Theranos and Zenefits are a feature, not a bug, of Silicon Valley - <AUTHOR> https://qz.com/1235955/theranos-and-zenefits-are-a-feature-not-a-bug-of-silicon-valley/ <comment><USER3> I don't agree with the premise that some amount of deception is necessary to pitch a company. Founders should say both what they plan to do, and what they actually have working today.

I think it's a partly a dysfunction of some investors, that they get excited by the plan and forget to drill into what actually works. Investors who consistently drill into the current situation aren't surprised when things are a little broken, because that's true of every startup.

<comment><USER4> and investors simultaneously kill competition by honest companies...'you have a 10 year roadmap to do X? not interesting. i'll invest $100m in this company that says they can do 10X in one year!'

<comment><USER5> The market should correct that though. Those companies will (should) quickly run out of money to invest. While those who pick the ones with the right 10 year plan will (should) have the returns to continue investing.

<comment><USER6> What really happens is the company that over-sold their capabilities gets the $100M and then ends up not meeting their stated timeline but investors are already 9-figures deep so they just accept there were "unforeseen setbacks" and continue supporting the company rather than admit they were hoodwinked.

Meanwhile, the realistic company that was passed over runs out of money and folds.

<comment><USER7> I think most startups understand this implicitly, and therefore most pitches are lies. Most of the rest of the comments are about "it doesn't have to be this way!", but it's almost an inescapable local max. The previous big breaks in technology were nearly always the 10X in 1 year types, but it's extremely hard to tell who is actually a 10X in 1 year because they are so extremely rare. Probably impossible, since more likely than not, the 10X is pure luck on the part of a competent 1X than any kind of real difference.

So the sensible 10 years for 1X that will make you profit but not overwhelming profit don't get funded, so the 10 years for 1X have no choice but to lie and get the funding they need, and investors get stringed along with all their sunk costs because most of the time that 1X payout is still a lot more than their sunk costs.

</comment></comment></comment></comment></comment><comment> castle-bravo Canadian engineering culture is a little different from American engineering culture. In Canada, you can't legally call yourself an engineer unless you are certified as such by a professional association. All students graduating from engineering programs are given an "Iron Ring" (stainless steel) to wear on the little finger of the working hand. The steel in the ring symbolizes the steel in a fallen bridge. The message is simple: if you fuck up, people can die. This extends to purely financial matters too; if you waste 2M of capital, you've wasted the productivity of an average person's life (average in Canada and the US).

If you lie to people to get your hands on their money and misrepresent your work, you shouldn't be lionized as some kind of entrepreneuring maverick; you're a danger to the public interest. This is worse than making a calculation error that results in harm; it is willful and deliberate harm at the scale of a mass murder.

<comment><USER8> Definitely a pet peeve that so many software developers call themselves software engineers. I went to engineering school in Canada, and no longer wear my ring because the work I do is not engineering, it's development.

I'm not trying to knock the software development profession, I have a lot of respect for and derive a lot of joy from the work. There's just a difference between "As a member of this association of professionals, I declare this a safe and appropriate design, and am personally and professionally liable for failures in this design" and "I have push access to master and can deploy code to prod".

<comment><USER9> On the other side, do we want to treat every project like a medical device?

In the vast majority of sane engineering orgs there isn't gross negligence and developers are very cautious (hence the popular evil PM / incompetent manager trope) to the point that they barely move at all.

<comment><USER10> >On the other side, do we want to treat every project like a medical device?

No, but is most software work really engineering? Personally, and atthe risk of completely going off topic and starting a debate which has little purpose, I don't think so. I don't consider duct taping together various frameworks and third party libs to create yet-another-CRUD-app "engineering".

<comment><USER11> In all fairness, a lot of other disciplines of engineering could be described the same way. My SO for instance is a civil engineer at a construction company. The company works on multi million dollar projects building airports, hotels, schools, etc. These are massive projects meant to service thousands of individuals and if they make a mistake people can die. She describes her job as "a whole lot of babysitting adults (sub-contractors), and duct taping bad designs to worse material".

Are there safety concerns that a lot of engineering doesn't have? Sure. But it goes both ways. In her field of engineering there are limited impactees and mistakes while potentially fatal have minimum monetary value. I can fuck up and cost my company millions in an instant. Or expose millions of user's personal information. Different risks, and I'd still probably take the a stolen identity over death, but at the end of the day it's a similar job.

<comment><USER10> A civil engineer is responsible for every tolerance, specification, and design they put their name on. I imagine they would be verifying those before they sign off. She also has to have a lot of knowledge in math and certain sciences to do that job I'd consider that engineering.

<comment><USER11> This is a late reply but basically, you're completely wrong. There are certain aspects that someone on site has to be sign off on, but no the majority of engineers on site don't have to be responsible for really anything other than verifying they delivered what they promised. There are inspections (generally by the state) that verify the safety of a finished project. If something goes wrong because of sub par material or a design from an architect that ended up not being sound that's not on the engineer who signed off. And as far as Math and Science skills it's actually pretty similar to CS people where you learn a lot of stuff that you never use, or are expected to. Some guy did a basic derivative for something or other on their site, a week back, and everyone freaked out they were so impressed. These aren't the day laborers. There are all guys who've been in construction for years, Superintendents, field and project engineers, etc.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is why medtech has the FDA, and why the FDA has actual teeth.

"move fast and break stuff" is bad PR if you're facebook. It's a game-over felony if you're making medical devices.

<comment><USER13> The FDA is necessary but I do think it could stand to adopt a little bit of the Silicon Valley ethos.

Good example: the Freestyle Libre CGM is a recently approved glucose monitor for diabetics. The European version lasts 14 days and takes an hour to start up, the US version lasts 10 days and has a 12 hour (!) startup time. It's the exact same hardware with artificial restrictions added to the software for unclear reasons.

<comment><USER14> > It's the exact same hardware with artificial restrictions added to the > software for unclear reasons.

Well, a quick search of Google Scholar turns up at least one citation in which the Freestyle Libre CGM was significantly less accurate in the first day of use than in later days, indicating that it needed more time for proper calibration:

[https://www.liebertpub.com/doi/pdfplus/10.1089/dia.2014.0378](https://www.liebertpub.com/doi/pdfplus/10.1089/dia.2014.0378)

I expect that the differences are based on some actual findings, not just "unclear reasons," but you may have to do some research to find out.

The FDA is notoriously cautious, possibly somewhat excessively so, but there is some good reason for that caution; medication and medical devices can have unexpected behavior and side effects and it can take a lot of long term study to find them. One example of the caution working out well is the Thalidomide case, which was approved in many other jurisdictions but not in the US, and which had significant side effects on fetuses.

<comment><USER13> What's unclear is not the data but the decisions they made based on the data. Why is that first-day margin of error acceptable for European diabetics but not American ones?

Anecdotally, as a diabetic, the margin of error in that paper is much less scary than going 12 hours without a CGM. Poor data is much better than no data, especially if I know the data is going to be a little questionable the first day. I was completely ready to switch from Dexcom to the Libre until they announced that restriction.

<comment><USER15> > What's unclear is not the data but the decisions they made based on the > data. Why is that first-day margin of error acceptable for European > diabetics but not American ones?

The decisions were being made by different people. It's not like the FDA decided that Americans require a 12-hour window but Europeans only need 1. The FDA is just more cautious.

<comment><USER13> I wasn't being literal. The point is the FDA is overly cautious to the point that they're harming the health of patients. Slight deviations between the US and EU are understandable, 10x is questionable.

<comment><USER15> I'm sure there are people who would say that European regulators are being permissive to the point that they're harming the health of patients. A lot of women in the US could have benefited from thalidomide while it was being used in Europe, but the FDA was too cautious to allow it.

People will benefit from those extra 11 hours, but they'll also be hurt by the lower accuracy. It's completely reasonable for different people to weigh these costs and benefits differently.

<comment><USER13> > People will benefit from those extra 11 hours, but they'll also be hurt by > the lower accuracy

11 hours without a CGM is a much greater risk than marginally lower accuracy. As a potential user of this system I've been unable to locate research to convince me otherwise.

<comment><USER15> Luckily there are other ways to get them, and the FDA's decision has kept you using a more accurate one.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Venture capital is much more of a Ponzi scheme than the community cares to admit. For every spectacular case like Theranos, how many cases are there where early investors at the top of the pyramid are able to take money off the table at the expense of later investors who never make it back? Technically, the company may still be viable, and might be acquired for some fraction of the total invested. But the mechanism that the VCs leveraged for _their_ profit still resembles a classic pyramid scheme, where it is money from later investors ("the greater fool") that lines their pockets, and not profits from a successful business.

<comment><USER17> Could you give some specific examples where a startup was sold _at a loss_ and some of the investors actually got out more money than they put in?

I know that when a public company goes bankrupt, the investors with preferred stock can, at best, get back all their money, but they can't make a profit.

<comment><USER18> VCs can invest money with garunteed payments greater than 1x. It doesn't mean that if the company sells for less than their investment they'll get their money back, but if they put in 1x and are garunteed 2x and first in line to get paid, when the company gets sold for 3x the VC gets their 2x and all the other investors/employees get to pull from the leftovers

</comment></comment></comment><comment><USER19> It's unfair I think, to group Theranos - a total lie and fraud - <USER2> Zenefits, offering a useful service but cutting corners illegally.

<comment><USER20> I think it is perfectly fair to group corporate criminals together.

<comment><USER21> Yesterday I jaywalked across a street. Most people wouldn't put me in the same group as Charles Manson.

Grouping drastically difference offenses in the same bucket obscures reality instead of making it more clear.

<comment><USER20> No, and 'most people' would not put Zenefits into the same bracket as a company that filed a VAT statement two days late either.

Zenefits is closer to Theranos on that scale (and closer to Uber and a couple of other entities that seem to enjoy breaking the law and letting others pick up the fall-out).

The fact that Zenefits survived as a company is remarkable, but it makes their intentional deceit and fraud no less.

<comment><USER21> Theranos conducted medically invalid blood tests and sent the results of those test to patients.

Zenefits sidestepped some occupational licensing rules that only exist to protect the market of incumbents.

<comment><USER22> Well, no. Theranos made fraudulent misrepresentations about their technology, which was used as the basis for medical treatment for at least some patients.

Zenefits made fraudulent representations about the training of their sales representatives, many of who know diddly squat about what plans they were actually selling to companies, and Zenefits' incompetence in actually transcribing data across incompatible systems. This resulted in numerous employees being denied timely access/use of their benefits, including health insurance. Zenefits absolutely belongs in the same category as Theranos and both companies should thank their lucky stars that their executives aren't in prison cells right now.

</comment></comment></comment></comment></comment></comment><comment><USER23> "The only problem with an honest buck is they're so hard to make - the margins are too low, too many people are doin' it." \-- Yuri Orlov , 'Lord of war' [http://www.imdb.com/title/tt0399295/quotes/qt04033055](http://www.imdb.com/title/tt0399295/quotes/qt04033055)

There will always be unethical people willing to exploit the commons for their own profit. Some will do so spectacularly, as a society it's our job to ensure that the EROI of such actions are < 1x so that they will lose out in the long run. Elizabeth Holmes was thoroughly unethical and will spend the next decade paying for that choice, I doubt she profited from it.

</comment><comment><USER24> Theranos is a ponzi scheme right? I can see that they scammed investors by using Silicon valley techniques, but Zenefits seems like just a poorly run company just like any other one.

On that front, why is no one at Theranos jailed and why is that company still operating?

<comment><USER25> Not every fraud is a ponzi scheme. Ponzis are a specific kind of fraud where existing investors are paid dividends using investment funds from new investors. I haven't heard that existing Theranos investors ever got payouts.

<comment><USER26> good comment.

Most folks think in terms of absolutes, like "good vs bad", "right vs wrong", "steve jobs", "freedom", "jail", "fraud", "ponzi scheme", "criminals", and don't care about the details. People are easily misled by labels, like "Little Marco" or "Lyin' Ted" or "Crooked Hillary"

All of a sudden people are calling Theranos a ponzi scheme when it's doing something completely different.

</comment></comment></comment><comment><USER27> Lack of ethics is a feature?

Ambition shouldn't come at all costs.

</comment><comment><USER28> Just because "exuberance and fraud" are bound to happen doesn't mean they are a good thing. I also don't buy the skippery slope between pitching your vision and lying about the facts. Theranos clearly crossed the line, demonstrating that the line is sometimes clear. An article arguing that the line is sometimes blurry, or that deception can be a good thing, should draw on different material.

If Silicon Valley as a whole is a bit scammy, it doesn't serve us to defend it on that score or spin it into a positive.

</comment><comment><USER29> In my understanding, there is a clear issue here with the understanding and separation between the present, which is a fact and the future, which is a theory.

It is illegal to misrepresent your financial statements, thus lying about the present. But you can sell whatever you want about your future, like changing the world and making it a better place and what have you. The Silicon Valley feature is the unbelievable faith in the potential of an idea/startup. I don't think lying about your current financials or KPIs is a feature.

</comment><comment><USER30> There are fraudulent / bad actors in all industries the commodities industry has an entire sector whos job it is to prove that that shipment of grain, sugar etc is actually valid.

<comment><USER31> The difference in Silicon Valley is that the shipments go out and there's nobody checking. It's a _big_ fucking difference too.

</comment></comment><comment><USER32> The article makes a good point. Exaggeration is common when trying to raise money. Read the history of many startups and you'll find outright lies that seem mild after the fact since the startup was able to continue and deliver. We've all heard the stories as well as all the people that invest in startups.

</comment><comment><USER33> In the case of Theranos, the investors should get domain experts as consultants when they invest.

<comment><USER34> Isn't that simply called (investment) diligence, and unrelated to Theranos?

</comment></comment><comment><USER35> Bad apples are everywhere. It will be poor judgement to prejudice with these limited facts. Business war is everywhere, some entrepreneurs are taking it just too far in pressure to pursue the baseless goals.

</comment><comment><USER31> This is what you get with no oversight, tons of money, s lot of arrogance, and a focus on "hustle" over anything else. It definitely works for a while, but when it comes crashing down it's going to take out a lot of innocent players with it.</comment>


Why & howto stay secure from Short URLs using cURL OR webService 'WebHoudini' - <AUTHOR> http://hackersmag.blogspot.com/2011/08/howto-check-for-safety-of-shorten-urls.html

<comment><USER2> And there's also isshort.com, which will output publisher-provided short URLs (flic.kr, n.pr, etc)</comment>


Rogue Airbnb listings still exist where short-term rentals aren't allowed - <AUTHOR> https://www.cbc.ca/news/business/marketplace-airbnb-covert-listings-banned-units-1.5066673 <comment><USER3> Recently I rented an Airbnb that turned out to be nothing like the pictures. The building that the apartment was in was falling apart, stank of cigarettes and was on a sharp slant to the point where my suitcase would roll if I left it standing in the apartment.

I left immediately, booked a hotel and messaged the host for a refund - <USER2> said no. I had to get Airbnb involved and they asked if I would accept a partial refund. I said no.

The Host asked me to cancel my trip, but I refused because I would have to agree to not accept a refund of more than $30.

At the end of my stay I was asked to leave a review and I left an honest, critical review of the apartment. Airbnb immediately messaged me asking if I'd accept a full refund to take down my review.

This is the kind of sketchy activity that will keep me booking hotels instead. I now have no faith in a place with all good reviews, as guests who leave critical reviews probably removed them for refunds similar to me.

<comment><USER4> I thought Airbnb was supposed to cover the cost of your alternative accommodation in this scenario as well?

If airbnb isn't giving you a full refund without removing a negative review just issue a charge back.

No way they will fight it with that behavior on record.

<comment><USER5> One should get a refund of the canceled booking but my last experience is they did NOT cover the extra cost of booking alternative hotel.

Had a NYE reservation in London canceled hours before my flight. Had to get hotel rooms ( I brought my parents on the trip ).

AirBnb support absolutely useless in rebooking (and no options, just one not close to similar listing repeating multiple times from different 'hosts').

What makes me so angry though was that a phone support agent told me they would give me 50% of a few days of the airbnb reservation cost to cover extra costs. I asked them to push too manager to cover full difference. But instead of offering to cover costs, over chat/email they claimed the phone person never made a promise and only paid me $85 (the difference was multiple thousands).

I asked for the recording but they never responded. I looked into arbitration but the cost/benefit of my time wasted doesn't work out.

<comment><USER6> Why not have your bank issue a chargeback? Takes like 5 minutes, never had any issues with it.

<comment><USER5> Maybe I wasn't clear. I got a refund for the price of canceled airbnb. But I had to get two hotels rooms, same day over NYE. Which was an extra few thousand on top of the canceled amount. This is the contention, where someone no phone told me an amount but then in the end I only got $85.

<comment><USER6> Ah, thanks for the clarification, I misread it.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's crazy to me that Airbnb is this massive company that derives most of their revenue from illegal services. What other multi-billion dollar co is remotely comparable?

Agree last thing I want to deal with is this feeling I'm not supposed to be there when I enter a random condo complex in a new city.

<comment><USER8> I wouldn't say they derive most of their revenue illegally without more data, but regardless it's hardly alone. The ride-sharing services were the first of the modern companies push this model of "implement first, work out legalities later". Many of the scooter- and bike-rental outfits have operated on similar profiles.

Arguably the granddaddy of all of them was PayPal, which substantially strayed into banking territory without ever getting the appropriate accreditation.

Honestly, it seems to me the way much of this legislation moves forward. I don't know that I love companies flouting laws, but when those laws are kept in place against public interest (thinking especially of the state protection of taxi services), it can be hard to muster any serious antipathy towards them.

<comment><USER7> Uber and Airbnb are completely different beasts. At least rideshare benefits both residents and visitors alike and taxis are universally hated for high rates and fees.

How does Airbnb benefits residents of a city outside of landlords/slumlords? In markets with low housing supply they crowd out housing for permanent residents and create safety issues for neighbors. I would be pissed if I lived in an apartment complex with a steady stream of random strangers coming in and out because my neighbor rented it out on Airbnb.

Residential zoning laws _are_ in the public interest. A city that made it legal for any home, apartment, or condo to be turned into a mini hotel does not benefit the people that live there at all.

<comment><USER9> They benefit their customers (who have a much wider and often cheaper selection available than the old hotel industry) and their hosts (many of whom keep their finances afloat through AirBnB revenue, or have been able to enjoy life-changing increases in their standard of living - like sending the kids to college - because of it). It's detrimental to the neighbors, who have to put up with a stream of transients, parties, noise, etc; and of course to the existing hotel industry (though many of them are adopting AirBnB as a booking platform).

Similarly, zoning laws are beneficial to resident homeowners and detrimental to renters, potential startups, real estate speculators.

There is no uniform "public interest". Any significant policy will have some people it helps and some people it hurts.

<comment><USER7> When I look at Airbnbs in SF, NY etc they are regularly more expensive than hotels with none of the benefits of a hotel.

Why should a city prioritize the needs of landlords and visitors over most of their constituents? Would love to see the number of mayors who love Airbnb. I can't imagine there are many, if any.

<comment><USER10> They can't be more expensive than hotels, worse than hotels, and still get booked without offering something of value, unless they're just a bait and switch operation.

<comment><USER11> I suspect there are a group of Airbnb users who never look at hotels at all because "they're more expensive" and so higher price worse units can and probably do get sold.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I've stayed at quite a lot of Airbnb over 4 years of traveling and every time this happened I reported it to Airbnb and they were usually quick to help me get into another place. The service got worse as the years went on, though.

I basically said I didn't feel comfortable being stalked by hotel / lux apartment lobby staff every time I entered and left the building. Some buildings were worse than others.

<comment><USER13> Shouldn't you know that there's a good chance a listing _is_ illegal and/or against HOA rules if you're booking a place in an apartment complex or condo?

I rarely book Airbnb's, but the only places that make sense as far as being "least likely to be against the law" are single family homes or Airbnbs run by a professional rental management co.

<comment><USER12> There are (were?) many lux condo buildings in Bangkok, at least a few years ago, that had plenty of open inventory so they were putting the units online themselves. The condo lobby would take care of your check-in process.

<comment><USER14> There are. I'm staying in one now.

It is somewhat concerning though, as there are big signs in the lobby of just about every luxury condo building stating — in English — that short-term rental is illegal, and you could face large fines and jail time.

</comment></comment></comment></comment><comment><USER15> Is this a surprise? I stayed at places in Vancouver and Seattle 2 years ago that had prominent signs in the lobby straight up stating the building did not allow Airbnb and the hosts had instructions about 'community guidelines' that were really designed to keep renters from being noticed by other residents.

<comment><USER16> Well, if you want to Do The Right Thing, here is the webform to report those hosts to the City of Vancouver:

[https://vancouver.ca/doing-business/short-term-rentals- repor...](https://vancouver.ca/doing-business/short-term-rentals-report- concerns.aspx)

Seattle doesn't seem to have an equivalent.

<comment><USER17> Is it really the right thing?

<comment><USER18> Yes, the law is the law.

<comment><USER19> That's the kind of logic that kept Jim Crow going.

<comment><USER20> You just compared the fight against slavery to lining the pockets of a venture capitalist by annoying the neighbors.

You might want to think about that some more.

<comment><USER21> They did no such thing and its disingenuous to claim so. They provided a counterexample that illustrates a flaw in the ethical model "law = right".

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> In this Airbnb drama there's a company getting all the business and none of the hate: Booking.com. They list apartments, don't perform any more checks on the legality and are never mentioned. It's amazing to watch.

<comment><USER23> In that case though the worse crime is its website...

<comment><USER22> Some will say the booking experience on booking.com is easier but that's not the point. The amazing fact is how they are reaping all the benefits of this growing market while being shielded by Airbnb getting all the bad press. Of course Airbnb started it but now they are both doing the same thing.

</comment></comment></comment><comment><USER24> It's super awkward & sketchy things like this that have prevented me from really trying Airbnb in earnest.

<comment><USER25> Almost every Airbnb I've stayed in has felt a bit like this--like I'm not really supposed to be there--and it's a reason I tend to stay in hotels.

I appreciate the premise of staying in a city a bit more like a local and having a kitchen, but I'm at a loss for how people get over how it always feels a bit sketchy and anxiety around the inconsistent process.

<comment><USER26> How they get over? Saving a bunch of $ helps.

<comment><USER27> Every time I've looked at an AirBnb the prices are the same or higher than a hotel or real bnb unless you compromise on location or sketch factor.

<comment><USER28> I've noticed prices between hotels and Airbnb are closer. I think part of this is cities have caught on and are either charging fees (like SF) or are enforcing more regulations, which limits supply.

In the past (2014/2015), AirBNBs were generally 30% cheaper than hotels and provided better amenities (like a kitchen).

<comment><USER26> It's the same NIMBYism and real-estate-related corruption ring in many large cities that should be upended. If they don't even care about reasonble-cost housing for their own residents, even less so will they care about reasonable- cost lodging for guests.

</comment></comment></comment></comment></comment></comment><comment><USER29> I used Airbnb for years, but after a lot of strange experiences like this I was just tired of it. It was just constantly so much _grief_. And some of Airbnb's policies and customer support was just plain useless or outright hostile.

At one point I realized that if I just stayed in Marriott-branded hotels all the time, I could get platinum status. Now I have it, and I'm much happier with Marriott than I ever was with Airbnb. They give me lots of extra care and free stuff because of my status with the chain. If anything at all doesn't meet my expectation, I just ask them and they always fix it.

</comment><comment><USER30> It's pretty shitty of hosts who know there are rules against Airbnb to Airbnb their homes out, even shittier of the management of such buildings to lock or kick people out (would they do the same to friends and family they didn't recognize?), and shittiest of Airbnb to not take responsibility and at least put up these people elsewhere and stop allowing listings in banned buildings. Of course, if you're a multi billion dollar company, laws don't really apply. After all what are the consequences to Airbnb? None.

<comment><USER31> Some might say that multi-billion dollar companies got those laws passed.

</comment></comment><comment><USER32> Airbnb, where the renter is not the customer, but the product being sold to hosts. Airbnb is a middle man, they dont care about renters or hosts, they only care about connecting the two and getting their cut.

</comment><comment><USER33> I would like to know why the photo was taken that way and why it was used in the article.

<comment><USER34> It makes you feel like you are the person about to stay in the place, only to find out that it's not allowed.

</comment></comment><comment><USER35> Can't the local governments use the homeless population to track such AirBnBs - the homeless will have a place to stay, will earn money(like 20% from the fine given to the landlord) and help detect an prove foul play.

<comment><USER36> If they are successful, the program eliminates itself.

What's to prevent the person from lying about visiting places? A failed career and ruined finances?

Also if the government is going to gather evidence about a crime, even a minor one, the evidence needs to stand up in court.

</comment></comment><comment><USER37> Can some people enumerate pros and cons of hotels vs airbnb?

I've always stayed at hiltons- granted my firm pays for it. Besides kitchen, I've never felt anything missing.

</comment><comment><USER38> Stayed in an airbnb and had someone come round and say the manager was illegally letting it. No official response to a complaint to airbnb. Haven't used it since.

</comment><comment><USER39> This is nothing new, I've used airbnb since 2015 and had the same with hosts, and also tell my guests the same sort of rules too.

Airbnb isn't banned at my condo, but - why tell people what you're doing?

Then again I have 100+ positive reviews, and I invite my guests personally in/meet them in the parking lot, etc.

</comment><comment><USER40> The head line should actually read, "Hotels are so bad, airbnb guests put up with lying and sneaking"

</comment><comment><USER41> Stories like this is exactly why I've created Roamie (www.roamie.co)...for those that want the safety and reliability of hotels, but also might be solo travellers and want to meet others.

</comment><comment><USER42> Why is this women so scared? She seems kind of an idiot, tbh. Who cares? Just play it cool, no one is going to kick you out.</comment>


Genes Responsible For Cancer-Fighting Substance In Opium Poppies Discovered - <AUTHOR> http://www.redorbit.com/news/science/1112546826/genes-responsible-for-cancer-fighting-substance-in-opium-poppies-discovered/

<comment><USER2> Terrible title. In addition to the article saying nothing about a "cure" (as jinushaun pointed out), the substance in question was found a long time ago. What was actually found were the genes responsible for producing it. The "heroin plant" is what most people call an opium poppy. Heroin is a synthetic drug made using morphine as one of the precursors -- opium poppies contain no heroin per se. Cancer cure -> wrong. Found -> wrong. "Heroin plant" -> wrong.

</comment><comment><USER3> Oops, probably shouldn't have been eradicating the poppy crop in Afghanistan, then

Actual article: [http://www.reuters.com/article/2012/05/31/us-medicine- poppie...](http://www.reuters.com/article/2012/05/31/us-medicine-poppies- idUSBRE84U11N20120531)

<comment><USER4> The largest producer of opium poppy is actually Turkey.

</comment></comment><comment><USER5> Title of article says cancer fighting, not cancer cure. HN title should be fixed.

</comment><comment><USER6> Is this yet another cancer cure that will never see the light of the day?</comment>