Ask HN: What happened to millionshort.com? Is it still being actively developed? - <AUTHOR>

Recently I was pained by google search quality. So , I searched around and found this
Imagine a search engine that removed top million sites from its index (millionshort.com) https://news.ycombinator.com/item?id=3910304
Though HN comments were enthusiastic, when I visited the site today, it seemed to be down. I want to know if the site is still up and running? Is the quality still good?
Thanks <comment><USER2> I just tried it I am getting a db.error1.1, and the favicon loads.

<comment><AUTHOR> Same things happens to me also.

<comment><USER2> FWIW, the way back machine shows it active on 11/12/2014.</comment></comment></comment>


Show HN: Simplest chat for platforms and marketplaces - <AUTHOR> http://gaglers.com/index.php/blog/the-simplest-chat-for-platforms-and-marketplaces/

<comment><USER2> Olark and other live chat systems work well when you want to provide all of your own customer support... you're basically in the middle of the transaction. This doesn't scale too well, especially when you have to query both parties to get answers and provide them. You have to become good at knowing the transaction, have good answers and information beforehand, and become good at knowing what questions to ask to reduce loops. Real time support on a marketplace this way is a challenge.

This system allows you to onboard all of the costs above onto the sellers in the marketplace.

My feeling is this would well in a marketplace where your supply side is tech- savvy. Otherwise you'll need a desktop client to keep them signed on.

Even if your sellers are tech savvy, they'll need to keep your browser window open all the time. Sure, you could build an app and push notifications, but it's hard to provide real time chat support on your mobile device. Integrating with Google Chat, Skype, etc... may be the way to go (this works well for me when using snapengage). I'd be really interesting in using this as soon as that ability is offered on the buyer-side.

<comment><USER3> Just to be clear. Sellers using Gaglers can be using any IM client or Gtalk as well. For sellers who do not want to configure an IM client, they can just use the browser.

On the buyers side, buyers have to use the browser to ask their quick questions. You can have the buyers use a IM client, only if you know the buyer ahead of time.

Can you explain how else you envision buyers using Google talk or any IM client? We'll be happy to collaborate with you to do this.

</comment></comment><comment><USER4> This is a wide open space, and I think a tool like this definitely adds a lot of value to engagement on e-commerce sites. Everytime I've bought an item on eBay, I've had questions for the seller, and getting the answers quickly on chat would definitely have helped me a lot. From what I understand, that is exactly the use-case that Gaglers is targeting.

<comment><USER3> Yes, that is exactly the problem we want to solve. Thanks Niraj!

</comment></comment><comment><USER5> Cheers for the MVP, but jeers for the copying of Olark's branding.

I used to work for a business chat company and I bet moderation will be your biggest challenge. When you put an open chat box online, the amount of times it ends up as sex chat approaches 100%. Think chatroulette, but text.

<comment><USER3> There is no copying of Olark's branding. As I mentioned earlier, the website is a template from themeforest.

You are also wrong about this being a open chat. This is a chat initiated with a seller of a product for a specific purpose. Can you please try to understand the product before commenting on it.

</comment></comment><comment><USER6> Very similar color scheme, layout, and design in general. Big no-no for me, but I applaud the effort.

<comment><USER3> The similarity is unintended. We are a group of programmers, and so we picked up a theme from themeforest for now. We are working on a better design for the site.

</comment></comment><comment><USER7> Why is the logo of such poor quality?

<comment><USER3> Sorry, that was a quick design work to get the product out. We are working on making the design better.

<comment><USER7> It's not so much the design. Rather, the image quality is very low, like it's a fully compressed JPG? Just save it as a GIF or PNG.

</comment></comment></comment><comment><USER8> How would you embed this in a marketplace listing? Pretty sure that'd be a no- no on eBay.

<comment><USER3> eBay will have to deploy this for their marketplace.

</comment></comment><comment><USER9> Wonder why Olark didn't build it. I just didn't realize that this was missing.

<comment><USER3> The problem that they want to solve and what Gaglers solves are for different people.

<comment><AUTHOR> People? I thought this was supposed to be for marketplaces right?

<comment><USER3> Yes, this is for sellers at platforms and marketplaces to interact directly with their prospective buyers.

</comment></comment></comment></comment><comment><USER10> Does it exist something open source like this?

</comment><comment><USER11> How does this compare/contrast with ZenDesk?

<comment><USER3> Gaglers and Zendesk seems complementary to me. Do you think there is any overlap?

<comment><USER11> I don't know yet - I was hoping I could be lazy and let somebody just tell me.

I've actually been meaning to try the whole live-chat with customers, but haven't gotten around to it; it'd be interesting scaring the bejesus out of a few potential buyers.

</comment></comment></comment><comment><USER12> How is this different from Olark?

<comment><USER13> So it's different in that Olark can't be used by two sides of a marketplace without using a chat application like Adium and having accounts?

<comment><USER3> Yes. This can be used without any Adium or other IM accounts. Sellers could choose to use any IM client, if they prefer.</comment></comment></comment>


Diversity? That's for racists. - <AUTHOR> http://jamellebouie.net/blog/2013/1/6/diversity-thats-for-racists

<comment><USER2> I think it's fascinating how people can claim that a group is homogeneous from skin color and genitalia alone. What about diversity of background, view point, education, job experience, etc?

I wonder how they choose books to read..

<comment><USER3> First, there are lots of types of diversity of background, viewpoint, education, experience, and the like that you can't get without making sure you have diversity of race, gender, class, and so forth.

Second, there's a question about what the point of diversity is; nobody is claiming that reducing homogeneity is, in and of itself, a worthwhile goal. In CS at least, it's obvious to me that there's no particularly good (in the sense of intrinsic) reason that there are way more male than female, white and Asian than black and Hispanic, etc. people in the industry. This means that my industry is missing some two-thirds of the people who could be in it -- drawing from a pool that's artificially limited to maybe a third of what it could be. I work for a company that's having trouble hiring, and I use and contribute to several open source projects that are having trouble finding volunteers. If we can triple the pool of involved folks, my life gets personally better.

Meanwhile, it's not at all clear to me that it's the case that CS as an industry (or design as an industry) is missing a bunch of folks who are perfectly capable of contributing except that they have the wrong background or viewpoint. Background is very easy to fix (if you're motivated and have the right opportunities available to you); work-relevant viewpoints tend to actually be important, like whether you value being a stickler for style, and I think there's plenty of diversity in work-irrelevant viewpoints.

Relatedly, there's a question of accounting for privilege. It is entirely too easy for me to geek out with people who have all been programming since middle school, which can be legitimately intimidating to someone who's just picking it up and afraid of asking dumb questions (instead of merely seeming precocious). Class, and to a lesser extent race and gender, influence privilege and what opportunities are available to people. Things like viewpoint, not so much, and things like education are an effect, not a cause (since they're fixable, and since it's a good thing not to have diversity of education and merely to have everyone well-educated -- tying back in to what the point of achieving diversity is). Going out of our way to include people who didn't have the opportunities we had is a good way to counteract the effects of that unfairness.

<comment><USER2> Yes, it's possible to self-select into a group of people who seem the same now, but that's still based on assumptions.

For example, until graduating high school, we were one of two "white" families in the entire neighborhood. Further, I didn't get my first computer until I was 16.. when I had saved up enough money at my minimum wage job to buy it myself. It only took two years. Finally, I was the first in my family to finish a full year of college and then the first to graduate. Only a few have followed me since.

Assuming you know who I am and what I am because I happen to look "white" and be male is insulting.

<comment><USER4> And you have no idea what it would be like to go through day-to-day life as a black woman. If your response to "You have privilege" is "I had it hard" you've already failed to even understand what the conversation is about.

</comment></comment></comment></comment><comment><USER5> Correct me if I'm wrong, but doesn't the word racist meant someone who classifies people based on race?

That racist could be using their classification in a 'positive' or 'negative' way depending on your viewpoint or desires.

Personally, I'd rather classify people based on decency, skills, and other material differentiators and leave both the 'positive' and 'negative' racists to the dustbin of history.

<comment><USER6> I'll correct you. That is wrong. "Racist" is a negative term. If it meant "classifying people based on race," then the word loses all meaning unless you are completely blind and never notice any of the physical or social characteristics that tend to cluster in human beings.

Historically, people who defend the status quo have tried to broaden the word as much as possible, because one way to "win a debate on the Internet" is to move the goal posts. e.g. If Alice brings up a subject about racism that Bob finds uncomfortable, he asks her if she considers herself Black. When she says "yes," Bob accuses her of being a racist. Alice now spends a frustrating hour debating the meaning of the word "racist" and Bob has neatly eased out of discussing her original disquiet.

<comment><USER5> It see.

Then, I agree that 'racist' is a negative term, in that the motivation to segregate groups of people is usually to derive a undue benefit for either themselves or a particular group of people.

What is odd to me is that some people can engage in racist behavior, and yet feel the label doesn't apply to them because they are 'positive racists.'

</comment></comment></comment><comment><USER3> I'm quite glad to see that the "uh guys, you might be privileged" meme is attracting enough attention and mindshare to draw this sort of opposition. It shows that the efforts of the parties that have been pushing it are successful at reaching the people they need to reach, and more importantly, working to change the shared perception of standards in various communities. You'll note that he speaks as a minority viewpoint trying to claim that the majority is crazy, not like a person in line with the prevailing views of the community who's quieting a lone crazy voice.

<comment><USER7> _Note: Due to the highly charged nature of the subject matter, and likelihood of readers already having strongly entrenched positions, I realize that it will be anywhere from difficult to impossible for some people to 'hear' me on this. All I can ask is that you keep an open mind, and try to see it from the other side._

There's a negative and a positive way to approach the diversity problem, and unfortunately, the "uh guys, you might be privileged" camp have decided to run with the negative way, hence the (quite understandable) backlash.

Don't get me wrong, I understand and share the sentiment, but the inescapable fact is that saying "you're privileged" is not only inherently accusatory, but does more to emphasize (and reinforce) that which divides, rather than that which unites.

On the other hand, I've been very fortunate to be involved in advocacy groups like PHPWomen, which provide mentorship opportunities for female (PHP) developers, and connects them with conference organizers and major Open Source projects. They've been doing this for years (i.e. well before hating white male privilege was en vogue in the tech community), and they've been tremendously successful.

Guilt-tripping and divisiveness are toxic. If this is a problem you genuinely care about, the above might be a model to follow. Don't be reactive, be proactive.

<comment><USER8> > inherently accusatory

It unequivocally is not. It is pointing out a fact: I am a white, upper- middle-class, English-speaking, computer-literate, straight, cisgendered, first-world male with a supportive family unit. These are all descriptors which lend me advantages--on average and in the long run--that people exhibiting other available descriptors do not have. No one has ever told me that I am a bad person for having them (or if they did, I probably brushed it off as a ridiculous notion), but they have asked me to _recognize_ that it is so, and incorporate that understanding into my critical view of our culture.

That some take offense to _facts_ would seem to me to be out of the hands of those pointing them out.

<comment><USER7> 'Hey nollidge, the sky is blue.' Seems silly to point out, no?

That's because nobody points out facts in a vacuum; people point out facts because of things like _meaning_ and _implication_. The purpose of communicating new knowledge, or old knowledge put into a new context, is to produce a change in thoughts, actions, or behavior. This is not a complicated idea.

As an individual, operating under my own idea of what it means to be a 'good' person, I try to do my best to judge people on their character, not on superficial characteristics. Also, I feel like as a person, I have fairly healthy boundaries.

So, when someone communicates to me through implication, by emphasizing a series of facts, that I have a duty to violate my own sense of fairness and morality to rectify a broad, amorphous social problem of arbitrary criteria, yes, I consider that an attempt to violate my boundaries.

<comment><USER8> > people point out facts because of things like _meaning_ and _implication_.

Yes, great, thanks. Now please explain how that _meaning_ and _implication_ is "inherently accusatory", rather than pointing out non-obvious facts to people who don't seem to believe them (cf. evolution, the big bang, etc.).

What is it that you think is being implicitly asked of you?

<comment><USER7> > What is it that you think is being implicitly asked of you?

Well, that's the real trick, since it's been hard to pin down to any level of precision.

But then, I'm not one of the people going around, sanctimoniously passing judgement on those who don't conform to my personal moral code.

But if you can find one of them, and get them to give you an unambiguous, noncontradictory explanation for exactly what they expect of everyone, I'd consider it a favor if you passed it along. :-)

<comment><USER8> So you can't even define what it is people are "implicitly" asking of you, and yet you're convinced it's "inherently accusatory", would "violate your own sense of fairness and morality", would "violate your boundaries", and the asker is being sanctimonious.

Pardon me if I do not take your Real Important Concerns seriously.

<comment><USER7> My apologies, I can see you don't appreciate being toyed with. ;-)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This Andy Rutledge fella seems like just the type that has an overly simplified, reductionist point of view, which is akin to a child's mind. "Capitalist idealists" are too often blind to the reality of the world, seeing privilege as some made up idea because they don't understand their own.

</comment><comment><USER10> This is kind of disappointing that rather than looking at ourselves as part of a society and many communities, there is passive aggressive, smarmy, drivel like <http://conferencequotas.com/>.

I'd dare this fella to have a conversation with Eric Ries or Vivek Wadhwa and others. He'd get dummied into the next century, if this isn't a poorly thought out clumsy attempt at caricature/satire/parody.

<comment><USER7> > [...]if this isn't a poorly thought out clumsy attempt at > caricature/satire/parody.

From the footer: " _This site is satire. It pokes fun at the destructive idea of arbitrary diversity, or tokenism, and the people who promulgate it._ "

<comment><USER10> Didn't finish my sentence, if this isn't a poorly thought out and clumsy attempt at caricature/satire/parody, I don't know what is.

To have the right to free speech, we also have the responsibility to learn how to use it.

It's easy to be tounge in cheek biased/degrading towards others and say it is a joke.

</comment></comment></comment><comment><USER11> This post seems to have been removed from the front page.

<comment><USER12> I wonder why. (Not sarcastic, btw.)

<comment><USER13> Articles like this don't promote healthy discussion. Achievement gaps between races in different areas are a huge social taboo.

It's just not something that can be discussed calmly and openly in a semi- professional forum like this. So you get nothing but on side spouting politically correct cliches and the other side claiming that they are the truly politically correct ones.

</comment></comment></comment><comment><USER14> People like this are obviously blind to the sort of misogyny and racism that still permeates human culture, especially U.S. culture, today, and don't realize what considering the people affected by these social diseases can do. When you consider the marginalized, the marginalized will get a voice, and this demonstrates that people besides white cissexual men can have a place in the community (in this case tech communities).

But then again, we're talking about adults who still use 4chanisms like "o hai!" (see: the footer of conferencequotes.com), so it's possibly just a matter of waiting for these people to grow old and get out of the way of more progressive-minded individuals who are building communities that can afford to value sensitivity and skepticism, without egos and masculinity complexes keeping love and rationality at bay.

</comment><comment><USER4> I wanted to not post, but this was too much greatness: <https://twitter.com/andyrutledge/status/288048242590101504>

This is beyond great too, stick around for the quiz: <http://capitalismis.com/>

<comment><USER15> capitalismis.com is satire, I hope?</comment></comment>


Once-starving GnuPG crypto project gets a windfall. Now comes the hard part - <AUTHOR> http://arstechnica.com/security/2015/02/once-starving-gnupg-crypto-project-gets-a-windfall-but-can-it-be-saved/

<comment><USER2> > It's encouraging to see the GnuPG project benefitting from similar largess. > But it also raises the question: how is the money best spent?

However the heck they want to spend it. These are donations. If the guy has been working so hard just to make the world a better place and he wants to disappear with the money, I'd be bummed and I imagine lots of other people would too, but _they were donations_. A "thank you for busting your back for so long", not a "hey, now you've made it to the big leagues, better saddle up (the way I want you to, by the way)."

We've been using this software (probably worth many millions a year in the private sector) for free for how long? At least for libgcrypt, the initial commit was November 8, _1997_. 17+ years ago.

That said, what are the chances this awesome, passionate developer is going to deliberately drop this project he's poured blood, sweat, and probably some tears into? What are the chances that he _doesn 't_ labor over the decision on how to spend the money, and consult his peers?

I sincerely hope this doesn't turn into some donation-gate fiasco where everybody's miffed about how the money that was freely donated got spent. This guy has changed the world and deserves to take the money as thanks and not added responsibility. He's already been shouldering that responsibility for years.

<comment><USER3> I'm more concerned he might mismanage the money. He seems like a really nice guy but seems to have no great business/finance perspective. Still, he is free to do whatever the fuck he wants with my small donation. I feel like I owe him a lot more than that.

<comment><USER4> Why does he need a great business perspective to spend something which is nowhere close to what companies using his hard work are earning?

<comment><USER5> This. The article says Google and Facebook each gave him 50 big ones. Which != 0, but I can't help but thinking that's like .00001 seconds of Google profits, given to a project that is probably on the critical path of >50% of their business.

<comment><USER6> Google's profit was $13G in 2013, according to Wikipedia. Thus $50,000 amounts to about 2 minutes of their profit stream. You are off by seven orders of magnitude...

More to the point, how do you figure that GPG is on the "critical path" of 50% of Google's business?

<comment><USER7>
      > More to the point, how do you figure that GPG is on the
      > "critical path" of 50% of Google's business?

Anywhere they're using a debian-based linux distribution, they're using gpg in the package management.

<comment><USER6> That's true, but it says nothing about how difficult it would be to replace.

<comment><USER7> Do you have any idea what be involved in that replacement?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Matt Green, a professor specializing in cryptography at Johns Hopkins > University, said he has looked at the GnuPG source code and found it in such > rough shape that he regularly assigns chunks of it to his students for > review. "At the end I ask how they felt about it and they all basically say: > 'God, please I never want to do something like this again,'"

Reading that reminded me of some comments[1] made by the author of ObjectivePGP, a very recent effort to create an OpenPGP compatible Objective-C library:

> Today I regret that I have not made any notes during programming, so that I > could now quote all my moments or doubt, all WTF? instances (I think that > some of them are still present in source comments). Many sudden turns of > events, lots of dead ends and a massive amount of uncertainty await for the > person implementing this protocol. Now I understand why OpenPGP does not > have many implementations — the protocol itself is simply quite difficult to > implement.

and

> Now, with all I have learned during the time I spent working on it, I would > have written the library in an entirely different way. ... I have even made > a note in my TODO "Need to rewrite the whole thing!". This is true, but if I > keep on rewriting it all the time, I will not finish anything else.

[1] [http://blog.krzyzanowskim.com/2014/07/31/short-story- about-o...](http://blog.krzyzanowskim.com/2014/07/31/short-story-about- openpgp-for-ios-and-os-x-objectivepgp/)

<comment><USER9> One wonders why this fancy professor doesn't assign some students to contribute some patches.

<comment> iso-8859-1 What does "contribute" mean? You can't make the maintainer accept, even if it's actually a good patch. How could this ever be fair?

</comment></comment></comment><comment><USER10> Dear Werner - if you are reading this: Please ignore all the articles and comments about "how is the money best spent"! They don't know what they are talking about! Instead take 2-3 weeks free and bring your whole family somewhere in Mediterranean Sea to the long deserved holidays so you can rest from all the financial burden, take a fresh breath and gather new energy and motivation for the project! And please again: ignore those comments! Greetings from Munich!

<comment><USER11> Indeed. I notice he has a family to support, otherwise I'd have proposed "please use half of the money on wine, women and song, and the rest you can just waste". Whatever he decides to do with the donations, I'll say he's earned the right to do anything he wants.

I fear he'll anyway just hire some help for himself to work on this stuff...

</comment></comment><comment><USER12> The vitriol in the article is pretty surprising to me. Monday morning quarterbacking of an open source project is pretty noxious. Is there some other story that I'm not aware of here?

This guy has sacrificed a lot and built something that is pretty critical to people all over the world. As a pretty casual, I recall directing direct answers from the author in hours from the author. If the code is mess, at least it has been implemented in such a way that the mess is harder to exploit.

<comment><USER13> > The vitriol in the article is pretty surprising to me. Monday morning > quarterbacking of an open source project is pretty noxious. Is there some > other story that I'm not aware of here?

The two most recent upsets were GPG deliberately breaking a whole bunch of compatability, meaning newer versions will not decrypt older files. For people who use GPG for e.g. securing transferred documents that might be called in court, it's pretty upsetting, to put it mildly, that the maintainer has told us we're on our own if we want to be able to access old files[1]. Since this is one of the core uses for GPG it's generated a lot of angst.

The more obnoxious one for me is going out of his way to break a whole bunch of GPG integration, complete with acerbic error messages for people who had been relying on it. Making encryption harder to use will not improve security.

[1] Sure, you can keep old sources around and hope GPG 1.x will still build 10 years from now, but that's a bit of a gamble.

<comment><USER14> _Removal of PGP-2 support

Some algorithms and parts of the protocols as used by the 20 years old PGP-2 software are meanwhile considered unsafe. In particular the baked in use of the MD5 hash algorithm limits the security of PGP-2 keys to non-acceptable rate. Technically those PGP-2 keys are called version 3 keys (v3) and are easily identified by a shorter fingerprint which is commonly presented as 16 separate double hex digits.

With GnuPG 2.1 all support for those keys has gone. If they are in an existing keyring they will eventually be removed. If GnuPG encounters such a key on import it will not be imported due to the not anymore implemented v3 key format. Removing the v3 key support also reduces complexity of the code and is thus better than to keep on handling them with a specific error message.

There is one use case where PGP-2 keys may still be required: For existing encrypted data. We suggest to keep a version of GnuPG 1.4 around which still has support for these keys (it might be required to use the --allow-weak- digest-algos option). A better solution is to re-encrypt the data using a modern key._

[https://gnupg.org/faq/whats-new-in-2.1.html](https://gnupg.org/faq/whats-new- in-2.1.html)

This only affects data encrypted by PGP-2, the original Phil Zimmerman PGP. If you are on GPG 1.4 or 2.0 and want to switch over to 2.1 this shouldn't be a problem.

<comment><USER15> It affects the data encrypted by GPG until that "new and improved" version, as long as the keys have "older" format. Until recently the GPG was able to use such "older format" key for both encryption and decryption. Now it can't do both. And that was even not necessarily known by the users, that they used something "older": you saw the shorter fingerprint but otherwise everything worked.

GPG even doesn't inform the users in the runtime that it silently removes user's "old format" keys from the set of keys they had. They just "dissaper."

The people who use the PGP the longest are the ones most inconvenienced. The old data, supposed to be backups, can't be read by the new version.

<comment><USER16> We must maintain perfect backward compatibility back to the beginning of time! We must have pristine clean and cruft-free code to help ensure mistakes are easy to catch!

Sounds like the age old, More Taste! Less Filling! Backward compatibility for insecure algorithms is exactly the code which should be jettisoned. We have VMs which run Amiga and DOS, if you're terrified of not being able to decrypt then grab a cup of coffee and get to re-encrypting with a key that doesn't inline MD5!

You did get the part where this is free software, and you are free to fork it if you wish?

I tend to think it's the _users_ responsibility, by choosing to use the package, to actually understand how it works. The maintainer owes you nothing. It's stated right there in the license.

P.S. The scare quotes do not help your argument. The old keys are technically weak. That happens with crypto from time to time. If you can't plan for that, might as well keep it cleartext.

<comment><USER9> _We must maintain perfect backward compatibility back to the beginning of time!_

Actually, if you are writing archiving software, yeah. Especially for official or legal records.

</comment></comment></comment></comment></comment></comment><comment><USER17> > But it also raises the question: how is the money best spent?

No, it fucking doesn't raise that question. As far as I am concerned the money is already spent. And that's the way it should be, because Werner Koch has already devoted years of his life to developing this stuff.

</comment><comment><USER18> Don't bother, donate to the NetBSD team instead: [http://www.netpgp.com/faq.html](http://www.netpgp.com/faq.html)

WK has unreasonable opinions, e.g., see this thread: [http://www.reddit.com/r/programming/comments/2uw2gt/the_worl...](http://www.reddit.com/r/programming/comments/2uw2gt/the_worlds_email_encryption_software_relies_on/cod1u7t?context=3)

Having tried to integrate PKCS#11 support into GnuPG (rejected with bogus and dodgy arguments, see threads documented here: [http://zvrba.net/software/gpg_pkcs11.html](http://zvrba.net/software/gpg_pkcs11.html)), I can testify that the codebase is messy and complex.

Just ditch it and make something from scratch. I have more faith in the competence of NetBSD-associated people than in WK.

</comment><comment><USER17> > The main problem with the code, he said, is it hasn't been properly > maintained over the years.

Maybe this is because it was being maintained by a single underfunded developer. I'm not sure how the fact that we're now funding that programmer enough that he can hire a second developer (as was his stated intent) that this brings up questions of whether the money is well spent.

Ars Technica? More like Talking-out-their-arse Technica. Non-technical people writing about code critiques they can only understand second-hand is pretty much worthless.

</comment><comment><USER19> TFA says the GnuPG code is pretty rough. Has anyone (with crypto knowledge) looked at it? Confirmations and denials welcome.

<comment><USER20> libgcrypt is pretty rough, yes.

The plus side is that GnuPG by design has a relatively limited attack surface. It's tough to conduct a side-channel attack that requires thousands of message stimulus-response tests to get a single key or message bit, given that each iteration of that attack will (in typical GPG usage) require manual intervention.

As long as your crypto isn't "online", GPG is still a pretty safe bet. You can't say the same thing about a lot of newer crypto libraries.

However, if you're doing something like encrypting a session cookie, you should use Nacl, not GPG.

<comment><USER21> Can you expound on your last point?

<comment><USER22> If you assume the rest of his comment is true (I'm no crypto expert but it seems intuitive enough for me, and he _is_ a crypto expert!), having something like a session cookie (which can be attacker controlled) encrypted with GPG (which means it's now "online", without manual intervention) has now increased the attack surface considerably; it gives up the neat offline part of GPG and makes it easier to attack.

That's how I understood it anyway!

<comment><USER20> Yep.

</comment></comment></comment></comment></comment><comment><USER23> $60k is hardly a windfall, but it is a lifeboat.

<comment><USER24> Its actually 120k in direct donations, 60k from CII, 50k from facebook and another 50k from stripe. Even at just under 300k it still isn't much for a development team.

<comment><USER25> Facebook and Stripe each pledged 50k per year, not one time. So assuming they keep their end of it, that is 100k/yr guaranteed for the project.

<comment><USER23> Didn't catch that, yeah, that is more like a windfall. :)

</comment></comment></comment></comment><comment><USER26> The power of internet sometimes still amazes me.

One article. 180keur in donations in a day.

<comment><USER27> Honestly... given that likely millions of people read about this yesterday, I think it's showing of how ineffective internet donations can be that it was a worldwide top story and only generate a few hundred thousand dollars.

If only one project can be in the spotlight a day, there aren't that many projects that can get a respectable amount of funding this way.

<comment><AUTHOR> I imagine if there were a concerted fundraising campaign behind it, they could raise much more. The money they got off the story is just the lowest of the low-hanging fruit.

According to TFA, he's raised nearly $300K so far; rather than using that all to hire coders, it might be worth taking $100K of that, setting up a foundation, and hiring a full-time fundraising/development person. A good one should be able to bring in enough to pay for themselves and ensure a steady stream of ongoing cash, which would be much better than having to rattle the tin cup when things get dire.

<comment><USER15> If I understood correctly, if given as salaries, half of the received money will go to taxes (for Germany, like most of Europe, it's typical tax to the salaries) as the developer handles everything through his company. And everything donated through paypal will also be additionally charged.

[https://g10code.com/about.html](https://g10code.com/about.html)

It's certainly more than the developer expected or made in previous years, but all together it's not as much as it appears to be.

</comment></comment></comment></comment><comment><USER28> The Ars article ends with:

        "A real audit of the [GnuPG] code would be great," Green said. "The problem
        is it would be really expensive and I'm not sure it's worth it."

I wonder what Green means as the alternative to auditing the GnuPG code. Doing nothing? Or could he be arguing that it would be better to start from scratch? Is there a replacement in the wings? Or even as a glint in someone's eye?

<comment><USER29> Yes, there's NetPGP: [http://www.netpgp.com/](http://www.netpgp.com/)

<comment><USER28> That is interesting. I wonder if Enigmail would support NetPGP as an alternative.

</comment></comment></comment><comment><USER30> Hopefully GnuPG developer[s] will also address Mailpile complaints[1]. And JSON-friendly interface as a part of it.

[1] [https://www.mailpile.is/blog/2014-10-07_Some_Thoughts_on_Gnu...](https://www.mailpile.is/blog/2014-10-07_Some_Thoughts_on_GnuPG.html)

</comment><comment><USER31> If he keeps doing what he does every day, except with financial security, these donations have done their purpose as far as I'm concerned.

</comment><comment><USER32> Whats amazing, is that lives will be saved because of these donations. Human rights defenders, journalists, activists etc...

</comment><comment><USER33> Overall a bad article, but the issues it brings up are important:

> The financial strain Koch has endured underscores a cruel irony that has > only recently come to light.

No, that's like saying that women being treated lesser than men "has only recently come to light". Open source, even (especially!) the core, important stuff is blasphemously underfunded, and it always has been. Everyone knows this, even those who deny it.

Furthermore, the psychology is uncomfortably close to the psychology of misogyny: historical precedent, deeply rooted social structures (in this case driven by software economics), by and large nobody wants to pay the significant costs of fixing it, and every now and then a truckload of goodwill is dumped on the fire to douse it so we can all forget about the broken system we're working with until the next time it breaks.

<comment><USER34> I don't think you're going to find a lot of sympathy in drawing parallels between gender equality issues and open-source issues. (And you're likely to get blowback for stepping on a third rail type of issue, whether fair or not.)

The crucial difference, and I believe flaw in your argument, is that female developers being paid less than male developers to do the same job is much more clear-cut evidence of some kind of bias than a developer on an open source project being paid less than a developer on a closed-source project.

The latter is enough apples to oranges that you might as well be wondering why an entry-level doctor gets paid more than an entry-level airline pilot.

</comment></comment><comment><USER35> miniLock [1] seems like a good alternative to PGP for both file encryption and email. It's just so new and it should have more audits.

[1] - [http://minilock.io/](http://minilock.io/)

They've recently launched Peerio as well which is kind of a closed email-like system with easy to use end-to-end encryption based on miniLock.

[https://peerio.com/](https://peerio.com/)

<comment><USER20> From the team that brought you Cryptocat.

<comment><USER36> I'm ready to show my ignorance. Cryptocat bad? I had been using it to help people get their feet wet for OTR. What must I read?

<comment><USER20> Just use OTR. ChatSecure on iOS is fine. Cryptocat is not safe.

<comment><USER37> Is there anything bad about telling people to ignore PGP/GnuPG altogether and use OTR/TextSecure?

<comment><USER38> You can't use OTR for email. Well not in a meaningful way, anyway.

I think the article[ed:1] misses the point, btw. Yes, managing keys might be tricky - but it's not really rocket science. The thing that's hard is managing trust -- which key one trusts etc. The CA system for web is completely broken. I had some hope for cacert.org -- I think that model (perhaps expanded to include recommending signing gpg-keys as well as x509 certs) has a lot of merit.

I think web of trust is the only thing that _can_ work for managing trust. But it needs to be accessible. Have post offices and banks sign gpg keys on when people come in with valid id. Cacert is a different take -- I like to look on it as a "strucutred eternal keysigning party". I trust that model a lot more than the classic CA model. But as it is based on the CA model, it suffers the same problems with centralized trust. Centralized trust is great for organizations, it's not so great for individuals.

I think the best model would be a world-wide web of trust for gpg, helped by formal and informal signing organizations (ie: like cacert, signinparties -- and with the help of banks, governments, DMV and similar institutions that traditionally help with issuing IDs). Then there should be support for anchoring DNS/CAs (and CAs for openssh) with gpg. So that if you trust someone is a representative of an organization linked to a domain name, you can trust them to autorize a CA for that name (there's technical details here, but I think the idea should be clear enough).

CAs go away, everyone can sign their own certs -- and there's an easy way to link x509 and gpg trust.

People will still lose their keys, and get invalid keys signed etc -- key management _is_ hard. But the really confounding thing is trust -- and knowing how to determine which keys are "proper" keys for a given entity. That's really trust management, not (just) key management.

[ed:1 whops, that was the other article on making key management easy ;-) But I suppose this comment is relevant wrt how to make encryption more readily available...]

<comment><USER39> Web of trust is a complete joke. It is literally a system where people who are unqualified to do so confirm identity based on a government id.

<comment><USER38> As opposed to the CA system, where machines who are unqualified to do so confirm identity based on an email?</comment></comment></comment></comment></comment></comment></comment></comment>


Show HN: Chat – simplest live chat widget on the planet - <AUTHOR> https://keyreply.com/chat <comment><AUTHOR> Our team built a variety of web and mobile products, to support customers on websites, we either have to use ugly contact forms, or resort to paying for expensive and bloated live chat software that we do not need. Our time is better spend communicating with customers on mobile, via chat and in a personal way, we want to help owners connect with site visitors directly.

We built Chat by KeyReply to end all of our issues and yours. Simply select the channel you want customers to reach you on and put it into your website code. Watch it turn questions from customers to conversations on messenger, telegram or other applications. Did I mention that it is free forever?

Try it, share it and let's stop the search for a good live chat widget forever.</comment>


Ask HN: Is there a best practices for jQuery in 2020? - <AUTHOR> I'm writing a basic front-end for a Django app. I just need a liiitttle js to smooth things UX-wise. I don't know any JS frameworks and I'm not vanilla JS savvy.
Having used jQuery in the past, I think it would be fine for my use case. However, I don't want to end up with a mess on the front-end.
How do I write jQuery that doesn't end up that way? Is there a canonical text or set of best practices I can follow? <comment><USER2> jQuery was a tool to make DOM manipulation more concise and work across browsers. You don't need it in 2020 at all. Use vanilla JS.

You also don't need a framework yet. Just write code encapsulated by functions until it becomes a pain to maintain, and then look at frameworks.

<comment><AUTHOR> I see, so vanilla JS will work across browsers, mobile and all?

That's a load off, I'll focus on vanilla then.</comment></comment>


Why You Should Feel Deceived and Sickened by America's Stunning Inequality - <AUTHOR> http://www.alternet.org/story/149477/

<comment><AUTHOR> make sure to look at who wrote it ...</comment>


Why 99designs raised $35 million from Accel Partners - <AUTHOR> http://finance.fortune.cnn.com/2011/04/28/why-99designs-raised-3-million-from-accel-partners/ <comment><USER2> What is the general consensus in the HN community on the business model of 99designs especially in light of the protests against "spec" work from the design community at large. There's obviously a market for what they're doing but would your company consider using 99designs?

<comment><USER3> Building apps for the iOS marketplace is "spec" work. I'm working for free until someone decides to purchase my app.

Bootstrapping a startup is "spec" work. No one is paying founders anything.

It's a choice to do "spec" work, no one is forcing someone to work for free. 99design is building an amazing marketplace for customers and professionals on a global level. This will change the way the restrictive nature of supply and demand in design.

EDIT: When I graduated from college, I worked for free. I bootstrapped a startup with my savings that failed to support me and then I worked for free at a development agency doing random projects. From that experience, network, and portfolio I now am living very well doing contracting work and personal side projects.

<comment><USER4> For a designer, it's generally a lousy deal. The upside for the iOS apps or a startup is a lot better than the $300 for winning a 99Designs contest. Yes, you can build a relationship with the contest holder, but you're starting in the basement and it's unlikely you'll make any actual money from that relationship.

That said, it can be good practice for those who need it (and the quality of available designs typically reflects this).

<comment><USER3> I've watched my friends work hard in basement for months when they were forming a band. All they got from that work was the chance to play for tips at a local bar.

There are a lot of designers who are passionate and have amazing potential, but no access any markets.

It can take months to build an app and startups can take a lifetime to build into a company.

The upside to all spec work is pretty bleak everywhere, but we do it out of passion and our audacity.

If it is too lousy of a deal, then 99design wouldn't even exist or be viable. There would be no startups, everyone would work at major established companies and Android and iOS would be terribly boring devices with only apps made by the platform manufacturers.

</comment></comment></comment></comment><comment><USER5> Answer: So the founders could cash out.

<comment><USER6> Yeah. Glad to see that was the answer. It's the only one that would make sense.</comment></comment>


Ask HN: Suggest an online reminder application or website? - <AUTHOR>

I'm mostly looking for the one that is long-term friendly.<p>I.e. my drivers license expires in 5 years, could I get a reminder a couple of weeks before. My passport expires in 3 years, I should apply for a new one ... etc. <comment><USER2> Hi Evgeny!

I put things like that on my Google calendar at the time they are due, set up with an email reminder. It has worked pretty well, although it doesn't put all the reminders together in one place. Speaking of which, I have a passport expiring in 2016 ...

BTW, I'm a developer living in Chengdu China, pondering career directions as I end a fallow period teaching high school -- I'm looking for peers I can talk with about what to do next. Would you be willing to chat some time? I like your posts and think it would be interesting to talk.

In particular, I am curious about the direction of societal change (Pinker's Better Angels, for example) and would love to contribute to it in a positive way, through my work.

Bill Baker, bbbaker at alum dot mit dot edu

skype, wechat: neolefty</comment>


Postgres: Abusing Security Definer Functions - <AUTHOR> https://www.cybertec-postgresql.com/en/abusing-security-definer-functions/ <comment><USER2> The example would be even better if it used the built in functions to correctly escape and cast input types.

CREATE FUNCTION public.realplusplus(integer) RETURNS integer LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog AS 'RETURN EXECUTE format(''SELECT %L + 1'', $1)';

However the search path limitation is still required due to the ability to over-ride basic operators; something that I consider an anti-feature from a security standpoint since it does not LOOK to the casual observer that an overridable function exists.

[https://www.postgresql.org/docs/9.6/functions- string.html#FU...](https://www.postgresql.org/docs/9.6/functions- string.html#FUNCTIONS-STRING-FORMAT)

<comment><USER3> The OP query was static SQL, you changed it to dynamic SQL. How is that supposed to be better?

</comment></comment><comment><USER4> Interesting, this sounds very much like SUID binaries in Unixes.

People want them, but there are so many things to worry about -- LD_PRELOAD, PATH, untrusted input, file open races.

I am surprised that postgres is still vulnerable to to those things. I'd think it is natural that those scripts should ignore "search path", just like Perl requires user-specified PATH in the taint mode, or how Linux SUID binaries ignore LD_PRELOAD variable.

</comment><comment><USER5> This reminds me of the LD_PRELOAD security measure [1]. However the solution there, to always set it to a sane default, appears superior. Can't you set the search path for SECURITY DEFINER to a saner default unless specified?

[1] [https://manpages.debian.org/wheezy/manpages/ld- linux.so.8.en...](https://manpages.debian.org/wheezy/manpages/ld- linux.so.8.en.html)

        LD_PRELOAD
            A whitespace-separated list of additional,
            user-specified, ELF shared libraries to be
            loaded before all others. This can be used
            to selectively override functions in other
            shared libraries. For setuid/setgid ELF
            binaries, only libraries in the standard
            search directories that are also setgid
            will be loaded.</comment>


Transport for London – New responsive website - <AUTHOR> http://www.tfl.gov.uk <comment><USER2> This is really good.

To give an international perspective, this is what I was used to as a Dutch person:

[http://9292.nl/](http://9292.nl/)

I didn't realise how great that website was until I moved to Sweden to study. This is what is available here:

[http://www.reseplaneraren.skanetrafiken.se/querypage_adv.asp...](http://www.reseplaneraren.skanetrafiken.se/querypage_adv.aspx?language=sv)

I've noticed that I used public transport on long distances a lot more when the website was a lot easier to use.

<comment><USER3> I have to agree on that, however I moved in the opposite way.

Back in Sweden I just found it easier to download the route maps of the cities and just manually follow the routes to determine the best place to get on/off or switch.

Also these travel planners that are available for Sweden (or at least 2000's) didn't really work well when you want to travel between cities.

9292ov.nl helped me out tons when I moved here, it still do, but mainly for trains these days. In the cities I just use the bicycle, as is customary around here :)

<comment><USER4> It really depends on where you are in Sweden. Different regions have different public transport providers.

Never thought I would defend Västtrafik(public transport in south west Sweden) but here I go.

Their webpage [http://www.vasttrafik.se/](http://www.vasttrafik.se/) is quite usable. It finds good routes and you can fiddle around with different parameters such as times for changes etc. You can say that you are willing to walk or take a bike part of the way as well. Overall pretty good as long as you are on a computer.

On a phone the default app is not so good. Instead use ResOplanerare which has a very minimal and slick interface.

</comment></comment></comment><comment><USER5> Looks fantastic! There is also an API and documentation available at [http://api.tfl.gov.uk](http://api.tfl.gov.uk).

Disclaimer: I'm part of the combined TfL and BAE Systems Applied Intelligence team (née Detica) that did the build and architecture, along with the great folks at We Are Experience and Attenda.

<comment><USER6> Is there an API for Oyster balances yet? (or planned?) I ask as someone slightly concerned by popular apps which seem to rely on you giving some third party your TFL login for them to scrape it for you...

Very happy to see that TFL have done as much as they have though. Lovely to see :)

<comment><USER7> Not yet, both myself and Tom Loosemoore (deputy director of Government Digital Services) have queried about this here - [http://blog.tfl.gov.uk/2014/03/12/why-a-new-website-but- no-a...](http://blog.tfl.gov.uk/2014/03/12/why-a-new-website-but-no-app- part-2/)

</comment></comment></comment><comment><USER8> It formats nicely on Mobile Safari but ...

1\. "Welcome to our new site" wastes space. 2\. The logo and menu bar wastes space. 3\. "Tube, DLR and London Overground" wastes space.

Then I click on "Special service" for London Overground (the black text on dark orange is hard to read btw) and ... I get an entirely wasted page that tells me nothing about the Overground because the crap at the top has pushed the actual information I'm after under the fold.

cf [http://bit.ly/1gJ64ri](http://bit.ly/1gJ64ri)

Also, the "add any further feedback" text box has issues under Mobile Safari once you try and go back to edit text - I can't add any more text once I've deleted anything. If I close and open the feedback pane, I can type again. It's a bit confusing!

Minor quibbles really but I'd say it was only half responsive, not fully there.

</comment><comment><USER9> Really appreciate the initiative. Need to point out a couple of things (using an Android phone):

Cannot do a search. The menu items are on top of it.

Cannot close the information box about cookies.

Overall, a very good initiative.

</comment><comment><USER10> Looks good, website is more responsive than the existing one. Quick wins I've noticed on my 2min browsing: 1 Auto fill on the "to" and "from" boxes. 2 website looks clean and responsive 3 The future feature "avoid zone 1". Plenty of people are limited with the travel card deals and will enjoy this feature 4 "View on map", thank God I really didn't like having to download a pdf every time I wanted to check a trip

</comment><comment><USER11> They had it on a subdomain for ages. Glad it's finally the main site. It's actually beautiful. Now if only they'd redesign the Oyster bit too.

<comment><USER7> TFL's comment on this - "To make it easier to use Oyster on your smartphone we will be launching a mobile-friendly version later this year."

[http://blog.tfl.gov.uk/2014/03/12/why-a-new-website-but- no-a...](http://blog.tfl.gov.uk/2014/03/12/why-a-new-website-but-no-app- part-2/)

</comment></comment><comment><USER12> This site is really nice to use.

Does anyone know where it gets data on walking routes?

There is a train station near where I used to live. Google Maps correctly identifies it as being 11 mins' away by foot. The TfL site thinks it's 23 mins away by bus, so never includes it in any suggested routes, instead showing my multiple-leg journeys by bus and tube.

Is there a place to report errors or 'I found a faster route'?

<comment><USER5> Can you send me a link to the journey planner results? There is no specific way to contribute improvements to the results, best way for now would be to leave feedback through the form in the title bar of the new website.

Edit: You also might get some mileage out of setting your walking speed to "Fast" and selecting "Routes with fewest changes"

<comment><USER12> Choosing 'fast walking' and 'routes with fewest changes' sort of worked, but it still shows a walking route which doesn't use the pedestrian-only bridge:

[http://www.tfl.gov.uk/plan-a- journey/results?IsAsync=true&Jp...](http://www.tfl.gov.uk/plan-a- journey/results?IsAsync=true&JpType=publictransport&From=Rutland+Close%2C+Merton+%28London%29&FromGeolocation=&ToGeolocation=&ViaGeolocation=&To=Tulse+Hill&TimeIs=departing&Date=20140328&Time=1145&Via=&NationalSearch=false&JourneyPreference=leastinterchange&Mode=tube&Mode=bus&Mode=dlr&Mode=river- bus&Mode=tram&Mode=cable-car&Mode=overground&Mode=national- rail&Mode=coach&AccessibilityPreference=norequirements&WalkingSpeed=fast&MaxWalkingMinutes=40&CyclePreference=AllTheWay&SavePreferences=false&FromId=-0.17270861753%2C51.41920719351&ToId=1001298)

<comment><USER13> Even with the fast walking, they seem to have employed a slow walker to measure this. My walk to work I can do in 35 mins, which isn't at a terribly fast pace, but even TfL's fastest option reports it as taking 44mins [http://www.tfl.gov.uk/plan-a- journey/results?IsAsync=true&Jp...](http://www.tfl.gov.uk/plan-a- journey/results?IsAsync=true&JpType=publictransport&From=n1+6hq&FromGeolocation=&ToGeolocation=&ViaGeolocation=&To=se1+2xb&TimeIs=departing&Date=20140328&Time=1445&Via=&NationalSearch=false&JourneyPreference=leasttime&Mode=tube&Mode=bus&Mode=dlr&Mode=river- bus&Mode=tram&Mode=cable-car&Mode=overground&Mode=national- rail&Mode=coach&AccessibilityPreference=norequirements&WalkingSpeed=fast&MaxWalkingMinutes=40&CyclePreference=AllTheWay&SavePreferences=false)

</comment></comment></comment></comment><comment><USER14> Interesting to note that they minified the generated html. Other than that , well done just on face value

</comment><comment><USER15> This is great, much better than what my city offers: [http://www.mbta.com/](http://www.mbta.com/) I really don't know how a company literally focused on their customers being "mobile" can't have a decent mobile website.

</comment><comment><USER16> My main use case is checking what time the last tube home is, which I can't yet find.

On the old site, I could find the last tube out from Location to Middle Stop, but then get to Middle Stop and realise that the line from Middle Stop to Home is now shut. Hope they fix that now.

</comment><comment><USER17> Developer Tip,[http://www.tfl.gov.uk/tube-dlr- overground/status/](http://www.tfl.gov.uk/tube-dlr-overground/status/) on this page is an SVG version of the tube map...

<comment><USER5> Surprised more people haven't noticed there's an SVG tube map right there! Bonus: it's tagged with the station Naptan codes and TransXChange route ids that are the API's currency.

</comment></comment><comment><USER18> This is pretty neat. We've had one[1] in Czech Rep. for a while but the UI is a little busy (and the adverts are a pain) so this TfL one is much nicer

[1] - [http://idos.cz](http://idos.cz)

<comment><USER19> plus the fact that the site refreshes at almost every click on the menu. If you have tabs, use them the right way! :)

</comment></comment><comment><USER20> doesn't disappoint on the title 'responsive', great!

off topic: this is the FIRST site I've seen that used Samsung mobile image to show the responsiveness of the page instead of an iPhone or an iPad

edit: the favicon is not right, when the page is not in focus, you'll see pieces of the white-background left (i have OCD)

[http://i.imgur.com/z0LAmnJ.png](http://i.imgur.com/z0LAmnJ.png)

<comment><USER21> The hero image shows a lady using an iPhone. Where is the samsung image?

<comment><USER22> [http://www.tfl.gov.uk/corporate/a-new-tfl- website/](http://www.tfl.gov.uk/corporate/a-new-tfl-website/)

</comment></comment></comment><comment><USER23> Wonderful - must better than the old site and has what I want on the front page both on the desktop and my phone.

</comment><comment><USER13> This is really great! So much more useful (and aesthetically pleasing) than their old site!

</comment><comment><USER24> Wow, one of the best responsive designs I've seen.</comment>


I've Sent This Over 100 Times to Recruiters looking for .Net devs - <AUTHOR> http://compositecode.com/2014/04/09/ive-officially-sent-this-email-over-100-times-to-recruiters-looking-for-net-developers/

<comment><USER2> I went into a clothes shop the other day, and asked the manager if they had any red velvet jackets.

"No, but it's funny," said the manager, "you're the 100th person to ask me that - but I keep telling you people, there's simply no demand for them!"

<comment><USER3> seems like this is a lack of supply, not a lack of demand.

It would be more like walking into the tailor and asking for a red velvet jacket, and the tailor responding "Wow, you are the tenth customer today asking me for a red velvet jacket. But, I don't make red velvet jackets, because I don't have the skills to work with velvet. In fact, I don't know of any local reputable tailors that are skilled with velvet who are not already under contract."

"Besides that, I'm an expert, and I think velvet is an inferior materiel. I am quite skilled with silk, and I could make you an excellent silk jacket. Silk is far more stylish and functional than velvet, anyhow."

"I know another very skilled leather-worker I could refer you to if you would like a jacket made of leather, but if you want velvet? I just can't help you"

Fundamentally, I think "I don't like working with technology X" is a fundamentally reasonable position to take. People have preferences. Sometimes people are willing to take less money in order to meet those preferences. "I don't have experience working with technology X" I think is an even more reasonable position to take.

<comment><USER4> I guess what people are saying is that red velvet is so unfashionable they'd rather get a job in a factory working green leather day in, day out, than touch it.

 _Aside: If programming languages were coloured jackets?_

C - black leather, with studs.

C++ - black leather, with studs, on the inside.

Perl - there seem to be fourteen armholes. And seven zips. It's light blue, but in some places the paint is flaking and many other colours show through. Oh, and there is no head hole. Its wearers insist it gets things done just fine and is very flexible. Everyone looks at them weirdly.

Java - a hospital gown. The bare minimum to cover you, mostly designed around the convenience of others. You can buy a factory to make them, but the customisations don't seem to make any difference.

Python - A comfortable denim jacket of average size. It is straightforward to put on. Most people say it fits them perfectly, although a few people say it chafes.

Ruby - every time you move this jacket, it changes slightly. Putting your arms into the sleeves causes new sleeves that would fit better to appear underneath the existing ones. If you tap it, you inexplicable end up with two jackets.

Haskell - a large tartan straitjacket. When you try to put it on, you find yourself in a new jacket, and the original jacket is still in the wardrobe. The jackets are connected by an unbreakable thread of modal. When you take it off, you find yourself looking at yourself still wearing the jacket. You are connected to your other self by a thread of modal. Allegedly you can do anything without errors whilst wearing a Haskell jacket; you suspect the wearers are simply crazy.

Go - A tweed blazer with leather arm patches. It can be split into multiple _gackets_ , which can be worn by multiple people. When wearing your gacket, you can communicate with anyone in another of your gackets, but only one of you can move at once.

C# - part of a family of colourful jackets. The fit well, and are suitable for all formal occasions. However, they are not available outside the USA. Knock- offs are available in the rest of the world, but only in shades of grey.

Fortran - a powered exo-skeleton. It is old, slightly rusty, uncomfortable, unfashionable, and the wrong choice for almost all occasions. However, whilst wearing it you can run as fast as Usain Bolt.

Javascript - a quite ugly mustard yellow suit jacket. It almost looks like its been cut out of something else, a sofa possibly. If you put your hand in a pocket without declaring your intention to do so first, you find other people's stuff in your pocket, and your stuff gone. They are unreasonably popular due to a historical quirk in the law that requires you to wear one of these jackets when visiting a stranger's house.

Lisp - a bolt of woven yak wool, dyed saffron.

Clojure - a bolt of woven yak wool, dyed saffron. It also comes with some smaller pieces of wool dyed different colours, and a direct phone line to a hospital. If you read enough tutorials online, you can assemble a comfortable and useful jacket, although you often have to copy the jacket before you can modify it.

(many edits as I'm on a roll :-) )

<comment><USER5> And to continue....

Smalltalk - the most perfectly made jacket in the entire world but when you put it on, all your other clothes disappear.

Javascript - A jacket with legholes where the armhole should be, but you wear it because everyone else is wearing one.

Visual Basic - A jacket made out of bits of old carpet.

Haskell - A highly technically advanced jacket made out of nano particles that configure themselves to the wearer, but nobody wears them as the instruction manual is written in Sanskrit.

I disagree with your Perl jacket... a Modern Perl jacket would come with a magic incantation that when said over the jacket, it turns it into a bad-ass leather jacket that comes with a free Harley Davidson.

<comment><USER6> JavaScript - more like a jacket with thousands of pockets. Some contain useful tools, usable by anyone with some experience of DIY. Others, extremely dangerous tools, many with their safety features disabled, usable only by qualified builders. There is no manual as to which is which.

CoffeeScript - A T-shirt and tie combo. You started with the intention to look smart, but got distracted by all the other cool looks you could potentially carry.

<comment><USER7> > JavaScript Half the pockets a full of dung, so you have to use fingers very > carefully.

> CoffeeScript Also both are bright pink, because why wouldn't you come up > with your own syntax sugar when you have such an option?

</comment></comment></comment></comment></comment></comment><comment><USER8> There is nothing quite so laugh out loud hilarious as recruiter baiting on HN. Recruiters are easy targets, everyone thinks they suck and there's so many clever ways to point out their cluelessness.

Even now I'm chuckling to myself at how thigh-slappingly hilarious this is and how it points out that you are a smart developer and recruiters are foolish as fish.

Magnificent humour and not in the slightest dogmatic, pompous, superior or neckbeardish. The clever digs at Microsoft oriented developers have certainly shown you to be one step ahead of them in the cleverness stakes.

Well done sir! I wait with bated breath for the next clever and superior person on HN to show how much smarter they are than recruiters.

<comment><AUTHOR> This is hilarious, but I hope we can get back to real HN submissions. I can't wait to see the next Something.js that does something jquery already does or check out a new something.io startup that has an API where you can access all your APIs.. in one place!

But really another NSA or Heartbleed article would be much better. Hey have you heard of Heartbleed yet?

</comment></comment><comment><USER9> Dear Enterprise/Microsoft Hater 128 345 501,

Do understand that we were simply asking for a developer who understands the .Net platform; and in no way labeling the developers - heck, it's what they call themselves!

We appreciate that there is a lot of FUD surrounding various languages but as we all know FUD is unfounded hatred and hence theoretical; where the conscious and deliberate action of excluding yourself from an entire market is a literal limiting action.

We are grateful to hear that your community of contacts have this trend in terms of development technologies; as most developer communities tend to. You should meet some of the COBOL folks I hooked up with work, they work once a month and drive Ferraris - such a pity COBOL is an evil enterprise language; it's not even cool like Javascript is!

Yours, Scummy Corporate Recruiter 1

<comment><USER10> Hey if I'm on any of your call lists can you remove me please? Cheers.

<comment><USER9> I'm not an actual recruiter, was just roleplaying there; at my gig we don't really need recruiters - in fact we usually have problems with developers that they send our way (we have been forced to use them a few times to match our growth). Our best talent comes from word of mouth. I'm not sure they do a good job (for both the employer and employee) no matter what the language.

I was merely pointing out the irony in the post.

</comment></comment></comment><comment><USER11> Your complaint is that you hear about too many opportunities in the "career- limiting" area of .NET development? No .NET developers are looking for work? Sounds like anyone wanting to be employed should get familiar with .NET.

Or do you just disagree with the job title having a language in it?

<comment><USER12> "Career-limiting" != No Career.

Here in Chicago, .NET jobs pay less than other technologies. A RoR developer with 4 years of experience probably earns as much as a .NET dev with 8. If that .NET dev is lucky.

Most of the .NET job listings I get recruiter spammed with are for enterprise development things from companies whos primary "product" isn't technology. So if you work for them, you're working in a cost center and will be treated as such.

Edit: By the way, there's _always_ been a shortage of .NET developers for as long as I can remember- even going back to '04 and '05 when the industry was starting to recover. But the salaries always trailed even then. You could make 5-10K more doing Java work in those days. No clue why.

<comment><USER13> Yup, exactly. That's another nuance of what I'm hitting at in the blog entry. This is the case in a lot of big cities with big corp gigs. They're just dead end gigs. If that's all somebody wants, that's awesome. Learn .NET or Java and get that shit. But if somebody wants a bit more or a bit of freedom or a bit of changing scenery, one has to step outside of that. :)

</comment></comment></comment><comment><USER14> Honest question, what do you think is wrong with .NET?

C# is my favorite language and I'm learning F# at the moment, which I think just as good (but very different). Microsoft have done a shitload to evolve the platform in the last decade as well.

So why all the sarcastic joking and hate?

<comment><USER15> Because it is cool to take the piss at .net developers around here! Most coming from young folks that have only been working on the 'next facebook' with go/node.js/rails to understand there is a big and very profitable world out there that runs on more mature stacks/languages.

But hey, doing CAD/Financial Modelling/Insurance/etc software isn't shiny and something to brag on the next hackathon for hacker cred right?

<comment><USER16> That, my friend is well said. Agreed!

</comment></comment></comment><comment><USER17> I love .NET and C# and will gladly write again. I had probably 3-4 years experience. With one twist - no web stuff. It is awesome for everything else.

</comment><comment><USER7> Short version "Real world, please care about our hipster frameworks that are using languages older than some enterprise ones. We don't want to use Xamarin to re-use maximum code while retaining native performance and languages that don't suck; we don't want to use Unity3d to be able to quickly prototype at low cost and hight quality. Please pigeon-hole Node.js in every freaking domain, because everything is an IO throughput problem plus you get to use a crappy language not just on client side but on server side as well!".

</comment><comment><USER18> It would be an interesting 'hack' to put up a set of LinkedIn profiles in, say, Seattle (where I live), each essentially the same but in the tech stacks listed: C#, Java, C++, Ruby, PHP, and Haskell. Then, track the recruiter spam as well as the kind of positions/salaries offered.

I think it would violate LinkedIn TOS to do this, as well as be kind of douchey to the well-intentioned and hopeful recruiters. So I won't. But still.... be interesting. :)

<comment><USER19> Its not like recruiters would avoid a reverse situation to get you on their books by saying there is high paying job looking for your skillset, when there is not.

</comment></comment><comment><USER20> > switched from being a .NET Developer to a Software Developer

so brave!

<comment><AUTHOR> I think it's a snarky way of saying "someone that decided to take one of the other 10,000 different options to develop available out there".

I love me some .Net but you'd be silly to ignore the alternatives and many .Net devs do.

<comment><USER21> I don't ignore the alternatives, but I certainly don't have the time to dive into every language of the month so that I can add them to my tool belt "just in case".

And, of course, even if I had them in my tool belt, I don't know too many companies that will pay what I'm making as a .NET developer to work in a language I've picked up on the side.

If there's another way, I'd love to hear about it.

<comment><AUTHOR> No, it's basically the same route I'm on I put more effort into sharpening my .Net skills than any other. But if I see something that another technology will do I try to integrate it just to get familiar (like Node for instance).

The ASP is trying to hard to integrate other stuff into it, and I think few people deep dive into .Net and Rails, node, etc combined but it's a definite strength to have some familiarity.

</comment></comment></comment></comment><comment><USER22> Am I the only one who thinks that sounds pompous?

I can understand maybe being spammed from recruiters, but replying like this just brings you down to their level. It also makes software devs seem like jackasses. That would be the case if you were trashing Java or Python or any other language. I just don't really see the point of replying like this.

</comment><comment><USER23> People may or may not have good reasons to dislike technologies. I'm sure people have their reasons for disliking .NET just like they do with Java or any other technology. From just a generic statement - its hard to know either way.

I actively dislike all current web app frameworks. The SaaS trend is worrying IMO because it seems to be the only viable way that startups can make money these days. I rarely see any startup selling an actual software product.

In my view, you take a rich client application - throw in memory bloat, CPU bloat, reduce the responsiveness, add in some downtime and you get a webapp. By the very fact that all web apps are limited by client apps (the browser in most cases), I don't see any reason to settle for a 'second-class' experience.

</comment><comment><USER24> And people wonder why developers are not being treated like mature professionals...

This kind of juvenile "OMG, I wouldn't want to be seen dead in such off-brand sneakers" attitude belongs in a school playground.

Meanwhile there are probably many thousands of .NET devs making a good living in a nice job with a pleasant (albeit somewhat conventional) work environment and making enough money to take care of the things that really matter to them (family, kids). And they couldn't care less about being a cool Node.js or Ruby developer.

No, you won't run in the them that much. They hang out with the grown-ups.

<comment><USER25> And I am so disappointed to see that on the front page. I'm a young .NET developper. I will have to find a new job in a few months. I really like Node.js so I would like to find a job on it but I will never refuse a job just because it is .NET development.

First, it is a nice technology to work with even if it is linked to prioritary code.

Second, it is not the technology which makes a job interesting. It has more to do with the product, the company and the team.

Third, it might a good bet to work on a technology which is not the current cool kid on the block. .NET is used in a lot of places so we will have a lot of job offers with few developers. In this context you can manage to get a nice salary and you won't be treated like meat.

I agree with you we have a problem with this fashion of technologies. But like you said, and thanks to that, there are still a lot of developpers who do not fall on this trap.

</comment></comment><comment><USER26> You know what, if they are looking for a developer that can hit the ground running with .NET and make some great stuff, I'm not that guy.

If they're looking to do some .NET projects and want some developers that are good to pick it up and try it. I'd do that.

How do you get into that situation? Is it even possible? I hear and see the opposites - companies with absolutely no interest in training, and companies that love training.

</comment><comment><USER27> I can't quite figure out if this is a genuine and reasonable reply, or if he's being a pedantic ass. ".NET developer? Oh no no no! I'm just a software developer who also knows .NET. Please resubmit your offer, replacing all instances of the phrase '.NET developer' with 'software developer'."

<comment><USER28> I'm erring on the side of pedantic twat. But I'm just a php developer so what do I know.

</comment></comment><comment><USER13> Seriously Hacker News needs a 'cool comment' button.</comment>


Show HN: Pip-init to generate a simple setup.py file - <AUTHOR> https://github.com/juanpabloaj/pip-init

<comment><USER2> It would be nice if it allowed you to specify initial dependencies, or call out a requirements.txt file.

<comment><AUTHOR> ... maybe put in setup.py something like

from pip.req import parse_requirements

requirements = parse_requirements("requirements.txt")

setup(

...

install_requires=[str(r.req) for r in requirements]

[http://stackoverflow.com/a/16624700/348081](http://stackoverflow.com/a/16624700/348081)

</comment></comment><comment><USER3> Thank you.

Please do the thing with the requirements.txt file.

<comment><AUTHOR> fiatjaf, now the generated setup.py file will import the requirements from the requirements.txt file

[http://i.imgur.com/TTw7Ctn.gif](http://i.imgur.com/TTw7Ctn.gif)</comment></comment>


Facebook Marketing Down to the Core – 4 Factors of Post Optimization - <AUTHOR> http://blog.getpostrocket.com/2012/06/facebook-marketing-down-to-the-core-4-factors-of-post-optimization/

<comment><USER2> Flagged for being SEO horseshit.

</comment><comment><USER3> this is hot. question: what do you make of the various content curation platforms out there? are they worth it?

<comment><AUTHOR> Content is king. I'd try what's out there and see if one works for you. If you have the time, manually curating it is probably your best option-- but this definitely is time consuming.</comment></comment>


Show HN: A platform to learn and talk about Racial Injustice - <AUTHOR> https://giveadose.co/ <comment><USER2> I love the power behind this product, and the fact that it offers a genuine view of racial injustice affects real people. I think this is incredibly powerful and really appreciate the mission here.

</comment><comment><USER3> Finally a solution that is not just another two way social media platform. This is going to be my new safe space to better understand racial inequity!</comment>


Into the Borg – SSRF inside Google production network - <AUTHOR> https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/ <comment><USER2> > it's not because of the design of Borg interfaces

As the original creator of the Borglet status page, I think it's not really accurate to describe it as "designed". :-)

It was more a case of gradual semi-random evolution, with people (mostly me, at least in the old days - I've no idea how much it might have changed in the last eight years) adding things that seemed like they could help Google engineers trying to track down issues with their Borg jobs. User-friendliness for random SSRF hackers was definitely not high on the priority list.

<comment><USER3> As a user of the borglet pages they aren't pretty but they are quite functional and to-the-point. I can appreciate the no-frills design.

</comment></comment><comment><USER4> This is a great find. SSRF is a really unappreciated vulnerability; it is usually game-over. That it came from a Caja audit adds some tasty irony.

A friendly word of advice: when you find flaws like this (you, the reader, not you, the guy who wrote this post), think carefully before disclosing internal network details you discover like this writer did. The internal details of a target network don't become public domain simply because you found a vulnerability. There are firms that get _extremely_ itchy about this kind of stuff getting published, and I can't blame them.

<comment><USER5> I'm still amazed that this individual published as much data as he did. I don't see where it says they have permission to do so.

Specially because:

> I hope they won't beat me with a stick for disclosing any of this

This tells me that this wasn't cleared with them. Doesn't sound like a smart move. If your gut is telling you it may be a bad idea, it could be because it is...

<comment><USER6> The page he accessed probably contained _thousands_ of Google borg jobs. Many about secret or future projects for example. Many giving implementation details for secret sauce algorithms (eg. oh - they precompute all possible misspellings for their spell corrector via this mapreduce!). Simply knowing the fleet wide CPU, network and RAM usage for Gmail would give a competitor a lot of knowledge into the probable running costs of the service for example.

In this case he exposed a tiny proportion of what he accessed.

Sounds fairly reasonable to me.

<comment><USER7> Uh, how does that follow? In what other domain do you get a pass for doing a little unnecessary harm because you could have done much more?

</comment></comment></comment></comment><comment><USER8> > Google is still relying on Borg for its internal production infrastructure, > but I can tell you it's not because of the design of Borg interfaces!

No matter how spartan, the Borg status pages are more helpful than most Kubernetes UIs out there when it comes to debugging a problem in depth, i.e. past CPU and memory graphs. Part of that is made possible by applications exposing debugging endpoints and telling Borg about them.

<comment><USER9> Yeah, I would kill for the k8s pod contract to have something like the borg status line.

<comment><USER10> It's something we've talked about on and off. Never seems to make it happen.

</comment></comment></comment><comment><USER11> For those who is new to the world of SSRF vulnerabilities, check the SSRF Bible (full disclaimer: I'm with Wallarm): [https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUed...](https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit)

</comment><comment><USER12> Very impressive findings.

Disclaimer: I am part of Borg team.

<comment><USER6> Time to make everything accessible via stubby only, none of this http nonsense...

<comment><USER7> Integrity and privacy for all streams.

</comment></comment></comment><comment><USER13> Webarchive link to the article above, as I found myself unable due to the system load on the page. [https://web.archive.org/web/20180720170255/https://opnsec.co...](https://web.archive.org/web/20180720170255/https://opnsec.com/2018/07/into- the-borg-ssrf-inside-google-production-network/)

</comment><comment><USER14> borglet status page in full resolution: [https://opnsec.com/wp- content/uploads/2018/07/borg2.png](https://opnsec.com/wp- content/uploads/2018/07/borg2.png)

</comment><comment><USER15> Not quite relevant to the article: Since it seems to be tricky to properly sanitize URLs for SSRF, I had an idea for safely calling user-defined URLs: Set up an unprivileged non-VPC Lambda function that calls a URL and call all user-defined URLs through the Lambda function. I think it should be bulletproof, anything I'm overlooking?

<comment><USER16> GCP does it by requiring a header on requests to metadata systems.

Require a header on your internal services and make sure you never send that header with user-requested URLs and you can guarantee safety there.

<comment><USER17> Still allows tons of attacks and recon, like port scans, or even crashes of processes- since internal things might not go through the same fuzzing scrutiny as external endpoints.

</comment></comment></comment><comment><USER18> tl;dr SSRF is server side request forgery, where you can gain access to private resources by convincing privledged servers to make requests for you.

If you are using network access for security, either don't, it blacklist private IPs (and use public DNS) for untrusted URLs.

</comment><comment><USER19> Ha! I spent so much time squinting at that borglet page. Such nostalgia

</comment><comment><USER20> > I should mention that Borg, like Kubernetes, relies on containers like > Docker

Hmm, containers _like_ Docker, or Docker? I thought Google used lmctfy since long before Docker?

<comment><USER21> cgroups were written at Google, and have been used internally for a very long time; they provide "container"-like limits on resource usage for a group of processes.

I assume that Google isn't using Docker internally for production services, but don't know for sure (and I assume anyone who does know for sure can't tell you).

<comment><USER22> I've heard a few times that Google's containers actually run inside of VMs. I'm curious if anyone knows what their VM implementation is or what its based on?

<comment><USER23> Mostly upstream KVM with a custom replacement for QEMU:

[https://cloudplatform.googleblog.com/2017/01/7-ways-we- harde...](https://cloudplatform.googleblog.com/2017/01/7-ways-we-harden-our- KVM-hypervisor-at-Google-Cloud-security-in-plaintext.html)

<comment><USER24> Lots of bits of KVM turned off, though. Makes it really interesting when I work with people on Open Source stuff. I find out all sorts of things KVM can apparently do that mostly leave me going "you put WHAT in host ring zero?!" :)

(note: as implied, I work on our userland QEMU replacement)

</comment></comment></comment></comment></comment><comment><USER25> I found this really cool to read into. Some of it went over my head but a great read none the less. Thanks for sharing.

<comment><USER25> Why was this downvoted? I really don't understand the users of this site sometimes.

</comment></comment><comment><USER26> i can't help but very lol @ kubernetes as the successor to borg :0</comment>


GoDaddy Prepares for IPO - <AUTHOR> http://online.wsj.com/news/articles/SB10001424052702304914904579439542130264508?mg=reno64-wsj&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052702304914904579439542130264508.html

<comment><USER2> GoDaddy has too many bad practices for me to recommend them to anyone. I hope the IPO falls flat.

<comment><USER3> I feel the same way. I have to wonder - how much has negative sentiment from the hacker community affected GoDaddy's earnings?

</comment></comment><comment><USER4> GoDaddy is the perfect example of a company killing it with the mainstream while getting (often unjustified) hate inside the tech community. If you look beyond the common complaints against it, you'll find a company that has made smart product acquisitions that solve real painpoints for their small business customers.

<comment><USER5> Unjustified? The hate I see on GoDaddy stems from a number of concrete, substantive things:

* Skeevy, pandering advertising

* Skeevy, pandering CEO

* Bad behavior when it comes to transfers (i.e. wait to the last possible second to complete a transfer out because fuck you, that's why)

* A checkout workflow that makes it very hard to avoid adding extra things to your cart that you probably don't want

* Weak, script-bound CS

* Shoot first, ask questions later attitude to third party complaints (whether they be copyright based or otherwise)

* Their sponsorship of and _carving out a fucking exemption for themselves on_ SOPA

* Unintuitive, badly designed, and confusing management tools

* Unlisted restrictions (their VPS services block certain ports outbound. This is not listed anywhere.)

GoDaddy is the PayPal of web hosting. They're ubiquitous, but I'd bet a high number people who've been in the hosting/domain for any length of time have a horror story to tell.

Network Solutions seems positively angelic by comparison.

<comment><USER6> >Skeevy, pandering advertising

Agree with you on that, you have to jump though a bunch of product options before you finally see you cart.

>Skeevy, pandering CEO

Also agree with you on that especially the elephant and SOPA issue.

>Bad behavior when it comes to transfers.

Nope I have transferred over so many domains with absolutely no issues. Unlock, get your transfer code, give it to the next registrar and done.

>A checkout workflow that makes it very hard to avoid adding extra things to your cart that you probably don't want.

Disagree even though you have a ton of things offered, none of them are check by default, hit next > next > next and you are at the cart. Its a smooth checkout after that.

> Shoot first, ask questions later attitude to third party complaints

Disagree, even Namecheap has a list of blacklisted keywords that if your domain matches, cannot be transferred over or registered without the help of CS. Gandi has the a weirder TOS that can says they can pull your domain for any reason. Lavabit's or other major domains were located with Godaddy and it was never pulled. So Godaddy is on par with other domain registrations when it comes to complaints.

>Unintuitive, badly designed, and confusing management tools.

Agree but I haven't found better ones elsewhere either.

>Weak, script-bound CS

I had the opportunity to contact them multiple time in the past and they have been helpful and able to resolve the issue.

>Network Solutions seems positively angelic by comparison. Then you have never had any experience with NetSol. They are most shadiest registrar in history.

<comment><USER7> > I have transferred over so many domains with absolutely no issues. Unlock, > get your transfer code, give it to the next registrar and done.

It took me close to 6 months to transfer domains from there the last time I tried. Throughout the entire back and fourth, shit getting switched. Waiting periods, back and fourth emails and everything else I found it amazing that any of that was legal.

In retrospect I could have likely transferred my domains away from them faster if I'd hired a lawyer. Why anyone considers that 'ok' is so far beyond me I can only come to the conclusion that you work for or have some kind of stake in GoDaddy.

</comment></comment></comment></comment><comment><USER8> Attempt to maximize profits out of deteriorating giant before it's too late.

Kind of "Upsell of a century"

</comment><comment><AUTHOR> I'm a product manager at GoDaddy helping to head up enhancements for web professionals (hackers, web designers, SEO, etc.). I know we've had a checkered past, but things are drastically changing and we're making huge commitments to the web professional market. I think you'll find a different company emerge over the next few years. It's going to take some time before the outside world sees what the amazing talent inside is coming out with, but it's coming, and it's exciting.

<comment><USER9> So you're ditching the incredibly sleazy and offensive advertising?

<comment><AUTHOR> Yes, it has all stopped.

<comment><USER9> Good. The 2013 Superbowl ad in particular just made me feel embarrassed for you folks.

</comment></comment></comment></comment><comment><USER10> They will offer a .net, .org, ssl certificate and a private registration with the purchase of 1 share. Jokes aside I'm wondering how their bad reputation in the tech community will affect the IPO.

</comment><comment><USER11> I've read every single comment. I think there is 90% bias.

I've been a GoDaddy customer for a decade at least, and yes, it has sucked. But in the past tense... when it comes to customer support, checkout ease of use and honesty, etc.

SOPA? Right now even ICANN is a US only institution, so I am not expecting registrars to be entirely respectful. The Bill & Monica factor works for registrars too, like it does for married men in positions of power. I am adamantly against what I see people do, but I don't ever expect it to change unless it changes systemically first.

As I commented elsewhere, yes - domains get bought out from under me all the time if I leave them in my cart and don't buy them immediately. Do I think that's shady? No. I think my ideas are golden, and I treat it like - "if I'm stupid enough to share before I just flat out buy - my bad." They've capitalized on so many things, subtly. Key being subtly.

Their checkout process absolutely looks better, and is not like exiting Tijuana and avoiding buying "chicklets" any more. It is radically different. Their management interface too. Perfect? No! Way better? Absolutely. I am almost to the point of recommending them to others. Now, I just say "I'll deal with it" and use GoDaddy anyway. Not out of any real loyalty, just out of the inability to really say there is anything better to the point of wanting to migrate away hundreds of domains, or starting to monitor two separate registrars. Call me lazy, but they haven't given enough incentive to leave, and they do provide incentive to stay.

Case in point: my wife wanted to surprise me one day and saw that I had domains expiring while I was out of cell reception on a business trip. She obviously has all the necessary to verify she is my wife, and has access to my domains. If she used this to do something bad, this would be a different story. Instead, she was able to have a good conversation with someone who ended up giving her discount codes because she "knew I used them, but didn't know where to get them" and she wouldn't make the purchase until she saved at least 35% as I always said I did, minimum. All my domains got renewed, with a new card being added just to be sure it wasn't using money I didn't authorize - no matter who called. She is afraid of breaking things and still got through the process with positive experiences!

I am not finding the horror stories in my experience, now.

<comment><USER12> > Case in point: my wife wanted to surprise me one day and saw that I had > domains expiring while I was out of cell reception on a business trip. She > obviously has all the necessary to verify she is my wife, and has access to > my domains. If she used this to do something bad, this would be a different > story. Instead, she was able to have a good conversation with someone who > ended up giving her discount codes because she "knew I used them, but didn't > know where to get them" and she wouldn't make the purchase until she saved > at least 35% as I always said I did, minimum. All my domains got renewed, > with a new card being added just to be sure it wasn't using money I didn't > authorize - no matter who called. She is afraid of breaking things and still > got through the process with positive experiences!

Here's your horror story.

They allowed an unverified (by the account holder) third party to make changes to your account.

That's fucking terrifying.

</comment></comment><comment><USER13> I haven't read the article. I wonder if it involves enticing people with pretty girls.

<comment><USER10> No, you will find coupons in FatWallet.

</comment></comment><comment><USER14> I really hate how the link to this is a non-free article...

<comment><USER15> [https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCwQqQIwAA&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052702304914904579439542130264508.html&ei=K6AjU8ClBoi3kAeS8oGAAg&usg=AFQjCNFPuD4CVJMHDP1zHgeKR0P7CCBXDw&sig2=cShoatLGL_n_Wf_m_NbU-A&bvm=bv.62922401,d.eW0)

</comment></comment><comment><USER16> I'll offer four dollars for 80% of their shares.

</comment><comment><USER17> I would not buy it.

</comment><comment><USER18> I know what I'll be shorting this summer.

</comment><comment><USER19> Haven't read the article (requires registration) but I am with GoDaddy for a year. Frankly, it has driven my blood pressure up to the sky.

The is just bloated and slow. Why I must click on Sign In button on the right, to get a drop-down thing with the inputs to the left ? Are you kidding me ? I shouldn't click on a button to _unlock_ the form.

The cPanel ? You have to click through a shit-ton of buttons to do the simplest things. Click My Account, click Hosting, then I have to click "Launch" to get to the point...

When you try to register a domain, somehow, some things are checked by default and God forbid you don't check how much money they're going to debit you before you check out.. So you unclutter the order from all the crap that magically got added. If I remember, they tried to charge me a second time for the "Domains by Proxy" service (I'm not sure) which I already had (since it was simply renewing my hosting, and not the domain which is still valid).

I don't know.. It just left a bad taste in my mouth, and bear in mind that it's the first company I deal with, so I don't have any other reference point of greatness to compare it to, still, I think it sucks.

Their support articles don't take into account shared hosting or something. Nobody tells you that you can't do stuff if you don't have a dedicated server unless you specifically ask, which you don't at first because you want to figure things out before you bother a human being.. Which means countless hours spent reading about an issue and searching the web. It's good in the long run, since I'm learning, but the info should've been there. If you have a shared account, you can't do this. One line that would've saved me so much effort.

Click, click, click, click. Bloated interface that makes it really slow to load. Bad UX design. I'm as mad as hell.

Next company will be SiteGround. I've seen the ad on htmldog.com. The site is greatly done. I got the link from ESR's article (How to Become a Hacker). And since ESR is referring htmldog, and htmldog is referring SiteGround, they get points of confidence in my naïve, newbie opinion.

Grrrrrrr !</comment>


New Gmail ads looking a lot more like emails - <AUTHOR> http://pete-hamilton.co.uk/2013/07/10/google-ads-in-email-list/ The new ads in gmail's promo tab look a lot similar to emails than before. An interesting new addition or move towards advertising trickery? I lean towards the former but I'd be interested what other people think. <comment><USER2> I think it's perfect. You're on the promotions page looking for a deal, right? Isn't that what most of these promotions are, ads? These things are what makes a lot of our industry thrive, the more meaningful the utilization of ads, the more we should praise (and learn from) it. [repost of my comment from the blog's disqus.]

</comment><comment><USER3> I had to disable adblock to see the images, fyi. which is amusing on a meta level.

<comment><AUTHOR> Wow. How the hell did that happen :S

</comment></comment><comment><USER4> And I'll assume this is only a problem if you're using the web client? ... When GMail starts putting ads into my POP3 or IMAP mailbox, I'll draw the line! (Actually, I'm thinking about ditching GMail anyway since they're so happy to share my private business with the government).

<comment><USER2> Although I'm not extremely happy about Google under many lamps, it has been made clear that they've just been following lawful orders via FISA. It's time to blame the game, not the players.</comment></comment>


Perfect olympics coverage already exists... - <AUTHOR> http://lloyd.co/post/28400375882/perfect-olympics-coverage-already-exists

<comment><USER2> Youtube doesn't work. I'm in the US and this is what I get:

<http://i.imgur.com/5qF5k.png></comment>