UX is not UI - <AUTHOR> http://www.helloerik.com/ux-is-not-ui <comment><USER3> I get that UX is not UI. I really do.

The one thing that consistently confuses me is that when someone explains what UX _is_ , it always ends up being explained in a very nebulous way where a UX designer seems to have authority over virtually everything in a company, and responsibility over very little.

It can occasionally feel as though UX people want to be PMs, UI designers, marketers, developers, and data analysts all at the same time, but of course when pressed, they "aren't supposed to be about UI / PM / dev / etc.".

The list is a great example. "Company Culture evangelism" is a UX discipline? Really?

<comment> martin-adams No, they want to work with the PMs, UI designers, marketers, developers, and data analysts, enabling them to have the right tools to make better choices.

<comment><USER4> But "work with" as a very euphemistic term. Are they instructing the PMs etc., or are they acting on their orders?

I know that in an ideal world it's 50/50, but I don't think a position that is involved in every single step of the project has any chance of success unless you happen to also be in charge.

<comment><USER5> > Are they instructing the PMs etc., or are they acting on their orders?

What does a consultant do? A UX designer is basically another name for a consultant who, by training, knows a lot of stuff about _the experience your users will have with your product._ Like with any consultant, the relationship can be anywhere from asking them direct questions, to getting them to make you mock-ups, to modifying your product, to having them tell you what to do. As with any other consultant, you hire them for their perspective and experience, not for some particular skill.

A UX guy is not necessarily good at creating pretty designs--although he'll be able to tell you, using user-testing et al, whether a design _is_ pretty. And so forth, for each thing they do. It's not a collection of skills; it's an approach.

(A similar question might be "what does it mean to hire a _scientist?_ " Not skills; approach.)

<comment><USER6> Being an internal consultant is often what happens. It's a horizontal role that might look like it's owning a bunch of things, but really it's support various needs in various domains that have a touch on the user/customer "experience."

So yeah, I'll be in a PM meeting and then leading the PM meeting. Then I'll go out and into a meeting where we're analyzing analytics on the website, then to a meeting with devs on how we're implementing the interface literally, and getting me set up so I can run builds, edit the html/css, write all the front end views while devs create the models.

And then the CEO pulls me aside and wants to know what 'I'm doing to help turn this company culture into one that is user-centered and customer driven."

So it is like being a consultant on this huge spectrum of "customer/user experience" touch-points, and it's way more than just 1 or 2 people can do. And then all of this is rolled up into the perception that you're there for "look and feel" which probably only takes up 15-20% of your actual job.

You've made a really good summary of how I feel often.

</comment></comment></comment></comment></comment><comment><USER7> So basically he is saying that some parts that have been traditionally considered a part of UI design are not a part of UI design but of UX and that is why UX and UI are different. "Boohoo, nobody takes me seriously, they all think I just make pretty dialogs." I know that feeling but I don't think coming up with more names and vague definitions that nobody knows is going to help.

<comment><USER8> Performance and Speed is UX. Something UI designers never really will understand. It's not just UX, but the only UX that's actually quite objective. No one ever goes "Oh gosh this app is too fast"

Another non developer talking about things that they can't implement.

<comment><USER6> I agree. That's one of those places where being in a UX role is way outside of UI design, and I'm taking the apps on-site with customers (I am mostly b2b) and observing and testing them as they use it. Recording their responses, as well as the applications. When logging in to the system takes 40 seconds because of database performance (or lack of), that's a UX insight that needs to be observed and reported. That's not something I can control but it has a huge impact on the user's experience.

There's an element of user-advocacy that I'm doing where I take the experience they are having and translate it back into business, design, and development goals as when someone is trying to use an enterprise piece of software and the experience is terrible, that is going to fall on designers, developers, PM's, and all the other people involved in the creation of the "thing" which becomes the user's experience.

That's another ambiguous situation. I go spend 2 days with users out at a company HQ, and I come back with tons of data that now has to be consumed by devs, designers, pm, marketers, executives, QA, customer service etc etc. The experience of what we build is a collection of every role in the entire company as far as the user is concerned, and all those various business roles need that UX information brought back. So at this point I'm so far from UI and visual design I'm closer to a PM or product owner now, but soon will be jumping back into the design an development realm to start to fix those experience problems.. unless the problems result in bad business drivers or invalid use-cases, so then I'm back at the PM and management table,

I still can't find a clear distinction about what I'm supposed to say I do. I just know that there is a certain disservice to just tell people "UI design, look and feel."

</comment></comment></comment><comment><USER9> So let's take all this stuff that a UI designer does, claim that a UI designer doesn't do them and can't possibly understand them, and invent a new term, UX, to mean the thing that UI design used to mean. Okay.

<comment><USER5> Well, no. All those people who were already doing those things _are_ UX designers now. I think the point of the rename is mostly that "UI designer" is limited and derogatory in the perception it encourages, like "code monkey" or "web designer." Nobody just does UI, so nobody is, or was ever, just a UI designer.

<comment><USER9> That reminds me of the universities that I went to that tried to rename the Graphic Design departments to "Communication Design" or "Graphic Communications" or anything but the image of a lowly pixel pusher. Graphic Design has been greatly devalued by the prevalence of the adobe suite of software- it used to be about solving large organisational problems. now people just think "The way it looks" and that perception has become impossible to shake. It's a real problem.

I don't think it's solved by coming up with new airy fairy words that nobody understands, and are never clearly defined. It gives the strong impression that it's not a real job. Like "social media consultant".

</comment></comment></comment><comment><USER10> Great Article. UX is the new buzzword in pretty much every sector at the moment, especially financial, my last contract was "UX Developer" I'm not even sure what it means, but from my day to day, I wrote javascript HA!

<comment><AUTHOR> Heheh, so they intended to hire a front end developer, because of the new buzzword, and then they hired as a UX Developer to chase up the trend...

I have seen a lot of companies doing that, they also guess a UX designer could do everything...

</comment></comment><comment><USER11> relevant: [http://design.org/blog/difference-between-ux-and-ui- subtleti...](http://design.org/blog/difference-between-ux-and-ui-subtleties- explained-cereal)

</comment><comment><USER12> To the people who consider UX as a job title. If you want your online business to be successful, UX is the first thing you should think of.

Design is like the strawberries on the cake, UX is, how the cake tastes.

<comment><USER13> I have another set of people, the product designers, who will strongly disagree on your unqualified use of word "design", saying that design is the all encompassing use of a "thing" in a context. Largely being what you call UX.

My larger point is that the geeks of the web, in trying to come up with pointlessly precise definitions of what they do, rebase themselves from where they came from.

<comment><USER12> I totally agree with "trying to come up with pointlessly precise definitions of what they do"

what i am trying to say is, what makes product successful is not the interface design.

I don't care if your product looks so beautiful and lovely if i can not use it with bad bandwidth for example, or on my mobile. I don't care how cool colours you use, if i need to click everywhere to find what i am looking for.

<comment><USER14>
      > "trying to come up with pointlessly precise definitions of what they do"

A few years ago I was following a few IA (Information Architecture) blogs, but dropped them quite quickly, because that was pretty much the main concern of theirs :)

</comment></comment></comment></comment><comment><USER15> Who doesn't understand the difference between Interface and Experience? Clearly using tools with virtually no interface at all can be a great experience.

<comment><USER16> Also UI can be a huge part of UX.

<comment><USER17> CLI is an interface too, though.

<comment><USER18> Yes, and it's a UI. GUI is a strict subset of UI, as is CLI.

</comment></comment></comment></comment><comment><USER19> Since when UI ( =User Interface) is only visual? To me it seems as UI got too narrow understanding of just visual in the wild (i.e. general population) and then people who really understand what they are doing decided to rebrand themselves as too many people saying they are related to UI where just visual design related...

</comment><comment><USER20> Yes and no, IMHO. The list on the left are all tools to solve interaction problems. But, I think "UX" professionals tend to fall into the trap that this is a process needed for every problem. Sometimes, good UX is just UI/Visual design. And, that is just fine.

</comment><comment><USER21> Out of curiosity, how many people did not know that.

<comment><USER22> At least a few :) Here is my anecdote.

One of my friends got an offer from his company to evolve his current position into a UX position. A while later, they have an actual project on which he could work as a UX designer. The only thing they ask is how fluent he is with a specific image editing software.

<comment><USER23> Heh... like qualifying a programmer by how fluent he is with Visual Studio.

</comment></comment></comment><comment><USER24> Cool, so UX is just good old fashioned design.

</comment><comment><USER6> Hello, I wrote this article. I can check one thing off my bucket list - <USER2> article of mine on the front page of HN (spot 28 as I write this).

Reading the stuff here in HN, I agree with almost everything said. My intent wasn't to take a hard line tone, and in retrospect after getting tons and tons of feedback, I'd write it differently, but I'll take this chance to clarify some things, both for myself and for others.

It is not written in a snarky or superior voice. It wasn't a rant. If it sounded so, I apologize. It also comes off as a list of "this is what a UX job title should be", which also wasn't my intent. The simplest way to say what I was trying to convey is that if you label yourself as anything "UX whatever", it is perceived as "graphic artist for interfaces."

The article often seems to convey that UX "owns" all these different things, like it's a panacea role above all others. It's not.

It's not something that I can clearly define. On the little 2-column lists, the things on the left were supposed to be things that I/we "do" in the sense of what often becomes the reality of the job, not in the sense of responsibilities that should be granted to use to be accountable for. And if that large list does become the reality of the job, it's more than anyone can or should do. It was intended to be a "these are some of the things a UX person might be responsible for." And yes there are some silly ones on there.

I don't think UX is in a position of being a land-grab of everything that isn't writing code because "it's what we do", but it's more of a "this is what we are often doing" list. And some of the things on it should be owned by other discrete jobs careers. The motivation to write the article came from being in role after role where that list on the left was the list of things I was inadvertently responsible for, but "graphic designer for interfaces" is all that is seen by others, which isn't fair to UX people who don't focus on interface design, and isn't fair to interface designers who don't focus on the UX work that isn't based on UI or visuals or interaction.

It's sort of just a response to the introductory conversation I have the first few weeks at any job. "What is your role here?" "Well I'm the new UX guy." "Great! Our stuff is ugly, you're gonna give it that sexy look and feel?" "Yes, but I am going to be doing other things that sort of result in that look and feel you want" And then when I list off some of those things, typically the other person looks at me like I'm a lunatic and we both end up confused on what I'm actually supposed to be doing, and the disappointment that I'm not just there for look and feel.

But for sure, the article is not meant to be a land-grab or king of the hill situation of "UX OWNS EVERYTHING", but just a glimpse into the terrible ambiguity of what UX is and how the very common initial perception of "graphic designer for interfaces" makes it even more unclear.

</comment><comment><USER25> well written article..</comment>


Understanding PostgresSQL window functions (2013) - <AUTHOR> https://tapoueh.org/blog/2013/08/understanding-window-functions/ <comment><USER2> The actual title on the web page is "Understanding Window Functions", although it might help readers to know that this is about PostgreSQL window functions.

</comment><comment><USER3> Great summary with nice examples. Read through and bookmarked for when I will need this at work.</comment>


Ise-ji: Walk With Me - <AUTHOR> https://walkkumano.com/iseji/ <comment><USER2> Thank you for sharing this multimedia diary and recommendations. I walked the Nakahechi route a few years ago, it was one of the most beautiful, profound, and peaceful experiences in my life. As for Ise-ji; damn, that looks like a fine hike. I hope to complete the Kumano Kodo journey soon!

</comment><comment><USER3> I am currently in Japan (Kyoto), and right now a few days walk would probably be one of the nicest (and safest) things to do.

If there are fellow HNers that are currently in Japan and can provide some suggestions (or perhaps want to do it together), I would love to hear them!

</comment><comment><USER4> Cheers. (Author here) If you have any questions about the walk or geekery of putting the site together, please ask away.

<comment><USER5> I lived in Shingu in 2017-2018, which I see you visited on Day 8. I am absolutely enamored with this small city and the people in it, who are the most welcoming I've met, and whom I think about daily. I'm looking forward to my second visit since moving away in order to walk the Kumano Kodo myself. Thanks for sharing your experience!

<comment><USER4> Have spent many nights in Shingu — I agree, I love these small towns. Made all the more interesting by how rich (and important!) their spiritual histories are.</comment></comment></comment>


British mobile phone group Vodafone sold to Verizon for $130bn  - <AUTHOR> http://www.theguardian.com/business/2013/sep/02/vodafone-biggest-corporate-deal-130bn-sale

<comment><USER2> Headline is wrong. Vodafone is not being sold to Verizon, in fact almost exactly the opposite - Vodafone is selling off its existing 45% stake in Verizon.</comment>


gauged: a time series database - <AUTHOR> https://github.com/chriso/gauged/tree/master

<comment><USER2> Interesting storage method; I like it. Some notes:

\- A MySQL backend should be very fast, but scaling it into multiple shards will have to be an exercise for the user. Perhaps CitusDB (PostgreSQL compatible) could be useful here.

\- Metrics cannot be tagged. This will make it useless for any sort of rollups or breakdowns ("give me the sum of requests over my servers in the XYZ data center"; "give me the requests for each server in the XYZ data center by hostname").

The second issue in particular needs attention before it can complete with enterprise-grade metrics solutions such as Datadog.

<comment><AUTHOR> Tagging would be the next addition. I added the ability to search for keys by prefix quite efficiently, so provided one stored keys like "requests:server1", "requests:server2", one could easily run the following

        requests = 0
        for key in gauged.keys('requests:'):
            requests += gauged.aggregate(key, Gauged.SUM, start=-Gauged.WEEK)

<comment><USER2> Tagging needs to be multi-dimensional to be effective (e.g., host=X, device=Y, interface=Z, etc.)

</comment></comment></comment><comment><USER3> I'd love to see an honest comparison against RRDtool. You mention it once in "Support for sparse data (unlike the fixed-size RRDtool)".

What are the other advantages, disadvantages and trade-offs?</comment>


How to succeed or fail on a frontier - <AUTHOR> http://unenumerated.blogspot.com/2006/10/how-to-succeed-or-fail-on-frontier.html?repost <comment><USER2> Good summary of Portuguese vs Chinese sea exploration.

Bad extrapolation into modern space exploration. Also, there's an artificial distinction between publicly funded space tech. and publicly funded military space tech.

Military spec tech. is funded from our taxes just like the shuttle is. And while it _may_ serve as a deterrent, there also may be much cheaper ways to get the same peaceful results. Like for example changing foreign policy to be less interventionist.

I think it's important to remember that Columbus was funded by the Queen of Spain, so it wasn't all private efforts.

It's also important to remember the modern day trade restrictions on space tech and flight restrictions imposed due to _military needs_.

And that's what's common between us and ancient China, it's not the public funding, it's the public restrictions.

<comment><USER3> _I think it's important to remember that Columbus was funded by the Queen of Spain, so it wasn't all private efforts._

The kingdoms and the city states of 15th century Europe were like competing family owned businesses (large property owning and managing businesses). The two keys for building a scalable success are competition and the profit motive. By definition, profitable means you get out more resources than you get in. Thus anything that is scalable must be profitable. The Chinese ran the missions for reasons of glory, so they did not concentrate on profit. As a result, the missions did not scale and were cut back when new rulers came to power. The same goes for NASA. But the monarchs of Europe were trying to make a profit so their exploration strategy was far different and far more cost effective.

</comment></comment><comment><USER4> This is remarkably interesting. I wish it'd been better titled so that I didn't keep skipping it.

<comment><AUTHOR> Interesting. It was originally submitted by 'bokonist' accurately titled as "How tiny Portugual beat the Chinese Empire in the race to control the seas", but this got very few votes: <http://news.ycombinator.com/item?id=482484>

I resubmitted it with this title, which is the original title of the article, hoping that it would be called to the attention of a few more readers. Empirically, this title seems to have worked better.

What title would you suggest?

<comment><USER4> I'm not sure that I have any better suggestions, although the title of that original post was definitely clearer. It's too bad I didn't see that one.

</comment></comment></comment><comment><USER5> _We proved that our socialists, if funded by taxing capitalists, could beat their socialists funded by socialists._

What a ridiculous statement!

<comment><USER6> If by "ridiculous" you mean "insightful". :) Seriously, the race to the moon was useless for accomplishing any of the things that we space nuts (though I wasn't born yet; no one has been to the moon in my lifetime) dreamed. It was a huge diversion from actual economic growth into pyramid building.

If done for a profit, going to the moon would _be_ economic growth, but as it was, it was essentially a program to build a legacy for Kennedy and Johnson, at which it was immensely successful! After all, people associate those two with the space program more than with the Vietnam War, now, as far as I can tell.

</comment></comment><comment><USER7> An interesting side effect of all this Portuguese expansion was the accompanying decline of the Republic of Venice, which was the former big power in terms of trade.

The town where my wife is from south of Padova is actually fairly new in Italian terms (16/17th century). Why? Because it was originally mosquito- infested swamp land. It got cleared out when the Venetians turned 'inwards' to try and make better use of the land they had when their trade fortunes started to decline. Or so goes the story, at least...

<comment><USER8> I thought the Most Serene Republic declined because they got squeezed between the Ottoman Empire and Habsburg Dominions, both of whom were able to mobilize significantly larger armies and navies. The Habsburgs could do so because of New World silver, and the Ottomans could because they had the world's best bureaucracy, and trade with the East.

</comment></comment><comment><USER9> If you enjoy this article, then I highly recommend Nathaniel's Nutmeg:

[http://www.amazon.com/Nathaniels-Nutmeg-Incredible- Adventure...](http://www.amazon.com/Nathaniels-Nutmeg-Incredible-Adventures- Changed/dp/0140292608/ref=sr_1_1?ie=UTF8&s=books&qid=1244233412&sr=1-1)

</comment><comment><USER10> Summary: Want to succeed on a frontier? Do it frugally, so it pays for itself! Best way to do it frugally? -- involve the free market as much as you can!

</comment><comment><USER11> Also, there's no one to trade with or conquer on mars

<comment><USER12> Well, Mars exploration can be a potential commercial enterprise in real estate, travel, and natural resources (unsure on this one). Regardless, I think the point of the article was to point out there needs to be 1) focus on a tangible benefit/gain, and 2) be able to scale from small to big, similar to most startups.

<comment><USER6> There is unlikely to be anything worth bringing back from Mars, physically. I think Mars' biggest export to Earth, if it ever has any, will be entertainment or other information.

But I think humans-off-Earth will never be a large percentage of all people, even after/if people-off-Earth are an overwhelming majority. Meat isn't suited for space.

<comment><USER10> There's plenty which will be worth lifting off the surface of Mars, but not to head back to Earth. Mars gravity is only 38% of Earth's -- low enough that we can build a space elevator there with materials we have had for years. Even without that, it's still much, much cheaper to get to the asteroids and the rest of the Solar System from there.

Mars has a nearly 24 hour day/night cycle and solar flux suitable for growing plants. Mars has also had the same sorts of geologic processes that created many of the mineral deposits on Earth. Basically, Mars is a treasure trove of resources to enable the cost-effective human settlement of the rest of the Solar System.

And the rest of the solar system _will_ get settled. There is simply too much military advantage to be gained from being up there as opposed to down here. Ultimately, the amount of resources and energy that a solar system-wide space- faring civilization will be able to control will be a couple of orders of magnitude larger than what we can easily acquire on Earth. Therefore, some Earthside societies will try to settle Mars and exploit the resources up there, and it's only a matter of time until at least one succeeds.

However, these attempts of Earth societies to colonize space will ultimately fail to create good copies of their parent societies and will instead give rise to an entirely new society, which will generate many new innovations much as the American colonies failed to remain under Britain and eventually gave rise to much of the innovation of the Industrial Revolution.

Whether or not we're mostly made of meat by that time -- I'm not sure how relevant that is, really.

<http://baetzler.de/humor/meat_beings.html></comment></comment></comment></comment>


Show HN: Build RegEx - A Simple RegEx GUI - <AUTHOR> http://www.buildregex.com?hn

<comment><AUTHOR> This is my newest side project, and one of the only ones to actually get finished and launched.

I used VerbalExpressions.js to handle the regex building. Thanks Jehna for a great little library! So useful.

VerbalExpressions.js: [https://github.com/jehna/VerbalExpressions](https://github.com/jehna/VerbalExpressions)

Build RegEx on Github: [https://github.com/stevenwadejr/Build- Regex](https://github.com/stevenwadejr/Build-Regex)</comment>


61% Oppose Federal Regulation of the Internet - <AUTHOR> http://www.rasmussenreports.com/public_content/lifestyle/general_lifestyle/november_2014/61_oppose_federal_regulation_of_the_internet <comment><USER2> I think it's a biased poll. It asks if the government "should regulate the Internet like it does radio and television."

Radio and TV are on the public airwaves, and subject to prohibitions, including the prohibition of transmitting pornographic movies.

A very direct reading of that poll questions could be "do you want the government to regulate the content that can appear on the internet, just like it does radio and TV?" Hence why "Sixty-eight percent (68%) are concerned that if the FCC does gain regulatory control over the Internet, it will lead to government efforts to control online content or promote a political agenda, with 44% who are Very Concerned"

A perhaps less biased question would be ask if the government should regulate the internet like it does the long distance phone services.

Also, and in case people have forgotten, there already is federal regulation on the internet, with laws like CAN-SPAM and DCMA.</comment>


Think the heatwave was bad? Climate already hitting key tipping points - <AUTHOR> https://www.reuters.com/article/us-climate-change-heatwaves/think-the-heatwave-was-bad-climate-already-hitting-key-tipping-points-idUSKCN1UN065 <comment><USER2> I really hope this can be done without the help and with the actual opposition from countries like the US, Hungary, Poland, and the other fascist or pseudo fascist countries opposing it. I highly doubt it though. I think what we need to start thinking about is how to live in a world with a +3° average temperature that can no longer be avoided. It's almost time to accept our fate and try to figure out the next steps because we are not going to prevent this catastrophe. Should be interesting times ahead. I don't think our children will be too happy or forgiving of our generation. Hopefully they don't put us oldies in concentration camps and exterminate us for what we did to them, but if they did, I couldn't blame them.</comment>


Building AI that can master complex cooperative games with hidden information - <AUTHOR> https://ai.facebook.com/blog/building-ai-that-can-master-complex-cooperative-games-with-hidden-information/ <comment><USER2> If you're wondering why this is interesting, games that AIs excel at like chess/checkers/go are all two-player, zero-sum, perfect-information (everyone knows everything), deterministic games, so you can exactly predict your opponents behavior by simulating "what would I do if I were them, and trying to make me lose". The only real hard problem in this space is extreme branching factors.

Everything gets vastly more complicated once you break any of those rules: non-zero sum games create a prisoner's dilemma cooperate/defect dynamic, every three or more player game is non-zero sum (and exponentially more for every player you add), hidden information forces you to manage how much you reveal to your opponent and requires you to simulate multiple "alternate futures" based on things you learn after making a decision, and randomness is equivalent to an extra player that makes irrational unpredictable moves.

Games like that are vastly closer to the messy real world than the computationally expensive but near-ideal world of games like go, and they're much more of an open problem.

<comment><USER3> In particular, _communication_ is in some ways a complex multiplayer game requiring multi-level modeling of other participants. In the ideal case, it can be modeled as a cooperative game. In suboptimal cases that sadly occur often in the real world, it's a game where you're fractionally cooperating and fractionally competing with every other player, and the degree to which you're cooperating or competing with any given player depends on your model of them, which you update over time based on your observations of how they "play". And it's a helpful shortcut in modeling if you can group expectations of other "players" into common conventions.

Hanabi's multi-level "what is my model of each other player, and what is my model for their model of other players including me" is remarkably deeper than it looks on the surface. Play it for long enough, and you start to handle situations for which preconceived "conventions" don't help: "OK, of the four players at the table, three of them understand certain common conventions, one of them doesn't seem to understand at least one convention based on the misfire they just had/caused (which is also consistent with their low player rating), I can probably assume they don't understand any other conventions commonly considered more challenging than the one they just failed at, so if I give this hint, how will the more advanced players understand it, can I do so without the less advanced player misunderstanding it in a harmful way, and what will happen? And also, for future games, I should remember that this player doesn't know these conventions (yet) until I see evidence that they've improved. I might also consider helping them learn more common conventions. Or, if they don't know enough conventions and don't improve, I might not want to play with them in the future at all."

<comment><USER4> Unfortunately Facebook's approach sidesteps this complexity by ensuring each player uses the same random seed and searches policy based on information they can all see. It's not really solving the problem as intended in my opinion.

<comment><USER5> We are entirely focused on the self-play setting in which the goal is to learn the highest performing policy for a team of agents all trained together. The Hanabi Challenge also outlines an ad-hoc setting in which you need to adjust to the diverse policies of other agents in the team on the fly.

</comment></comment></comment></comment><comment><USER6> Hi! I'm one of the authors on the paper. We'd be happy to answer any questions. Ask us anything!

<comment><USER7> Hey Noam, this is some great work; I'll need to sit down and give the paper a deeper read. Also, the visualizations on this blog post are incredible.

I saw a talk on the Libratus agent a while back, and one of the most interesting takeaways was that the behavior of the bot had already started to impact the professional players, who now spontaneously bet large amounts to force other players out of a hand. Were there any behaviors your agent demonstrated that surprised you in the same way? What insights might we draw from this _cooperative_ AI system that may have more general applicability to other planning domains?

<comment><USER6> In terms of Hanabi, this bot arrived at conventions that are pretty different from how humans play the game. We invited an advanced Hanabi player to play with the bot and he pointed out a few things in particular that he'd like to start using. For example, humans usually have a rule that if your teammate hints multiple cards of the same color/number, you should play the newest one. The bot uses a more complicated rule: if the card you just picked up was hinted then play that card, otherwise play the oldest hinted card. That gives you way more flexibility to hint playable cards that would otherwise be tough to get played.

I think one important general lesson is that search is really, really important. Deep RL algorithms are making huge advancements, but Deep RL alone can't reach superhuman performance in Go or poker with search. Here, too, we see that search was the key to conquering this game, and I think that will hold true in more complex real-world settings as well. Figuring out how to extend search to more complex real-world settings will be a challenge, but it's one worth pursuing.

<comment><USER3> > For example, humans usually have a rule that if your teammate hints multiple > cards of the same color/number, you should play the newest one. The bot uses > a more complicated rule: if the card you just picked up was hinted then play > that card, otherwise play the oldest hinted card. That gives you way more > flexibility to hint playable cards that would otherwise be tough to get > played.

I've definitely seen advanced Hanabi players use a more subtle version of that rule: "If your hint looks like it's telling me to play my leftmost hinted card, how long has that card been playable? If it could have been hinted for play a long time ago, and it's just being hinted _now_ , it must not be playable. So what else must you mean...?"

That version of the rule allows for more subtle cases. Suppose you hint that a player's second-from-the-left and fourth-from-the-left cards are both red. If there _hasn 't_ been an opportunity to hint the second-from-the-left since it became playable, go ahead and play the second-from-the-left. If there have been opportunities to hint second-from-the-left, play fourth-from-the-left.

That rule requires human players to model whether the other players' actions in the interim have been "urgent" things that needed taking care of before hinting them, or whether those other players _would_ have hinted them sooner if their card was playable.

</comment></comment></comment></comment><comment><USER8> they (basically) applied the ideas from a bot that plays poker to another game. it's interesting work, though perhaps not groundbreaking.

This idea of selfplay + counterfactual regret minimization does seem to be the superior way to solve game theoretic problems. Identifying valuable game theoretic problems remains a challenge...

<comment><USER6> The search algorithm shares a lot in common with our Pluribus poker AI ([https://ai.facebook.com/blog/pluribus-first-ai-to-beat- pros-...](https://ai.facebook.com/blog/pluribus-first-ai-to-beat-pros- in-6-player-poker/)), but we added "retrospective belief updates" which makes it way more scalable. We also didn't use counterfactual regret minimization (CFR) because in cooperative games you want to be as _predictable_ as possible, whereas CFR helps make you unpredictable in a balanced way (useful in poker).

The most surprising takeaway is just how effective search was. People were viewing Hanabi as a reinforcement learning challenge, but we showed that adding even a simple search algorithm can lead to larger gains than any existing deep RL algorithm could achieve. Of course, search and RL are completely compatible, so you can combine them to get the best of both worlds, but I think a lot of researchers underestimated the value of search.

<comment><USER8> I just spent three weeks going through your research. Thank you for that work, especially the supplementary materials.I wish I'd known how much the ideas in the pluribus paper depended on reading the libratus paper.

I see what you're saying about the real time search (which took me quite some time to understand). I came up with a way to do that from disk due to memory limitations. It limits the number of search iterations but doesn't seem to have a huge negative impact on quality so far.

Anyway, thanks again!

</comment></comment></comment><comment><USER9> They should tackle Starcraft II next like DeepMind has with AlphaStar, or at least a similar real time RTS like Starcraft with a fog of war and a partially observable state.

<comment><USER5> There are unique challenges around learning effective communication protocols that appear in cooperative settings, which was the focus of this work. Getting robust superhuman performance in SC2 remains an interesting challenge, though.</comment></comment>


Show HN: dash.up, a Tumblr client for iPhone - <AUTHOR> http://itunes.apple.com/app/id466141513?mt=8

<comment><AUTHOR> I've spend the last few months of my free time making this app, so please: feedback, of any type!</comment>


Ask HN: Does the use of CoffeeScript improve your productivity? - <AUTHOR>

Thinking of starting to use CoffeeScript, but this decision will affect 3 developers. Anybody have opinions on this? <comment><USER2> I'm biased, insofar as I'm the author of the CoffeeScript book published by PragProg (<http://pragprog.com/titles/tbcoffee/coffeescript>), but I'd say "yes, with slight reservations."

If your team consists of three John Resig-like JS ninjas, then the benefits of using CoffeeScript may be slight, or even cancelled out entirely by the extra step of compilation or the concern that future versions of CoffeeScript may break your code. But if your JS skills are beginner-to-intermediate, then I'm quite confident that you'll be more productive after a week or two of using CoffeeScript. That's based on my own experience, and the experience of many developers I've talked to.

CoffeeScript is an improvement in a lot of ways, and makes some of the most common JS mistakes (polluting the global scope by omitting `var`, relying on `==` to coerce types) impossible, while making many (`this` not being what you want it to be) easier to fix. Brendan Eich, the creator of JavaScript, is on record as being a fan.

It's not a magic bullet, and there are certainly tradeoffs, but all in all, I'm of the opinion that CoffeeScript is what most devs should be using. And the benefits are especially pronounced in a team setting, where having shorter, more readable, more modularized code makes communication much, much easier. In pg's words: "Succinctness is power."

(By the way, I've also waxed about this subject at the Programmers Stack Exchange: See [http://programmers.stackexchange.com/questions/72569/what- ar...](http://programmers.stackexchange.com/questions/72569/what-are-the-pros- and-cons-of-coffeescript/) and [http://programmers.stackexchange.com/questions/72699/should-...](http://programmers.stackexchange.com/questions/72699/should- i-invest-time-learning-coffeescript.))

</comment><comment><USER3> I'm hardly an expert but it was greatly beneficial to me. Got the complexity under control, started working much faster, and being able to understand stuff better when i revisited it. It's also just generally more pleasurable to use, with the high-level loops and other control aspects. Makes your code much prettier. And this, I might add, with a far from optimal development setup - can't get Node to run on my comp, so I'm just pasting code in and out of the 'try coffeescript' widget on github.

</comment><comment><USER4> Yes, _undoubtedly_. It has a learning curve like any programming language, but even for existing intermediate JavaScript users, the learning curve for CoffeeScript is shallower than the learning curve for expert, best-practices- driven JavaScript development.

</comment><comment><USER5> IMO it improves developer happiness... whether that improves productivity dunno. For me, I doubt it would, I am using the very good js2-mode for emacs, which is able to issue warnings and error messages as I type, checking my javascript syntax as I go.

</comment><comment><USER6> I recently did some medium-scale work with it and was generally satisfied. The gotchas I encountered were mainly javascripts fault.

</comment><comment><USER7> Short answer: No.

It depends on the complexity of the project, and whether or not you are counting the time to learn CoffeeScript.

If it's a small project, you won't notice a lot of difference. But, if you know CoffeeScript and use it on larger projects you'll notice it's easier to not repeat yourself, and you can get things done a lot quicker.

I think that in large projects with lots of styles and code to manage, tools like SASS can really improve maintability and extensibility. The speed for which you can make improvements in the future is greatly increased.

Personally, I think SASS + Compass is a more robust solution than CoffeeScript.

</comment><comment><USER8> Hell yes!</comment>


Why our minds have probably evolved as far as they can go - <AUTHOR> http://io9.com/5865987/why-our-minds-have-probably-evolved-as-far-as-they-can

<comment><AUTHOR> Link to abstract of journal article:

<http://cdp.sagepub.com/content/20/6/373>

The full article

<http://cdp.sagepub.com/content/20/6/373.full.pdf+html>

may appear to you as well, if you don't encounter paywall restrictions.</comment>


Show HN: A Phylogeny of Android Bubble Shooter Games - <AUTHOR> http://blog.megafaunasoft.com/2012/11/a-phylogeny-of-android-bubble-shooter.html

<comment><USER2> Interesting analysis, one comment though:

PCA used in this way is not particularly helpful without understanding what the principle components actually mean, especially when there's not much structure in the resulting 2D plot.

This highlights a broader point, which is that similar analyses are often performed in scientific research. The real utility of the approach is when it is used to recover latent dimensions that help to explain the differences or clusters in data, and then translate these into meaningful and describable features.

<comment><AUTHOR> That's fair. I didn't quite get to outputting the loadings. This was really more about MDS than PCA.

</comment></comment><comment><USER3> Reading this makes me wonder where game value is these days. I suspect that a curated source of 'decent' Android games would be more valuable for the curation than for the actual games. Of course it would not be easy to extract that value. The two avenues would be charge for use, or charge for entry. And either way the authors are going to wonder if they should get a cut if you're making money off their "free" game.

</comment><comment><USER4> Saw your spreadsheet. Analysis might have been easier by just ripping open the APKs. For example, City Games LLC "Shoot Bubble Deluxe" is obviously Frozen Bubble code with lingering unused data sprinkled about. (Also the company's domain name was registered once upon a time to an address that was a Kentucky Fried Chicken near Google HQ.)</comment>


HTML5 presentation - <AUTHOR> http://apirocks.com/html5/html5.html <comment><USER3> Tried it in Chrome, and I'm hella impressed. Everybody else is busy hating on it, but I'd like to thank the developers for putting it together. That 20 minutes of playtime has taught me 10 times as much about what to expect (and why I should be excited) than all the discussions and blog posts I've seen so far.

So, while some things didn't work, I'm not going to harp or nag, as overall the presentation was excellent.

<comment><USER4> It was fantastic (on Chrome anyway). Incidentally that 'press arrow key for next page' feature is something I've wished all websites had for a long time - like to leaf through forum pages or article pages.

<comment><USER5> Opera has a "Next Page" feature that is usually able to do exactly what you ask on most sites/forums. Also, it's smart about it - if you're on a page that it's remembered a username/password for, if you go Next Page (either the mouse gesture or left/right mouse rocker gesture), it'll log you in automatically.

</comment></comment></comment><comment><USER6> I realize that HN is a bastion of keyboard-worshippers, but it bugs the hell out of me that I can't click that arrow to progress.

<comment><USER7> Indeed; I clicked the arrow three times before realizing it referred to the right arrow key.

<comment><USER8> Good lord, I'm an idiot. I was about to close the browser until I saw your comment :)

</comment></comment></comment><comment><USER9> Cool demo, but it's a bit odd to tout new, standard features, when you have a disclaimer that this is only intended to completely work in Google Chrome with experimental features enabled. Part of the excitement is that these features are being standardized, and aren't just one vendor wandering off and doing their own thing without consulting with anyone else.

What would be far more impressive would be a demo that worked seamlessly in Firefox, Safari, Chrome, Opera, and IE with Chrome Frame, with graceful degradation (or, preferably, progressive enhancement) for features which aren't implemented yet in IE without Chrome Frame (and the features that aren't yet fully supported cross-browser).

<comment><USER10> This is a demo of what's at the bleeding edge. To complain that it's not implemented across all browsers with graceful degradation is to be frank, silly.

</comment></comment><comment><USER11> I don't have an arrow key on my phone, why not make it advance upon click?

<comment><USER12> I spent at least a minute looking for the "->" button.

</comment></comment><comment><USER13> This is extremely cool. I admit it scared me a little bit just how easy it was to do the geolocation. The web is about to change dramatically, again. :)

<comment><USER14> Does anyone know where GeoLocation gets the data? My IP is registered to a city 35 miles away, yet it's able to pinpoint where I am within a few meters?

<comment><USER15> «There are a few common ways to get location information. The most common are local WiFi networks, IP address information, and attached GPS devices. In Firefox 3.5 we use local WiFi networks and IP address information to try and guess your location.»

– <http://hacks.mozilla.org/2009/06/geolocation/>

</comment></comment></comment><comment><USER16> Uh, why only use webkit specific CSS attributes when there are mozilla ones as well.

<comment><USER10> It's a tech demo designed for Chrome — a pretty reasonable compromise given it's supposed to show what's coming up in browsers and requires Chrome be invoked with various command line flags to demo all the features.

</comment></comment><comment><USER17> Awesome. It doesn't work on the Droid, because of the arrow key requirement. I also think it is missing a position-in-presentation indicator, like a progressbar or a smaller zoomed out version along the bottom.

</comment><comment><USER18> That was great!

though i didn't get the last comment about IE6. I tried loading the url in IE6 twice, and both times the browser crashed.

<comment><USER19> That's probably the point. It should work with Google's compatibility layer.

</comment></comment><comment> brown9-2 Which browsers are WebGL-enabled?

Chrome 5.0.342.9 (beta) does not seem to be.

<comment><USER20> I think you'll need to use the --enable-webgl command line switch to turn it on. I'm not sure that will work in anything besides the latest dev channel builds though.

</comment></comment><comment><USER21> I didn't realize inline-block was considered html5 -- I had been using that for almost 2 years already.

<comment><USER22> yeah, i thought the same thing. it must have been an error on the part of the author.

here it is in the CSS2.1 spec -- <http://www.w3.org/TR/CSS2/visuren.html#display-prop>

it looks like it was introduced in CSS 2.1 because it is missing in CSS2 and CSS1: [http://www.w3.org/TR/2008/REC- CSS2-20080411/visuren.html#dis...](http://www.w3.org/TR/2008/REC- CSS2-20080411/visuren.html#display-prop) <http://www.w3.org/TR/REC- CSS1/#display>

</comment></comment><comment><USER23> The "Web 2.0 Logo Creatr" slide is both useful and hilarious.

</comment><comment><USER24> The best HTML5 introduction I've seen so far. Very nice! This just gets me even more excited about the future of web apps.

</comment><comment><USER25> I wonder if the author will write a tutorial on how he created this. Explaining the presentation elements (I mean).

</comment><comment><USER26> Tried in FF and in Chrome and the browser "Back" key doesn't work, only <\- and -> arrows do.

Is this expected of HTML5?

<comment><USER23> It's all a single page, so the browser's back button wouldn't come into play.

<comment><USER27> Not quite true. Each page has its own anchor, so making the back button work properly is pretty trivial. That's a big oversight in an otherwise awesome presentation.

</comment></comment></comment><comment><USER28> Very nice. Not very FF friendly but still very nice. I am liking how the web will be in the coming future. Only need all browser vendors to get their act together and get standards compliant. Microsoft can be augmented with Chrome frame so the one hindering block can be ignored.

</comment><comment><USER29> I tried searching within text and it works okay (in some cases it even moves to the appropriate "slide"). I managed to break things, however.

That said, I hope Adobe is scared as hell--and more importantly, that they get their act together... or else.

<comment><USER30> If Adobe get their act together, what would you expect them to do?

<comment><USER31> 1\. Get flash working on every mobile OS other than iPhone

2\. Transition flash creationg tools to HTML5 creation tools

voila - <USER2>

</comment></comment></comment><comment><USER32> I am most excited about the css; this will cut our development time in half! We aren't going to need images to have decent looking buttons anymore.

</comment><comment><USER33> It looks like HTML is no more just Hyper-TEXT Markup Language.. It should perhaps be called Hyper Markup Language.

<comment><USER34> HTML5 was started by WHATWG which stands for Web Hypertext Applications Technology Working Group. A lot of work shown there is under umbrella of "Web Applications 1.0", see [http://wiki.whatwg.org/wiki/FAQ#What_are_the_various_version...](http://wiki.whatwg.org/wiki/FAQ#What_are_the_various_versions_of_the_spec.3F)

</comment></comment><comment><USER35> Doesn't work in opera. Alignment is screwed up.

<comment><USER36> Read the disclaimer: <http://apirocks.com/html5/disclaimer.html>

</comment></comment><comment> doc-film lots of failures in FF

<comment><USER37> FF is quickly becoming an obsolete browser. iPhone uses Webkit, iPod Touch, iPad, every single Android phone (like the Nexus One and Droid), Chrome on Windows & Mac... every new Mac... the list goes on. I'm all for competition, but Webkit is clearly the champion here.

<comment><USER38> That's nice and all, but Firefox is still one of the biggest browsers out there. It's _not_ obsolete, and you can't ignore it if you value users. In fairness, not everyone values users.

<comment><USER39> Replace "Firefox" with "IE" and your arguments are even more persuasive.

</comment></comment></comment></comment><comment><USER40> Nobody has said anything about it breaking the back button yet.

<comment><USER41> It doesn't. Back moves to the previous slide.

That doesn't seem like broken behavior to me.

<comment><USER40> It doesn't do anything for me in Srware Iron.

</comment></comment></comment><comment><USER42> Does the __amazing __presentation go to 5 pages only ?? Rather a HUGE letdown, i'd say.

<comment><USER43> No, it's 46 slides long.</comment></comment>


Ask HN: Do you get pain in your finger tips from typing all day? - <AUTHOR>

I figure I can't be the only one who experiences this. The constant pressing all day of both work and play is taking a toll on my fingers. I am now experiencing pain after using a keyboard for not that long. Is there a specific type of keyboard that helps mitigate the pain? Any advice would be greatly appreciated. Thanks. <comment><USER2> I get that pain too sometimes, like a bruised bone in the tip of my fingers. It doesn't seem to happen when I get a good mechanical-switch keyboard. But when I'm on a bad keyboard, like a laptop keyboard, and I have to bang the keys hard or else it can't keep up with my speed, then I feel it. Do you have to bang the keys because your keyboard misses your keystrokes?

These days when it starts to happen I adjust my typing style to type more slowly and more with the flats of my fingers instead of the very tips/nails. Also I wear a bandage when it gets bad. It goes away after a day.

I don't know what kind of doctor I'd see for this.

</comment><comment><USER3> Step 1: Get one of these <http://kinesis-ergo.com/contoured.htm> along with a trackpad <http://kinesis-ergo.com/touchpads.htm> which you can tape down to the keyboard in the middle.

Step 2: Posture. Sit up straight, and type such that your upper arms hang down, your forearms are about horizontal, and the tops of your hands bend down just a small bit from the horizontal (fingers should dangle down onto the keys). For me, having the keyboard on my lap --- as well as using a footstool to keep my lap level --- is just right.

If you _really_ want to go all out (say your pinkies are hurting you the most), consider a foot-switch to use in place of the Shift key (note, I've never tried the footswitch).

If you can take the productivity hit for a week or so, consider switching to a keyboard layout such as dvorak. It's not that much _faster_ than qwerty, but it's more comfortable. Find out about crazier (and more optimal) layouts at <http://mkweb.bcgsc.ca/carpalx/> .

I don't work for or have any other interest in Kinesis other than really liking their Contoured keyboard (combined with the trackpad).

<comment><AUTHOR> Thanks so much for your response. I'll check it out.

</comment></comment><comment><USER4> I was playing the bass too and sometimes I also experience pain in my wrists or my hands. Not only when I am coding. Writing is the worst my hands always hurt from writing.

A doctor should help or if it does not, go see another. Of course he will not give you an advice about which keyboard you should buy, but he might tell you that you should have a break and stop coding for a while. Or maybe do some exercises, not sure. :-)

</comment><comment><USER5> How old are you? Do you heavily use your fingers in some other activity (guitar, rock climbing, etc.)?

More importantly, go see a doctor.

<comment><AUTHOR> 30\. I've played countless hours of guitar through my twenties but have stopped this last year due to pains in my fingers.

I am seeing a doctor, but I doubt he can give me as good a keyboard recommendation as the people here.

<comment><USER5> Fair enough.

It seems that in your case though, you may want to stop using your keyboard for a while as you explore options with your doctor rather than just try to mitigate the pain– there are quite a few carpal tunnel horror stories out there, and it's infinitely better to stop using a computer for a month rather than become unable to use a keyboard for life.

As far as keyboard recommendations, my PhD advisor had wrist problems and used something that looked very much like this: [http://www.mac-pro.com/Adesso-Tru- Form-Pro-Contoured-Ergonom...](http://www.mac-pro.com/Adesso-Tru-Form-Pro- Contoured-Ergonomic-Keyboard-image.jpg)

</comment></comment></comment><comment><USER6> I've had pain in my finger tips for over 3-4 years now; I haven't done anything about it. I do notice, a couple days away from the computer entirely takes away the pain. But that is extremely rare in my life. The pain can get pretty bad sometimes -- it comes not just from typing, but also from clicking my mouse and rolling the mouse wheel(!).

</comment><comment><USER7> I've never heard of pain in the finger tips from typing on a keyboard, and if it really is as you describe it you might not have a lot of options except medication.

I find the Rapoo e9007 wireless keyboard more pleasant and less painful than bigger ones with big chunky keys. Maybe a personal thing though.

</comment><comment><USER8> Music physiotherapist. They aren't cheap, but they know more about _protecting the long term functioning of your hands_ than just about anybody else. It's a career-ending problem, and it only gets worse if you don't sort out the fundamentals.

</comment><comment><USER9> Have you considered another keyboard layout?

Supposedly the workman's layout has many of the most common keyboard shorcuts in the same place. I have typed on the Dovark layout for a long time and don't regret it.

</comment><comment><USER10> Only in deep button keyboards, like the standard Dell/HP. Shallow keyboards like Apple have simply less travel, less pressure for less time needed.

</comment><comment><USER11> Is the pain only in your fingertips or do you experience it in your joints as well? Is the pain in all of your fingertips, or just some?

</comment><comment><USER12> No - Change keyboards. I have been told I type very fervently (aka loud and hard). If anything , my wrists hurt.

</comment><comment><USER13> Is it numbness or pain? I see noone brought up 'Carpal tunnel syndrome' yet. Can it be CTS?</comment>


Some of you are going to hell. – Was this another scam on kickstarter? - <AUTHOR> https://www.kickstarter.com/projects/ispaul/intelligent-security-camera-cover-webcam-privacy-c/posts/2154643?ref=ksr_email_backer_project_update_registered_users <comment><USER2> FWIW, I got the 10 I ordered. About 14 months late (and by which time I'd already ordered practically identical camera covers for less money on Amazon). So it wasn't an outright scam.

All up - this guy got ~$200k(usd) - about 25 times his initial goal, then totally blew the fulfullment - with many people still screaming for delivery or refunds while he's got them for sale on through his new company (set up with the Kickstarter money presumably) on their website, leaving some (most? many? a few?) backers angrily waiting.

Pretty much what I'm expecting to be a 50% likely outcome every time I back something there, and set my expectations accordingly.

I've been burnt there before, and will be again, and haven't actually regretted any of them. My biggest fail was the ZPM Espresso machine, about $300 which never succeeded. Again a stupidly over subscribed Kickstarter, and at least they had the grace and transparency to fail publicly in their attempts to manufacture 50 or 100 times as many as they'd planned...

My take away is to never do a Kickstarter-like physical good project and accept 10x or more "orders" that your initial plan had in it. Sure, if you're making software or art which can be duplicated at tu=iny fractional costs, let the orders go wild. If you have to hammer things together (or even put easy- to-reproduce things into boxes and ship them), stick to your initial small batch size and defer new orders when you hit that for a future run. Don't commit to making 100,000 when you'd done your planning/pricing around being realistically capable of making and shipping 1000.</comment>


2010 Color Trends - <AUTHOR> http://www.colourlovers.com/business/blog/2011/01/12/2010-color-trends-business <comment><USER2> I remember when colourlovers.com came out with a similar post a few months back and I said something like this:

[http://www.colourlovers.com/business/blog/2010/10/26/color-o...](http://www.colourlovers.com/business/blog/2010/10/26/color- of-the-year-2010-by-the-people#comment-12576)

And so while this is still a nice, shiny piece of infographic eye candy, I don't really see the scientific basis behind any of this. It still seems like cherry-picked data to me. Why does it matter that _these_ companies' colors be analyzed compared to any of the thousands of others that were successful in the last year?

<comment><USER3> Just pointing out colors in brands that stood out in the last year... I understand you'd like hard scientific data about color associations, emotional and social associations that have impact on the trends... But we're an inspiration company.

And in the end, color has an impact on brands... but it doesn't make a break a brand... Maybe I should write a longer post about this.

<comment><USER2> _But we're an inspiration company._

And what greater inspiration for knowledge is there than properly-gathered statistics? All I'm saying is that you guys could do a lot of interesting things if you relied more on well-selected samples over multiple time series. I don't think your post was at all bad, but it leaves me begging for more information.

<comment><USER3> And your comment for more information leaves me wishing for more time to gather and share just the kind of thing you're asking for :)

<comment><USER2> Of course...I don't mean to imply that you could have put together any real meaningful time series data in such a short period of time. I only mean to _inspire_ you to do it in the future ;-)

</comment></comment></comment></comment></comment><comment><USER4> Most of these brand decisions were made well before 2010, if not 3 or more years ago... how does the fact that they were big as businesses in 2010 make them "Color Trends" for 2010? Google was really big in 2010 too, does that mean "rainbow" was a trend?

<comment><USER3> They were standout brands that either made a big impact, or were "hot." A lot of design is just "inspired" from other design, so hot companies in 2010 have an impact on the trends.

</comment></comment><comment><USER5> blue and red continue to dominate, with a reasonable amount of green. as usual, no pink.

<comment><USER6> _no pink_

Flickr?

</comment></comment><comment><USER7> Five Guys has been around for 25 years with that same color scheme.

</comment><comment><USER8> Thanks Colourlovers and Bubs, for putting this together. It's interesting qualitative data, and useful in many ways, though not for everybody. Color is more art than science, which probably accounts for some of the negative comments here.

I think the quantitative approach to color is largely a dead end, anyway; remember that Doug Bowman left Google out of frustration, citing their preference for endless color testing as a surrogate for expert design choices.

</comment><comment><USER6> Alternate title: some random red and blue logos arranged by color. (Does this mean that BofA wins, with a bit of each?)

</comment><comment><USER9> I was curious about the lack of green and wondered if there's a reason behind it. Came across this website (no clue how accurate it is) that breaks down color meanings across cultures.

<http://www.sibagraphics.com/colour.php>

</comment><comment><USER10> I absolutely love Colour Lovers. It's amazing how much time you can waste looking at colo(u)rs and patterns.

And we definitely need more pink/violet company logos.

<comment><USER11> Your comment reminded me of a job that I had years ago.

I was handed a list of company standard design practices when I first took the job. As I was reading over it, I noticed a line item: "Absolutely no pink dialogs."

</comment></comment><comment><USER12> How are old color choices, from well established sites considered 2010 color trends? Pandora? Really? Is flash a trend now too?(Pandora is playing now fyi)

</comment><comment><USER13> it would be cool, if there was a tree ring like structure detailing the year or generation of the logo or year or something</comment>


HTML5 image editor wants to replace Photoshop and Gimp - <AUTHOR> http://blog.photopea.com

<comment><USER2> Cute, but these guys have a loooooong way to go.

Will it be just an editor or will they incorperate sharing features or Dropbox support?

<comment><AUTHOR> Hey! I am the author and I am the only one author :) I can connect it with Dropbog, Google Drive and other services, if you wish. But now, I am focusing on image editing :)

Hope, in few months, it will be the best image editor for Chromebooks and iPads :-D

<comment><USER3> What will you provide in terms of image editing, that something like pixlr doesn't? I currently use that for image editing, since Gimp is just total rubbish to use, and I need a damn "business case" to get Photoshop.

<comment><AUTHOR> Well, currently Photo Pea has much better support for PSD than Pixlr (e.g. more layer effects, folders of layers, vector masks ...) Pixlr also uses Adobe Flash, wich is not available on some devices.</comment></comment></comment></comment>


Tribology - <AUTHOR> https://en.wikipedia.org/wiki/Tribology <comment><USER2> Is that why it's called 'tribbing' in the videos with the girls who do the rubbing together of their what-nots?</comment>


South African ISP Fighting 326Gbps+ DDoS Attack - <AUTHOR> https://mybroadband.co.za/news/internet/329279-cool-ideas-fighting-massive-ddos-attack.html <comment><AUTHOR> Poster and affected residential user here.

Link to an ISP representative quoting the 326Gbps figure is here[1].

Just to add a little more context here for people not familiar with the economic situation of South Africa. While it is true that the majority of our population could be categorized as third world in regards to their education and income, large urban areas are populated by middle class or wealthier citizens, also being highly developed and comparable to many US or European cities in terms of infrastructure.

I have a 25/25Mbps fibre connection which costs me about 800ZAR (~55USD) per month which is maybe a little faster compared to an average middle class person's connection here.

I find this interesting as our remoteness from major connectivity hubs in places like the US and Europe makes us particularly susceptible to what is essentially economic ransom demands.

[1] [https://mybroadband.co.za/forum/threads/cool-ideas-fibre- isp...](https://mybroadband.co.za/forum/threads/cool-ideas-fibre- isp-%E2%80%93-feedback-thread-2.1027306/post-24488921)</comment>


Don't Cut Out the Middleman--Become One  - <AUTHOR> http://www.entrepreneur.com/startingabusiness/businessideas/article203310.html

<comment><USER2> eBay's a middleman. So's Google (for information). Being a middleman is fine - just add some value and efficiency in the process.

<comment><USER3> I don't think you need to add anything. As you get better at matching buyers and sellers you get closer to equilibrium and make everyone happier.

<comment><USER4> Except the company who tried to kill Octopart( see pg's startup school 08 talk.)

</comment></comment></comment><comment><USER2> More I think about it - those that can't do, pontificate. Just build s__t that creates value or efficiency - whether you're a middleman or not.

Reading these articles is like peeing in the wind. You get wet and you stink. Instead, go in the cave and just....build....s__t!

<comment><USER5> So, by "these articles," you mean... HN? Why are you pontificating here, then?

<comment><USER2> Nope, meant those long blog posts. But you make a good point.

</comment></comment></comment><comment><USER6> I guess they didn't get Sarah Lacy's memo: [http://www.techcrunch.com/2009/09/17/memo-to-start-ups- you%E...](http://www.techcrunch.com/2009/09/17/memo-to-start-ups- you%E2%80%99re-supposed-to-be-changing-the-world-remember/)

clarification edit: Just pointing it out. Don't agree with her oversimplified (and 37 signals s vs n link-bait style post) essay</comment>


The State of Software Security in 2019 - <AUTHOR> https://noncombatant.org/2019/01/06/state-of-security-2019/ <comment><USER2> What a beautifully written article with informative links.

[http://lucacardelli.name/Papers/TypefulProg.pdf](http://lucacardelli.name/Papers/TypefulProg.pdf) is now next on my list when I finish reading A Philosophy of Software Design (which is brilliant if you haven't seen it).

<comment><USER3> Cardelli's Modula-3, a C++ alternative, also illustrates excellent balance of simplicity, programming in large, compile time, and run time. Expanding on that carefully like with macros, a borrow checker, and LLVM integration would have made for a simpler, safer, systems language. Give it a C-like syntax with C compatibility, too, for adoption.

[https://en.m.wikipedia.org/wiki/Modula-3](https://en.m.wikipedia.org/wiki/Modula-3)

<comment><USER4> You mean C# I guess. :)

Actually with .NET Native, the GC improvements in .NET 4.6 ( _TryStartNoGCRegion()_ and other companion methods), and the C# 7.x improvements taken from Midori, it is quite close.

<comment><USER3> C# looked a lot more complex than Modula-3 when I last looked at it. The book was _thick_. They definitely did nice things in C#. I just don't know it's fair to equate it with the simplicity vs get shit done vs small runtime of Modula-3.

I am up for you elaborating a bit on the second sentence since it sounds interesting. Not doing .NET, I don't know what any of those are except the middle one which sounds like SYSTEM/UNSAFE sections.

<comment><USER4> It is more complex, but Modula-3 isn't that tiny either, around Algol 68/Ada 83 "tiny".

They integrated the improvements from M#/System C# (Midori) into C#.

Namely return ref, ref for local variables, stack allocation for arrays in safe code, spans (slices) across all memory types, allocation free pipelines.

</comment></comment></comment></comment></comment><comment><USER5> Off topic, but I just love this article: it's 22.8 KB, with a bit of hand- written JavaScript that the website works well without, and just enough CSS to make reading pleasant.

</comment><comment><USER6> _it is just barely possible to significantly raise the cost of exploiting memory corruption vulnerabilities for projects implemented in unsafe languages._

If there is something positive walled gardens can bring to the table, it would be more of ecosystems where entire classes of exploits are completely mitigated. I think it's something that users and devs should be asking for. (We did it with USB plugs you don't have to flip over.)

</comment><comment><USER3> I like this article. I want to correct something on C and C++ side.

He hints it's barely possible to write correct C. He doesnt mention how safety-critical sector, esp regulated, cranks out reliable C on a regular basis. They use C subsets with careful coding, reviews, and every automated tool they can. Static analyzers, automated testing, you name it. There's also analyzers that, when they work, can prove absence of entire classes of errors. RV-Match, Astree Analyzer (used by Airbus), and Frama-C are examples. CompCert eliminates compiler errors afterward. Most security-critical development doesnt use tools like these even when companies can afford them. It's apathy, not technological capability.

Now, C++ is special given it was designed to reduce risks of using C. Yet, almost all the verification tooling was for C and Java. C++ is just so complicated that it's hard to statically analyze or even build tools for. That means a C program done like above might have fewer errors than a C++ program. For that reason, I recommend avoiding C++ in favor of either C or safe systems languages compiling to C to take advantage of its verification tooling. They're getting hit with these vulnerabilities because they using a harder-to- analyze language possibly with coding strategy that adds difficulty. See Cleanroom Software Engineering or Praxis's Correct-by-Construction for examples of low-defect, development strategy.

<comment><USER7> I completely agree with your assertion regarding the verification tools for C, unfortunately most commercial projects (i.e. not regulated) won't pick between e.g. Frama C and C++ and instead will choose between plain old C and C++, thereby making C a very poor choice.

<comment><USER8> Nitpick: The idea of your comment is sound, but Frama-C is a C program static analysis framework, not a C subset. You still write regular old C even with Frama-C.

</comment></comment></comment><comment><USER9> I agree with most of this dude's points, except about not starting new projects with C++.

I think C++ still has good strong merit but it definitely needs some critical thinking about _where_ it's used. Other languages are likely better candidates for most things.

<comment><USER10> The author works on Google Chrome so I'm pretty sure they're familiar with the pros and cons of C++. It's possible that there's a place for using C++ on a new project in 2019 but that would definitely be a decision to justify with a comprehensive process for mitigating the risks of not using e.g. Rust.

<comment><USER7> Although on HN it looks like there's some kind of competition happening, Rust is a rounding error compared to languages like Java, C# or even Swift which are actually chosen instead of C++ for many projects.

I'm looking at job ads periodically and Rust is almost not at all present. I've talked to someone from the Rust community and they told me that "many" companies are using Rust, but not advertising it and not hiring for it on public channels.

Whatever the reason, the Rust skills market seems to be non-existent, which is a bad position to be in when considering whether to start a project in Rust. Project = commercial product that makes money, not OSS or start-up dreams.

<comment><USER11> The subtext of Rust in posts like this is that Rust compiles programs that are pin-compatible with C/C++ programs. Without rethinking the architecture of a kernel, for instance, you're meant to be able to write Rust drivers.

I prefer other higher-level languages to Rust; I'd rather just work with garbage collection than wrangle the Rust borrow-checker. But if you need to write software that can't abide GC, Rust is basically the only memory-safe game in town.

<comment><USER4> Although I like Rust for those scenarios where GC isn't an option, I bet Ada/SPARK still have more commercial deployments out there.

It might change given the price of their compilers versus free rustc, however those are industries that also certify compilers, which isn't going to happen for the time being for Rust toolchains.

Also Rust still isn't pin-compatible with COM/UWP or Objective-C runtime, and I guess we need to wait around one year until mixed language debugging experience is a thing across all major IDEs.

<comment><USER12> > Although I like Rust for those scenarios where GC isn't an option, I bet > Ada/SPARK still have more commercial deployments out there.

I doubt it, if you're counting users. Hundreds of millions of users of Firefox and Dropbox, just to name the first two that come to mind, use Rust code.

> Also Rust still isn't pin-compatible with COM/UWP or Objective-C runtime

What? Of course it is. We're shipping Rust code that uses COM and Objective-C in Firefox beta, right now (WebRender).

<comment><USER4> Of course statistics is the art to make the numbers how we like them to be.

On my case I am counting systems in production.

Using COM is a tiny portion of COM development experience.

Where is the Rust support for creating COM and UWP components, including mixed mode debugging on Windows IDEs, likewise for Objective-C integration.

If I missed that, where can I find more about it?

<comment><USER12> Again, we ship COM components. You can't load local fonts on all versions of DirectWrite without that.

Likewise, Rust has had support for creating Objective-C classes with methods written in Rust for ages. You can't usefully render OpenGL into a window on macOS without doing that.

<comment><USER4> In that case it would be nice to actually answer my question.

> If I missed that, where can I find more about it?

How do COM type libraries get generated in Rust?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> The advice to use -Weverything is very bad advice. See, e.g., [https://quuxplusone.github.io/blog/2018/12/06/dont-use- wever...](https://quuxplusone.github.io/blog/2018/12/06/dont-use-weverything/)

Using -Weverything other than for a one-off, manual build, is a sure fire way to result in one or several of 1) hacky code that works around some compiler author's style preferences, 2) _less_ safe code because of the workaround hacks, or 3) coworkers quickly learning to ignore or disable (e.g. using inline #pragma's) diagnostics.

For both GCC and clang, -Wall comes close to the line of rejecting objectively correct and good code, but doesn't quite cross the line. -Wextra crosses that line (expect it to reject some correct and good code) but the pros often outweigh the cons. -Weverything blows past the line and wraps around the earth several times.

</comment><comment><USER14> I'm happy to see npm in the ugly section. I wish the code security review pipeline got as much attention as the package deployment one.

<comment><USER15> It's hilarious, after the event-stream fiasco last year, NPM has changed...Nothing. NodeJS made a 'package maintenance' repo, but failed to address the actual root cause of the problem.

We'll see plenty of other NPM disasters this year, and as always, nothing will change because security is an afterthought not a core mission principle.

If it was, NPM wouldn't exist in its current form. It's confusing, adding extra security wouldn't even be that difficult or time consuming, they just don't.

I wish it were possible to take over a project with individuals who actually care. The people in charge of NPM are incompetent at running a secure, large scale distribution system, why they're still allowed to be a part of it is beyond me...

If security isn't your top goal you don't belong in charge of a very important, widely used ecosystem which many rely on.

<comment><USER16> NPM announced support for 2FA and read-only tokens soon after the incident.

[https://blog.npmjs.org/post/166039777883/protect-your-npm- ac...](https://blog.npmjs.org/post/166039777883/protect-your-npm-account-with- two-factor)

Can't say I'm aware of any other package manager even discussing these issues.

<comment><USER17> Since you said "even discussing", might as well mention that the Rust community has discussed adding 2FA support to cargo: [https://internals.rust- lang.org/t/requiring-2fa-to-publish-t...](https://internals.rust- lang.org/t/requiring-2fa-to-publish-to-crates-io/7931). But as far as I know, crates.io/cargo still has no 2FA feature of its own.

On the other hand, if your crates.io account is linked to a GitHub account, you could have 2FA via GitHub. So I'm not entirely sure whether "cargo supports 2FA" would count as true or false at the moment.

<comment><USER16> Yes, I'm the author of that thread. It went nowhere.

</comment></comment></comment></comment></comment><comment><USER18> > Throwing away the idea of using 'engagement' as the sole or primary metric.

What are some alternatives that are not a synonym for engagement?

<comment><USER9> Customer satisfaction, perhaps?

I can be satisfied with products that I don't use at every moment of every day.

I am usually more satisfied with my life when I am not being gamed to be addicted to something such as a "free" product.

<comment><USER19> But what if I want to know why you're not using my product every moment of every day, and what I'd have to change to do that?

If you're satisfied with my product, but you only buy it once a year, that's bad for me. If you're not very satisfied with my product, but you buy it 30 times a year, that's better.

I'd rather have 30 sales than 1 sale, even if you badmouth my product and lose me 15 more sales down the line.

TBH I may not give a crap how "happy" you are if you're still engaging.

Satisfaction is trailing, engagement is leading.

<comment><USER9> > _But what if I want to know why you 're not using my product every moment of > every day_

Did you try asking me?

> _and what I 'd have to change to do that?_

Again, did you try asking me?

> If you're satisfied with my product, but you only buy it once a year, that's > bad for me. If you're not very satisfied with my product, but you buy it 30 > times a year, that's better.

If I'm satisfied with your product what makes you think I'd be _more_ satisfied with it if I had to buy it multiple times per year?

> _I 'd rather have 30 sales than 1 sale, even if you badmouth my product and > lose me 15 more sales down the line._

You assume every sale is the same price. If you sell your product to 30 people, are those 30 people generating the same amount of revenue as the 15 people could have if they were _more_ satisfied with your product?

> TBH I may not give a crap how "happy" you are if you're still engaging.

That is, in a nutshell, exactly why I'm not satisfied with many online products and have actively _disengaged_ from them. Your line of thinking leads down a road where the end user is nothing except a source of income to you. You've completely forgotten that you're supposed to provide a service _for_ humans. It shows a complete lack of respect of users' intent and instead you wish to push users to generate more money for you potentially at the cost of the users themselves.

<comment><USER19> My line of thinking is what makes companies profitable.

You can moralize all you want, but the incentives align for a company to maximize on profitability, not on "hey my customers like me". You can't pay for dinner with goodwill, but you can pay for dinner with money.

If I'm being so disrespectful, why is my engagement high? Do people love to be disrespected?

You're talking about what ought to be, as if it were how it is. It's not that way. It's how I describe. Maybe it should be some other way, but it's not.

<comment><USER9> > _My line of thinking is what makes companies profitable._

I don't disagree, however unfortunate that is.

> _You can moralize all you want, but the incentives align for a company to > maximize on profitability, not on "hey my customers like me"._

Let's change that so that the incentives _do_ work for being liked.

> _You can 't pay for dinner with goodwill, but you can pay for dinner with > money._

Somewhere there's some middle ground which represents the failure of our government to incentivize; where companies may still be profitable (even obscenely so), and employees _are_ able to pay for dinner, and customers _are_ happy, and people _aren 't_ being manipulated.

> If I'm being so disrespectful, why is my engagement high? Do people love to > be disrespected?

Love to be? No. Most have become desensitized to disrespect such that they _expect_ to be abused by collusion between big corporations and big government.

> _You 're talking about what ought to be, as if it were how it is. It's not > that way. It's how I describe. Maybe it should be some other way, but it's > not._

I'm talking about what ought to be, indeed. I recognize it's not that way. Do you recognize that it doesn't have to be that way? Don't you agree that it should be some other way?

<comment><USER19> I don't agree with your yanking what I've written out of context... Respond in full please, not line by line.

<comment><USER9> I replied to every statement. I don't agree with having super large replies that people start looking for a tl;dr

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Interesting write up. Having seen iOS in 'The Good' section with no mention of Linux or Windows, I thought things might get interesting in "The Bad" or "The Ugly". But there was no mention at all. That was a bit jarring, though I respect the author for omitting them if it is just ignorance in those areas. I'm not sure if there is a connection or intent, but the result may be a (tacit?) endorsement of Apple.

<comment><USER21> I'm an enthusiastic Linux user (called myself evangelist the first years of using it) and was always on a mission to defend it against the dark evil empire that was Microsoft. Apple was only used by graphic design types back then.

Now that I've established how much I love Linux and the FOSS movement (I'll still defend it over proprietary works) , I'm also a realist. Realist because when you do a lot of security dev then reality on Linux looks different today. Sticking for sake of discussions with monolith kind of kernels (comparing oranges with oranges) I absolutely hate the security design choices of modern Linux. Linux could do a lot better in this regard and Torvalds doesn't do the industry a favor when he calls security experts a bunch of _masturbating monkeys_. I can see where he comes from but the attack surface on any type of Linux (whether embedded or not), I'd go as far to call it total trash when compared to its BSD cousins. A lot of this isn't just Linux's fault considering how big the system is today. To realistically secure a Linux system is almost impossible (within budget+time that is) when compared to BSD.

The only reason why I still put up with Linus is because of FOSS. But if it were purely for security (on a desktop system) I'd have to say Linux is really poor.

It hasn't always been that way. My theory (really just theory) is that while Microsoft got hammered for decades for having shit security (remember trustworthycomputing.com ??). And I think the message slowly but gradually sank in at Redmond. Microsoft (and I still get hick-ups when saying it) somehow got their act together. I believe all that pressure amounted to something in the end while the Linux community missed the train. Not to say that there aren't brilliant ideas coming out of that community but there is very little pressure to provide integrated security that actually protects the user in a coherent way. You get lots of little pockets of good and bad (as is the nature of FOSS) and integrating it isn't even done well by the major distributions.

Again not saying Linux can't be secure but to make it good depends a lot on who integrates and sets up the system. And for the end-user who only has a semi-technical background (never heard of threat-modeling or grsec ... for them it's a dumpster fire).

I'm not comparing Linux to Apple here because Apple security is brilliant and thought all the way through to the UI/UE level. Linux in that regard doesn't even stand a chance. @thegrugq has a pretty good guide for OpSec/ComSec which is still relevant to this very day that spells out the tough reality (which a Linux fan like myself doesn't always appreciate hearing): [https://news.ycombinator.com/item?id=8950875](https://news.ycombinator.com/item?id=8950875)

<comment><USER21> also this a 1000 times:

 _" Dependency slurping systems like NPM, CPAN, go get, and so on continue to freak me out. They might potentially be more dangerous than manual dependency management, despite the huge risks of that practice, precisely because they make it 'easy' to grow your project's dependency graph — and hence the number of individuals and organizations that you implicitly trust. (And their trustworthiness can suddenly change for the worse.)"_

<comment><USER22> I always pin dependencies to fixed versions in production software, which makes it less likely that my toolchain gets poisoned by a rogue version update. Also, for languages that allow it I bundle dependencies locally (in Python e.g. using Wheels) or run my own registry proxy, which makes poisoning by registry takeover also less likely. Personally I think there are bigger threats than malicious dependencies, especially if an adversary specifically targets me. My biggest concern is what happens when someone takes over our CI/CD setup, as that gives way more access to an adversary.

</comment></comment></comment></comment><comment><USER23> Does anyone else think alexa/(services that record and retain) should be on the list of bad.

</comment><comment><USER24> ARM is a bit more secure than x86 in that there's one unambiguous way to read a sequence of ARM instructions but with x86 you might have two entirely different but completely valid instruction sequences if you start reading at address FOO versus address FOO+1.

<comment><USER25> While that is nice I'm not quite understanding how this is a security issue? Can code reuse attacks exploit it?

<comment><USER24> Here's an example

[http://mainisusuallyafunction.blogspot.com/2012/11/attacking...](http://mainisusuallyafunction.blogspot.com/2012/11/attacking- hardened-linux-systems-with.html)

<comment><USER9> > _Actually, file descriptions. The description is the kernel state pertaining > to an open file. The descriptor is a small integer referring to a file > description. When we send an FD into a UNIX socket, the descriptor number > received on the other end might be different, but it will refer to the same > description.↩_

Oh man, that perfectly explains a formerly-unanswered question I had about how that mechanism worked. Thanks for linking.

</comment></comment></comment></comment><comment><USER26> ELI5 : It is 2019. Why isn't everybody using pubkey crypto for email?

        i.e., transparent support of:
        * I publish a public key
        * Anyone can use it to send me an encrypted email
        * I use my private key to read
        * as a bonus, I sign my email with my private key
        * anyone can verify with my public key

<comment><USER27> There are several reasons:

1\. Key distribution is a difficult problem. Where do you go to look up what the public keys are? The only obvious answer is the email provider, which brings us to...

2\. Your email is already in practice secure from everyone except you, anyone with access to your email address, and your email provider. Your IMAP, SMTP, and POP connections are all secured with TLS anyways, and the MX connections between your email provider and your recipients' email providers are likely to be secured with TLS as well if at least one of them is Big Email Provider. (Even if that's not the case, this communication is occurring over the Internet backbone which is generally only tappable by the sorts of people who could probably get into your personal email account via other means anyways-- the extra value is probably illusory).

3\. Secure email doesn't actually secure any headers. Given that From/To/Date is going to be implicated by SMTP logs anyways, and these are the most useful headers for intelligence analysis, there's not much that oculd have been improved.

4\. You lose the ability to do full-text search (or even header search, if you designed it to hide the headers as well).

5\. Anti-spam measures become basically impossible with encrypted email; you'd have to push everything client-side, which is going to get annoying when you're trying spam detection on your smartphone for 10x the messages and you have to spend extra time decrypting each one.

6\. Deploying any automated public-key infrastructure requires somehow automating the verification process. The verification process that can be automated is "this came from a person who has access to this email account," but the verification process that people want is "this came from the person whose name is associated with this email account," which we don't know how to automate.

<comment><USER6> _Deploying any automated public-key infrastructure requires somehow automating the verification process. The verification process that can be automated is "this came from a person who has access to this email account,"_

What if all gmail and Microsoft email accounts came with a 4096 bit public key, with an option for the state DMV to verify the public key's association with a driver's license? I'm sure this would come with downsides, but would they be much worse than state DMVs using your gmail account to reset their web app passwords?</comment></comment></comment>