al_james

More than one server across multiple datacenters is the only way. The use either a load balancer (which brings its own problems) or some kind of status aware DNS scheme to route traffic to live servers.

I wish linode would offer some kind of high availability load balancing like amazon ec2 does, that really is a killer feature.

Arh... But apple sells the phone AND the ads (iAd) AND makes a profit from iTunes!

I am probably wrong here, but I was under the impression that a HTTP based protocol like PSHB would probably struggle to manage traffic at the 1000's of messages per second level. Correct?

They will probably be rolling out a pure TCP (XMPP maybe) interface that should be more efficient.

Exactly. Google's approach is to lose money on creating the OS and promoting it (give it free to handset manufacturers) but hope to make money off the users that use it. I am sure they can make money from this, however, I am also sure Apple will make more money per user by selling an actual phone to them AND making money from the user.

I am going to cope with this using an apache rewrite. E.g.

/resources/screen_ver<any code>.css -> /resources/screen.css

Should be simple to remove any _ver<any> string from the url via apache.

Great! The article seems to suggest that this only works from amazon origins (e.g. EC2 or load balanced EC2 instances), not arbitrary servers. Can anyone confirm or deny?

Arh, but then she will forget how to left click and we will be back to square one.

All the advertising networks we deal with only offer HTTPS. Hardly any advertising networks support HTTPS.

Sorry for misquoting you.

However, with proper CSRF protection your man in the middle argument is not the case is it?

Well, I would say its not 'just as dangerous' as a man in the middle attack is harder to set up.

Good point though. Maybe this could be solved by including a unique access code with the form that is a hashed value of the user'id and the url that you are submitting to (with salting to make this unguessable). Simply check this value upon submission to make sure it matches the URL seen by the controller. That would prevent anyone rewriting a form to submit to a new endpoint.

We cant serve ads over HTTPS and we make most of our money from ads. So that would be very expensive!

But then we can't server ads to signed in users which would be a large revenue cut for us.

Yes, I was homeschooled and went on to get a PhD, so this simple poll does not seem to be able to represent that!

Hmmm... I see what you are saying, but (for example) godaddy offer basic SSL certs for $10. Not a huge price for anyone.

There has got to be a sensible way around this. It seems overkill to require every pageview to be over HTTPS, even for otherwise public sites. For example, should these public discussion pages be over HTTPS on hacker news?

On my site I am planning the following: operate the login page over HTTPS and issue two cookies. One is HTTPS only and other other is for all pages. The public (non HTTPS) cookie is only used for identification (e.g. welcome messages and personalisation). However, all requests that change the database in any way are handled over HTTPS and we check to make sure the user has the secret HTTPS cookie as well. Often forms submit to a HTTPS backend and then redirects back to the public page over HTTP. Also, all account information pages (sensitive pages) will be over HTTPS.

This way, the worst that can happen via cookie sniffing is that someone can see pages as though they were someone else. In your case, this is not much of a risk.

Most of the attack vectors for software updates depend on man in the middle (via DNS spoofing), so this would not help right?

I am the complete opposite. Having more than 4 tabs open feels like working at an untidy desk. I can't cope with it!

Can anyone outline how a software package would protect against this?

Yes true. Apologies to any true UX experts (who are not UX zealots) I may have offended.

Your assertion that all upsells have a 'nominal chance of benefiting the user' is wrong. Some users love upsells if they are the right deal.

It depends what makes you happy. I get happy when I get a great deal more than when its a nice shiny UI.

Of course, both a great deal and a great UI is best, but if I had to choose one, I know which it would be.

Quote of the day: "This is where you stop looking at your startup as a self-masturbatory piece of UX genius and start looking at it as a business"

There was an article on HN the other day about expedia increasing revenue by removing a confusing form field on their booking process. I think the lesson is that users find different things confusing / annoying than UX experts (or web designers). UX experts ramble on about 'clutter' and simplification, however, in my experience, everyday people have a high tolerance to clutter as long as its the right clutter and that clutter is easy to understand (or is a really great deal). At the end of the day, put your faith in data driven split testing, not UX zealots.

Yeah, its because many of the ad networks that you may load into it simply cannot work asynchronously (document.write). So they have to enforce synchronous loading on the ad manger code.

Not if they are contextual and demand the host script to be in the top level document. (and this is against the terms of use of many advertising services)

Not always possible with all banner networks I am afraid!

Ad networks are a particular culprit. For many (banner) ad networks, HTTP requests get bounced around so many servers that it can really slow things down.

Now, if only they fix all the other issues on their site. I tried twice at the weekend to make a booking and the whole convoluted process simply did not work (saying there is errors on the form even if there was not etc...).

Yeah, I use that. However, once you block someone they are gone until you unblock them. All I want to do if be able to see a newsfeed from my 'top' friends and another from the 'rest'.

To me, starring captures enough of the functionality without being a pain to manage. But I see your point.

Very ranty article, but has a point.

I taught in a Computer Science department for 4 years whilst studying for a PhD. I can honestly say that each year, the quality of the students coming in reduced (lower qualifications, less students with any Maths background for example) and in order to maintain pass rates, the university responded by taking hard subjects out of the syllabus.

The UK higher education system is a mess. Its designed to only work financially with a ridiculous amount of students flowing through it. You can't maintain that volume and also maintain the quality out the other end.

My PhD was the same. I honestly believe that the minimum quality of what I had to produce what much lower than it would have been a decade ago. PhDs are the new masters and masters are the new degrees.

Knowing people that teach in the most prestigious universities in the UK, I also know that this issue affects all universities in the UK.