Hacker News Reader

jeff18on Patrick McKenzie (patio11) interviewed for an hour on SEO & AdWords

I noticed you support Google Checkout. Have you thought about adding Amazon FPS? From my experience, about 20% of people choose Amazon versus 10% for Google. It seems like a really small change to capture a few more percent on conversion.

jeff18on Faster Firefox landing page increases download conversion by 15%

No, you really just want to use inline CSS. Is it really worth all of the trouble just to cache 3 kilobytes of data (probably 20 milliseconds of download time)?

jeff18on Faster Firefox landing page increases download conversion by 15%

This is good advice, but not optimal. Using multiple domains in this case will actually slow down the site because of the additional DNS lookups -- only do that if you are serving up a ton of images.

a) The CSS file should be inline.

b) The images should be done away with entirely by including them as a data uri.

c) For IE6-7 (data uris not supported) the fallback image should be sprited.

d) For bonus points (if you want HN to be served nearly instantly, globally) splurge for an application caching CDN provider like Akamai.

jeff18on Faster Firefox landing page increases download conversion by 15%

The short answer is no. Even an extremely intense, CSS heavy page might have say 16 kilobytes of CSS. After gzipping, that should turn into about 3 kilobytes. 3 kilobytes, inline with the rest of your content, is utterly negligible and caching that would probably classify as a micro-optimization, even though every instinct is telling you to put it in a nice, cacheable stylesheet.

It feels dirty not to cache it, but if you look at a download waterfall and see how much time it takes to send that separate http request (while blocking the display of the page) it is well worth it.

jeff18on Black Hat Recruiter Tactics

Nothing's worse than getting to an interview and finding out that you know COBOL from the hiring manager reading it off your resume.

The rest of the tips seem to be really sleazy, but are pretty surreptitious. However, wouldn't this be extremely obvious to both parties and be so blatantly unethical to end the recruiter's career?

jeff18on iPad jailbreak after less than 24 hours

Could you source that fact? That seems totally unbelievable to me.

Maybe people are buying pre-jailbroken phones for carrier reasons?

jeff18on PayPal Never Could Have Been Built Lean

If you are going to spend tens of millions of dollars on a referral bonus promotion, it better not be speculative!

jeff18on PayPal Never Could Have Been Built Lean

Assuming you will get a measurable ROI for each referral, you probably could just go to the bank and negotiate a traditional loan to pay for it.

jeff18on Who's using Google App Engine?

We rarely go over the free limit -- I think we've stayed under $10-20 for the entire year, while serving up several million pages. Most of this is due to bandwidth overages from our comic: http://www.wolfire.com/comic

The times we are charged tend to be for burst traffic when something gets picked up on Digg or Reddit. Recently, one of our blog posts was featured on Digg, Reddit, Slashdot, etc. at the same time and Google dutifully served up a couple hundred thousand visits over the course of a few days. They charged us about a nickel! Granted everything is nicely cached so we were not doing much heavy processing.

It definitely depends on your web app. If you can cache it, App Engine is essentially free. If you are doing something CPU intensive for every visitor, it's going to be expensive.

jeff18on Who's using Google App Engine?

That is no longer a limitation as of the 1.3.2 release. I quote:

URLFetch API - We’ve expanded the number of ports you can access with the URLFetch API. You can now access ports 80-90, 440-450, and 1024-65535.

jeff18on Who's using Google App Engine?

I've been using it for about a year for http://www.wolfire.com and several hobby projects and am a big fan. If you have any specific questions, I am familiar with most aspects of it. It certainly has a lot of limitations, but if your app happens to coincide with what App Engine currently offers, it is a pretty sweet deal.

jeff18on CloudApp is live

Everything shared on this service (by default, any screenshot a user takes) is mapped to a three character URL. In other words, it would be easy to download everything ever shared using this app. People will not realize this and soon there will be complete archives of every screenshot any CloudApp user has ever taken available on BitTorrent.

Some screenshots that were auto-shared will have sensitive info in them and there will be a massive privacy backlash.

jeff18on Quake 2 ported to HTML5

I will personally vouch that this is not a hoax. If this is an April Fool's joke, may pg erase all of my karma.

I am playing it at 30 FPS on my MacBook Pro right now. ;)

jeff18on What the iPad Really Means to Developers

In reply to the "return of the thick client", I disagree with the notion that desktop apps are going to beat web apps. The reason why the original web API failed is because the hardware was too poor and WebKit was too immature. This is rapidly changing though.

jeff18on Cheap or free web-based tools for your web startup

Check out the AppScale project: http://code.google.com/p/appscale/

You can run your App Engine apps pretty much anywhere.

jeff18on Cheap or free web-based tools for your web startup

Couldn't you just set up a cron job to ping your app every 15 minutes until you start getting some real traffic?

jeff18on Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

Hmm, with that logic, all private Facebook albums, EtherPad documents, MySpace images, and [insert obviously private thing here] are also public.

jeff18on Introducing "Aristo", A jQuery UI Theme/Experiment

Not with the style -webkit-user-select:none; or equivalent.

jeff18on Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

Adding a single character to the length (from five to six) would probably have been enough to keep them off the radar by making it dramatically harder to bruteforce. I would not be surprised if this single extra character would have completely diverted the attack, since the miss rate would be so high, it would trigger S3's DoS protection.

Doubling the characters to 10 would pretty much completely solve the problem. It would take many, many years to find a single image. Far below the threshold where Amazon S3 would ban you.

jeff18on Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

A random hash is actually fine -- the problem is that they are using only 5 characters. Had the programmers decided to go with a single additional character, this vulnerability would be much, much less severe. If they chose seven characters, it would be difficult to even grab a single random image. Ten characters, and it would take half a century per image.

jeff18on XSS Flaw on Paypal.com

I use PayPal, Amazon, and Google Checkout. PayPal and Amazon are almost interchangeable.

Google Checkout, on the other hand, is relatively weak (doesn't support bank accounts, is slower, more false positives, weaker API, etc.).

jeff18on HTML5 Forms Are Coming

Minor internet correction, the placeholder attribute has actually been in Safari since 2003. Also, Safari has supported range inputs for quite some time to.

jeff18on The Onion cut 66% of their bandwidth by upstream caching 404s

Pardon? I did not mean to offend you. I apologize.

jeff18on The Onion cut 66% of their bandwidth by upstream caching 404s

As are the 404 pages, according to the comment.

jeff18on The Onion cut 66% of their bandwidth by upstream caching 404s

This seems more like a DailyWTF than a sweet optimization to be reminiscing about. I'd love to hear more details about this. I mean a single video is about the equivalent of tens of thousands of 404 pages.

I'm not sure which is more mindboggling... Spending 66% of their bandwidth and 50% of their CPU on serving these trivially cacheable pages or the fact that they didn't correct the problem when they were serving more than 5%.

jeff18on Coby $85 Smartbook Feels Like a Hundred Bucks

Just like you can't demo an iPhone app without having an internet connection to download it first! However, the iPhone, Windows CE, and Chrome OS ship with a number of apps preinstalled. :)

jeff18on Coby $85 Smartbook Feels Like a Hundred Bucks

Right, and neither does Windows CE. :) Chrome OS certainly does ship with apps preinstalled, just like Windows.

jeff18on Google App Engine Team's Post-mortem for February 24 Outage

A lot of companies have nice official apologies but this one really stands out. Google is not just saying sorry, they are actually implementing serious changes which probably represents millions of dollars of development to help make sure this doesn't happen again.

jeff18on Coby $85 Smartbook Feels Like a Hundred Bucks

That's a common myth. HTML5 supports many features that let you run "web apps" offline. There is no technical reason why you would need an internet connection for Chrome OS but not for Windows CE.

jeff18on Why Flash Doesn’t Suck

Both of those websites, like the Blizzard sites could be completely done in HTML5. Is there a specific element that you believe could not?

I already explained why I cannot give you an example of a AAA HTML5 website (Internet Explorer doesn't support it).

If you'd like to discuss the technical aspects of HTML5, feel free to email me at jeff@wolfire.com - I am going to stop checking this thread.