bls

I think when you say "firefox os" you really mean "browser-based UI for Linux," right? You are already supposing that Linux (an actual operating system) exists underneath.

Isn't Internet Explorer + Windows Explorer + Web Folders pretty much doing this already? Windows' Web Folders feature lets you store documents remotely and access them over HTTP from regular (non-web-enabled) applications. Internet Explorer lets you browse the local filesystem and the web from the same browser window pretty seamlessly.

It seems that Firefox is indeed becoming an application deployment platform. However, it doesn't seem like a good idea to me. Instead of having one package manager in the operating system, there will be two: one system package manage and one Firefox package manager. There are all kinds of security and manageability problems with that. Already, there are many buggy Firefox plugins that cripple the browser, effectively causing a DOS attack with crashes and decreased performance. This is a good indication that we should not have confidence in Firefox's abilities to manage third party applications. Really Firefox should be in that business at all, since resource allocation and crash prevention are fundamentally operating system features.

The right solution is to improve the installation experience provided by the operating system, and have it provide security-oriented integration capabilities for applications (as opposed to to the performance-oriented integration capabilities we have now). This would require the operating system to provide a sandboxed environment by default to downloaded applications. The OS needs to provide a middle ground between the almost unrestricted access given to today's downloaded applications, and the totally restricted access given to web apps; that access needs to be very close to the web app side.

With this kind of severely-limited sandbox, we can then eliminate the whole UI of application installation. Instead of installation, we would just have caching. Instead of a list of programs in "Add/Remove Programs," we would just have a "Free up XXX MB of disk space" page.

Just like everything on scribd, this would be much better as an HTML document.

On the right hand side of the screen, you can sort the comments chronologically.

I've never seen a single blog post wander in so many directions. Fogbugz. The nuclear arms race. Korea. The virtues of the Korean writing system. Japanese WWII atrocities. Fogbugz. Ruby. Tourism in Asia. Open source.

The irony could be mistaken for satire if it wasn't so unfunny. He rants about Joel making up numbers, and then does the exact same thing. His general call for others to cite references to back up their claims are preceded and followed immediately by his own bold, unsubstantiated claims.

STOP sending emails right away, until you've corrected the problem. Every email that you send now that gets flagged as SPAM is being counted against your IP addresses and domain name. You are making the problem worse in your testing.

Sign up for a Tuffmail account, as well as accounts from similar services. Make sure that the SPAM filtering is set to the MAX for each account. Make sure that the SPAM filtering message headers are turned on. Then, do all your testing my sending to these accounts. Observe the headers set by SpamAssassin and other spam filters. They will tell you exactly what is going wrong.

Send the absolute bare minimum of email that will get the job done.

In particular, don't use email to send invites. I, and other people I know, file invites and similar requests as SPAM specifically to cause problems for sites like yours. I promise you that if I get any email from your website, it will be forwarded to SpamCop and other places, whether or not my friends requested you to send it to me.

Check your IP addresses of your servers to make sure they are not on any blacklists. Similarly, check the blacklists to make sure your domain name itself isn't on them.

Make sure that your mail server has a domain name, a static IP address, and make sure that the reverse DNS resolves back to its domain name. This is needed to get past ESMTP ELHO filters.

Make sure that you have a valid and restrictive SenderID/SPF record in your domain's DNS.

Make sure that the syntax of all your SMTP commands is compliant with the SMTP specification. Make sure the syntax of your messages are compliant with RFC2822, MIME, and related standards.

Ensure that you are using the following in the SMTP handshake (square brackets used instead of Less-Than and Greater-Than to get through the filters on this site):

EHLO onista.com

MAIL FROM:[XXXX@onista.com]

Make sure that the From: header is an address from your domain: From: XXXX [XXXX@onista.com]

If you refuse to do that (because you want to forge your user's email address in the From: header):

From: Joe Blow

Sender: XXXX [XXXX@onista.com]

Avoid HTML MIME messages. If you refuse to avoid HTML messages, avoid messages with images. If you refuse to avoid messages with images, then embed the images in the MIME message instead of hotlinking them to your site.

Implement the recently-finalized DKIM standard.

Ensure that your WHOIS information for your domain is accurate, up to date, and has contact email addresses with your domain name in them.

Pay money to GoodMail and related services. You WILL have to do this eventually, because you WILL be sending a lot of email that people simply don't want to receive.

How are you going to deal with piracy? I have been in Thailand for about half a year. While I was here I had a lot of software ideas to help Thai kids learn English. But, the licensing of high-quality language materials to embed into the software is expensive, so I cannot give it away for free. Yet, most of the Thai people I know think the idea of paying for software is laughable (literally).

Also, from what I know, most people in Asia only have access to computers in internet cafes. Isn't that problematic for you?

What are you using on your workstation? If you are using Ubuntu on your desktop, I would deploy Ubuntu on the server also. This allows you to combine your desktop and testing machines into one. Then, you only need a dedicated staging (virtual) machine and the production machine.

Otherwise, I also recommend CentOS, especially if your hosting provider lets you run it with SELinux enabled.

This site is designed for a touch screen system that lacks a keyboard. That is why it is pre-populated with a default set of items. On a device with a full keyboard, it would be faster to just type your list in.

I think it is pretty smart. I think I will try something similar in my mobile applications.

I can't get this to work. I tried to delete this comment: http://news.ycombinator.com/item?id=17545 because it includes my email address. But, I don't see any link for deleting it.

You can already create links in web pages that will dial a phone number when activated with mobile phone browsers. Similarly, I assume that the email integration is going to be basically "mailto:" links. Maybe they will have support for HTML 5 features like like INPUT TYPE="email" as well.

a href="wtai://wp/mc;16504808000" a href="tel:+358-555-1234567"

Be careful when implementing some of the suggestions from this presentation, especially if you are trying to be accessible to mobile phone browsers and/or people who use screen readers.

For example, some screen readers are really noisy when it comes to list items--when you wrap a label/input in a list item the screen reader will say a bunch of garbage that distracts the user.

If you use a bunch of floating and/or CSS positioning then be prepared to have your form look horrible to the point of being unusable on mobile browsers--by default, many mobile browsers will ignore your CSS and present the user with a bunch of unaligned, way-too-narrow fields.

Similarly, the BUTTON element is not part of the deployed versions of XHTML Mobile Profile, so you generally shouldn't use it if you can get away with INPUT TYPE='submit'.

Finally, you should be careful with your Javascript validation--some mobile browsers will let you disable submit buttons, but they don't support the Javascript events that you are depending to re-enable them. As a result, it is usually a good idea to leave the Submit button enabled all the time.

But, they aren't in any mobile phones that I have seen. I am going to end up buying a Verisign cert just for that reason.

Comodo and other SSL providers will give you free certs that don't cause any warnings. But, they only last 3 months instead of 1 year.

This article is very interesting. However, the headline strongly indicates that it was submitted here to smear Sun.

Firstly, the headline is at odds with the conclusion in the article; the article states that they would have preferred Sun's updated (fixed) product if it had been released at the time.

The headline takes one specific company's experience with one specific product and generalizes it to cover the vendor's entire storage product line.

The comment poster, Onethumb, has never commented or submitted to this site before.

I have no affiliation with Sun.

Obviously, free is better than $19.95. But, I think $19.95 per day is a pretty good price too. I would rather pay browsercam.com $20 for instant results than wait around for hours (the current wait time on the browsershots.org cue is over three hours as I type this).

You switched from Google to Yahoo for privacy reasons? Yahoo! has already demonstrated their total lack of ethics regarding privacy by helping the Chinese jail thought criminals. Whereas, Google has designed all its systems and its business models to ensure that it does not need to cooperate with horrible regimes.

Also, Yahoo! happily shared its users' information with the U.S. government upon request (when not even legally obligated to do so), whereas Google went to court to fight for its users' privacy.

The 99% effective statistic came from the author of codinghorror.com. His CAPTCHA for every comment is a single static image of the word "ORANGE" in a slightly stylized but plainly readable font. I've seen other bloggers claim that simple addition puzzles are almost 100% effective as well (at least, they were when they were introduced).

I think that spammers simply don't want to create a special case handling of every site they come across.

I think in less than 5 years, a botnet will be able to participate in discussions in a way that is nearly indistinguishable from humans. If a robot posts better-than-average commentary, do you care if it is a real human or not?

(a) The user's email address should be used as the username.

PRO: The user doesn't have to remember yet another username for yet another site. PRO: Email addresses are more or less unique. PRO: Entering the email address does not require any new thinking on the part of the user.

CON: A lot of pain when the user changes his/her email address. CON: If the user can share his username publicly on the site, he will get inundated with SPAM and other unwanted email. CON: "Email address:/Password:" prompts mislead users into entering the password for their own CON: It is easy to guess a person's account, and determine if they are a user or not, and even impersonate them if they use the same username/password for the site that they use for their email.

(b) The user should be forbidden from using an email address as a username.

PRO: Email address is kept private. PRO: The user can change email accounts without disturbing his identity on the site. PRO: Users who want to use their email address for convenience may be missing some of the subtle security problems caused by doing so--you are kind of protecting them against their own ignorance.

CON: Nice, easy-to-remember names get taken fast; the user is likely to forget what username he used. CON: Users' anonymity often causes as many problems are it solves; this is why Amazon.com has the "Real Name" feature.

"2 + 3" and codinghorror.com's "ORANGE" CAPTCHA are 99% effective.

There are many (mostly unpopular) sites without effective protective measures against SPAM. For attacking these sites, botnets are effective.

Almost all popular sites have some effective protective measures. For these sites, coding and deploying a constantly evolving botnet to keep up with this arms race is just not effective. It is more cost effective to hire third-world (or even first-world) labor to attack them.

There was an article on news.ycombinator.com a few days ago about how posting a comment on TechCrunch is more effective advertising than AdBrite. Go look at the comments on TechCrunch and pay attention to how many of the frequent commenters link back to their sites. (The kewter.com guy sticks in my mind the most, as that domain name is hard to forget).

With that in mind, imagine paying a few US college students $6.00 an hour to read+comment on weblogs, forums, and social networking sites for hours at a time. Tell them that they are to carry on educated, intelligent, and intriguing discussion. For each post, they need to include a link back to (their profile on) your website. You could even hack together a few tools to make it really easy for them to participate in dozens or hundreds of discussions per day--for example, build an email-confirmation sidebar widget for Firefox and some collaboration software that allows human-net to collude.

How do you stop this kind of attack?

news.ycombinator.com already does this, passively.

Email confirmation isn't a CAPTCHA: If you can write a robot to sign up for reddit.com, then surely you can write a robot to send a "HTTP GET" request for every link in your email account.

There are three obvious purposes for email confirmation:

- Users often forget their usernames/passwords. Usually the only way to remind them is by sending them email. If they used an invalid email address (purposely or accidently), you will end up with support emails saying "I forgot my username and password but I don't have any evidence that it is actually my account!" Email confirmation ensures that you can communicate with the user on a side channel.

- When raising money / selling advertising, how many users' email addresses you know is a big deal. People use this metric to judge how "engaged" the user in the site.

- It makes it difficult to have multiple accounts. Again, advertisers/investors look at the number of unique users when deciding to fork over money.

If the user will be storing any important information/money solely using your service, you should go through the confirmation process ASAP so that they don't get locked out of their data/money. If your site is a "waste your time and hopefully click on my ads" service, then:

(1) Have a page where the user enters his proposed username/password, with no email field. This makes it look really simple to sign up.

(2) When the user submits #1, bring up a page with the email address field. This page should already show the user as being logged in & show/hint that the user has already unlocked whatever functionality requires an account. The big print on the page explains why you are asking for it and your amazing privacy policy. The fine print tells the user that it is optional but highly recommended, and remind about your amazing privacy policy.

(3) If/When the user submits their email address, send the user an email. But, unlock the account functionality without requiring confirmation.

(4) In the email, provide a brief explanation of confirmation and provide the confirmation link. Automatic password reminders can only be done after this initial confirmation link has been requested.

Why invent a new language instead of using Javascript?

The goals of JavaFX are the same as the goals of Java ME and Java SE. Java ME and Java SE have basically failed to live up to their expectations. Why not fix Java ME and Java SE instead of inventing something new? And, why should we expect that JavaFX will succeed where Java ME and SE have failed?

How do you expect to differentiate yourself from pickydomains.com?

What makes you think that the price is $4,500? In almost all cases, these prices are very negotiable. Keep in mind that the owner probably paid less than $10 for it. Even considering overhead, $200 is a very good return on the sellers investment.

Here's how I would go about negotiating the price:

 Subject: Interested in buying a domain name
 Date:    2007-04-28
 To:      squatter1; squatter2; squatter3; ... ; squatter50

 I am thinking about purchasing one of the following 
 domains. According to the WHOIS information, you are the
 owner of one or more of them. If you are interested in 
 selling, please reply back with domain name and the price 
 you want for it. In order to give everybody enough time to 
 respond, I will wait a few days collect the responses I get
 before I make a decision. I promise I will not disclose 
 your offer to anybody.

 Thank you!

 domain1.com - squatter1
 domain2.com - squatter2
 ...
 domain50.com - squatter50


 Subject: RE: Interested in buying a domain name
 Date:    2007-05-10
 To:      squatter

 Thanks for your reply. I cannot afford the price you gave
 me. If you still are interested in selling, please reply  
 back with a smaller price. Thanks again!

 Subject: RE: Interested in buying a domain name
 Date:    2007-05-25
 From:    me
 To:      squatter

 Thanks for your numerous replies. I guess my expectations
 are unrealistic because I didn't want to pay more than $100
 for this project. I am not interested in the other 
 variations (.net, .org, etc.) you offered me. Please let me
 know if you will accept $100 for just .com.


 Subject: RE: Interested in buying a domain name
 Date:    2007-05-30
 From:    me
 To:      squatter

 Sorry, $ is too much for me. I will pay $200 if you throw
 in the other variations too. I want to finish this up soon
 so please reply back with the payment/escrow information.

I use a Lenovo T60 running Windows XP, with Ubuntu 6.10 running in a VMWare virtual machine. VMWare Workstation is really cheap and VMWare Player is free. You can find many preconfigured Linux virtual machines on VMWare's website.

Power management and battery life in particular suck on Linux. Even if you can get it to actually work (lots of Googling + configuring) you will get at best 2/3 of the Windows battery life. Plus, I don't have a lot of faith in the quality of the suspend-to-disk functionality in any flavor of Linux.

(1) Less UI clutter, (2) instant response time, (3) automatic Bluetooth sync with my phone, (4) offline ability (I live in Thailand and my internet connection is not 100% reliable), (5) an easy way to get stuff from my email to my TODO list, and (6) instantly-responding UI.

I like a lot of things about Nozbe.com but it is too slow and I cannot do anything with it using my phone. Also, the fact that you will have to pay according to how many "projects" you have is crazy.

mashable.com is censored here in Thailand. Do have an alternative source?

That is exactly what the operating system's virtual memory system does. But, there comes a point where there is too much swapping.

I also want to point out that it is easy to waste a lot of time looking for the absolute best productivity solution. The reason I picked GTD is because it seemed reasonable and other people claimed success with it; I didn't want to waste a ton of time evaluating methodologies. Similarly, there are a lot of productivity tools (especially software); I spent WAY too much time evaluating them, but only because each of them suck in their own special way. I think now I'm simply going to use Outlook 2003; I can't access it from the internet but I can sync with my phone which in many ways is even better.

I just started using GTD-like techniques. The basics of it are this: (1) write everything down as you think of it, so you don't forget anything. (2) very often, go through the list of random items; do the small (two minute) tasks immediately, and organize the rest of them into into (groups of) "next actions." (3) spend all the rest of your time eliminating items from the "next actions" list.

I think it is effective. There were many times when I let a lot of email pile up in my inbox. Now, I very deliberately go through my email and respond to everything ASAP; everything that I can't do immediately gets filed away in a TODO list so I don't forget it. My inbox is thus ALWAYS empty. I don't know why but that makes me happy. It also makes other people happy because they are getting their responses faster. And, I get more done because having a list of "the next thing I need to do" makes me want to do things to get them off the list.

The other thing I found to be helpful is to schedule all my distractions. Now, I have a reminder that tells me "hey, check your email" and even "hey, check your feed reader." This seems silly, but it is really helpful; I know that I will get the "check your feed reader" reminder soon, so I just keep working until it comes. Sometimes, I get annoyed and refuse (!) to check my email because I'm busy; in fact, I had started with scheduling them hourly but I am slowly reducing it down to three times per day. As a result, I check my email and weblogs WAY less frequently than I did before (even with an hourly reminder), because before I would check my email basically in between each item on my TODO list or even in the middle of something.