AngelList Connects Start-Ups With Investors - <AUTHOR> http://www.nytimes.com/2011/03/07/technology/start-ups/07angel.html?_r=1&src=tptw <comment><USER2> I understand the premise behind Angel list, but with all of the literature, talks and emphasis on the team and the personality behind a venture, and knowing that the actual direction of a company can and does change quite often, doesn't Angel List mask those nuances in the investor-startup relationship? Understandably, the marketability of the venture is the ultimate way of making a return, but I guess I assumed that angel investors were also interested in an advisory role to assist an early stage startup that may not have worked out all of the kinks yet...But I guess if a coffee meeting is the "end" of Angel List, it is the beginning of that aforementioned relationship.</comment>


Letting things go - <AUTHOR> http://www.37signals.com/svn/posts/1611-letting-things-go <comment><USER2> Maybe the scope was too vague or the goal was too monolithic if he was implementing patches he didn't need. It is easier to declare tight little tools as "done." Plugability/modularity helps this as well, because it lets those things that need to vary and evolve over time do so without threatening the health of the core.

<comment><USER3> There was definitely an element of that, too. Most of the patches were reasonable changes: bug fixes, or minor feature additions that improved the usability for some large segment of the user base. There were a few that snuck in that I later regretted, but I got better at saying "no" as time went on.

However, ultimately, if every project said "no" to every feature the developer did not personally need, there really wouldn't be very many widely-adopted projects. They key is balancing patches that you don't personally need against your vision for the product: and I _did_ have a vision for Capistrano. It just wasn't really clearly defined, especially early on, which is why I regret some of those patches.

It was definitely a learning experience all around.

<comment><USER2> Thanks for the reply. I can see how the definition would increase in clarity it grows and you eat the dog-food. I'd also like to thank you for being frank with your decision to step aside as the maintainer -- far too many projects languish as the developer doesn't make a public declaration like you did.

</comment></comment></comment><comment><USER4> I'm surprised Buck held out so long. I don't know if many people looked at the Capistrano ML, but it was just this giant hellish suckhole of entitled Windows users angrily demanding someone help them with their homework. Buck doesn't spell it out, and probably wouldn't even admit it, but I got the pretty strong idea having to support windows was the main cause of misery.

However, I have some criticism over the way it's been handled, and I'd like to point out before saying it that it's not a personal attack, just some observations. I don't use Cap but I do use net/ssh and I'm very grateful for Buck's contributions. However ...

It's his right to walk away, and as he points out, he owes the community nothing. But it's still a bit weird and passive-aggresive, the way he's done it. Healthy human interaction in a situation like this would be polite but insistent assertiveness; defining your limits and consistently sticking to them, not holding it in, getting silently angrier and more pissed off, then quitting in a blaze of defensiveness.

There are techniques for dealing with users/contributors, distributing the load so no one person is overwhelmed. Capistrano's documentation, for example, was/is awful. The website has almost nothing useful. The way to learn how to use it is to perform any number of searches for people talking about how they did it on their blogs, and then doing it yourself by trial and error. Or the entitled newbie way, which is to pile on the mailing list, where their questions were foolishly answered, attracting ever more entitled newbies looking to have their problems solved for them, causing stress. Decent documentation would have solved a lot of that.

And overloaded with feature requests/patches? There are websites for handling feature requests, and the developer should have insisted on nothing but properly tested patches fixing a known bug. Wouldn't that have gotten the situation more under control? Or hell, why not roll cap into Rails proper and spread the load that way?

It's all just a bit suboptimal, is all. Oh well. Good luck to the dev. Hopefully other projects can also learn from the experience.

<comment><USER3> You're right, of course, about the documentation being awful. I was actually working on fixing that at the end, but every time I'd spend a few evenings writing docs (which was a few more evenings where I didn't get to do what I wanted to do), people would ask questions on the list not covered by what I'd just documented...and I'd get discouraged all over again. Docs help, for sure, and I painted myself into a corner where there was too much to document in the amount of time I could afford to spend on it. My fault.

I actually used a website for handling feature requests and patches (lighthouseapp.com), and it worked great. But even the best tested patch for a known bug still needs review. It needs to be applied and tested locally. It needs an update to the ChangeLog. And eventually it needs to be bundled and released, each new release requiring (at minimum) some release notes and a blog post announcing it.

It was a bunch of little things that got more and more annoying. I would have loved to distribute the load across more devs, but aside from a few who would review patches on specific topics (Scott Chacon, for instance, helped with git issues), it was all me, all the time.

<comment><USER4> _"It was a bunch of little things that got more and more annoying."_

What you need to do is write a script to automate those small but repetitive tasks! I heard about this great bit of software to do that for you called Capi.. oh.

I was going to add, I think a factor contributing to the lack of ongoing support you received is simply capistrano's place in the stack. Unlike Rails or other libraries, it very much has a "deal with it once then forget about it" usage pattern, which would seem to discourage ongoing participation. Or if there was some kind of missing feature "blocking" the envisaged deploy scenario, that would create a pressing need to "get this in NOW!" - and then forget about it.

The simple position of Capistrano as the deploy mechanism - a critical "bottleneck" through which one must pass but then safely forgotten - could be the reason for the "all me, all the time" dynamic.

Anyway, glad to see you don't seem bitter. Good luck and looking forward to future projects.</comment></comment></comment>


PEPSI had a navy - <AUTHOR> https://medium.com/lessons-from-history/when-pepsi-had-6th-largest-navy-in-the-world-4612708b70d2 <comment><USER2> Already posted a few months ago, previous discussion: [https://news.ycombinator.com/item?id=20280587](https://news.ycombinator.com/item?id=20280587)</comment>


Ask HN: Which are the best places to showcase an app for teens or women? - <AUTHOR>

If I want to show an app for early adopters in the tech world I go to places like HN, Reddit, etc.<p>But what if I want to target teens or women, which are the best  online places to showcase an app? For example, I thought in some subreddits. <comment><USER2> Not an expert here, but you might try reposting this question at [http://reddit.com/r/askwomen](http://reddit.com/r/askwomen).

And by "teens or women", do you mean "teen girls or women"? Or teens of both genders and women?

<comment><AUTHOR> Hi, thanks for your suggestion. I mean teens of both genders and women.

</comment></comment><comment><USER3> Reach out the the editors of teenvogue they always showcase apps. You can find their info on the Condenast directory.

Teen magazines are very influential, don't be afraid to reach them. Research all the companies that have magazines or media that reach women and teens and contact them. If only one or two reply and talk about your app you can have lots of attention and hopefully downloads.

Cheers

<comment><AUTHOR> Thanks, I'm going to make that research</comment></comment>


Show HN: Custom-Build Factorio Server Hosting Serivce - <AUTHOR> https://factorioserverhosting.com <comment><USER2> If you haven't tried out Factorio [0] I _highly_ recommend it. It's a great game and the demo alone was enough to sell me on the game. Don't be put off by the "early access" stuff, I've sunk hundreds of hours into this game, it is a blast. In all of that time I've never played online/multiplayer so if you don't like that aspect you can just ignore it.

[0] [https://www.factorio.com/](https://www.factorio.com/)

<comment><AUTHOR> Absolutely true, Factorio is such a wonderful and rich game!

</comment></comment><comment><USER3> I love Factorio, but this is a rather expensive offering compared to other, more mature Factorio hosts. Quick search reveals other hosts offering 50+ slots for the same price or cheaper than this site's 1-4 slot option, with better control panel functionality.

<comment><AUTHOR> Thank you for your feedback. Have you tried out our control panel, what can be improved in your opinion? Although I could not find any host which offers 50+ players for $9.99, I would strongly doubt the validity of the offer. It is simply not possible to maintain a server for 50+ concurrent players for 10 bucks. Maybe the 50+ slots are referring to savegame slots? We at FactorioServerHosting.com offer arbitrary many savegame slots.

<comment><USER4> [https://clients.mcprohosting.com/order/factorio](https://clients.mcprohosting.com/order/factorio)

[https://www.gameserverkings.com/games/factorio-server- hostin...](https://www.gameserverkings.com/games/factorio-server-hosting/)

<comment><AUTHOR> Thank you! Our goal is to provide a smooth and customized multiplayer experience. Although we want to keep prices low, quality always trumps quantity in our price making. So lets look at their pricing and make a quick back-of-the-envelope calculation: 100 slots for $10 => $0.1 per slot per month. Based on our observations a reasonable minimum RAM usage per slot is 250MB. Thus, in this deal you pay $0.1 for 250MB RAM or $10 for 25GB RAM for a whole month. Well...this does not seem right. Why, you ask? Simple, the cheapest AWS instance with only 16GB RAM (r5.large)[0] costs $109/month. To put this again into perspective: you wont be able to serve 100 players on an AWS instance which is 11x as expensive and only has 65% of the minimum capacity. On top of that r5.large is optimized for memory not CPU, so you would end up with a way more expensive AWS instance to serve 100 players.

Then how can they offer such a deal? Again it's, simple, the quality will suffer dramatically. You will lose connections, lose game states and have low FPS. (You can find plenty honest reviews stating this).

Having said that, we aim for customers who are willing to pay a fair price for an awesome game experience. Our current price is $9.99/4 players/month which translates to $2.5/player/month. Seems fair to me...

[0] [https://aws.amazon.com/ec2/pricing/on- demand/](https://aws.amazon.com/ec2/pricing/on-demand/)

<comment><USER5> Isn't it possible they are not using AWS? There are plenty of game hosting services that own their own hardware.

Even if they are using AWS (which personally seems like a poor decision for this kind of use case), I don't think your pricing comparison is fair. On demand pricing is the most expensive way to rent AWS servers. Reserved instances, dedicated hosts, and savings plans can cut the cost you quoted by ~70%. By your calculations that's 100 players for ~$33/month.

<comment><AUTHOR> Yes, it is possible that they do not use AWS, but thats not my point. If you can offer a price which is a fraction of AWS' price (or for that matter of any other major cloud provider), why bother with gaming? Just sell your capacity 11x cheaper, whereas this is a lower bound for this factor. They should be able to sell it for even less.

Owning hardware does not make it necessarily cheaper. Most often to the contrary.

So by your approximation they still make -$23/month?

Either way, we offer a solid Factorio Server Hosting Service, where you do not have to bother with capacity limitations, resulting lags or an awful configuration panel. We solve this problems and we offer it for $2.5/player/month. If you want a smooth gaming experience when coming home from a stressful workday, we are the right choice. If you dont care for about the aspects mentioned above and you want to pay a few cents less per month, you should probably us a different game server host.

Our focus is quality of service.</comment></comment></comment></comment></comment></comment>


Show HN: TvOS Developers Slack Community - <AUTHOR> https://tvos-developers.github.io/ <comment><AUTHOR> Hey guys, as someone learning to work with both UIkit and TVML I know I need to bounce ideas off of other people working on Apple TV apps. Hoping those who join will find it a helpful community!</comment>


Briefs: A Cocoa Touch Framework for Live Wireframes - <AUTHOR> http://giveabrief.com/ <comment><USER2> At first I thought this was 3D wireframe. A thought: someone could write a "diminished reality" 3D wireframe MMO for the iPhone. Locations would be based on real cities with your location in the game determined by your real life location. The player would use the iPhone as a sort of "viewer" into this alternate universe. I'm envisioning gameplay like "Rez" except that the player is static. (Wouldn't want someone running across the street into traffic.)

The beauty of this setup: product placement. Except, it wouldn't be product placement, it would be _Customer Placement_. One could have a deal with Starbucks. Certain Starbucks locations in big cities would be a gateway to certain quests to obtain rare items. This could tie into a "virtual coupon" for a certain product Starbucks wants to promote. I picked Starbucks, but any business with lots of urban locations and WiFi would do.

Make the gameplay so that there is an advantage to cooperative play with several in the group. This is good for the sponsor -- it brings a bunch of customers in. It also enhances the social aspect of the game.

</comment><comment><USER3> Looks really cool, but where's an example / screencast?

<comment><AUTHOR> I emailed with that same question just before I posted it here.

</comment></comment><comment><AUTHOR> Anyone have any experience with this framework? I love doing my prototyping using paper first followed by VectorDesigner so this could be great.

</comment><comment><USER4> What does this do that you can't quickly do in Interface Builder?</comment>


Inside the secret world of Trader Joe's   - <AUTHOR> http://money.cnn.com/2010/08/20/news/companies/inside_trader_joes.fortune/index.htm <comment><USER2> The Trader Joes return policy is pretty amazing. For the first 5 years I shoped there I never even thought to bring something back, but then once a few years back I felt the need to give it a test -- and honestly I couldn't believe they'd even accept a label off a microwave dish and my word that it tasted awful.

The manager was cheerful about it, and told me I wasn't the first person to bring back that particular item. Then he reeled me in:

"I'll gladly get you a refund; did you have any other shopping to do today? I can have the checker credit your order."

"Oh... I suppose I do."

I returned an item that cost less than $2, and then ended up buying a week's worth of groceries at $50.

Zappos may be the only other company I can think of that has the kind of return policy that increases revenue in the long run.

<comment><USER3> Amazing timing - I returned my first ever item to Trader Joe's today, and the experience was memorable.

My wife bought blackberries this morning. Tonight, after dinner, we realized they were moldy. I went to exchange them at about 8:30 pm, just before closing. The store was out of blackberries, though. I called home to ask if there was anything else I should get.

"Olive oil" was the answer. So I walk up to the counter, ready to do an exchange, and the cashier looked at the $8 bottle of Olive Oil, the $3 carton of moldy blackberries, and said:

"Yeah those are about even. Have a good night." He then shooed me out the door without even ringing anything up on the computer.

That kind of autonomy is not what you expect from ANY retail establishment, let alone a grocery store.

<comment><USER4> I once bought a package of smoked salmon at Trader Joe's. It was gross, so I took it back, and the guy asked me to try a different brand instead. I said "OK," and it was gross again. I went back very apologetic just asking for a refund, and he asked me to try a third type. I refused entirely, until he MADE me take the third type of smoked salmon. That third type was really good and I've probably bought $200 worth of it since that day.

</comment></comment></comment><comment><USER5> FYI, the rather reclusive owner of the company, Theo Albrecht, died quite recently. It may surprise you to know he was one of the world's richest men.

TJs has the lowest number of different products in it stores of any major supermarket, plays employees significantly above the industry average ($40-60k; managers can earn 6 figures), gets a far greater $/sq foot return than competitors, and does over $8 billion a year in sales. And pretty much everyone likes them.

Herr Albrecht is a pretty good role model if you ask me.

[http://www.guardian.co.uk/business/2010/aug/05/theo- albrecht...](http://www.guardian.co.uk/business/2010/aug/05/theo-albrecht- obituary) [http://online.wsj.com/article/SB1000142405274870489500457539...](http://online.wsj.com/article/SB10001424052748704895004575395251115540766.html?mod=europe_home)

<comment><USER6> If you would like to know more about what made the Albrecht brothers' stores so successful, you should read Dieter Brandes's book. It think the English version is this one:

[http://www.amazon.com/Bare-Essentials-ALDI-Way- Retailing/dp/...](http://www.amazon.com/Bare-Essentials-ALDI-Way- Retailing/dp/0954282973/)

<comment><USER7> Yikes, used for $500! Looks like a publishing model that is seriously being missed. I know a screenwriting book that sells for a couple hundred if it can be found. A lot of work to get the copyrights for a short publishing run but sure looks like it could be lucritive.

</comment></comment></comment><comment><USER8> Trader Joe's is a boostrapper's dream: cheap, tasty and quick meals.

Their prepared foods and marinated meats are really pretty good. Their cheese and wine selections are quite good. I found a Petite Syrah I absolutely _love_ there for $3.99. We buy it by the case. Bread is consistently some of the better bread I've found outside of dedicated bakeries here in the US (our bread generally sucks). A glass of wine ($3.99 a bottle), a loaf of bread ($1.99 a baguette lasting a day or two), a bit of low fat goat's milk brie ($2.99 a round lasting several days), a bit of sliced salami ($2.99 a for 2 salami's lasting 4 meals), some dried almonds ($3.00 for a pack of 20 mini bags), and I have very tasty no-cook meals for a day or two.

If you're in Silicon Valley (or anywhere that has a Joe's), and trying to eat well on a budget visit Trader Joe's.

</comment><comment><USER9> Perhaps the most relevant point:

 _A closer look at its selection of items underscores the brilliance of Coulombe's limited-selection, high-turnover model. Take peanut butter. Trader Joe's sells 10 varieties. That might sound like a lot, but most supermarkets sell about 40 SKUs. For simplicity's sake, say both a typical supermarket and a Trader Joe's sell 40 jars a week. Trader Joe's would sell an average of four of each type, while the supermarket might sell only one. With the greater turnover on a smaller number of items, Trader Joe's can buy large quantities and secure deep discounts. And it makes the whole business -- from stocking shelves to checking out customers -- much simpler._

<comment><USER10> I see the opposite side of that here in London. All the main supermarkets - Tescos, Asda, Morrisons, etc. - have very little in the way of product choice. Living in east London, I have to go well out of my way to find a different branch of Sainsburys or Waitrose to get certain products.

For example, "McCains Simply Gorgeous Chunky Chips", a variety of oven chips in beef dripping, is vanishingly rare; there's a Sainsburys in Bethnal Green which sells them, but that's going well into the city.

Similarly, for The Berry Company juices - things like açaí, blueberry, goji berry - I have to go to Waitrose in Canary Wharf. Other Waitrose outlets are hit and miss, with patchy coverage of the line; and there's virtually no chance of finding the products elsewhere.

I was amused to find once I went to a Tescos Extra that they largely just had twice the space on the shelf for the same number of SKUs.

<comment><USER11> From what I've read, Brits don't have the insane supermarkets we do here in the states.

<comment><USER12> Tesco's one of the world's most profitable retailers (I think it's #4 globally) and ASDA is a subsidiary of Wal-Mart. London's just a special case - where do you put an out-of-town superstore in zones 1 or 2 of the Tube map?

<comment><USER10> I wouldn't mind if they were in zones 4 or 5, but it still doesn't add much choice. Tesco Extra stores aren't exactly small, but they still don't have much choice in the grocery side.

If a different store had the range, I'd go there instead. But each store targeting a slice of the demographic pie has very much the same limited range with a tiny bit of diversity outside of store brands.

</comment></comment></comment></comment></comment><comment><USER13> Wow, I've been a regular Trader Joe's shopper ever since one opened up down the street about a year ago. Frankly, I was always a bit worried that between the price and the quality there was a "too good to be true" angle that I was missing. But from this article, it seems like they rely on:

* Buying good food

* Distributing it efficiently

* Paying their employees well.

I don't really care how "quirky cool" they are or are not, that's pretty sweet.

</comment><comment><USER14> I love Trader Joe's. They have an excellent supply of fancier foods and a pretty good selection of pantry items at good prices. I feel as though I get the same level of quality from them without paying for it like I do at Whole Foods.

I love the New Zealand Cheddar they sell there. I have no idea why but it's my favorite cheese. My two year old daughter can't get enough of it either so maybe it's genetic.

<comment><USER15> My understanding is New Zealand cows are grass fed. Makes a difference, I think. (Irish cows too. Try the Kerrygold Dubliner cheese at TJs. Try the Kerrygold butter too. Now _that's_ butter!)

</comment></comment><comment><USER16> Trader Joe's and GE are two of my favorite companies mostly because of their amazing depth of vertical integration. They've got this stuff down to an art form.

<comment><USER17> GE really is an incredible "behind-the-scenes" sort of company. When you first think of GE, you probably think something along the lines of "Oh yeah, don't they make light bulbs or something?" But the more you look into them, the more you realize just how big and diversified that company is. Taking a look at [http://en.wikipedia.org/wiki/List_of_assets_owned_by_General...](http://en.wikipedia.org/wiki/List_of_assets_owned_by_General_Electric) is a good starting point, and then start clicking on the links therein and you'll probably find that GE is behind a lot of products and involved in a lot of industries that you'd never have guessed.

<comment><USER18> I was surprised to learn that GE owns NBC, Telemundo, and Universal Pictures.

<comment><USER19> Clearly you haven't watched/heard of 30 Rock.

<comment><USER18> I know what it is. I don't really watch TV shows much.

</comment></comment></comment></comment></comment><comment><USER20> The vicinity of Trader Joe's is actually a significant consideration whenever I relocate.

<comment><USER21> As a european grad student at Caltech - I can say that the pasadena Trader Joe's bread and cheese is the only thing that allowed me to survive American (or at least LA) cuisine.

<comment><USER22> Uhhhhhh, I'm guessing that you were eating cheap. There's no reason that you'd have to "survive" LA cuisine unless you actually didn't spend money on it and just went to McDonalds. There are amazing restaurants in LA. Lots.

<comment><USER23> There's plenty of good cheap places to eat in LA too, especially if you broaden your horizons a bit. The range of cuisines here is quite extensive.

<comment><USER21> Well it was Pasadena, so Mexican or McD were the options.

Go into an American supermarket and there are dozens of types (or at least shapes) of bread - all the same oversweet soft wonderloaf inside, and dozens of types (or colors) of cheese - that all taste the same.

When I lived there, live cheese was banned, pot is being legalized but Brie is illegal !!!!

</comment></comment></comment></comment></comment><comment><USER24> This fan-made commercial says it all:[http://www.youtube.com/watch?v=OdB7GDZY3Pk&feature=youtu...](http://www.youtube.com/watch?v=OdB7GDZY3Pk&feature=youtube_gdata_player)

And now it's stuck in your head! _ding_

<comment><USER25> Great commercial. I recognized almost every product there. TJ really does have a unique and eclectic mix of food. The thing I notice is that I can find 99% of all the items I need when grocery shopping there but I only end up spending $50-60 a week instead of $100 or more that the same items would cost at a Stop and Shop or Whole Foods.

The one thing they seem to be lacking is a meat and seafood department. All their meat is shipped in; it's not bad, but it can't compare to Whole Foods. My solution is to get everything at TJ, then stop by Whole Foods to buy a pound of fish and chicken. Best of both worlds...

<comment><USER26> This works extremely well for me also. The Cambridge Trader Joe's is extremely close to a whole foods.

</comment></comment></comment><comment><USER27> It's a real tragedy when TJs discontinues one of your favorite items. Still mourning the loss of those flat New Zealand buiscuits filled with apricots and raisins. Also the pomegranate syrup is gone...

</comment><comment><USER28> My GF and I have done a lot of shopping at the Chelsea store from the article. Funny the author pointed out "random Manhattan strangers" as I noticed this yesterday when we did our week shopping.

I think the Chelsea store opened a few weeks back, as someone from our office stumbled upon it and brought back peanut butter filled pretzels nuggets - which were awesome. Needless to say, once I heard they opened a TJ in the area, I had to stop by and experience it.

The Chelsea store is so much more open with high ceilings compared to the Union Square location. If you live in NYC, I recommend shopping in this location.

</comment><comment><USER29> Trader Joe's, come to Colorado, you can make the long haul work, I promise.

<comment><USER30> Hey, not before they come to Utah first!

Kidding aside, I used to live one block away from a Trader Joe's and am sort of over them now. It can be a frustrating place to shop when you just want 'regular stuff', rather than paying the markup for fancy varieties of things. It's very nice to have as a supplement to a normal grocery store though.

</comment></comment><comment><USER31> Trader Joe's is pretty clever.

I go there and there are about fives things I want and which are good deal. Then there are ten things I'd buy if I was in a hurry and are only a good deal if want I to pay premium for processed stuff. I get a good deal there but I suspect most customers throw down a lot of money for convenience that isn't cheap or healthy - but I suppose that's what they want.

</comment><comment><USER32> A Trader Joe's is opening in the on 72nd and Columbus in Manhattan that. It's already causing the local groceries to change their game and they haven't even opened yet.

</comment><comment><USER33> Among a generally critical-minded crowd like HNers, Trader Joe has not gotten a single bad comment.

I am impressed.</comment>


CG Rendering of Asteroid Impact on Earth (HD) - <AUTHOR> http://alexiatsotsis.com/2010/06/20/perspective/

<comment><USER2> Armageddon porn.</comment>


The Ethereum network is currently undergoing a DoS attack - <AUTHOR> https://blog.ethereum.org/2016/09/22/ethereum-network-currently-undergoing-dos-attack/ <comment><USER2> My understanding is it works like this in Ethereum:

The miners can run any arbitrary code ("a contract") that you write, and this code is verifiable and trusted by everyone once it's been uploaded to the blockchain. The contracts can read/write arbitrary things in the blockchain and send coins to anyone you want, determined by the code you write.

There's a "gas price" that you have to pay for each operation you tell the miners to execute. However, the operation "EXTCODESIZE" evidently has too low of a cost, allowing someone to pay to have it executed enough times to noticeably slow the miners down for shits and giggles.

Someone correct me if I'm wrong?

<comment><USER3> Is there another angle? E.g. can the attacker have precomputed the results of those operations and now he can mine faster than anybody else or something like that?

<comment><USER4> Yes you can game the network by writing your own Ethereum Mining Client. Introducing a ton of code. Selectively ignoring code. BUT this isn't smart. You are devaluing the currency you are deriving profit hurting your profit margin.

Furthermore you need to maintain plausible deniability. THIS IS HARD. If Ethereum catches you, they'll just hard fork. So your average blocked claims can't change by a large amount. So in reality you already need to 1st/2nd sigma miner, then increase your profits by maybe 20-30%. This is a lot of risk, and a ton of work.

Most likely it is just somebody doing it for the lulz

<comment><USER5> I'm disappointed that the devs established the precedent that if things go south they'll hard-fork. It reduces the incentive to avoid risky behavior. Having a centralized roll-back/bailout authority is what led to too-big-to- fail banks.

</comment></comment></comment></comment><comment><USER6> Etherium is a first cut at a hard problem. The "smart contracts" problem is interesting, but after the DAO debacle, it's clear that smart contracts shouldn't be executable programs. It's too hard to predict their behavior, and that's very bad when they're connected directly to money. Some human-readable declarative notation is needed. I've suggested decision tables. Dealers need enough expressive power to handle all the usual financial instruments, but don't need or want Turing completeness.

Another advantage of a declarative notation is that compute time tends to be bounded by a fairly low bound. That would put a lid on problems like this new one, where the little programs are chewing up too much time.

We may see some smart contracts system with a better notation in the derivatives business. It doesn't need to be a currency, just a blockchain with enough identified independent players to prevent tampering. The need for "mining" comes from the desire for anonymity; it's not inherent in smart contracts.

</comment><comment><USER7> Isn't this the kind of thing that a decentralized network should be resilient against? Maybe I just don't understand blockchains.

<comment><USER8> From the article:

> miners and nodes need to spend a very long time processing some blocks. This > is due to the EXTCODESIZE opcode, which has a fairly low gasprice but which > requires nodes to read state information from disk;

AIUI, the data in the blockchain isn't just "data". It's actually small bits of code that execute inside a VM, which each node needs to execute in order to "understand" the blockchain. "EXTCODESIZE" would be one of the instructions in this particular VM.

I think that most blockchains either have a complexity limit per record/transaction, or have a complexity "cost", so that complex code is more costly to insert into the blockchain.

However, in this case, it sounds like someone has figured out how to insert some code that is actually more complex than the complexity-measuring code thinks it is, and is therefore causing all miners (all users?) to perform higher-than-expected amounts of computation to parse the blockchain, to the point where they can't keep up with the network.

(Corrections welcome)

<comment><USER9> The transactions are verified by all full nodes (which are basically all users).

</comment></comment></comment><comment><USER10> Trial by fire, I see...

</comment><comment><USER11> Who benefits from this?

<comment><USER12> The crypto-community is a pie whose size isn't changing much. Coin prices fluctuate as investors move money from one coin to another, which causes price fluctuations. Attacks like this one which make ethereum look bad are beneficial to those other coins, who will expect prices to rise as a result of people selling their ETH out of fear.

<comment><USER13> And in the end, after the whale makes his profit in btc, he will probably reinvest in eth because it is low, gaining a larger stake in an already fragile economy, and will be able to exert more influence next time he tries to move the market.

</comment></comment></comment><comment><USER14> I wonder if this is related to what is going on with the folks at [http://www.foundups.com](http://www.foundups.com) claiming they invented ETC and are hosting their own conference around their own protocol.

</comment><comment><USER15> Could individual miners change the cost they charge for individual opcodes, or perhaps even disable specific opcodes alltogether?

<comment><USER9> The developers were thinking of doing this at the beginning but decided against it.

Currently, when you send a transaction, the transaction includes a gas price that you are willing to pay for a unit of gas. The miners then decide if they want to mine your transaction, or not. Each opcode in the Ethereum Virtual Machine requires a different amount of gas, which is hard coded (look at this spreadsheet: [https://docs.google.com/spreadsheets/d/1m89CVujrQe5LAFJ8-YAU...](https://docs.google.com/spreadsheets/d/1m89CVujrQe5LAFJ8-YAUCcNK950dUzMQPMJBxRtGCqs/edit#gid=0) the opcode that is causing trouble today is EXTCODESIZE which has a gas cost of 20, which is apparently too low).

Initially, there were ideas where you could specify in the transaction the gas price you are willing to pay for each opcode. But this would make transactions very large (in terms of bytes).</comment></comment>


George Orwell: Politics and the English Language (1946) - <AUTHOR> http://alexgolec.github.io/orwell/politics <comment><USER2> The more I read Orwell's essays of the 1940s the more they seem like a master class in how to write, which means they are also a master class in how to think. The combination of clarity and impact in his style is so powerful that it's actually shocking. Moreover, it seems to be aging very well, so Orwell's reputation (specifically for this) has been steadily increasing.

Other great examples:

[http://orwell.ru/library/essays/wiw/english/e_wiw](http://orwell.ru/library/essays/wiw/english/e_wiw)

[http://orwell.ru/library/articles/nose/english/e_nose](http://orwell.ru/library/articles/nose/english/e_nose)

Is anyone writing today with that particular quality (i.e. that combination of clarity and directness)? All the candidates I can think of fall far short of it, and only clarify how distinctive Orwell is.

Edit: It's also interesting that this material is now widely seen as classic when at the time it was mere pamphleteering. To my knowledge, Orwell wasn't thought of as a hack—he was respected—but this sort of writing was regarded, even by him, as throwaway work, with a sense that it was too bad that circumstances didn't allow him to do better. (He touches on that in "Why I Write", the first link above.) It's a common theme in the history of art for high-status things to start out as low-status things; this may be a case of that.

Edit 2: Another interesting thing—he was writing this stuff about current events in more or less real time. That's a very murky pond to be looking into. I would very much like to know what it was that gave Orwell that degree of insight.

<comment><USER3> If you're like me and prefer reading print books, there's an excellent (and very comprehensive) collection of Orwell's letters, essays and journalism. It's slightly difficult to track down but worth the effort.

[http://www.godine.com/search.asp?search=orwell](http://www.godine.com/search.asp?search=orwell)

<comment><USER4> There's also the 20-volume, 8500-page Complete Works, which I first saw on the bookshelf of Christopher Hitchens in some interview video. Much more difficult to find [0].

[0] [http://www.timeshighereducation.co.uk/162699.article](http://www.timeshighereducation.co.uk/162699.article)

</comment></comment></comment><comment><USER5> If you're as turned off by the formatting of this page as I am, I'm currently working on a CSS framework to beautifully display longform text.

As luck would have it, this essay was my test case:

[http://alexgolec.github.io/orwell/politics](http://alexgolec.github.io/orwell/politics)

<comment><USER6> ..and you somehow forget the _most_ important feature, bar none:

        p { max-width: 30em; }

<comment><USER5> What browser are you using? I believe I implemented the max-width using a container div rather than putting restrictions on the p elements.

</comment></comment></comment><comment><USER7> Timely post, considering the insanity I was just handed by my campus Social Justice society on my way inside the student union building. It's full of newspeak, and openly calls for the suppression and censorship of speech, literature and music on campus and contains unclear/vague threats of punishment to anybody "who benefits from promoting patriarchal attitudes and relations of power that were inflicted here by colonists."

<comment><USER8> Colonists? Where do you live?

</comment></comment><comment><USER9> I wonder what he'd say about memes. They seem to be the ultimate self- reinforcing de-evolution of language.

In many ways, it seems like he is talking about memes, just the memes of his own time.

       But in between these two classes there is a huge dump of
       worn-out metaphors which have lost all evocative power and
       are merely used because they save people the trouble of
       inventing phrases for themselves.

<comment><USER10> I don't know about that. At least memes don't pretend to be anything else than they are. They are the unabashed verbal and visual equivalent of musical jingles, things designed to grab your attention and stick in your head, but nobody is suggesting that jingles are equivalent to Beethoven.

Corporate PowerPoint-talk is the spiritual heir of what Orwell is mocking in his rewrite of the Old Testament passage. An ever-growing wall of "strategic" abstractions and vaguely Latin buzzwords is used to hide the debilitating lack of meaning and power that plagues the days of almost every mid-level manager at any established company.

<comment><USER9> I agree they aren't intended to be high quality, but because of their ease of use and mimicry, they are often used in place of actually formulating a thought or statement which is similar to the themes in Orwell's piece.

      But if thought corrupts language, language can also corrupt
      thought. A bad usage can spread by tradition and imitation
      even among people who should and do know better.

</comment></comment></comment><comment><USER11> This post on Language Log identifies ways in which Orwell violated his own rules in the essay.

[http://languagelog.ldc.upenn.edu/nll/?p=992](http://languagelog.ldc.upenn.edu/nll/?p=992)

</comment><comment><USER12> Well, this is perhaps the way we should write code too:

"What am I trying to say? What words will express it? What image or idiom will make it clearer? Is this image fresh enough to have an effect?

And he will probably ask himself two more:

Could I put it more shortly? Have I said anything that is avoidably ugly?"

</comment><comment><USER13> One of my favorite essays and even more relevant today than when Orwell wrote it. ("Enemy combatants", "right-sizing", "Patriot Act") I think the effect in business is even greater, partly because the bar for good business speech and writing is so low.

I wrote a post inspired by Orwell's essay called How Your High School English Teacher is Ruining Your Proposals to vent my frustration over language that obfuscates rather than clarifies, whether intentionally or just due to laziness. ([http://www.mimiran.com/proposals/how-your-high-school- englis...](http://www.mimiran.com/proposals/how-your-high-school-english- class-is-ruining-your-proposals/))

</comment><comment><USER14> I've admired this essay of Orwell's since I first read it years ago, and have striven to shed stale metaphors and pretense from my writing ever since. I wonder how well I have succeeded.

</comment><comment><USER15> Surprised to see such a seminal essay on the top of HN. I'm sure most people here will have read this before ... but, hey, always a good re-read.

<comment><USER16> How old do you think the average HN reader is? Or is this covered in some kind of CS class?

<comment><USER15> I think the average user on this site is pretty literate. Easily a quarter of the top posts are non-CS related.

</comment></comment></comment><comment><USER17> _" The range of verbs is further cut down by means of the -ize and de- formations, and the banal statements are given an appearance of profundity by means of the not un- formation."_

Obviously, we need to deincentivize that.

 _" one can even, if one jeers loudly enough, send some worn-out and useless phrase ... into the dustbin, where it belongs."_

<comment><USER18> > into the dustbin

The irony being that this is one of the worst kind of cliches, proving that Orwell had no idea what he was talking about.

</comment></comment><comment><USER19> This was my first ever reading assignment at university, for an International Relations class of all things!

I spent the next 5 years introducing it to others as a a precursor to any copy-editing sessions.

</comment><comment><USER20> I'm about to go do something, but wanted to be somewhat critical; the result will probably be a bit all over the place and incoherent:

The irony of this post, of course, is that it decries the evolution of language while praising the evolved parts of the language.

Orwell says, '… while on the other hand a metaphor which is technically "dead" (e.g. iron resolution) has in effect reverted to being an ordinary word and can generally be used without loss of vividness. But in between these two classes there is a huge dump of worn-out metaphors which have lost all evocative power and are merely used because they save people the trouble of inventing phrases for themselves.' This as if dead metaphors simply materialized overnight, and never lived in the middle class. Unsurprisingly, several of the "dying metaphors" he cites are at this point in time essentially dead (Achilles' heel and hotbed, for instance).

He leads with "Most people who bother with the matter at all would admit that the English language is in a bad way, but it is generally assumed that we cannot by conscious action do anything about it." It's immediately evident, I suppose, that Orwell is a writer, not a scientist. Who is defined as bothering with the matter at all? "Most" is quite the weasel word, isn't it? A case study in phrasing things in a way that you can't really disagree with them. I'm a self-and-by-others-described lover the English language, and misuse and misspelling of words and phrases annoys me as much as text that is too complicated to follow, but I don't think it means the "English language is in a bad way", any more than it did then. But then I'm simply not one of the "most", I suppose, by virtue of disagreeing.

"Now, it is clear that the decline of a language must ultimately have political and economic causes: it is not due simply to the bad influence of this or that individual writer."

Let's grant that the language is declining. Is this assertion really clear? To whom is this clear? It's certainly not clear to me. It isn't clear that either side is true, or that it is false: indeed, the decline, or evolution, as I would put it, of language is likely inextricably _intertwined_ with politics and economics and technological evolution and society.

He addresses this immediately after, saying "But an effect can become a cause, reinforcing the original cause and producing the same effect in an intensified form, and so on indefinitely", and in doing so he renders his previous statement pointless, filler, not a meaningless word but a meaningless phrase!

To boot, he says: "Silly words and expressions have often disappeared, not through any evolutionary process but owing to the conscious action of a minority." His hope for curing the language is the conscious action of a minority, but the decline of language cannot be due to the bad influence of a minority?

Orwell makes good points at times here, I think, with respect to overly ornate language that does nothing to clarify its own content. And he gives some reasonable guidelines to boot. But he extrapolates these smaller conclusions to bigger ones that are unlikely to be true, and presents them in a such a way that you don't realize that he's weaseling out of truly concluding anything—he simply postulates. Even when he does make good points about using language to defend the indefensible, the idea that this is some sort of novel discovery that was particularly bad in the 40s—or is now—is unfathomably foolish.

"I should expect to find -- this is a guess which I have not sufficient knowledge to verify -- that the German, Russian and Italian languages have all deteriorated in the last ten or fifteen years, as a result of dictatorship."

What is deterioration, pray tell? What makes a _language_ worse? Did a change in instruments in the second half of the twentieth century make our music worse? Our great musicians? Did the emergence of Ruby or Python make our programs worse? Our programmers? By what metric?

Really investigating the concept of worse or better when it comes to such abstract things as language is incredibly difficult. Distinguishing _worse_ from _different_ is incredibly difficult unless maybe you're comparing two things that were conceived at the exact same moment—and even then, your judgement is specific to the now, not to forever.

"Look back through this essay," Orwell says self-deprecatingly, "and for certain you will find that I have again and again committed the very faults I am protesting against." Conveniently, this makes 90% of the essay immune to criticism. Another weaseling.

"Two recent examples were explore every avenue and leave no stone unturned, which were killed by the jeers of a few journalists."

I'm afraid I must report to Mr Orwell that 67 years later, these metaphors are alive and well—or, more likely, dead.

Is our English today "worse" than it was 50 years ago? If not, was it a small cadre of noble writers who saved us? If the decline of language was arrested, was that because the language stopped declining, or simply because on this end, decline doesn't really look like decline—just movement? And if it is worse, then how? All of the complaints he's making seem to be equally valid today, but not particularly more so.

People have been trying to make points without having to really justify themselves for ages, and they will continue to for many years to come. It happens in politics, yes. But it seems that it also happens in essays about politics and the English language.

<comment><AUTHOR>
        The irony of this post, of course, is that it decries the
        evolution of language while praising the evolved parts of
        the language.

He decries one aspect of the evolution of language, the aspect which just hides meaning. And it seems to me, that objectively there is a incentive for many stakeholders to disguise the inherent meaning of their message, either to appear more disruptive in whichever space they move, or to straight out lie by misunderstanding.

        What is deterioration, pray tell? What makes a language
        worse? Did a change in instruments in the second half
        of the twentieth century make our music worse? Our
        great musicians? Did the emergence of Ruby or Python
        make our programs worse? Our programmers? By what
        metric?

Completely unrelated, but to use Cory Doctorow's [1] argument, it probably is. His argument is, that electric guitars enabled a four man band to play a concert. So at the start of the 20th century you need to be good enough to convince a symphony orchestra to play your music to give a concert. This is a rather strong filter. But with electric amplification all you need to do is to convince a few friends. So probably the average quality of music dropped. But on the other hand, this also allowed the rapid evolution of music in the second half of the last century. Similar I would expect that the average quality of writing is brought down by reddit, but simultaneously this will likely fuel a much faster evolution. And for programming languages, it is again the same. If you need to convince a mainframe operator to run your program, then it should better be written well.

[1] [http://www.locusmag.com/Perspectives/2010/01/cory- doctorow-c...](http://www.locusmag.com/Perspectives/2010/01/cory-doctorow- close-enough-for-rock-n.html)

<comment><USER21> _> He decries one aspect of the evolution of language, the aspect which just hides meaning._

But that begs the question of whether meanings are in fact hidden, or simply changed -- at least as far as language as a whole is concerned[1]. There are of course individual cases where people are, as you point out, incentivized to do all sorts of weird things with language to accomplish some goal. Thus was rhetoric born.

1\. Many insults, for example, shed their original sense and persist only as generic attacks. Does that mean that the original meanings are hidden? Or are they simply no longer relevant? Like 'Scumbag': [http://english.stackexchange.com/questions/28253/origin- of-s...](http://english.stackexchange.com/questions/28253/origin-of-scumbag). (Note the several possible etymologies, none of which really bears on its use today anyway.)

 _> And it seems to me, that objectively there is a incentive for many stakeholders to disguise the inherent meaning of their message, either to appear more disruptive in whichever space they move, or to straight out lie by misunderstanding._

Well said. "To appear more disruptive" is particularly apropos on HN, where 'disruptive' is so perfunctory an adjective as to have lost all meaning (see [http://en.wikipedia.org/wiki/Glittering_generality](http://en.wikipedia.org/wiki/Glittering_generality)).

Edit: To Doctorow's point, I doubt that's quite true. In the West at least, solo pieces (particularly piano), quartets and quintets of various kinds (particularly brass and string), and so on have been popular for ages.

<comment> loup-vaillant I sometimes try to talk with my mother about truth, reality, correct beliefs and so on. Her problem is, she is relativist. To her, the idea that there's only one reality, and that contradictory beliefs are incompatible is not only false, but _repugnant_.

One of the major causes happens to be vocabulary. In French, the closest synonymous for belief, "croyance", carries a heavy religious connotation. We have other words, such as "knowledge", "opinion"… but they have other problems. We just don't have a short colloquial word to convey the idea of a probability distribution, _and no more_.

"No problem, I'll just define the word for her." But I'm not allowed to. I'm supposed to be _accessible_ , which means no long sentences, and no jargon. My trying to be precise comes of as pedantic, pretentious, and needlessly complicated.

And so we're stuck. She doesn't understand what I mean, and I can't explain it to her. Even worse, she actually believes she _does_ understand. Because my words have meanings to her. Just not the meanings I wanted to convey.

\---

Regarding solo pieces, quartets, and quintets, you should note that guitar has frets. Playing in tune is much easier compared to say, the cello. While becoming a good guitarist requires just as much effort than becoming a good cellist, merely playing something that sounds cool requires much, much less effort.

</comment></comment></comment></comment><comment><USER22> One of my favorite essays. I re-read this every six months as a reminder to be as clear and precise as possible in my communication.

</comment><comment><USER23> Schopenhauer said it 200 years before Orwell did, a fact I discovered only this week.

I recommend Schopenhauer's essay if you liked this one. Read essays 1-3 [http://ebooks.adelaide.edu.au/s/schopenhauer/arthur/](http://ebooks.adelaide.edu.au/s/schopenhauer/arthur/)

</comment><comment><USER24>
      > one can even, if one jeers loudly enough, send some
        worn-out and useless phrase ... into the dustbin,
        where it belongs.

Such a fitting sentence on which to end the essay, since "dustbin" is no longer part of the modern English lexicon, as far as I know.

<comment><USER25> Google N-Gram analysis suggests otherwise, with dustbin more common in books in 2000 than the 1940s/1950s:

[https://books.google.com/ngrams/graph?content=dustbin%2Cwast...](https://books.google.com/ngrams/graph?content=dustbin%2Cwastebasket%2Ctrash+can&year_start=1800&year_end=2000&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Cdustbin%3B%2Cc0%3B.t1%3B%2Cwastebasket%3B%2Cc0%3B.t1%3B%2Ctrash%20can%3B%2Cc0)

However, it has be losing in relative rank to 'trash can'. I believe _dustbin_ is far more common in British English than North American English.

<comment><USER24> Many thanks to you and the other replies for increasing my linguistic cultural awareness!

</comment></comment></comment><comment><USER26> Politics and the English Language [with annotations from a rational thinker] [http://pastebin.com/mSzbX5Hd](http://pastebin.com/mSzbX5Hd)

</comment><comment><USER27> I try to read this once a year to jolt myself out of my typical writing. Another useful tip is to have "The Elements of Style" by Strunk & White nearby.

</comment><comment><USER28> This has always been one of my favorite essays.</comment>


Ask HN: Getting New Business - <AUTHOR> I have some experience with a large company's totally inadequate search solution, and would like to put myself forward as the person to fix it.
The way I would think to do it is to write a large proposal, going into depth how the current solution is bad and how it should be improved.
But of course this is also a lot of unpaid work, preferably I would like to get paid for it, but my experience is in having companies ask me to build things, not suggesting to companies what I should build for them.
The company under question is also very compartmentalized/arranged under sort of feudal lines, I have some connections in the company but not in the area that needs to be improved so I wonder if my best entry should be to contact someone at the top of the organization and make my pitch.
Suggestions on how to proceed appreciated. <comment><USER2> If you offer a way to fix something, you need to have the position in order to re-allocate time/resources to doing so, otherwise your attempt will be unpaid.

Try to convince the people that have this power, and then leave it up to the organization. With the best intentions, some companies will not change due to ignorance, fear, resources or culture.

<comment><AUTHOR> I can re-allocate time resources, although I am also unsure as to what to charge - normally consulting I am charging 2X what I get paid full-time (a rule of thumb), but now I would also be doing stuff on top of just programming, and maybe should bring in other people so I wonder what my offer should be (I would like a good rule of thumb for that situation, like charge 25% more for person you're paying to cover cost of management)</comment></comment>


Google Checkout will be retired - <AUTHOR> http://googlecommerce.blogspot.com/2013/05/an-update-to-google-checkout-for.html <comment><USER2> I'm surprised by this - I'd have thought the more Google knows about a user's purchase history, the more effective Google's ads would be for that user.</comment>


Ask HN: How do i do biz dev in 6-weeks? - <AUTHOR> I have 6 weeks where the wife and kids will be traveling and I will be home alone. I want to go in a HYPER BIZ DEV MODE to get more client/contracts for my consulting business (custom software dev).<p>Any tips or ideas on how to effectively use my "free" 6 weeks? <comment><USER2> 1/ Make a sales process : materialize in software (dedicated CRM or Trello or whatever) and decide how your sales pipeline should look, how you should follow up with customers. Don't over engineer it, just try to make a formal process that you will be able to follow for after (not only those six weeks).

2/ Follow up with contacts (easy, stupid, but very often neglected)

3/ If you lack recognition / portofolio, maybe run a quick "marketing project", something that could reach front on HN (but might not) but that you could anyway showcase to customers. This could also be a nice opportunity to engage a discussion with customers.

<comment><AUTHOR> Thanks.

So my company is established and has a decent online presence and portfolio. I have a process in place in hubspot as well.

I guess my question is, How would you do the biz dev part of the process? Do you go to meetups? Do you look for local events? Do you just run some online ads?

I want to maximize the 6 weeks and do the things that are harder to do when you have to be home with the family after 5pm. That's why I was thinking of the "offline" meetups and such. Not sure where to start or if it is even effective.

<comment><USER2> I would say that the "what to do" depends a lot of your markets. I have spent fair amount of my time attending startups meetups in the past, it was not productive. Selling services, ads also come up as non productive. Staying in touch with existing customers was a better time investment.

You don't have time to test and iterate in six weeks, but I would say that you might know what works.

</comment></comment></comment><comment><USER3> 100 cold calls per day. I have heard that a good metric for cold calling is rejections rather than successes because it gamifies the calling process in favor of the normal outcome.</comment>


Zoom Endpoint-Security Considerations - <AUTHOR> https://dev.io/posts/zoomzoo/ <comment><USER2> Zoom is the Windows of conferencing apps: It is the most popular one, so researchers actually look at it and say it's shit, but the alternatives aren't much better [1].

[1] Just one example: [https://github.com/jitsi/docker-jitsi- meet/blob/master/CHANG...](https://github.com/jitsi/docker-jitsi- meet/blob/master/CHANGELOG.md#stable-4384-1)

<comment><USER3> But honestly, the main reason people use Zoom is that it is by far the most reliable video conferencing app out there. Anyone who has used other video conferencing systems on uncontrolled networks knows the pain that Zoom seems to magically avoid.

Now, it seems lately others have been getting better, but I'm not really sure what the source of that is; when I've been pulled into Zoom calls over the last five years, they've been absolutely rock-solid.

<comment><USER3> Separate from whether it works or not, I will not install it unsandboxed on any endpoints, nor use it deliberately.

Their security architecture is ???, and their excuse for its use of servers in PRC to move encryption secrets makes no sense, and honestly gives me the impression that at some level, somebody working on Zoom made that decision with the conscious intention to make secrets available to the PLA.

</comment></comment></comment><comment><USER4> I feel like this article is conflating things... it is absolutely possible to do SQL string concatenation safely. I've done it many times to work around aggressively-bad SQL APIs. Assuming SQL concatenation is _automatically_ bad is the kind of thinking that makes me roll my eyes at security researchers.

<comment><USER5> Building SQL queries from strings is possible safely, in the same way that C's memory model is safe.

It can be done... But not by most people. Are history proves it, time [0] after time [1] and time [2] after time [3].

It is simply not worth it, if you can make use of parameterized queries.

[0] [https://web.archive.org/web/20161024090111/https://ico.org.u...](https://web.archive.org/web/20161024090111/https://ico.org.uk/about- the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets- record-400-000-fine-for-failing-to-prevent-october-2015-attack/)

[1] [https://www.nytimes.com/2014/08/06/technology/russian- gang-s...](https://www.nytimes.com/2014/08/06/technology/russian-gang-said-to- amass-more-than-a-billion-stolen-internet-credentials.html?_r=0)

[2] [https://www.baltimoresun.com/education/bs- xpm-2014-03-07-bs-...](https://www.baltimoresun.com/education/bs- xpm-2014-03-07-bs-md-hopkins-servers-hacked-20140306-story.html)

[3] [https://web.archive.org/web/20150219165019/http://www.batblu...](https://web.archive.org/web/20150219165019/http://www.batblue.com/united- nations-internet-governance-forum-breached/)

<comment><USER6> > Building SQL queries from strings is possible safely, in the same way that > C's memory model is safe.

But still you wouldn't say that every software written in C is automatically insecure. You have to look into the actual case. Just grepping for SQL-string- concatination or uses of sprintf doesn't say much.

<comment><USER7> The difference is that there are sometimes no real alternatives to doing memory management by hand - which means there are prople that are really really really good at this.

With sql that's different, every sane sql client library supports some form of prepared statements out of the box and they are really simple to use. There is no reason whatsoever to do this by hand, except for people that don't know better.

<comment><USER8> I disagree with the part that there is always an alternative to building strings for SQL statements. Yes, all client libraries support prepared statements. But none of them support placing prepared statement fields in any part of the SQL statement.

Prepared statements work fine as long as you just have simple SELECT statements with a few WHERE values as parameters. They completely fail if you need to do any advanced SQL with anything dynamic. Like optionally add more sophisticated calculated properties to the SELECT fields, conditionally JOIN in extra tables, use any of the DB engine's more advanced XML or JSON parsing features in a conditional way, support choosing <, > or =, etc.

<comment><USER9> The real problem is doing ad hoc SQL string concatenation. In the situations you point out, one could (and should) write a simple formatting library that makes it easy to join string literals (the operators) with dynamic data, the same way one would write a basic prepare wrapper around a SQL driver that lacked prepared statements--a simple (and proper--not regex hack) format string parser that quotes and concatenates its arguments. Doing this ensures you'll end up structuring your code for easier auditing of code and data admixtures--there should literally be a _single_ line in the entire code base calling the abominable "escape" routine for quoting and escaping special characters. Ironically, this is the type of thing that's really trivial in C because it's so simple to write a small state machine (while + switch loop, with a variable for escape state) for parsing the format string and building a new string character by character.

</comment></comment></comment></comment></comment></comment><comment><USER10> And yet the adoption rate is through the roof.

Seems that to succeed you don't focus on security till you get caught.

None of this will change unless there is a shift of liability back onto companies for securing data.

<comment><USER11> For the average user, a privacy/security concern is a possible/theoretical issue, missing features a very real, instantenous issue.

Slack, Teams & co flat-out ignored calls and screen sharing until now. They were sidelined so-so features. Hell, on Slack you couldn't even see screen sharing from mobile, and you did not even got a notification that another person is sharing. Never mind missing even the most basic annotation features.

No wonder Zoom eats all the pies now. Sure, they made a lot of mistakes, but it was a huge landfall on a small(ish) company. That said, if the others top up their game, I'm happy to get rid of an additional app - but that's how market works.

<comment><USER12> Just general video/audio performance too. Zoom is the only one I've used where everyone can have an open mic, have noise in the background (or even music), and the whole group can still have a good conversation.

</comment></comment></comment><comment><USER13> We have been measuring and tracing Zoom traffic from the various client apps for the last couple of weeks.

One weird thing. It appears Zoom uses SCO Cloud [1] and HunTel Engineering Nebraska [2] to form sort of their own IPX? I have been a cloud architect for the last decade and haven't seen anything like this. The costs must be enormous if we are measuring correctly (no guarantee).

SCO Cloud though is quite the character. Apparently they are part of some group that has been trying to sue the Linux kernel for the last 20 years, until the case was put to rest in 2017 I think [3].

[1] - [https://scocloud.com](https://scocloud.com)

[2] - [https://htleng.com](https://htleng.com)

[3] - [https://arstechnica.com/tech-policy/2017/10/appeals-court- ke...](https://arstechnica.com/tech-policy/2017/10/appeals-court-keeps-alive- the-never-ending-linux-case-sco-v-ibm/)

<comment><USER14> The SCO that birthed all the lawsuits is pretty long defunct. I doubt SCOcloud is at all related. Their site doesn't seem to match the MO of the old SCO.

</comment></comment><comment><USER15> As a quick note, no affiliation whatsoever on my part - I've had great success running online meetups on the LGPL project bigbluebutton. Hope it helps some members here with their pain point.

[https://bigbluebutton.org](https://bigbluebutton.org)

</comment><comment><USER16> On Linux, you can get Zoom as a Snap or Flatpak, that provides a useful layer of sandboxing.

<comment><USER17> Some, I guess, but not enough to make much difference. The Flatpak for it mounts the user's home directory:

[https://github.com/flathub/us.zoom.Zoom/blob/master/us.zoom....](https://github.com/flathub/us.zoom.Zoom/blob/master/us.zoom.Zoom.json#L14)

...and the Snap seems to as well, though I'm less familiar with Snaps and it seems like this may not provide access to hidden files:

[https://github.com/ogra1/zoom- snap/blob/master/snap/snapcraf...](https://github.com/ogra1/zoom- snap/blob/master/snap/snapcraft.yaml#L32)

So your SSH keys may be safe there, your photos and documents probably aren't.

</comment></comment><comment><USER18> Can someone comment on this angle, where zoom traffic was routed through China, not exactly a paragon of openness?

<comment><USER19> Discussion: [https://news.ycombinator.com/item?id=22768494](https://news.ycombinator.com/item?id=22768494)

</comment></comment><comment><USER20> did see the same things with the Linux binary. Especially funny to see these old (and unsupported) OpenSSL-libraries. Isn't nearly every valley-company today built around the assumption of having a development model which makes things as this highly unlikely?

<comment><USER21> Zoom also does weird OS-detection which seems to fail with Debian-testing, so I can't use screensharing on Wayland. Works fine with Jitsi Meet. They also don't support dual-screen mixed-scaling (4k laptop with 1080p external screen).

Feels like using Skype: worked for a while under Linux, then never got updated and became very unpredictable/clunky.

<comment><USER22> One way to work around this, stolen from somewhere on the internet:

bwrap --dev-bind / / \--ro-bind /opt/zoom/os-release /etc/os-release /usr/bin/zoom %U

Where you set /opt/zoom/os-release to something appropriate. Should be enough to copy your current one and set VERSION_ID to 10.

(it's pretty simplistic)

</comment></comment></comment><comment><USER23> What about the last one? Code execution through turbojpeg.dll

Might be possible to share a picture through zoom and when zoom will attempt to render the picture it's gonna execute it?

Edit: nevermind looks like this CVE vulnerability only exists on ARM64 CPU, in optimized codepaths using neon instructions.

[https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2019-2201](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2019-2201)

[https://www.openwall.com/lists/oss- security/2019/11/11/1](https://www.openwall.com/lists/oss- security/2019/11/11/1)

</comment><comment><USER24> quite unfortunate that there is no alternative with the same great user experience like zoom.

Linux, Windows, Mac, every device all just working without a problem. Delay free screen sharing (Not like MS Teams/webex), even remote support is possible.

Fantastic product from a user perspective. I hope they will fix the issues or some other currently crappy solution will take over the user experience centric thinking.</comment>


Show HN: My side project iOS game just hit #3 in the Finnish App Store - <AUTHOR> http://www.gymnastickgame.com <comment><AUTHOR> So, I feel like I'm a little bit out of my league. I read the book "Surviving the App Store" and decided to follow its strategy of releasing an MVP in the App Store as early as possible.

Today, I woke up to see it at #3 in the paid apps for my country's overall Top Chart, #2 in games and #1 in its subcategory.

A publisher has now approached me about publishing the game. I have no idea about the pitfalls. If anyone here has any experience, I'd love to hear any pointers.

<comment><USER2> Congrats, and the game looks really cool!

I'm curious: how did you market your game? What made you go in the top charts?

<comment><AUTHOR> Finland is a rather small market, so friends & family were probably a big influence to get it off the ground. (Seems that it only takes some hundreds of downloads to reach the top spot.)

I also started threads with promo code giveaways in TouchArcade and Reddit, and emailed reviewers.

With those as a base, it got some initial visibility and then bloggers/reviewers started asking for promo copies.

</comment></comment></comment><comment><USER3> Your landing page is 100% on point. Explains about the product in the first second. No hassle, not too much fluff.

Awesome stuff. Congrats for reaching #3.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER4> Wow, that's what I call elegant and minimalistic design - both the landingpage and the game footage itself. Are you planning to release it for android too sometime?

<comment><AUTHOR> Thanks! It's built with Swift, so I'll have to see how far it goes in the App Store first before porting it. Finland alone is not a huge market, so it's hard to tell.

</comment></comment><comment><USER5> Pretty neat game. I commend you for not integrating ads or IAP. I went the same route with my iOS game.

<comment><AUTHOR> Was it a financial success? And care to link to the game?

In a way I feel like saying no to ads and IAP is a noble goal, but not the financially smart one. I was OK with it for this one, because this was a hobby/passion project that I wanted to make for a long time. I didn't want to ruin my baby with filthy ads, profits be damned.</comment></comment>


Ask HN - Did you go black today? - <AUTHOR>

Are you a startup against SOPA?  We challenge all startups to add their name to this list and go black with us today.<p>www.rentul.com is black <comment><USER2> Note quite black, but I think the point is clear.

<http://thenextweb.com/>

<comment><AUTHOR> Very clear!

</comment></comment><comment><USER3> Yep! <http://www.blackout.tech.li/>

</comment><comment><USER4> Yep, We went Black and Blue about an hour ago. and added a nifty twist to the page. <http://atodev3.com/>

<comment><AUTHOR> I like it!</comment></comment>


Show HN: Bitfolio, a simple crypto currency ticker and portfolio tracker for iOS - <AUTHOR> http://www.timelabs.io/bitfolio/ <comment><AUTHOR> Hi HN, I've released Bitfolio, a simple app to track your crypto currencies investments and coin values.

It's very very simple and I'm planning to add more coins and exchanges in the near future.

Main features:

\- Tickers with historic granularity

\- Portfolio with Forex support

\- iCloud Sync

\- Themes

\- Forex

Supported exchanges are Kraken, Coinbase, Bitfinex and Cryptopia NZ.

Supported crypto currencies: BTC, BCH, ETH, ETC, LTC, XMR, XRP, XEM, DASH, MIOTA, NEO.

Hope someone will find it useful, if you have any questions or feedback, I'm happy to answer.</comment>


FreeBSD deprecates all r-cmds (rcp, rlogin, etc.) - <AUTHOR> http://marc.info/?l=freebsd-commits-all&m=149918307723723&w=2 <comment><USER2> I'm surprised they're still in there, at all. You can still get them on Linux, but that's just because of the way Linux distros are built; nobody is working on them as a core part of the OS. If they were in ports and just kinda stuck around due to inertia, that'd make sense. But, it seems like these are in the core FreeBSD installation, which is borderline crazy.

One of the (few) things I like about the BSDs over Linux is that there is a core system that is maintained by a unified team working closely together in the same repos and with the same communication channels and the like, and following the same standards for docs, interfaces, etc. I like that aspect because people with good judgement are in charge of the platform itself and you can just sort of assume the default installation is cohesive, secure, and has reasonable defaults. This is sort of an argument against that theory; there's nothing reasonable about having rsh/rcp/etc. on a modern system. I mean, it's mostly harmless, as long as you know enough to never use them and never allow any software you run to use them, but still...why leave a bomb just laying around?

<comment><USER3> The r-cmds still have a place within cluster environments where their use is protected from the outside world and the overhead of encryption could adversely impact performance. Given the high percentage of Linux systems on the Top 500 list that's not going to change anytime soon.

<comment><USER4> History has thought us that we should probably be wary of "secure" networks. That said, there are a few cases where I could see a case being made for rsh etc w/kerberos: containers/vms - networking limited to a single physical host, with trusted clients/vms etc.

A "modern" network with ipv6+802.1x+ipsec - a situation where you trust the ip6-address just as much, or more than, a typical ssh host key (typical ssh is set up with trust-on-first use, not with expiring certificates).

Now, this is all balanced against the fact that you probably will use ssh _anyway_ \- and a hole in ssh(d) will likely be catastrophic - so in the balance, you might be better off managing _one_ secure infrastructure.

On the other hand, if you've set up proper ipsec with client certificates, and the possibility to "dial-in" \-- that still holds - why monitor and maintain two secure stacks, if you fundamentally _need_ to trust each one?

As for Debian, it seems someone made the (poor IMNHO) choice of setting up "alternatives" for rsh to point to ssh (if rsh-client isn't installed):

      $ update-alternatives --query rsh
      Name: rsh
      Link: /usr/bin/rsh
      Slaves:
       rsh.1.gz /usr/share/man/man1/rsh.1.gz
      Status: auto
      Best: /usr/bin/ssh
      Value: /usr/bin/ssh

      Alternative: /usr/bin/ssh
      Priority: 20
      Slaves:
       rsh.1.gz /usr/share/man/man1/ssh.1.gz

As I understand it, part of Google's new approach is indeed moving to secure network links (with policy on top) - in such an environment, I'm not convinced there's much to be _gained_ by layering TLS, ssh, HTTP2+SSL on top of end-to- end client/host authenticated networking/vpn.

<comment><USER5> You're missing the point. Supercomputer networks tend to be things like infiniband, where you're (usually) not using TCP and the whole point is to enable things like RDMA (yes, that stands for remote direct memory access). IPoIB is available but you pay a performance penalty; on Cray's interconnect the TCP emulation performance has traditionally been really bad.

Google's approach (to anything) is irrelevant to supercomputing, where users' program execution is managed by schedulers and the supercomputer is treated as one unit, despite being made up of many potentially-autonomous nodes. Just about all of the tech you've namedropped is completely unrelated to the manner in which HPC code networks.

Having said that, nobody uses rsh for performance, because if you really want performance you have to skip TCP altogether. People in HPC who are using rsh are using it because of inertia: the same reason the Top500 is the world's largest repository of csh users.

<comment><USER4> Sounds like we're in agreement: I say I see a couple of uses for rsh, none of which has to do with supercomputers, and you say that there's no special need for rsh with supercomputers, beyond it being convenient on a trusted network.

</comment></comment></comment></comment></comment><comment><USER6> I think OpenBSD completely removed them years ago; forget deprecation.

[https://www.openbsd.org/plus32.html](https://www.openbsd.org/plus32.html) (OpenBSD 3.2; rlogin/rlogind/rexecd) - 2002.

[http://marc.theaimsgroup.com/?l=openbsd- cvs&m=10207238812306...](http://marc.theaimsgroup.com/?l=openbsd- cvs&m=102072388123069&w=2) (Edit: [http://marc.info/?l=openbsd- cvs&m=102072388123069&w=2](http://marc.info/?l=openbsd- cvs&m=102072388123069&w=2))

They removed telnetd a bit later, 2005~ish? I can't find commits, but rsh/rshd have no online man pages since 5.6 - 2014.

<comment><USER7> I really have to hand it to the OpenBSD folks. They really have their release and deprecation cycles nailed down pretty well. I also enjoy the fact that they seem (to me at least) to rip some of old and clunky bits out sooner than others.

It would actually be pretty interesting to see a timeline of all the things OpenBSD has removed over the years.

<comment><USER8> OpenBSD can do this and get away with it since its use and deployment is minuscule compared to other systems.

<comment><USER9> No they can "get away with it" due to:

\- Having a regular and well tested release model.

\- Having a clear policy of supporting only the current and previous release.

\- Being a BSD style OS where the kernel, libc, and base programs are developed and released as a whole.

\- Not making promises about binary compatibility across releases.

<comment><USER10> ..which insures a miniscule install base. Zero compatibility guarantees and constant depreciation is anathema to enterprise at least.

<comment><USER11> Not really, because as mentioned the entire system is the release. They don't release kernels on their own and the userland is upgraded in lockstep with the kernel with each release.

That said, they'd be the first to tell you that if their model doesn't suit your needs, you're free to use another OS. They build and support what they want. If you want something else, they'll ask you to get involved and do the work.

</comment></comment></comment></comment></comment></comment><comment><USER9> Recall these were never meant to live very long in the first place.

        With the internal restructuring completed and the TCP/IP protocols integrated
        with the prototype IPC facilities, several simple applications were created to
        provide local users access to remote resources. These programs, rcp, rsh,
        rlogin, and rwho were intended to be temporary tools that would eventually be
        replaced by more reasonable facilities (hence the use of the distinguishing "r"
        prefix). This system, called 4.1a, was first distributed in April 1982 for local
        use; it was never intended that it would have wide circulation, though bootleg
        copies of the system proliferated as sites grew impatient waiting for the 4.2
        release.

[http://www.oreilly.com/openbook/opensources/book/kirkmck.htm...](http://www.oreilly.com/openbook/opensources/book/kirkmck.html)

</comment><comment><USER12> What about "rsync"? I use this command pretty often.

<comment><USER2> Completely unrelated.

<comment><USER13> Yep, rsync is still a relevant and awesome tool. The man page is one of the nicest I've seen too, 60+ pages in a small font and nicely structured with many examples.

<comment><USER14> I can't tell if your joking but Everytime I try to use that man page, I end up on stack overflow. I mean, why are all the options out of alphabetical order? You want me to page through all of them? Why are all the examples in the middle so I have to page past them to find out what options are available? It is such a mess.

Maybe that was the point and I'm just joke_explainer. Or maybe we have a legit disagreement about what makes a good man page.

<comment><USER15> Type / which is the command for search in less, the usual pager that displays the man page.

<comment><USER14> What if I don't know what options are there so I have to read or skip the examples to find the options? Most manage use is skimming the terse options section to remember what flag matches with an option and to remember which options I want.

I know how to search, it's the only man page I know that is formated this way and I find it to be a very poor design choice. As if I know what I wanted I wouldn't be looking in the man page.

</comment></comment></comment></comment></comment></comment><comment><USER16> For non-FreeBSD people, what do the r commands do?

<comment><USER17> Think of them as wildly insecure versions of SCP / SSH. Trusted LAN only, trusted users only, etc.

[https://en.wikipedia.org/wiki/Rlogin](https://en.wikipedia.org/wiki/Rlogin) has more background information.

<comment><USER18> They're not exactly insecure, they're just used for different things, like networks that are already secure. You can secure existing networks pretty well against things like MitM, and then it doesn't matter if you use rsh or ssh. (part of why so many routers still use telnet is it's supposed to only be enabled on management interfaces)

Quite a few years ago I helped build the public terminal cluster for HOPE. That year we used a token ring network for all of the hosts. Nobody anywhere near the conference had any token ring gear whatsoever. It was impossible to break into the network, so you had to use existing nodes. And the nodes' adapters had their promiscuous modes disabled in hardware. That plus a hardened terminal server and an extremely limited thin client meant nobody could successfully hack the network. You could have used telnet all day and been totally secure.

Though in conference environments, the network is not the biggest risk for targeted attacks. Carefully watching your target enter their password is simpler and more effective.

<comment><USER9> > They're not exactly insecure, they're just used for different things, like > networks that are already secure.

There is no such thing.

I'd be pedantic and rephrase this to - used for networks which you _trust_.

<comment><USER18> I think the engineers setting up red/black networks for the military might disagree with you, but even in the enterprise 802.1X can result in a secure local network.

I would say trust is a result of the operation of the network, as you may need to do something to establish it. And in this vein you're right, "networks you already trust" definitely would have been better wording.

<comment><USER19> No. You can't use rlogin on a 802.1X network or a red/black network. Passwords are transmitted in plain text, which means any other terminal on the network can sniff the password.

<comment><USER18> Red networks are intended for classified plaintext, by definition...

<comment><USER19> Passwords aren't classified plain text, they are authentication details and should be handled differently.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> While you're here, have you donated[0][1] yet? :) You may or may not be aware, but FreeBSD runs your movies on Netflix, your games on PlayStation 4 and Nitendo Switch, your files on FreeNAS and ZFS, your friends on WhatsApp and OpenBSD runs everything else on OpenSSH. ;)

So, you may or may not know that, but you need FreeBSD and OpenBSD and they also need you! Every cent counts and so does every contributor, that helps the foundations keep their non-profit status.

[0] [https://www.freebsdfoundation.org/donate/](https://www.freebsdfoundation.org/donate/)

[1] [https://www.openbsd.org/donations.html](https://www.openbsd.org/donations.html)

<comment><USER21> I do donate to FreeBSD and I encourage others to do so, but paying to give Netflix, Sony and Nintendo the privilege to use a free OS doesn't sound like a great incentive. They're not exactly nonprofits.

<comment><USER22> That was my thought too, not a great argument. I don't pay Oracle because my Bluray player runs Java, Sony pays Oracle to use Java and I pay Sony for the Bluray player. I don't even need to know it runs Java, it's included in the purchase price.

Likewise I shouldn't need to know Netflix uses FreeBSD, or the PS4 uses it, or Nintendo uses it. My users don't know my software runs on Heroku, they're not being asked to give money to DHH for Rails or become a Postgres sponsor or donate to the Linux Foundation just because they use a product that uses that technology on the back end.

If you make a product that directly profits from the work of a non-profit, you should consider a donation to keep the project around. But if you just use a product that's built on an open source project in a non-transparent way and don't actually use the open-source project yourself but you're still donating to it, you would be a _very_ generous citizen.

If FreeBSD didn't exist, Nintendo and Sony and Netflix would use something else. If companies that use FreeBSD want to keep using FreeBSD, _they 're the ones_ who should be paying for it.

It's a little much to ask that everyone donate to every open-source project they happen to use in an incredibly incidental way. I'd be spending half my time hunting down projects and the other half cutting checks to them. I donate to projects I actually use.

</comment></comment></comment><comment><USER23> I guess at this point I'm never going to learn the difference between rlogin, rsh, and rexec. Even googling it and reading the first page of results doesn't clear things up.

<comment><USER24> A comment below explains exactly this: [https://news.ycombinator.com/item?id=14699219](https://news.ycombinator.com/item?id=14699219)

<comment><USER23> No it doesn't. It explains what the three as a group do; what I'm asking is, what's the difference between these three? Why did we need three separate commands? When (in the pre-SSH days) would you use one versus the others?

<comment><USER25> SSH also brings these separate commands and a few more. ssh, slogin, scp, sshd, and sftp.

<comment><USER23> Okay, but that's not the question I'm asking.

<comment><USER8> Each of these FreeBSD commands have man pages which your googling should have shown.

<comment><USER23> slogin is just a symlink to ssh, and sexec does not exist. So the s-commands' manpages tell me nothing about the difference between rsh, rlogin, and rexec, or why all three needed to be created.

<comment><USER8> rsh, rlogin and rexec each have their own man pages, which you should be able to find on freebsd.org if google is being difficult.

<comment><USER26> The irony here is that these manual pages are the very things being patched _in the headlined message_. Their exact locations in the source tree, and some of their contents, are right there in front of us.

<comment><USER8> So read the older man pages? Why is this a problem? You can also easily read the man pages for a specific version of FreeBSD here [https://www.freebsd.org/cgi/man.cgi](https://www.freebsd.org/cgi/man.cgi)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Imagine a world where all IP packets are indistinguishable from any other, where TCP cannot be exploited to block SSH connections, where even key exchange/agreement cannot be blocked without blocking all IP packets. In such a world, blocking Wikipedia would be all but impossible without taking the totalitarian country to ruin.

But IPsec was sabotaged thoroughly. draft-ietf-ipsec-inline-isakmp was silenced. Now every protocol must implement a security policy and framework individually, without exception. SSH, TLS, EAP oh my (that is a lot of EAP methods.)

Vae victis. Woe to the conquered. RIP IPsec.

</comment><comment><USER28> very edge case, but you can't network-install an SGI machine without an rlogind on the other end.

<comment><USER2> You're telling me that these machines need an rlogind to install over a network? [http://www.sgi.com/products/servers/](http://www.sgi.com/products/servers/)

<comment><USER29> Probably not. Those run linux. It was a requirement for Irix remote installs. [http://techpubs.spinlocksolutions.com/irix/remote- irix-6.5-i...](http://techpubs.spinlocksolutions.com/irix/remote- irix-6.5-installation-from-linux.html)

<comment><USER2> So FreeBSD should keep shipping rlogin in the default install to support people who might be installing an OS for which the last major version was released in 1998 and the last minor update was in 2005? Man, nerds _really_ like to "Well, actually..."

<comment><USER29> I don't see that anyone suggested that.

<comment><USER2> It's how I interpreted the comment I initially responded to, but I guess it could have just been an "I remember old computer things, let me tell you about it." I have those moments sometimes, too.

</comment></comment></comment></comment></comment></comment><comment><USER30> These commands have deprecated themselves because of many limitations that were hitting almost randomly (for example [https://stackoverflow.com/questions/12677712/rsh-running- out...](https://stackoverflow.com/questions/12677712/rsh-running-out-of- ports)). We had to migrate all the scripts using r-cmds to ssh because of reliability issues when the number of hosts was increasing.

</comment><comment><USER6> "FreeBSD has deprecated rcp/rlogin/rsh in 2017. We're aiming for 2019 for telnetd and 2025 for SSHv1. No deletions planned at this time."

</comment><comment><USER31> rsync is not one of the deprecated commands. I guess it's not considered an "r-command", although "sync" is also a command on its own.

<comment><USER32> Rsync is implemented in terms either of rsh or ssh. It's not an r-command. It's unrelated to "sync".

</comment></comment><comment><USER33> Should have been deprecated long ago in my opinion. I've never seen those commands used in my professional life.

<comment><USER34> I have, and I'm sorry to report they may still be in use in healthcare, government, financial institutions.

</comment></comment><comment><USER7> About damn time!

</comment><comment><USER35> It's about fucking time.

</comment><comment><USER36> Make a SVN commit to deprecate these commands, it also seems time to depreciate svn.

</comment><comment><USER37> My immediate reaction and maybe yours too was "woah, including rsync?" And no, while rsync does indeed begin with a letter R, it is not being removed.

<comment><USER38> rm is also not being deprecated

<comment><USER39> thank goodness - I have no idea how I'd run m remotely.

<comment><USER40> the new, secure replacement, sm

<comment><USER41> No, we use the BSD version of that... bsdm.

<comment><USER42> The requirement to use SNMP with that always put me off.</comment></comment></comment></comment></comment></comment>