Rax –  A universal React-compatible render engine - <AUTHOR> https://github.com/alibaba/rax <comment><USER2> Funny story behind the line of Chinese React clones: the original goal of development was to make react work with ie6-9 (pirated winxp still is the "Default OS" here), but it came out that most of Chinese React forks are even less ie friendly than the original.

</comment><comment><USER3> Interesting that they don't compare it to preact: [https://github.com/developit/preact](https://github.com/developit/preact)

<comment><USER4> reading that, it seems pretty good. Are there performance costs to its diffing against the "real" DOM?

3kb for "React" is pretttttty tempting

<comment><USER5> Forget about file size, 40kb vs 8kb doesn't really matter in the modern era. If anything, using an obscure library may cost you more because it's less likely to be a CDN cache hit for the user.

<comment><USER6> Start testing on a mid range Android device on 3G and tell me you still believe that.

On mobile it's not just the file transfer that takes time: it's the JavaScript parsing and execution (on a single core) that hurts too. iPhones are massively faster than Android (especially cheaper Androids) at this, so many developers don't realize how much performance cost there is for a growing majority of their users.

Given how many different versions there are of popular libraries I'm personally skeptical that CDNs give you much of a chance if the asset being preloaded from another site. I'd love to see real numbers on this though.

<comment><USER7> I build games where the player is supposed to play for hours. Am I wrong thinking that file size matters less for me? It adds 1% to the loading screen.

<comment><USER4> Yeah for games it's not much of an issue.

It becomes more of an issue if you are doing a "business" app, where there's a lot of moving between pages and a lot of eventual page refreshes.

</comment></comment></comment></comment></comment></comment><comment><USER8> Is it faster than Inferno[1]?

[1] Inferno seems to be the fastest React drop-in replacement at 9kb size at the moment: [http://stefankrause.net/js-frameworks- benchmark4/webdriver-t...](http://stefankrause.net/js-frameworks- benchmark4/webdriver-ts/table.html) \- full post to the comparison table before: [http://www.stefankrause.net/wp/?p=316](http://www.stefankrause.net/wp/?p=316)

<comment><USER9> Inferno is definitely fast, but these benchmarks are highly misleading.

We're working on improving them so they better reflect the difference in keyed vs non-keyed implementations [1][2]. When ready, Round 5 should be a much more realistic apples-to-apples comparison.

[1] [https://rawgit.com/krausest/js-framework- benchmark/master/we...](https://rawgit.com/krausest/js-framework- benchmark/master/webdriver-ts/table.html)

[2] [https://github.com/krausest/js-framework- benchmark/issues/10...](https://github.com/krausest/js-framework- benchmark/issues/104)

<comment><USER8> Thanks, I was just wondering why the OP didn't compare Rax to Inferno.

<comment><USER9> Inferno is gonna be _really_ tough to beat, at least for non-keyed implementations. We don't have a keyed implementation from them, so it's hard to say exactly how they do there, but i dont doubt that it'll be at or near the top. For now kivi is likely the fastest possible but the way you have to write your code with kivi is rather unpleasent. However, the whole point of kivi was to push the perf boundaries, not to be useable directly.

At the end of the day, there are numerous <= 15KB libs that come within 3%-15% of Inferno, so the perf and size difference is really becoming secondary to lib ergonomics and features.

If you wanna read a lot more of our convo, head over to: [https://www.reddit.com/r/javascript/comments/5m2u0s/infernoj...](https://www.reddit.com/r/javascript/comments/5m2u0s/infernojs_10_release/)

</comment></comment></comment></comment><comment><USER10> Am I the only one finding it weird that they call it a render engine?

<comment><USER11> No, and it's really confusing what it really does. The one example is a hello world text. I didn't bother downloading the rest.

</comment></comment><comment><USER12> Well, I see it only a smaller project created by people in the Weex community who prefer React syntax. They did not even talk much about it on Weex Conf. [https://atf.alibaba.com/weex](https://atf.alibaba.com/weex)

</comment><comment><USER13> their repo is full of slightly adapted other packages. If they are 100% React compat, why would they need rax-redux? :-S

<comment><USER14> On the surface, the rax-redux implementation appears to be a lot simpler. For example, react-redux's connect spans all these files [https://github.com/reactjs/react- redux/tree/75658dab18f7fe3e...](https://github.com/reactjs/react- redux/tree/75658dab18f7fe3e62ea0c3d97fcf513bf176e10/src/connect) and includes "connectAdvanced": [https://github.com/reactjs/react- redux/blob/75658dab18f7fe3e...](https://github.com/reactjs/react- redux/blob/75658dab18f7fe3e62ea0c3d97fcf513bf176e10/src/components/connectAdvanced.js)

While the rax-redux equivalent seems to be contained in a single file:

[https://github.com/alibaba/rax/blob/07e20908e4e17b182873db09...](https://github.com/alibaba/rax/blob/07e20908e4e17b182873db0997729cb6c03ab690/packages/rax- redux/src/components/connect.js)

The simpler implementation might indicate that the rax developers are trimming overcomplicated bloat, or culling features that don't align with specific needs of Alibaba. Or maybe they're just removing code they don't yet understand the necessity for. It's not immediately clear what tradeoffs each are making, but having rax audit what's _really_ necessary could be a good thing for everyone.

<comment><USER15> Looks like the Rax version is based on React-Redux 4.x, which was was primarily a single file and kept most of the logic in a React component. React-Redux v5 is a complete internal rewrite that pushes the logic out into memoized selector functions.

In fact, it appears to be 98%-ish the same as React-Redux v4.4.6. They've added semicolons, swapped out the React imports for Rax imports, and shuffled the order of some of the methods, but the code is effectively identical.

</comment></comment></comment><comment><USER16> Good to see compatible implementations. Over time, we'll have something React- like as part of the web standards.

<comment><USER17> >something React-like as part of the web standards.

Hell no. High-level APIs should remain in user space, they are too often optimized for short term thinking, prone to breakage, and inefficient.

Most of the current DOM specification has been around since 1998-2000, and the spec hasn't made a single breaking change. Standards committees have an obligation to not break the foundations of the web, framework authors can do whatever.

<comment><USER18> Fair enough and very true! I suppose web-components are 'react like' in a way though so maybe it's already happening.

</comment></comment></comment><comment><USER19> Looks okay but what does it offer more than other react clones

</comment><comment><USER20> Does it support stateless function component?

</comment><comment><USER21> Noticed they added Facebook to the LICENSE. Facebook was notorious at one point for some unpopular language in their open source licenses. Does their inclusion in the LICENSE file mean a developer needs to be aware of how Facebook is currently (or in future) licensing React, as well as how Rax is licensed?</comment>


Tourist's lucky guess cracks safe code on first try - <AUTHOR> https://www.bbc.co.uk/news/world-us-canada-48477081 <comment><USER2> [https://www.cbc.ca/news/canada/edmonton/vermilion-alberta- sa...](https://www.cbc.ca/news/canada/edmonton/vermilion-alberta-safe-busted- lock-open-1.5159979)

The CBC article differs in two important aspects. The BBC article says they "enlisted the help of experts", when the CBC article says they just called a locksmith who gave them some combinations to try over the phone. The BBC article makes it sound like some tourist just tried a random combination, while in the CBC article, a machinist put his ear to the safe and listened for clicks.

<comment><USER3> I think they both tell a similar story. Someone on the tour (a machinist) played with the safe and got it open.

The experts tried it at were at a different time in the past.

<comment><USER4> You can be an expert tourist.

<comment><USER3> I imagine someone traveling wearing khakis with lots of pockets, pulling a wheelie cart with a handle, breezing through airport security and opening encountered locks in moments.

<comment><USER5> He is being followed by a guy in a pith helmet with a moustache and a big gun.

</comment></comment></comment></comment></comment><comment><USER6> If the combination does allow for wiggle room and the 1 in 8000 figure is correct, the code could have been brute forced in a couple hours. Source: my wife has a habit of forgetting the combination to her 3 digit luggage lock and I had to brute force it a few times (it's surprisingly quick, about 15 minutes) :)

<comment><USER7> The good thing about normal combination locks is that you can try all combinations sequentially with minimum movement.

      000 start
      001 1 move
      002 1 move
      ...
      008 1 move
      009 1 move
      019 1 move
      018 1 move
      ...
      011 1 move
      010 1 move
      020 1 move
      021 1 move
      ...

and so on.

<comment><USER8> I feel like saving 1 move in 10 (9 to 10 is 2 moves, 10 to 11 is back to 1 move) is not worth the mental capacity required to remember current up/down direction. Easier to let the muscles do the work and let your mind wonder.

<comment><USER7> That's a good point, though I do think that it's not that big of a mental hurdle. Consider knitting, for example.

</comment></comment></comment></comment><comment><USER9> A combination "20 - 40 - 60" on a dial that goes from 1 to 60... Sounds like an equivalent of a factory-default admin/admin login credentials. I wonder if it really was the default combination that the safe was bought with, and the owners never bothered to change it. :)

<comment><USER10> >The museum had previously enlisted the help of experts to crack the code, tried default combinations, and had contacted former hotel employees to see if they could help.

It doesn't sound like it was the default, just a "password1" situation.

<comment><USER11> Or maybe they just hired shitty locksmiths. Shitty locksmiths are often easier to find than real locksmiths.

</comment></comment></comment><comment><USER12> If the code was 20-40-60 and the "enlisted help of experts" failed to crack it, then said experts are not really up to scratch.

<comment><USER13> >The odds of Mr Mills correctly guessing the combination are pretty long, says the University of Toronto's Jeffrey Rosenthal, author of Knock on Wood: Luck, Chance, and the Meaning of Everything.

>He calculated the chance of correctly guessing the combination on one try as 1 in 216,000. (His calculation assumed the safe numbers actually ran from one to 60).

Glad they managed to find an expert with the calculating skill to clear up that other enigma as well.

<comment><USER14> Just to be cranky, shouldn't we eliminate all the permutations that use the same number three times? (i.e. 11-11-11)? My knowledge of combination locks doesn't extend much beyond goofing with Master locks in high school, but the more rudimentary designs require that the middle number be different from either of the two end ones. This doesn't sound like a super-advanced safe.

<comment><USER15> All the safes I have used have codes that get closer to '0' with each turn/direction change. This might be a low number when turning anti-clockwise or a high one when turning clockwise. These weren't sophisticated mechanisms, so it might just be these models.

</comment></comment></comment></comment><comment><USER16> "The fact that the combination was in a specific pattern and did not appear to be a random combination of numbers could also factor into a calculation of the odds, he added."

Hehe. I guess he'll have to produce a list of non-random numbers to work those odds out.

<comment><USER17> Randomness produces patterns all the time, and if we cut out the patterns that appear, then we are selecting the pattern that we've labeled as 'random.'

<comment><USER18> Humans are terrible at selecting truly random numbers so if the combination was picked by a person, and people who were guessing were also people, then I would say that the odds are significantly better that the safe would be cracked than what you would expect from calculating the permutations.

</comment></comment></comment><comment><USER19> Reminds me of the time I was playing a computer game, and right at the beginning you are presented with a door 5-digit combination lock. The objective of the game was to explore the game world and eventually discover all 5 digits of the code.

First time I played the game I just randomly entered 5 digits, and the door unlocked.

<comment><USER20> We have gotten to that point that so many new games are making references to "0451" being the first door code in old video games (System Shock, Deus Ex), you can pretty reliably use it as a first guess [0].

[0] [https://www.ttlg.com/forums/showthread.php?t=147925](https://www.ttlg.com/forums/showthread.php?t=147925)

<comment><USER21> I remember my uncle playing my copy of Bioshock way back when, he walked up to a random door and typed in 0451 and it opened. My mind was blown.

</comment></comment></comment><comment><USER22> >The museum had previously enlisted the help of experts to crack the code

since they have (essentially) infinite time, why couldn't they attach a machine that tries all possible combinations? feels like something that someone from the high school robotics club could come up with.

<comment><USER23> The article states that the museum is in a town of a little over 4,000 people. My guess is there was simply never the right combination of interest, knowledge, and resources available.

<comment><USER24> > the right combination

ISWYDT

</comment></comment></comment><comment><USER25> This reminds me of Feynman

[http://www.openculture.com/2013/04/learn_how_richard_feynman...](http://www.openculture.com/2013/04/learn_how_richard_feynman_cracked_the_safes_with_atomic_secrets_at_los_alamos.html)

</comment><comment><USER26> 1 in 216000... seems like you could build some robotic device to brute force that pretty easily... or you know, introduce it to a thermic lance.

EDIT: sorry, my research suggests that safe-cracking with thermic lances is plausible but not practical (source; Mythbusters, of course)

<comment><USER27> or maybe with a handheld x-ray like this:

[https://www.youtube.com/watch?v=ovqJpcaWD7o](https://www.youtube.com/watch?v=ovqJpcaWD7o)

but not with every safe:

"Some modern safe locks are made of lightweight materials such as nylon to inhibit this technique, since most safe exteriors are made of much denser metals"

[https://en.wikipedia.org/wiki/Safe- cracking#Radiological_met...](https://en.wikipedia.org/wiki/Safe- cracking#Radiological_methods)

<comment><USER28> Not that this was a modern safe (Thought to be bought in 1907)

</comment></comment></comment><comment><USER29> Everyone is so amazed that he opened the safe "on the first try" but the article also says, "Like the Mills family, other museum visitors played around with trying to open it, with no success." Moreover the museum had had the safe since the mid 90s, at least 20 years... sounds like lots of tries by tourists... is it really so surprising that someone eventually opened it? Probably people don't sit there all day, they try once or twice then let the next person have a go... so maybe 50% chance that the person that opened it would get it on their "first try". (If not the article would have said "almost immediately" which would be nearly as newsworthy.) Sounds like the multiple comparisons fallacy.

More-moreover, not unlikely there are multiple safes in public places like this in the world (I have seen at least one before in an antique shop that people would try like this) but this is the one that got opened and therefore written up in the news... sounds like survivorship bias.

</comment><comment><USER30> _> Typical combination lock_

Now hands up everyone who's TSA luggage lock combination is 9-1-1. Social engineering is the most interesting cracking to me.

<comment><USER31> I prefer 666 as a subtle reminder to the thief that they are being naughty.

</comment></comment><comment><USER32> During high school, I played a lot of morrowind and thought it was cool to learn how to pick locks. I had already known how to break combination locks, and I already taught myself to open traditional pin and tumbler locks. I saw a number lock with 4 digits and I couldn't help myself. Considering they were just numbers I thought to myself, this is a guaranteed crack. So every day before and after class, I would take a minute to mechanically go through about 50 numbers. Testing numbers is surprisingly quick.

It only took me like 3-4 weeks of testing a few numbers before and after class and I had it open.

The loot? A pair of used gym socks, shoes, and one of those math homework books you write in.

</comment><comment><USER33> "he noted that some combination locks allow for wiggle-room and if this one had a three-digit leeway, Mr Rosenthal put the chances at 1 in 8,000, "which is still a small chance"."

If this is the case, and there have been museum visitors having a go at opening the safe each day... this becomes a non story, right?

<comment><USER34> Humans are terrible at picking random numbers, it's quite likely many people tried the same thing (more or less).

<comment><USER35> But if the code was set by humans, it just makes finding it even more likely...

<comment><USER34> Only if somebody uses a human generated number (as done in this case). If it's genuinely random then it could take humans quite a while.

</comment></comment></comment></comment><comment><USER36> Alternative headline: after experts fail, museum successfully crowdsources brute force attack on safe, over decades.

With all due respect to Mr. Mills, in this context he's a pawn in someone else's master plan.

</comment><comment><USER37> What are the chances someone will crack any safe and that it will be a news worthy item?

Sounds like the newest hippest curve ball question on an interview :D

<comment><USER38> The chances of getting to correct number + (the number of news reporters per square mile in the town/total population per square mile)

</comment></comment><comment><USER39> The code was 20-40-60 is like somebody setting their account password as "password123" to me

</comment><comment><USER40> Its interesting that this is interesting.

People win the lottery all the time, they aren't newsworthy in the 'lucky guess' sense.

On the other hand whenever someone gets out a pack of cards I always try and guess the top card. Eventually I'll get it right.

</comment><comment><USER41> Reminds me of the famous 'Luggage Combination' scene from SpaceBalls.

[https://www.youtube.com/watch?v=_JNGI1dI-e8](https://www.youtube.com/watch?v=_JNGI1dI-e8)

</comment><comment><USER42> I thought the bbc had mis-lablled a photo of Gennady Korotkevich. ([https://en.wikipedia.org/wiki/Gennady_Korotkevich](https://en.wikipedia.org/wiki/Gennady_Korotkevich))

<comment><USER42> Gennady Korotkevich is a competitive coder who go's by the handle _tourist, so I read this headline as about him cracking a safe

</comment></comment><comment><USER43> > "They have no value really, but they are of great interest to us. It gives > us a little bit of idea of what the places were like in 1977, '78," said Mr > Kibblewhite.

This must be the most American thing ever. 40 year old stuff treated like they're ancient.

<comment><USER44> >This must be the most American thing ever.

Guys, who's going to be the one to tell him?

<comment><USER45> I'm sure the Canadians will be here shortly to correct him.

<comment><USER46> The sentence right before is: The pad included receipts for a mushroom burger for C$1.50 ($1.12; £0.59) and a package of cigarettes for C$1.00.</comment></comment></comment></comment>


A `pip` hack to upgrade all your Python packages - <AUTHOR> https://hackernoon.com/a-pip-hack-to-upgrade-all-your-python-packages-492658c49681 <comment><USER2> We use different files for "soft" requirements, dev/test requirements, and a freeze.txt containing all production requirements and then we default to installing from freeze.txt but can update from the other files. It's similar to this[1] but generating the freeze.txt in a temporary virtualenv.

I've started using an generated offline cache and PIP_FIND_LINKS to remove the dependency of pypi for known installs in one project as well, will be interesting to see if it turns out to be a good idea or not.

[1]: [https://www.kennethreitz.org/essays/a-better-pip- workflow](https://www.kennethreitz.org/essays/a-better-pip-workflow)

</comment><comment><USER3> A similar script in Windows script (.bat)

for /F %%i in ( ' cat requirements\\\base.txt ^| cut -f 1 -d ^= ' ) do pip install %%i --upgrade

Careful, it needs the unix utilities cat and cut on the path - they are included in various other packages so you will probably already have them.

Also, it must be run through a .bat file and not directly from the command line.

</comment><comment><USER4> Is it so difficult to upgrade all your outdated packages with pip?

All I do to upgrade with packages under virtualenv is the following:

       pip install -U $(pip list -o --format=legacy | awk '{print $1}' | paste -sd ' ')

That's it, really.

</comment><comment><USER5> Or, install pip-review.

[https://github.com/jgonggrijp/pip-review](https://github.com/jgonggrijp/pip- review)</comment>


Two-Factor Authentication with SSH - <AUTHOR> http://sysconfig.org.uk/two-factor-authentication-with-ssh.html <comment><USER2> We've been using Duo Security for two factor ssh auth[0] for a number of years. Its quite easy to setup and gives you push notifications to your phone. Its awesome.

[0]: [https://www.duosecurity.com/docs/duounix](https://www.duosecurity.com/docs/duounix)

<comment><USER3> Hi. I live in a dangerous city. What if I lost my phone?

<comment><USER4> Encrypt it? Don't store credentials on it unless you really need to? Make rotating keys and passwords easy in the event of losing it?

</comment></comment></comment><comment><USER5> From the article: "You should not publicly expose SSH on any server, if you can avoid it! The vast majority of your estate would of course be locked away and protected by some sort of proper VPN (IPSec, OpenVPN etc), wouldn't it?"

I'm curious about more details -- to what degree is SSH (with public key auth only of course) more vulnerable than VPN, and for what reason? From academia I'm used to access to computers around the world using public SSH and port forwarding for most things, and in my world VPN was something people used on Windows, or just because it lets desktop applications act more normally, but I didn't think there was a security difference...

(Yeah I don't do sysadmin work, rest easy)

<comment><USER6> The author goes into this in the beginning by stating that the admin can have "PasswordAuthentication no" in sshd_config and users with keys can still have weakly protected (or unprotected!) keys.

In other words, you can lead a correct horse battery staple to water, but you can't make it protect its key pair with a strong password.

<comment><USER7> That's a separate issue though. You can have weak/unprotected VPN keys as well.

I think the author's argument about using VPNs is more a "right tool for the job" thing. SSH is fine for remote shell, but then you start to need other network service access. You can use SSH tunneling, yes, but a VPN is better suited.

So, in a nutshell, the point is "only expose a _single_ service." And since a VPN is more flexible than SSH, might as well go with that if you have the choice. You can of course make counter arguments along the lines of "expose only the minimal amount of functionality" or whether you think a VPN or SSH is more secure.

</comment></comment></comment><comment><USER8> The usability of Duo Security's SSH two-factor and PAM two-factor make Google MFA look like an early beta of Microsoft Bob.

It's already in the most popular repos. It's used by the likes of NASA, Facebook, Box, Arbor Networks, Internet2, Twilio, Yelp, etc.

[https://www.duosecurity.com/docs/duounix](https://www.duosecurity.com/docs/duounix)

<comment> ryan-c Google Autenticator can't be bypassed by someone with access to Google's systems. Duo's two factor auth can be bypassed by someone with access to Duo's systems.

For what it's worth, I agree that Duo has better usability, and is probably the better solution in most cases. TOTP is the more paranoid option.

<comment><USER9> I believe that Google Authenticator uses TOTP. Six digit HMAC-SHA1 TOTP from a base32 encoded secret using a 30 second timestep. At least, that has been my experience. I wrote an OATH client and it works with Google Authenticator using those parameters. [https://github.com/w8rbt/oathgen](https://github.com/w8rbt/oathgen)

Duo supports this as well (and also other TOTP/HOTP modes). If you have access to a Duo account, look at the 'Import Hardware Tokens' feature under 'Devices'. That's not named accurately. Really it should be named, 'Import TOTP/HOTP secrets' as that's what they ask you to import and those secrets can be used in OATH compliant HW fobs or any software that does standard TOTP/HOTP. They also allow you to import Yubikeys as well if you like (of course, that's not OATH).

<comment><USER10> TOTP relies on a shared secret. With Google Authenticator, the secret is shared between your phone and the SSH server you're logging into. With Duo, the secret is shared between your phone and Duo's API backend; the server has no independent way of authenticating it.

</comment></comment></comment></comment><comment><USER11> _Now, some people argue that a password-protected SSH key pair consitutes MFA, with the key pair being the "what you have" and the password protecting it being the "what you know". Well, it is wrong and dangerous!_

No. It is fundamentally correct. The user can always do all kinds of stupid things to undermine the security of services they can access. For example transfer their token from a separate device (phone) to a generator on the same computer they use to log in (there's even a Chrome addon somewhere), or store passwords in a sticky on the screen... the possibilities are endless.

Still a good article on your MFA options with ssh.

<comment><USER12> Right, it is wrong and dangerous, but not for the reason the article claims. The user can always do something stupid to compromise their security, but if they just do what they're advised to do (store their token on their phone), then with proper 2FA, the attacker has to compromise two systems (the computer with the terminal and the phone with the TOTP secret) to gain access. With SSH passphrases, only one system needs to be compromised (the terminal).

</comment></comment><comment><USER13> Found Mozilla's version [https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Multi-F...](https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Multi- Factor_Authentication_.28OpenSSH_6.3.2B.29)

<comment><USER14> That one seems to recommend the OATH-toolkit, I tried it once and the documentation wasn't impressive (shocker!) and I was concerned about the security aspect as well. I wonder if anyone has audited that code properly?

Google Authenticator PAM module seems to be the other option that is widely used and it's much easier to find information on it.

<comment><USER13> the oath toolkit seems more standard if you look at the code itself, google authenticator code is pretty ugly in comparison

</comment></comment></comment><comment><USER15> Another one [https://www.rcdevs.com/products/tiqr/](https://www.rcdevs.com/products/tiqr/) [https://tiqr.org/archives/353/](https://tiqr.org/archives/353/)

[http://www.reddit.com/r/2fa](http://www.reddit.com/r/2fa)

</comment><comment><USER4> What about when your users start storing their passwords in a password manager app? Which is on both their smartphone and their laptop? (And it's possibly only encrypted when they are logged out - i.e. hardly ever)

The point being that users are already turning something-you-know into something-you-have by using a password manager.

EDIT I'm not saying that password managers are a bad thing.

</comment><comment><USER16> We use fwknop (time-based, single-packet, single ip, port knocking with gpg keys) + monkeysphere (ssh keys stored in gpg) + Google Authenticator on FreeBSD with PF enabled in addition to Security Groups on AWS.

</comment><comment><USER17> [https://jumpcloud.com/blog/sharing-google-authenticator- secr...](https://jumpcloud.com/blog/sharing-google-authenticator-secret-keys- across-servers/) If you are interested in setting up 2FA for SSH, we have a great step-by-step guide for multi-machine deployments. Alternatively, you can sign up for JumpCloud to automatically implement this, and manage other key aspects of your infrastructure.

</comment><comment><USER18> I'm using yubico-pam ([https://github.com/Yubico/yubico- pam](https://github.com/Yubico/yubico-pam)) module for a bit over a year now on our controlling servers as well as my own, so that we can use Yubikeys for authentication. Works extremely well so far.

</comment><comment><USER19> Shameless self-plug:

Three-factor authentication with ssh public key, Google Authenticator and password

[https://turquoiseliquorice.wordpress.com/2013/10/05/three- fa...](https://turquoiseliquorice.wordpress.com/2013/10/05/three-factor- authentication-with-openssh-google-authenticator-and-password/)

<comment> ryan-c That's still two factor authentication. The possible factors are "something you know", "something you have" and "something you are". Two "things you have" only count as a single factor between them.

<comment><USER20> How do you authenticate something you are? Specifically across a medium like the internet? Fingerprint scans?

<comment> ryan-c Generally, "something you are" is some sort of biometric. Fingerprint, iris, hand geometry, palm veins, face and voice are all possible. Some laptops have fingerprint readers, face/voice recognition would probably work fine through a cheap webcam. I'm not sure how you'd prevent replay attacks if you were running it over the internet.

<comment><USER21> For single or small-n user systems, the best practice that's evolved around this is to not actually send the fingerprint image to the remote server. A trusted security module has a private key and the biometric sensor, and the remote server has the public key. The trusted security module locally validates the fingerprint, and then signs a message that can't be replayed to indicate the fingerprint was presented.

</comment></comment></comment></comment></comment><comment><USER22> I've found the biggest issue with most of the Google Authenticator implementation is that they store the seeds in plain text.</comment>


Driving Your Startup to Profitability is Job One - <AUTHOR> http://www.caycon.com/blog/2011/11/driving-your-startup-to-profitability-is-job-one/ <comment><USER2> Profitability is ALWAYS the biggest, most important piece!</comment>


Ask HN: What are the most beneficial benefits we can get from AI? - <AUTHOR> I have a pointed version of this question;
Law. Can we give the entirety history of legal precedent to AI/ML and have it come up with what IT thinks is a good outcome. Then compare that with what humans deem reasonable?
What would be the inputs which we would use to tune such a system?
Where "[behavior]==bad, [Year]==XXXX" vs "[behavior]==good, [Year]==XXXY"
Or whatever the makeup is...
But a singular judge was found to be seemingly incompetent in their punishments for crimes recently and I just find that sort of behavior to be despicable.
I am not a fan of AI for bureaucracy, but jeasus chimminey - judges are completely AWOL on consistency even though 'precedence' is supposed to be upheld <comment><AUTHOR> Open law AI project needs to be a thing.</comment>


New Austin startup (in the Startup District) looking for a LAMP developer - <AUTHOR> http://www.treyp.com/thinkwelljob/

<comment><AUTHOR> Mentioning HN in an email if you're interested = mad bonus points.</comment>


New Multi-Touch Gestures on iPad iOS 4.3 - <AUTHOR> http://www.macrumors.com/2011/01/12/video-of-new-multi-touch-gestures-on-ipad-ios-4-3/ <comment><USER2> The whole idea of system-wide gestures seems wrong and un-iOS like.

The whole point of the iOS interface is that each app has its own mechanisms for accomplishing things that are optimized for that app alone, and the device is just a container that enables each app to do this.

So when you're in the web browsing your app, the experience is that you're using a device that has been made for web browsing. When you're in a calculator app, you're using a device that was built to behave like a calculator.

There are certain standards and techniques that all apps adopt when they handle similar tasks (like swipe to delete a row in a list or pinching to zoom and 2-fingered drag to pan) but those are all implemented by that specific app.

If the app decides that a 4-fingered swipe is the natural way of representing 'go to previous page' then thats what it will use.

Now, with a system-wide gesture, the _container_ is peeking in through the application's interface and putting its stamp.

Until now, this was the function of the home button which was clearly outside the app's interface. Looks like that's changing now.

<comment><USER3> 4 finger swipe already exists on OSX as a system wide gesture for Expose and Application switching. No, it's not exactly an apples to apples comparison as OSX doesn't depend on gestures as heavily, but the tradeoff is well worth the benefit.

You no longer need to push on a physical button to switch between apps!

Re: the container peeking through the application's interface.

This isn't necessarily a bad thing either. I'd argue that consistency can (in some cases) be more important than giving application developers total control. Have you ever been to a site which intercepts right clicks so that you can't copy and paste?

<comment><USER2> I don't know, I think I'd rather have a physical button that I can press with the hand I hold the phone with than have to do a four-figured operation on the screen.

<comment><USER4> I don't think the four-finger operations are on the iPhone/iPod, I think they're only on the iPad.

<comment><USER5> Correct. At least, that's the info that's currently available. :) If you try fitting 4/5 fingers on the phone, it's way too small to work well anyway. I don't expect them to show up there. If they do remove the button, I'd expect to see it only removed from the iPad.

</comment></comment></comment></comment></comment><comment><USER6> hopefully the browser will get the 3-finger gesture for back/forward.

<comment><USER7> I don't think that will be possible. From the video, it looks to me like the three-finger gesture is only for switching between apps, and having an app intercept it would be jarring. For instance, if you were swiping through your recent apps, and got to the browser, you wouldn't be able to move on using the same gesture, and it would be like hitting a brick wall. In fact, I imagine that individual apps won't even be able to capture these gestures, because the system will catch them first, and interpret them as app-switching.

<comment><USER8> From what I understand, switching apps is done using 4 or 5 fingers, so the 3 finger gesture is still free to be used by the app itself.

<comment><USER5> I believe 3 finger gestures are used by VoiceOver so there's a possible conflict there, but VoiceOver is a system wide on-off setting so I don't know if that'd be a good enough reason not to use them as shortcuts. VoiceOver more or less redefines how you interact with apps anyway, so I'm not sure it'd bit a big problem, but Apple may want to avoid having too many different actions for different combinations of fingers.

</comment></comment></comment></comment><comment><USER2> How does this effect apps that already use a 4-fingered gesture?

It's technically possible to support it (I believe the touch events give you up to 11 touches). Are there any apps that actually do?

And were there any guidelines in place about not using multi-touch gestures in apps that needed more than 2 fingers?

<comment><USER9> I'm curious how an app could use 11 touches. Both hands and a toe?

Also, most of the piano/music type apps support at least more than two.

<comment><USER10> Other than dirty jokes, perhaps a two-player game?

</comment></comment></comment><comment><USER11> Wow. They could, foreseeably, do away with the home button now. Multi-touch is fascinating, until it becomes non-intuitive and too complicated...

<comment><USER12> Doing away with a physical home button has accessibility implications, an area where Apple is a leader. I don't think it will happen.

<comment><USER5> Possibly, but the iPod nano doesn't have a home button and instead uses gestures for everything. Perhaps the nano was partly an experiment to see how well that concept worked in the wild.

</comment></comment></comment><comment><USER13> Getting rid of the home button would be very interesting/nice, since it is one of the last things that keep the iPad from being truly orientation-agnostic. (The rest being the power switch, speaker and the headphone jack, but these don't matter that much.)

<comment><USER14> You apparently don't use Netflix, MLB, NPR, YouTube, etc, etc. :)

I find myself looking for the speaker and volume switches a lot.

<comment><USER15> On 4.3, this would be a four finger swipe up to reveal the multitasking bar and a swipe from left to right on the bar to reveal the sound controls in any device orientation. Works pretty smooth, i'm running it now.

</comment></comment></comment><comment><USER16> Why are new gestures news-worthy(HN)?

<comment><USER11> Because it is an interesting UI/X innovation? And as the other poster said there's quite a few apple users on HN who would appreciate the info (I know I did)

<comment> sans-serif Even if you're non-Apple users interested in UI/UX, the news will be of interest because in this field most everybody ends up copying Apple. _flamesuit on_

<comment><USER17> You can take off the flamesuite.

* WebOS, imho, has the much better UI than apple now * And 2nd, it's, imho, desired if Google, apple, RIM, Microsoft, Nokia and HPalm copy from each other.</comment></comment></comment></comment>


How much should a custom WordPress website cost? - <AUTHOR> http://www.poststat.us/wordpress-website-cost/

<comment><USER2> Or you could just go with 29doors.com and get a semi-custom site with customized colors, fonts, and layout. U.S. based, easy to talk to on the phone, and very available around the clock.

</comment><comment><USER3> I tend to negotiate at ~$400.00, but that typically involves writing a custom child theme and plugins. Although i've done it for "whatever you can afford" for friends.

<comment><AUTHOR> If I have a friend that can't pay what I find it worth, I usually just do it for free. As soon as someone pulls out their wallet, expectations go way up. Another good tactic I've heard is to put the value price (what you'd charge someone legit) and then discount it to their price, but show it all. Then they value it what it should be.

</comment></comment><comment><USER4> I'm surprised you can charge big bucks for a WordPress blog. I guess it's a big-name brand these days.

<comment><AUTHOR> People build a lot more than blogs with it now. It goes head to head with just about any CMS now, and dominates the broader CMS market. That said, it's just now being included in more enterprise and government style projects.</comment></comment>


Show HN: Weekend project - a WebGL Orrery - <AUTHOR> http://www.solar-system-explorer.com This was my recent weekend project, aimed at teaching me JavaScript, a bit of HTML5, and (mostly) WebGL. The orbital data are from NASA JPL. I was inspired in part by this Flash app: http://www.dynamicdiagrams.com/wp-content/uploads/2011/04/orrery_2011_bce.swf, but wanted to do something in 3D.
Coming from the games-dev world, this is my first introduction to web coding. The UI is jquery. I mostly used http://learningwebgl.com/blog for the 3D stuff. Being WebGL, it will work mostly on Chrome, Firefox 4 Beta. Forget about IE.
I needed to figure out how to render text to the WebGL canvas - I won't say I have the perfect solution, but the general approach is to use a conventional HTML5 canvas, then copy it once per frame into a WebGL texture. There's something funky going on in this process - the textures get corrupted, and resizing the window leads to slowdown.
For the future I'd like to make the planets clickable and zoomable, maybe put in a search box to zoom to objects of interest. I'd like to build it up to a full catalogue of the Solar System - comets, the larger asteroids, dwarf planets - and maybe add the capability to put in known space mission trajectories. <comment><AUTHOR> This was my recent weekend project, aimed at teaching me JavaScript, a bit of HTML5, and (mostly) WebGL. The orbital data are from NASA JPL. I was inspired in part by this Flash app: [http://www.dynamicdiagrams.com/wp- content/uploads/2011/04/or...](http://www.dynamicdiagrams.com/wp- content/uploads/2011/04/orrery_2011_bce.swf), but wanted to do something in 3D.

Coming from the games-dev world, this is my first introduction to web coding. The UI is jquery. I mostly used <http://learningwebgl.com/blog> for the 3D stuff. Being WebGL, it will work mostly on Chrome, Firefox 4 Beta. Forget about IE.

I needed to figure out how to render text to the WebGL canvas - I won't say I have the perfect solution, but the general approach is to use a conventional HTML5 canvas, then copy it once per frame into a WebGL texture. There's something funky going on in this process - the textures get corrupted, and resizing the window leads to slowdown.

For the future I'd like to make the planets clickable and zoomable, maybe put in a search box to zoom to objects of interest. I'd like to build it up to a full catalogue of the Solar System - comets, the larger asteroids, dwarf planets - and maybe add the capability to put in known space mission trajectories.

</comment><comment><USER2> Looks pretty great, well done!

In Firefox 6, the knob of the speed slider appears at the top of the page, instead of inside the slider track. It looks like this is caused by having "display: inline-table" on the #time_slider element. That seems a strange choice, given that there's no child-elements with "display: table-row" or "display: table-cell". If I change #time_slider to be "display: inline-block" instead, the knob appears in the right place and works as expected.

<comment><AUTHOR> Thanks! This improves it a bit though for me the slider is now above its track on Firefox. I'll keep at it - my GL skills are a bit ahead of my CSS at this stage!</comment></comment>


Ask HN: Best Online Accounting App for Startups ? - <AUTHOR>

We're moving our book keeping and invoicing away from Excel and into the world of online small business accounting apps.
We've shortlisted: 1. Xero (http://xero.com) 2: Pulse (http://pulseapp.com)
I was wondering what the recommendations are from the HN community? Are there any YC startups offering these services? <comment><USER2> We've (4-man "lifestyle" software company) been using QuickBooks Online since the beginning of the year, and it's worked out well for us.

It's mainly used by one of us (myself, as president/chief bottle washer) for sales & general accounting/reporting/payroll stuff, but any of us can use it for quick reports about sales, A/R, etc.

Other than some extended downtime (several hours over a couple of days) recently, it's been quite good.

</comment><comment><USER3> It depends on the specific services you're looking for. If you have a tax preparer or otherwise need more robust reporting, you'll probably want to go with a larger package, like Quickbooks. That's what Fred Wilson recommends. In fact, you should check out his recent post on accounting: <http://www.avc.com/a_vc/2010/03/accounting.html>.

I'm considering moving to Quickbooks, but I've been using (and have been happy with) a straightforward, well-designed tool called Outright (<http://outright.com/>). Another simple accounting tool in this space is LessAccounting (<http://lessaccounting.com/>).

I _don't_ think that you should make your choice based on the cost of the apps ... you should use tools that work, even if they cost money. But if you aren't sure what you'll want to use, Outright is free, and LessAccounting has a freemium setup, so you can try with little risk.

</comment><comment><AUTHOR> What a terrible website QuickBooks have! Hardly any product info for the online only version...and almost twice the price of the competitors with only half the number of features. I guess they'll be merging Mint.com into their QB service?

</comment><comment><AUTHOR> Similar conversion going on at LSC: [http://groups.google.com/group/lean- startup-circle/browse_th...](http://groups.google.com/group/lean-startup- circle/browse_thread/thread/38147b2674c91770)

</comment><comment><USER4> checkout freshbooks.com .

<comment><AUTHOR> Yes i've tried Freshbooks and was impressed with the overall experience, but it seems more geared up towards time and materials based charging and invoicing, rather than expenses and general business accounting.</comment></comment>


Show HN: Blocksign, a Bitcoin service for legally signing any document - <AUTHOR> https://blocksignit.com/

<comment><USER2> I used this to send an offer to a candidate and get it signed, love this thing already.

</comment><comment><USER3> used it to sign my offer letter. worked like a charm! interesting concept as well.</comment>


Xkcd: volume 0 now available - <AUTHOR> http://store.xkcd.com/xkcd/#xkcdvolume0

<comment><USER2> Ordered. Shipping is supposed to take up to 2-3 weeks.</comment>


Show HN: Xpressive - CSS3 Live Design Tool for Mac OSX - <AUTHOR> http://xpressive.org/

<comment><USER2> Looks very impressive; I only do CSS occasionally so an easy tool like this is of value to me. Will try it.

A couple of things: I don't think the dot-org TLD is appropriate for a commercial venture. Your app store link takes me to an itunes web page on the Japanese app store, rather than launching App Store itself.

<comment><AUTHOR> Hey, The link they pointed is [https://itunes.apple.com/js/app/xpressive/id665817114?mt=12](https://itunes.apple.com/js/app/xpressive/id665817114?mt=12)

They should have pointed it to global link [https://itunes.apple.com/app/xpressive/id665817114](https://itunes.apple.com/app/xpressive/id665817114)

</comment></comment><comment><USER3> I just downloaded the trial, but the app requires Mac OS X 10.8, I'm still on 10.7. I suggest to put something in the website that it requires 10.8.

<comment><USER4> I would suggest to make it compatible with 10.7 :)

</comment></comment><comment><USER5> This is not a fault of Xpressive, but of CSS3's implementation: doesn't it bother anyone that we're in 2013 and we still have non anti-aliased motion graphics?

[http://i.imgur.com/GAJuyqV.jpg](http://i.imgur.com/GAJuyqV.jpg)

<comment><USER6> Interesting: I'm using Chrome and I don't actually see the graphic you linked. I saw a mess of boxes shaped roughly like what you posted halfway down the page and had no idea what it was. Chrome bug? Or maybe a CSS issue?

</comment></comment><comment><USER7> I think a double display setup coupled with automatic page refresh after a change is more than enough to efficiently write CSS.

<comment><USER8> Yeah, I'm not quite sure why they're pushing "live changes" feature so hard. It's been around forever.

<comment><USER9> Yes, but there may be some non-dev designers that do not yet know how to set it up, or haven't heard of Grunt.

<comment><USER10> That's what I was wondering about. Grunt is absolutely perfect for these kinds of workflows and if you want realtime changes that don't involve refreshing the page, just use the developer console.

</comment></comment></comment></comment><comment><USER11> looks fine I may give it a try to compare it with [http://brackets.io/](http://brackets.io/) , can you tell me why would someone choose it over an amazing, free and open source project like [http://brackets.io/](http://brackets.io/) ? Why should I use it over Bracket ?

</comment><comment><USER12> FYI, the call to action is obscured (actually it's more accurate to say there is no call to action, i.e. a button to download the app) in iPad portrait mode. You can see this when you resize the desktop browser to that width.

</comment><comment><USER13> This looks really interesting. Going to give it a play today. I'm interested in how you handle keyframe animations

 _EDIT_ I had a quick look through your CSS (which I think is built using Xpressive) overall I think it looks pretty good. Although you could definitely shave of 30% off by inlining some of the rules. For instance for margin:0 auto; you call margin-left:auto, margin-right:auto. The same applies for background, using the shorter version cuts files sizes dramatically

<comment><USER14> Just for the sake of clarification, I don't think "inlining" is what you're looking for. Using `margin: 0 auto;` is shorthand, not inline. Inline would be `<div style="margin: 0 auto;"></div>`. Definitely don't want that :)

</comment></comment><comment><USER15> Just purchased the full version for 21.99 on the Mac App Store. Is there an email address to give feedback to? I assume OP wanted feedback?

<comment><USER16> I found this: firstname.lastname@example.com

Also on Twitter: [https://twitter.com/Xpressive_Team](https://twitter.com/Xpressive_Team)

</comment></comment><comment><USER17> I wonder if this kind of native design would be easier to use than fully custom setup that many web applications are creating.

</comment><comment><USER18> will give it a go, though there are other ways to do the live reload (grunt for instance).

Being able to save code changes in element inspector is nice, any way to do that in chrome?

What were the other killer features?

</comment><comment><USER19> What does this do that codekit and a browser cant?

<comment><USER20> How do I get that timeline editing feature in CodeKit and Chrome? Oh, and automating the vendor prefixing. That would be nice as well.

Thanks!

<comment><USER21> The timeline editing is pretty cool. But you could easily get automatic vendor prefixing with SCSS/SASS (and you should be using a compile-to-CSS language if you're doing serious web design), and automatic reloads with Vogue or LiveReload. If I wanted to do serious CSS animations, though, this is worth a shot - and it's a great tool for inexperienced web designers or those short on time.

<comment><USER20> I was asking because the OP to my comment implied it could be done with just a browser and CodeKit. I'd rather keep the number of dependencies to a minimum. I haven't used Chrome for front-end dev work for some time, so maybe it's added these features. And CodeKit does compilation, so I figured it would have this.

If I have to go the route of installing a bunch of individual tools and maintaining them separately, then it becomes less appealing.

<comment><USER21> Yeah, I get that. It depends on how often you do web work. If you do it as often as I do, it makes a lot of sense to put in the extra effort now to streamline you work in the future. But obviously that doesn't apply to everyone.</comment></comment></comment></comment></comment>


Show HN: Boost your productivity with Trello, Hipchat and Github - <AUTHOR> http://needforair.com/blog/2012/05/03/we-wrote-a-book/

<comment><USER2> > If that's what you're looking for, we recommend Eric Ries' The Lean Startup, > a must-read in our opinion.

There are better books, I think. I've just read Nail It Then Scale It, which is mostly better than Ries' book. Steve Blank's new book also comes to mind, and Running Lean also comes highly recommended from others I know. Ries' book is too generic and leaves you without much of substance once you're done with it.

<comment><USER3> I felt _The Lean Startup_ could've been written in one-fourth of the amount of pages Ries used. There was a lot of fluff to wade through and I kept thinking "Come on, come on! Where's the good stuff? Where are the principles and case studies?" Perhaps I took the book a bit too seriously and had high expectations going in – I took notes and was really intent on studying the book – so perhaps one would get more out of it if used for more casual reading.

<comment><USER4> You are being FAR too kind. It could be condensed to two pages.

I honestly can't understand what the fuss is. There are far better books startup books going around.

</comment></comment></comment><comment><USER5> Great stuff. We use an xmpp chat room on jabber, github with hooks to jabber, and a knowledge engine that i build myself which is basically a search engine that will index anything you submit. Oh and Asana of course because its dynamic. Does the book mention any cool integrations or mashups between the three?

<comment><USER6> Sounds like you work a lot like us only with different tools. We have a synergies chapter that covers some of the mashups between tools, namely github hooks into Hipchat. However we don't go into details as to more complicated mashups, we just mention APIs. This guide isn't really targeted to very savvty people like it sounds you are but rather toward workflow noobies!

</comment></comment><comment><USER7> Good example and pieces of advice, although I prefer Asana over Trello. Can't wait to see these guys in action after choosing all these good tools

<comment><USER4> Are Asana and Trello really comparable though ?

They seem like completely different products Asana being a shared todo list and Trello being more like an Agile task board.

Asana felt more like a competitor to Basecamp to me only not as full featured.

</comment></comment><comment><USER8> sample <http://samples.leanpub.com/startupflow-sample.pdf>

</comment><comment><USER9> Where's the evidence? Show me that I will necessarily be more productive just because I use Trello and Hipchat.

<comment><AUTHOR> That's what happened to us. Huge difference for us between Skype chat (no hook with Github)/paper todos and Hipchat (which tells us about new stuff onGithub)/Trello. But the best way to experience it is to try the tools :)

</comment></comment><comment><USER10> _It adresses questions about_

*addresses

:-)

<comment><AUTHOR> Thanks to Leanpub, our readers will receive the corrected version :)</comment></comment>


Eero Is a Smart Wireless Routing System (Nest For WiFi) - <AUTHOR> http://techcrunch.com/2015/02/03/eero/

<comment><USER2> Dual-band (2.4GHz, 5.8GHz) AP with a Qualcomm 802.11ac SoC. Maybe it uses 802.11s to assist with mesh layer 2 routing? I'm curious to what extent the device may depend on Cloud-based mgmt services provided only by Eero, similar to Cloudtrax and Meraki's offerings?</comment>


Identification of Pre-Existing Immunity to Cas9 Proteins (CRISPR) in Humans - <AUTHOR> https://www.biorxiv.org/content/early/2018/01/05/243345 <comment><USER3> IANAS, but I do not believe that immunity will be a gating issue - <USER2> straightforward solutions on that front including 1) ex vivo treatment 2) tweaking Cas9 to make it undetectable by the immune response 3) varying the Cas9 variant 4) Cpf1 orthologs 5) nanoparticle delivery 6) intracellular expression may not be inhibited 7) suppress the immune response 8) treating organs that do not engender the immune trigger (e.g. eyes). Some of the brightest scientists of our time are advancing the science daily, I would not think they would be stymied by something so obviously foreseeable and circumventable. This is definitely something to be addressed, but the recent headline and twitter echo chamber was dramaticized to maximize in-feed virality. Immunity is a distant third in terms of hurdles and already has clearly identifiable workarounds - efficient somatic delivery and enhancing specificity w minimal off-target impact are of far greater priority. Just my $0.02.</comment>


Overlooked Gems of Science Fiction and Fantasy - <AUTHOR> http://greatsfandf.com/overlooked-books.php

<comment><USER2> "... of Anglo-american ..."

<comment><USER3> "...in English..." maybe you'd get away with; neither all the authors in this list, nor the authors and books listed throughout his site are all Anglo- American, it just happens that there are more books printed in English by anglo-americans than by non-anglo-americans.</comment></comment>


Analysis of the Imperial College Epidemiological Model - barry-cotter https://m.facebook.com/scarlett.strong.1/posts/252437219500976 <comment><AUTHOR> We could argue about code smells all day, but ignoring that, I think there's only one essential point made in the post. It claims that without a lockdown, things would be just fine, because people would automatically isolate themselves on their own. And therefore the model is useless.

This is a completely unfair criticism. When the relevant decisions were being made two months ago, a huge number of influential people in the UK were seriously proposing to do _nothing_ to get herd immunity. This model, which intentionally depicts what would happen if people indeed did nothing, was a big part of why people changed their minds.

You can't say the model is wrong because people would take COVID seriously anyway, when the model is half the reason people take it seriously in the first place. We're somehow forgetting history that's only months old now.

<comment><USER2> According to the Atlantic

> Johnson instead offered a suite of soft advice—people with symptoms should > stay home; no school trips abroad; people over 70 should avoid cruises.

So to be clear, even the most "do nothing" approach was not "do nothing", and at that time, people were alread voluntarily starting to socially distance.

<comment><AUTHOR> These options are so soft that they really are equivalent to doing nothing. Sick people have always been told to stay home; trips abroad and on ships might cause visible clusters early on, but they're a drop in the bucket later when the disease is already at home.

The real issue is that a strong response causes people to take things seriously, and a weak response causes them to not take it seriously. In other words, just like the model, we have a situation where predicted results inform the actions taken, which affect popular opinion, which in turn change the predicted results.

Yes, the optimal outcome is to somehow have the government do nothing, thus restricting nobody's freedoms, but simultaneously have society take it so seriously that they eradicate the disease themselves in two weeks. But that is not a genuine policy option.

<comment><USER2> You say that, but your intuition about those measures isn't good enough, which is why we needed a reliable model to tell us whether those measures were going to be effective, that's the entire point of the research. If our starting point is "Oh well obviously we need to do lock down" then why are we wasting money on modelling it? And since we haven't modelled the system without public policy intervention, none of the results mean anything.

</comment></comment></comment></comment><comment><USER3> Some questions I ask myself when reading random posts with grand and important claims on any subject:

Where is this from? Who originally wrote it? Is this text's origin really a random Facebook post, from a pseudonymous author with a cartoon profile picture and no claim of any serious credentials in the subject at hand? (Whether epidemiology or anything else)

Regardless of the merits of the text's post (which I do not claim to be able to judge) all evidence has to be analysed for context as well as content. Simple "common sense" claims (with a couple of big words to impress non- epidemiologists like me) are made to debunk the models: where is the evidence rather than rhetoric, even some basic citations, and/or examples of or links to counter-modelling? The post doesn't even link to the original model files from Imperial that they're claiming to critique.

It's perfectly _possible_ that the claims made in this Facebook post are correct, but it doesn't mean anyone should take this post (and its conclusions) remotely seriously without asking some very robust questions of it.

<comment><USER4> I have another view really. Which is reading a paper analyzing pandemic overshoot. The authors covered a half dozen models. From very simple ones built on a simple differential equations to complex ones that factored in network effects. My take away is actual models[1] in this space tend to be robust.

The Imperial College Model is a complex model designed to answer subtle questions about the spread and containment of an epidemic. But there is nothing subtle about COVID19. The model predicts catastrophe unless you turn all the knobs to contain it to 11 and do it now.

The model is validated by real experience. Italy, New York both blew up. And elsewhere half hearted measures merely slowed the virus down, not stop it.

The true the deniers can't escape is. If what's been thrown at the pandemic is unnecessary. Then if so, why hasn't the pandemic just collapsed?

[1] As opposed to models that fit a prior defined curve to data. Those are shit.

<comment><USER5> > The model is validated by real experience. Italy, New York both blew up.

Do you know where the first clusters in New York where?

Because in Northern Italy, and especially around Bergamo, hospitals and then nursing care homes turned into infection centers, and with the population there so skewed with the most vulnerable (along with imperfect knowledge on the pathology) it was easy for the virus to kill them.

In fact most of the initial clusters were in hospitals, and negligence turned Alzano Lombardo in a nice spreading place.

Would a model tuned on what we know now, taking into account different infection routes and places, work the same way? I don't know, but it is a question worth asking even if in the end the model proves to be absolutely correct.

</comment></comment></comment><comment><USER6> "the model that shut down the world economy"

The model was released on the 16th of March. Large parts of the world had already "locked down" prior to this date.

edit: of course there is no doubt this model was influential in other countries' decision to lock down.

<comment><USER7> Australia's influenza modelling had plans for this style of lockdown prepared long before the 'rona hit. So you are right, this model did not shut down the global economy. If anything did, it was China's demonstration that such a lockdown could actually work.

<comment><USER5> To be fair, not all of China locked down as hard as the Hubei province.

</comment></comment></comment><comment><USER8> John Carmack, who worked on the Imperial College model code, has a pretty positive attitude about it:

[https://twitter.com/ID_AA_Carmack/status/1254872368763277313](https://twitter.com/ID_AA_Carmack/status/1254872368763277313)

</comment><comment><USER2> I think there are some really important points here, and one of the most shocking is that Imperial put out in their summary that optimal mitigation policies could reduce deaths by half when their model just clearly doesn't model the base case.

> The social distancing policies are being compared to a zombie alternative > that cannot happen and will not happen.

This is absoutely correct, my company made us work from home signficantly before the lock down because they were quite rightly worried about business continuity. In the Imperial model, that sort of thing just isn't accounted for. We literally cannot say whether the natural societal reaction would've reduced that base case by 1% or 99%.

The second point I would make is that epidemics aren't different every time. Or rather, the underlying fundamentals of how diseases spread aren't that different every time. So how come, all of these institutions that are _meant_ to be studying the spread of diseases are putting out papers based on hacked together research code from the 1980s? Like, what were you doing in the 17 years since SARS?

Where are the dozens of open source, high quality, back tested, parameterizable models sitting on the shelf ready to go?

In many ways putting out the results of some trashy model that you haven't even properly tested and trying to shape public policy with it is actually quite a damaging thing to do. Not only is it likely to lead to bad decision making, it's also going to destroy trust in institutions that desparately need to be trusted in these situations.

</comment><comment><USER9> Everything described in the review is common practice in science.

Scientific publishing is broken. Is not only about the methodologies and how some reviews are conducted, but you can't get the files needed to reproduce them, not to mention datasets that are almost impossible to obtain.

</comment><comment><USER10> I've seen a couple of criticisms of the model, let's say, some less charitable (condescending) than others. This seems an ok criticism, though it is missing one of (IMO) important points of the other criticism (which I won't link here but some might have seen in some "skeptical" places)

I've worked briefly with simulations, I think most of the items here are valid. The RNG especially is a very easy place to shoot yourself in the foot, especially if your main RNG is used to derive random numbers with different distributions, and your numbers might look off and you don't know why.

Example, your RNG is biased or does not have all the range/precision you think it has (similar to throwing a die when you are expecting a number between 1 and 10 for example - this sounds stupid, but think for example, your results come as 0-100 but biased towards smaller numbers, it will be a pain to find)

Now, some other criticisms were pointing to a potential multithreading problem in the model, which sounds like a worrying problem.

</comment><comment><USER11> This is not really a great analysis. I would like to see an analysis from someone who:

-Is actually familiar with academic code so that the usual pearl clutching can be tempered with realism. That doesn't mean throwing up one's hands and just accepting that all academic code is like this, but it does mean coming from a place of knowing what normal academic code looks like (much worse than this).

-Is actually familiar with production forecasting in other contexts (outside of the small bubble of SV) the writer says they have "done some model review of financial models". I have done a lot of such reviews and many models are implemented in idiosyncratic Excel. Yes, models that drive policy decisions in government and large transactions in finance, models that are used in internal forecasting in many places. All Excel.

A recognition of the difference between should and is. There are claims here about what should be done in modelling which are correct but with little recognition that they almost never are.

Really I would like to see a review by someone who is familiar enough with epi modelling _and_ with modern software engineering practices to give a balanced assessment.

The only material criticism of the model that isn't just "this should have been implemented better" is that it assumes that people will not voluntarily implement forms of social distancing when many people are dying and that this distorts upwards the death count. An agent based model would model people's time varying contact matrices based on what they can observe (so as death rates go up, voluntary social distancing goes up as well).

Presumably this leads to a higher peak than mandatory measures because deaths lag measures which are visible to policy makers but not to the public, therefore people will distance later.

This is indeed not addressed in the model. It could be addressed exogenously by making interactions dependent on the rolling average death count of the last several days as that is probably the signal that will the cause the most widespread panic.

However. There is some important context here which is that:

-This was not even the only model used by SAGE. The LSHTM model was run alongside it and gave similar results.

-The "no intervention" case was sense checked using the basic equations of epidemiology.

Models that drive decisions can be criticised on technical-procedural grounds (ideally this model should use fewer globals, and use psuedorandomness better so that it gives the exact same result on every run rather than more-or-less the same result on every run) and on model concept basis (the model assumes zombies) but the most important assessment of real models is how they drive decisions.

In that regard the model was successful and drove the same decision as the very different LSHTM model, the models used by almost every other country, and what could be estimated using Epi 101.

That is the necessity of mass social distancing. Even the Swedes, incidentally, accept this. They have chosen to make everything except for the closure of the highest risk establishments voluntary. I wonder though if isn't the case that these restrictions are in practice voluntary in many cases even in the UK. I could easily visit my family and friends - the police would never know. My employer could continue having us come into work - there is no absolute ban on office workers being required to come in, just guidance that people who can work from home should. The actual legislation can be considered not only as enforceable rules but also as high-cost signalling. There will be people who simply will not take it seriously otherwise on the grounds that "if it were really that bad, they would ban it"

So to come back to the one substantive criticism - what different advice would a model that implemented behaviour changes have led to? I don't think it would have changed anything, if you tell policymakers: "listen, we don't necessarily need to make these things mandatory, once the coffins pile up people will stay home by themselves" what do you think that is going to drive? They're hardly likely to decide that we can leave off the restrictions. We came up to 80% or so of ICU capacity as it was. That tells me that anything that led to less or later social distancing would have put us in the position that Bergamo or Madrid were - at least localised and temporary overwhelming of hospitals. Potentially much worse.

<comment><USER2> >-Is actually familiar with academic code so that the usual pearl clutching can be tempered with realism.

I think this is a real and systemic problem. Academia has driven itself into this horrible cultural rut where they've defined for themselves this attitude towards code that it's not important and it's fine if it's bad, hacky, undocumented, not version controlled, copied and pasted over and over. Its just research code!

It's not pearl clutching to point out that this is the coding version of a teenager saving final_report.docx, final_report_final.docx, final_report_3/23/2020.docx, final_report_v3.docx. It's basically everyone outside of academia looking at academics and wondering why they don't just grow up, and it's a cultural issue.

The problem is that what you describe as pearl clutching is just the very reasonable observation that an entire profession has chosen to just refuse to do a core part of their job.

<comment><USER11> The problem is that it is _not_ everyone outside of academia. The vast majority of the world's modelling code for various values of modelling is written and "maintained" by subject matter experts who are not software engineers. Finance, insurance, you name it and there's a horrible Excel model driving it.

<comment><USER2> I think the core difference is that most places outside of academia there is a closed feedback loop. You make a crap prediction, you lose a bunch of money, you get fired. There's a self-correcting mechanism for insuring the models work correctly.

In academia you run your model, you write your paper, you publish your paper, you get your promotion. Because no decisions are made based on your model, there's no accountability. Even crappy excel models in business are more reliable than academic ones because people actually have to use the results- and that compounds over decades.

But the impact of lots of academics generating rubbish and publishing it is that we're literally polluting our knowledge pool. Which is why it _should_ be of as important for your code to be right as it is for your experimental method to be right.

<comment><USER11> Sure, models that break along their common paths will lose people money. Models that don't produce the results they should won't lead to high impact publications.

In both cases, models can break in unfortunate ways along rarely used code paths or under unusual conditions. If a model just doesn't work, then of course it will be fixed. That's in any context. If it works most of the time until it breaks badly once, then it may well not be fixed before it has caused massive damage.

</comment></comment></comment></comment></comment><comment><USER12> This whole thing has made me grateful for the fact that only engineers at my company will know the horrors I have perpetrated in my career.

Must be awful for the poor folks whose work is being savaged by everyone.

</comment><comment><USER13> Who exactly is this person and what are her credentials?</comment>


PPlanter: Rapidly deployable, reconfigurable public urinal and sink  - <AUTHOR> http://pplanter.com

<comment><USER2> Hey all. I work for GAFFTA, one of the organizations putting on the UP festival, and I'm super excited to see this on Hacker News. Here's where you can see the rest of the UP projects:

<http://sf.urbanprototyping.org/projects> These are the projects chosen from our Open Call several months ago — they're longer term with bigger budgets.

<http://sf.urbanprototyping.org/makeathon/projects> These were chosen from our Makeathon a few weeks ago.

It's going to be awesome. If you're in SF this weekend, come down to 5th and Mission and check it out.

<comment><USER3> Here is the facebook invite: <http://www.facebook.com/events/306073629499817/>

</comment></comment><comment><USER4> London has these $75,000 public urinals that disappear during the day [http://www.engadget.com/2006/11/19/urilift-the- disappearing-...](http://www.engadget.com/2006/11/19/urilift-the-disappearing- public-urinal-and-we-do-mean-public/)

<comment><USER5> Why did that cost 75k? I can only assume it's to be bulletproof against rowdy drunks.

<comment><USER6> Good hydraulic lift; custom manufacturing; extensive safety testing (what happens if the lift fails?); cost of building a product for a bureaucracy (paperwork, adherence to regulations, extension of development timeline); R&D and payback on loans or other capital outlay; profit.

<comment><USER7> It likely also includes cost of transport (it is a fairly large stainless steel structure) and installation (digging a hole, moving existing cabling out of the way, etc)

If not, prices have risen very steeply since 2007. [http://www.visit- gloucestershire.co.uk/boards/topic/2674-str...](http://www.visit- gloucestershire.co.uk/boards/topic/2674-stroud-to-install-) states:

 _"The Urilift and associated installation costs amount to £45,000 (broken down as £27,000 for the product and £18,000 for installation). As the structure is made of stainless steel and is very robust its lifetime should be 15-20 years - equating to a cost of only £2,000-3,000 per annum in addressing this serious problem. Maintenance costs are estimated at only £2,000 per annum."_

If £27,000 still seems expensive, you must consider that these things stand outside the whole year round, and, given the target audience, probably do not get the best of treatment by their users.

<comment><USER6> Ah, I didn't consider whether or not transportation / installation were included.

2007 was 5 years ago. Fuel and food costs have both risen sharply since then, as have the costs for just about everything other than labor. So, I wouldn't be surprised.

</comment></comment></comment></comment></comment><comment><USER3> This project is for the UP festival, and here are some more sketches/designs of the project: <http://sf.urbanprototyping.org/projects/ppplanter/>

There are some major efforts around this. eg. bill gates Foundation [http://www.gatesfoundation.org/watersanitationhygiene/Pages/...](http://www.gatesfoundation.org/watersanitationhygiene/Pages/home.aspx), or the toilet masterplan in SF <http://toiletproject.org>

</comment><comment><USER8> How will folks resist the urge to pee on the QR code?

</comment><comment><USER9> Just curious, how would you go about detecting urine with sensors?

<comment><USER4> The planter primarily senses smell, entry/exit and water level. There is also a mechanical system (construction is going on) that mixes an "appropriate" amount of water with pee, so that it is usable by the plant.

So in all we can sense:

\- number of people that went into the planter (approx)

\- amount of pee was collected

\- smell levels based on usage/pee levels

there are also some more things related to plant growth.

</comment></comment><comment><USER10> This seems really great until you realize peeing on a tree is about exactly the same thing.</comment>


Women and Tech Launches First of 50 Interviews - <AUTHOR> http://www.womenandtech.com

<comment><USER2> The site's taking a very long time to load, and once it does I'm unable to scroll down past the photo of Lucia to read the interview itself. (Using Chrome 24.)</comment>


Gmaps.js the easiest way to use Google Maps - <AUTHOR> http://hpneo.github.com/gmaps/examples.html

<comment><USER2> ... and also probably against the newest terms of use that Google put out recently:

<https://developers.google.com/maps/terms> 10.2(a):

"(a) No "Wrapping." You must not create or offer a "wrapper" for the Service, unless you obtain Google's written consent to do so. For example, you are not permitted to: ... (ii) create a Maps API Implementation that reimplements or duplicates Google Maps/Google Earth. For clarity, you are not "re-implementing or duplicating" Google Maps/Google Earth if your Maps API Implementation provides substantial additional features or content beyond Google Maps/Google Earth, and those additional features or content constitute the primary defining characteristic of your Maps API Implementation."

<comment><USER3> I think they are talking about web APIs here, not client-side libraries.

<comment><USER4> No, this applies to client-side libraries. OpenLayers required a specific letter from Google saying the terms didn't apply to them (but will apply to others).

</comment></comment></comment><comment><USER5> Honest question: what's the raison d'etre here? Is the Maps API really that annoying that people need a wrapper?

<comment><USER6> Yes it is overly complex.

<comment><USER7> Complex? For some certain tasks perhaps it's verbose, but I do like that the API is structured in a Java-like way. With wrappers like these I need to constantly consult the docs to find out what arguments to pass to the constructors.

With the google maps api I just create a new object and can use the various setters and getters to set and retrieve values. Everything is mostly self- descriptive as well.

You can place an extern file so that you can get additional help via intellisense in an IDE as well.

<comment><USER8> Personally, I don't like the Java smell. GMaps.js is more idiomatic JS; I have no problem remembering props to pass in to a method, but can never keep straight a bunch of classes and getters/setters. And I prefer building abstractions over relying on IDEs; being able to go back and change some keys/vals is more maintainable to me than having to go back to a bunch of explicit methods, with all their quirks and gotchas.

<comment><USER9> ugh, I was hoping we were moving past the "smells like Java" kneejerk objection. It doesn't apply here. Maybe you don't use the Maps API very much? It (v3, at least) actually strongly embraced being a Javascript API in a time when most APIs were not. Almost all objects are created with options specified almost exactly the same way as here. The main thing this seems to add is being able to specify event handlers in the same way (that really does appear to be the majority of the code).

It does look lighter to use, but that's just the age-old difficulty of writing an API that's both lightweight when it needs to be and completely flexible when it needs to be. You'll run into the same problem with this library, but in the other direction, if you need more than one click handler on something, or you need to use the underlying MVC structure directly, etc.

edit: it's a minor thing, but not having to create a LatLng object every time you need one _is_ nice on the code verbosity scale. That's one of the first things I alias when making a project with the maps api, actually. Lots of "new"s in your code isn't unidiomatic Javascript, though, even if some wish it were :)

<comment><USER10> Maybe it's not a "smells like Java" but from Google's perspective, they treat every api method with equal weight because so many people use different parts of it. GMaps is trying to solve the simple use cases where the other 80% of the api methods are unnecessary.

If you need something specific and you're building something beyond the typical google maps customer, then you'll have to use the google standard apis, but most people would be happy to use something simpler.

</comment></comment></comment></comment></comment></comment><comment><USER3> I really like that the interface is generic, abstracting away the mapping service. This way it may be possible to write bindings to other mapping services, such as OpenStreetMap or Bing Maps, and switch the service by just changing a variable.

<comment><USER11> There's OpenLayers too (<http://openlayers.org/>). Google Maps or Bing Maps are one of the possible layers. Works well for GIS-type folks, has some quirks otherwise. Don't like the layer switcher myself however, not very strong UX wise.

<comment><USER8> Yeah, using OpenLayers here too-- I was about to say almost the exact same thing. My PM is one of those GIS-type folks; I'm not, and there's some frequent pain. I've actually been messing with layer switching this morning, we have our own control UI for it. The native OL controls are generally pretty lame (especially compared to GMaps). We're progressively throwing out most of them, opting for a different direction that fits more with our filtering/search features.

Code-wise, I've found OL pretty awkward. It stinks of Java to me: over- organization, unnecessary complication in the name of feature completeness, confusing function sigs, overuse of `new`, etc. Feature-wise, I have little to complain about, but GMaps.js's look a lot more idiomatic and nicer to write code against, though I bet there's still comparatively a lot missing...

</comment></comment></comment><comment><USER12> As someone who likes to hack things together but is really not a great developer this is wonderful!

Would it be possible to add integration for Stamen maps?

<http://maps.stamen.com/>

I'd love that!

<comment><USER13> That's certainly a nice project. No idea why it went pass our radar. We'll look into that!

</comment></comment><comment><USER14> Requires jQuery. Strange that this is not mentioned anywhere in their website.

<comment><USER4> Looking at the source, this also requires jQuery in that unique 'jQuery as a crutch for not understanding the DOM at all' way.

<comment><USER13> It was born as a jQuery plugin for a couple of projects we had to use Google Maps and that incidentally used jQuery as well, so it made sense.

We aren't totally sure it will move forward as an independent Javascript library but it's certainly a turn it could have. We are rewriting it with Coffeescript now, so maybe is something to consider more closely.

</comment></comment></comment><comment><USER15> Has anyone compared this to Leaflet[1] or Mapstraction[2]? Leaflet was a big help on a quick project, but the abstraction was somewhat leaky and there were annoying bugs switching between maps.

[1] <http://leaflet.cloudmade.com/> [2] <http://mapstraction.com/>

<comment><USER16> While I respect the work done by the Mapstraction guys, I found that to get several non-trivial things working, I had to dig into the proprietary parts of the individual underlying framework - which defeats the purpose of using Mapstraction in the first place.

I had to rewrite large portions of the map interface code when I switched from Google to Open Street Map.

That said, the project is still young and maybe once I get some time, I should really contribute code to it to get those bits I needed working.

</comment></comment><comment><USER17> OT: Please fix the title. The unpaired quote makes me feel uncomfortable. ;)

</comment><comment><USER18> bookmarked for my current project, why doesn't Google Map use an API like this? Would save lives.

</comment><comment><USER13> For what is worth, we also have a Rails gem for GmapsJS at github.com/xenda/gmapsjs.

Issues and ideas are always welcome for both the JS and Gem versions!

</comment><comment><USER19> I was under the impression that features like routing required the expensive paid Google Maps tier.. is that not the case?

<comment><USER13> I does not. You have access to a, albeit limited, number of requests to to Geolocating, Geo-referencing and others. Should be no problem for a personal or small project.

</comment></comment><comment><USER20> I recently was reading was looking for an API that had address and directions support and found these two, <http://gmap3.net/> and <http://code.google.com/p/jquery-ui-map/>. Any plans to add that to gmaps.js?

</comment><comment><USER21> Also nice is this JQuery plugin by Shawn Allen that uses simple html and data attributes to generate basic maps. Very useful if the maps are just supplemental, because they can be just built out in a template: <http://prag.ma/code/htmapl/>

</comment><comment><USER22> Very nice. Going to use it.

</comment><comment><USER23> Great work, I'm using GMapEZ, but gmaps.js seems to be much easy and cleaner IMHO. Will take a look at it later. Thanks for sharing.

</comment><comment><USER24> This is one of the coolest things on here today. Definitely bookmarked.

</comment><comment><USER25> Add to my toolbox. Thanks!

</comment><comment><USER26> GMAP3 (<http://gmap3.net/>) is the killer ;-)

Actually, this feels and looks like a ripoff of J.B. Demonte's work (<https://github.com/jbdemonte/gmap3>), or is it a fork?

<comment><USER17> Not really. Demonte's is a much thinner wrapper and have a totally different API. This is a brand new (and nicer to use IMHO) solution to the same problem.

Disclaimer: I commited the "staticMapURL" method to gmaps.js

<comment><USER20> The gmap3 and also the one on google code(forget name) seem to have a larger API, for example I really like the "DirectionsRenderer",I don't see anything like that gmaps.js.</comment></comment></comment>


Ask HN: What are your favorite quotes about new ventures? - <AUTHOR>

Which quotes motivate you to get started on a new project, or sustain you when you are feeling discouraged? <comment><USER2> "Get err done!" :: I'm a programmer, (more abstractly a trial & error and cut & paste expert), but I feel a quote doesn't really help when feeling discourage or a lack of motivation. A quote to me is no different than an Ansel Adams poster with a simple headliner, with the hopes of sparking an epiphany.

"Just do it!" :: The quotes that I state above are what I tell my self while I blast 949 or itunes as I type away on Dreamweaver, and occasionally check HN for a distraction from the monotony.

In other words, FOR ME, a quote can't encapsulate motivation, but MY WIFE can lite a fire under my ass (my best boss lol).</comment>


Uber launches on demand Mariachi band for $100 - <AUTHOR> http://blog.uber.com/2012/05/01/on-demand-mariachi-fiestas/

<comment><USER2> Uber is brilliant at this type of thing.

Motorcades for Presidents day: [http://blog.uber.com/2012/02/16/this- presidents-day-take-a-t...](http://blog.uber.com/2012/02/16/this-presidents- day-take-a-trip-in-the-ubercade/)

Roses for Valentines day: [http://blog.uber.com/2011/02/10/valentines-day-go- from-zero-...](http://blog.uber.com/2011/02/10/valentines-day-go-from-zero-to- hero/)

<comment><USER3> OK, I'm going to be the downer guy in this thread: I don't care about any of this. I want Uber to improve their app and make their pricing more transparent.

Still waiting on that. Every marketing stunt they do backfires on me, because I see a company being distracted from their main product.

<comment><USER4> You're right, that's a downer and a complete lack of understanding of what it takes to get the public's attention. The best, most perfect app in the world would not stand a chance against Uber's very good app and brilliant marketing.

Every ride I've taken with Uber has been exactly the fee presented _before_ getting in the vehicle and with no tip expected. I'm not sure how much more transparent that needs to be. If you are referring to people who unexpectedly paid more on NYE, I can only sympathize a little. It's NEW YEARS EVE!!

<comment><USER5> _Every ride I've taken with Uber has been exactly the fee presented before getting in the vehicle and with no tip expected._

Eh? At what point do you give it a destination so that it can present you with an estimated price?

The only time it displays an estimated price RANGE is during surge pricing.

<comment><USER6> Airport trips in Boston are flat-fee trips.

<comment><USER7> And in SF ($65 flat fee)

</comment></comment></comment></comment></comment></comment><comment><USER8> I think this is just a premonition of what's to come.

Fast forward a couple of years, add in a ban (semi-optional) on visual advertising a la Sao Paulo, mix with freebee creative advertising, season with flash mob and suddenly our future could become extremely odd and confusing. Anyone who's not a fan of absurdism will have a hard time living in a metropolitan city.

<comment><USER9> I love this kind of thing - random absurdism in unexpected places. It pulls people out of their comfort zone in a non-threatening way where everybody gets a good chuckle.

The look on the guy's face as the band steps out of the elevator? That's one of my favorite things to cause to happen to other people - it's just plain _fun_ all around.

<comment><USER10> I disagree. There is a large mental overhead associated with these kinds of things and living in cities is all about choosing where to spend ones mental energy - since there isn't enough to see everything.

</comment></comment></comment><comment><USER11> How will San Franciscans combat offensive deployments of the Mariachi? Will this lead to retaliatory strikes of Chinese street opera?

<comment><USER7> This shall not stand! QUICK send in the Streisand Squad!

</comment></comment><comment><USER12> This would have been so useful years ago. I think it was 1996 or so. Most of my friends were still in college but I had already had my startup running. It was early enough in the dot com era that my business was designed to make money, so I had a decent amount of cash in comparison to my universally impoverished university buddies.

Anyhow, my best friends were throwing this weekend house party where all the local freaks, geeks, and hipsters would be in attendance. So when my best friend called me to convince me to come in for the party that weekend, for whatever reason, I had this dumb idea. Perhaps this was a harbinger of the pre-dot-com opulence to come and the idea, of course, was on a much smaller scale but nevertheless, for no reason whatsoever except that I had for the first time in my life a bunch of cash burning a hole in my pocket, I suggested we get a mariachi band for the party. My friend looked into it. He found a group. He told me the amount for the basic band. I forget what was going to cost $250 extra to bring along as a musician (maybe an extra trumpet) but it all seemed very worth it. We needed the proper instrumentation represented.

When the band arrived with the party in full swing, they were pretty freaked out, since, this was not the normal kind of gig they played; no, not collage parties. So the woman dealing with the thing asked for half the cash up front. She also upped the price a bunch from the initial agreed upon amount but I didn't care. I was really just looking forward to seeing them play near the tapped keg around a bunch of mystified acquaintances. Now if I could have only gotten this done for $100, I would have filled the whole house with competing acts that night. Great work Über and thanks for bring back a fond memory.

<comment><USER13> "Now if I could have only gotten this done for $100, I would have filled the whole house with competing acts that night. Great work Über and thanks for bring back a fond memory."

$100 here only gets you one song, though. This is a very good marketing idea, but not a cost effective way to hire a band for a real gig.

</comment></comment><comment><USER14> Hope they pay those bands adequately!

</comment><comment><USER15> Is this available in SF only?

<comment><USER16> From the link, it seems to be :<

</comment></comment><comment><USER17> Don't need an on demand Mariachi band, just go for a walk in Manhattan and you'll be bound to have one show up before the days end :) (Atleast from my experience..)

<comment><USER18> Out of curiosity, where have you had this happen? I've lived in the East Village (well, technically Alphabet City) for a year and a half and I've never experienced roaming Mariachi bands. I feel like I'm missing out.

<comment><USER19> IIRC, I would tend to run into them on the A train or the 1, north of 59th.

</comment></comment></comment><comment><AUTHOR> This is simply brilliant. Travis you are the man!

</comment><comment><USER20> Well, that is pretty awesome. Expanding the selection of orderable services is an interesting way for uber to grow.

</comment><comment><USER21> When did HN become product advertisement board? Whats next? A posting for all- new minty Pepsodent with added whitening?

</comment><comment><USER22> incredible marketing scheme! I love it.

</comment><comment><USER23> quatro de mayo?</comment>