How to show something in actual life size on any computer screen - <AUTHOR>

I'd like to share with you the site I've been working on for the past year and a half... It's called LifeSizer, and allows you to view any product in it's actual true size on any computer screen or mobile device. I came up with this a few years ago when I bought some jewelry for my wife, but after I received it the earrings turned out to be much bigger than I expected. That started me thinking: why isn't it possible to get a better sense of the size of a product on most ecommerce sites? Wouldn't it be great if you could view products in their actual size on a screen, so you really get a better idea of what it is that you're buying?
The technical challenge here was obvious: To be able to display anything in true size on a screen, you'll need to know the pixel density of that screen. Unfortunately there's no way to determine that programmatically (at least not from within a browser). You can calculate it based on the current screen resolution and the physical screen dimensions, but that actual screen size is an unknown too. The beauty (I think) of the solution I came up with is that it allows me to determine that screen size (even if the user doesn't know it himself) by using a simple calibration trick. And we've built in such a way that it can easily be integrated with other sites, here for example: http://mwctoys.com/REVIEW_060412a.htm  (see the second image).
We're officially launching today, and please check it out here: http://beta.lifesizer.com/images/featured
I would love to hear input from the community on what you think. Have you ever bought anything online that was much bigger or smaller than you expected? Do you see wide scale use for a feature like this? Would you use it on your own site? How can it be improved further?
thanks! Peter <comment><USER2> This is one of the few remaining issues with online shopping for me and would open me up to buying certain products that I feel I need to buy in person. It would be great if this was solved.

</comment><comment><USER3> I tried this out today and it is very interesting. I could see how retailers can see a very high ROI on this technology in terms of driving revenue.

</comment><comment><USER4> Brilliant!

Product comparison is a good point. Also, you need to find an easy way for the seller to do batch upload of a lot of items that were taken from the same position and resolution (so they have to measure only one image).

EDIT: Integration with common eCommerce systems would be awesome as well..

But the idea is great - and beautifully executed.

<comment><AUTHOR> thank you! I've actually worked with an ecommerce site that sells beads and things and uses a flatbad scanner for most of their products. With that site I was able to skip the 'add' step altogether and calibrate images on the fly as they are first viewed. Unfortunately this is more the exception than the rule, and in most cases there's not enough consistency in etailers' images that I can always assume the same number of pixels per physical inch.

I'm definitely aware of the potential overhead of adding lifesizer images though, so I've developed a bookmarklet with which customers can calibrate images without leaving their own site. And we continue to look at other methods (ie outsourcing this work) to reduce the amount of integration work to near zero. Thanks for your input though, it's great to see that people see the value.

<comment><USER4> Did you look into eBay integration? There are a bunch of companies that offer store management and templates. It should be a great feature for them.

</comment></comment></comment><comment><USER5> Awesome idea and execution!

The only problem I have is that I may want to open more than one, and you seem to be limiting it.

Say, for example, I have a phone that is on there and see a new phone I want. I may want to compare size without needing to hold up my phone to the screen.

<comment><AUTHOR> very good point. I do think product comparison will be an important use of this technology, and I'm definitely planning on adding features that would allow this. For now, you could hold your current phone up to your screen and see exactly how it compares ;)

</comment></comment><comment><USER6> This is awesome! A coworker of mine did the same. Ordered a ring online that she thought she saw in a store window while traveling on business. The ring arrived and it was so mafioso. Gave me the best laugh...but she was out several hundred dollars!!

</comment><comment><USER7> How does it work with multiple screens? Yes I have a MacBook Pro 17", but that's not the monitor that I'm using.

Yes this credit card is the right size of this monitor, now I'll just drag it over onto this monitor to get a better look...

<comment><AUTHOR> on most mac systems it will offer you a suggested screen based on your current resolution. If you're viewing it on your laptop screen you can just choose 'macbook pro 17' and you're good to go. If you move your browser over to your external screen it will typically detect that you're now on a different screen (unless that screen is exactly the same resolution), and it should tell you that. You can then do the manual calibration thingy there. At that point (and this is a feature I'm particularly proud of though it may not be used that often), you could drag the LifeSizer window from one screen to the other and it will instantly resize the item to show in lifesize whereever you move the window. Let me know if that works for you!

<comment><USER8> Yep. Opened it on my monitor and it detected my macbook screen also and gave me the option of both. Really like the site. Good work.

</comment></comment></comment><comment><USER9> Cool idea, seems like a no brainer for ecommerce websites to include this technology

</comment><comment><USER10> Wow I really like it. It looks very well put-together.

Would it work for large items like refrigerators or am I misunderstanding the purpose?

Also, why is it patented? Boo on that.

<comment><AUTHOR> it would work for a fridge (provided you use a high enough resolution image), though of course if you were to view that in actual size on a laptop, you would only see a small part of it. You could certainly put it on a big screen in lifesize... it will work with projectors too. There are some measuring tools in the viewer as well, which would allow you to measure the object or part of it, which can be very useful even if you're not viewing it in actual size. Sorry about the patent ;-) I have mixed feelings on them too, but the reality is that patents can open doors in terms of getting funding and building a successful product/service.

<comment><USER10> Good point about a projector. This could be used for seeing what furniture will look Like in a room.

</comment></comment></comment><comment><USER11> Sounds incredible - you are really solving a problem. As primarily an online shopper, I am often disappointed by size. Thank you!

</comment><comment><USER12> Did you give a tech preview here? I remember seeing a similar site that used CDs and other similar items for calibration ...?

<comment><AUTHOR> no, that wasn't us. If you remember their name would love to check it out.

<comment><USER12> I think it might be <http://pective.com/> , been around since 2008 or so it seems.

</comment></comment></comment><comment><USER13> Clickable: <http://beta.lifesizer.com/images/featured>

</comment><comment><USER14> Helpful for online shopping -- should prevent disappointment on size and reduce returns.

</comment><comment><USER15> the credit card calibration was nice. Would be interesting for electronics (Which I buy more frequently than jewelry). Would be neat to have life size faces for hangouts and Skype.

</comment><comment><USER16> I enjoyed looking at the life size image an iPhone on my iPhone.</comment>


Ask HN: How do you get someone away from affiliate marketing? - <AUTHOR>

My dad's a long time hacker, but recently fell into this trap of get rich quick affiliate marketing.
My philosophy has always been to help people and do what you love. I emphasize offering real value to people, and I know everyone on HN tries to do the same. Basically scamming people and using immoral techniques to sell some useless product is something I want absolutely nothing to do with. It feels almost impossible to get through to someone once they're hooked.
Any advice? <comment><USER2> Your suggestion that affiliate marketing is a "trap of get rich quick" that "scams" people and uses "immoral techniques" smatters of generalizations and inaccuracies. Like any industry, there are bad players. Affiliate marketing is no exception, however there are people who build individual brands helping local companies spread their marketing endeavors with affiliate style marketing and are quite successful doing so with honest methods. I recommend against throwing the baby out with the bath water and maybe sitting down with your father and figuring out-with a bit more clarity-what he's _actually_ doing.

<comment><AUTHOR> I just received this email. I'm pretty sure there's nothing honest in play here.

>Yo! We just did a webinar about marketing with purchased email lists. Think buying emails is legit? Wonder how many dead ones are in the list? They showed buying 70,000 emails at $.005/each. Not much $, but the result was to send them to an affiliate site, and hopefully get paid…..

<comment><USER3> You're missing his point. That's like saying if someone steals, everyone steals. Affiliate marketing itself isn't bad. It's the type and what an individual does.

</comment></comment></comment><comment><USER4> You're implying that anything sold through affiliate marketing is a "useless product", marketed using "immortal techniques", and, in short, a "scam".

If he really likes it so much, and it's making him money, perhaps you could convince him to sell honest products using honest techniques?

<comment><AUTHOR> To clarify, no he's not making money. Few people ever do. The products are more often than not worthless ebooks, but the real scam is the conmen that lead you to believe it's easy, anyone can do it, and pay me $99 and I'll have you earning thousands in the next few minutes.

>perhaps you could convince him to sell honest products using honest techniques

Precisely what I'm after. It's hard to be convincing when my side of the argument isn't offering "40000/month on autopilot!"</comment></comment>


Show HN: TLSproxy – automatic Let's Encrypt proxy - <AUTHOR> https://github.com/chrisDeFouRire/tlsproxy <comment><USER2> This gives literally zero control over the TLS side of things: no way to specify what options you want to support, what versions you want to support, or what cipher suites you want to support.

The argument is that this is because it's 'too complicated'.

The problem is, that then means you're _completely_ relying on the developer(s) of TLSproxy to know what is considered a secure setup, and to keep it updated.

If you decide you want to make a change (e.g based on recommendations on [https://mozilla.github.io/server-side-tls/ssl-config- generat...](https://mozilla.github.io/server-side-tls/ssl-config-generator/) or results from [https://www.ssllabs.com/ssltest](https://www.ssllabs.com/ssltest), you're shit out of luck.

<comment><AUTHOR> ..author here...

I'm very well aware of the restrictions of TLSproxy, but there are 2 kinds of people: those who take the time to setup TLS properly and know how, and those who just skip TLS.

As the author of sslping.com, so I know very well that most TLS installations are not well configured. Of 6600+ servers monitored by sslping, only HALF are ok.

So yes, you can configure TLS on your webserver, handle your certificates, renew them on time, and if you know how to do it properly, then perfect.

Or there's TLSproxy if your can't spend the time, or just don't know how.

<comment><USER2> Shouldn't a "no knobs" tls proxy do forward secrecy and ocsp stapling?

Shouldn't it also _not_ use weak ciphers?

This was my whole point: it's advertised as being easier than configuring an existing tls web server or proxy, but it means you get a less secure tls endpoint than you'd have if you literally copy and pasted the config from Mozilla's recommended tls settings tool.

If copy and pasting a config file is too hard for someone, maybe that's a sign they _shouldnt_ be trying to configure their own server.

<comment><AUTHOR> forward secrecy: fixed cipher order

weak ciphers: 3DES is not weak only a bit less strong, fixed anyway

I'm still working on making TLSproxy better. A little encouragement will help ;-)

Now 'A' with SSLLabs, with 0 configuration, which is WAY better than the vast majority of TLS servers out there (people don't take the time).

<comment><USER2> Great work.

Any chance of supporting ocsp stapling and PROXY protocol?

Presumably it uses the tls-sni challenge for LE certs?

<comment><AUTHOR> OCSP stapling isn't supported yet by Go as far as I can tell, but I'll implement PROXY for HTTP proxying (not for TCP proxying of course)...

And yes, it's using SNI which is now largely supported, but I think I can add an option to restrict it to as single TLS certificate (and make it work without SNI).

The original use-case is a friend with 2500 websites hosted on a single server, and he wants to make the switch to TLS ;-) but I'll try to make it work for everyone!

<comment><USER2> I see.

Re: SNI I meant the ACME challenge mode to issue the LE cert: given that it only listens on :443 i assumed it must use the tls-sni based challenge, rather than the http based challenge?

<comment><AUTHOR> By proxy, do you mean [https://www.haproxy.org/download/1.8/doc/proxy- protocol.txt](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) ? this looks very new... (I thought you were talking about X-Forwarded-For)

Yes, it's using the TLS-SNI challenge (through golang's autocert)

<comment><USER2> Yes that's what I meant by PROXY protocol support.

Introduced 7 years ago is "very new"?

<comment><AUTHOR> I must have read a bit too fast...

I'd never heard of it actually, I just knew about X-Forwarded-For for HTTP but I didn't know of a TCP compatible protocol.

I've read the RFC, it's easy enough to implement the v1, I'll do it... If you're willing to test it with me, please email me chris [à] chris-hartwig.com</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Data Science Starter Kit - <AUTHOR> http://shop.oreilly.com/category/get/data-science-kit.do

<comment><USER2> What should be the recommended order for these books?

<comment><USER3> From my experience (I haven't read all of them) they cover things that are so different there isn't any real order. From this bundle, "Think Stats" might be a good first book, and then you can branch out to "Programming Collective Intelligence" and "Machine Learning for Hackers", which are more or less the same thing, except the first one is in Python and the second one in R (and slightly more advanced), or "Data Analysis with open source tools", which is more statistics oriented and more advanced than "Think Stats". The R books are interesting if you want to really get into R because I don't think they go into much details from a stats point of view and the videos are, in my opinion (I haven't watched them), not worth buying because they cover topics you can find in hundreds of free online lectures.</comment></comment>


A VC: RSS: Not Dead Yet - <AUTHOR> http://www.avc.com/a_vc/2011/01/rss-not-dead-yet.html <comment><USER2> I never could understand why anyone would think RSS is dead. Blogs, sites and podcasts leverage RSS to blast out updates and notifications.

RSS is just underlying protocol. You might as well say 'http' is going away. It will someday, but not anytime in the near future.

</comment><comment><USER3> Not sure when it was alive. My circle of friends includes some people who I'd consider fairly technical people including a lot of programmers (as a percentage) and I'm the only one who uses an RSS reader. Some people use Twitter but no one uses an RSS reader. I often ask candidates during interviews if they read any blogs and only one person over the years has ever said yes and he used Google Reader to keep up with it all.

</comment><comment><USER4> Seems to me the number of people using RSS readers isn't even that important - RSS is infrastructure, most of its users aren't even aware of it (eg, various "latest stories at.." widgets). The annual "RSS Is Dead" posts would be meaningful when/if we see a decline in content publishers supporting it, rather than browsers developers.

</comment><comment><USER5> A more interesting statistic here would be to compare these metrics with those of a more neutral demographic more representative of mainstream internet traffic since readers of AVC are going to be significantly more adept at something like RSS than say, a tmz.com reader.</comment>


Codius – Open Hosting Protocol - <AUTHOR> https://codius.org/ <comment><USER2> What protocol? I see a website promising a glorious crypto-future and a git repo with virtually no code in it. Seems vaguely familiar.

<comment><USER3> Looks like some TypeScript around hyperd and docker:

[https://github.com/codius/codiusd](https://github.com/codius/codiusd)

So who wants to let others host some arbitrary code execution Docker containers in their datacenter for some crypto currency?

I think back to the episode of Futurama where they go fishing in the middle of the ocean, and Bender asks if they're in international water. Then he radios a boat that comes picks up a package from him and he says, "Guess what you guys are now accessories to."

<comment><USER4> > So who wants to let others host some arbitrary code execution Docker > containers in their datacenter for [money]?

I believe they're called hosting companies. ;)

SCNR.

More serious answer: When we pitched AWS on running Codius they pretty much said the same thing: credit cards aren't just used for payments but also to keep spammers out. So we may need some kind of trust system eventually. But it seems to work ok for now. (Port 25 outbound is blocked and DDoS from Codius is more expensive than other options. Codius costs about the same as EC2 and hiring a botnet or adding a few dozen iframes to your reasonably popular website is much cheaper.)

</comment></comment></comment><comment><USER5> This seems to be solving an actual interesting problem (running untrusted applications on anonymous compute, at scale). A scraper, for example, would be the killer application for such a platform.

But the cryptocurrency integration looks tacked on, or orthogonal to the problem -- which will hamper the adoption, or even turn away application makers otherwise interested.

<comment><USER6> I don't know if what it's promising is actually possible. Ultimately you need to trust that the machine/node which claims to be running your code is in fact running it as-is and not running some hacked version of it which behaves the same superficially but is actually collecting all your user passwords behind the scenes.

The node can always lie by perfectly adhering to the protocol but doing something completely different behind the scenes. You can hash, sign or encrypt the code as much as you like but that has nothing to do with verifying that the hardware is actually running that code.

Maybe with homomorphic encryption this will be possible but AFAIK this technology is not even close to ready for such use cases.

<comment><USER4> The way all distributed systems work is that you hope that some hosts may be malicious but not too many and not in a coordinating fashion.

So in Bitcoin for example, Bitmain has 41% of the hashing power and a bunch of pools have 10% but you just assume they won't work together to defraud you. And turns out, you're pretty much right, that's never happened.

Codius just improves on that security model by letting you choose however many hosts you want by whatever criteria you want.

</comment></comment></comment><comment><USER7> How do I verify that the host is executing my application correctly?

They talk about smart contracts[1] but there is a huge difference between a single host executing an app and having the whole Ethereum network reaching consensus on the execution of a smart contract.

[1]: [https://codius.org/docs/overview/for- contracts](https://codius.org/docs/overview/for-contracts)

<comment><USER8> Technically proof of output could be used by running it on multiple nodes and comparing output, but for anything but idempotent reads this will be difficult. Also for anything that needs any privacy this is fraught since unless you're running hardware obfuscation (sgx or similar) every workload is possibly observable by the 3rd party who is running the workload, including the client who is connecting. Ssl? Keys are on the host...

Then there's the risk to the host, which could be side channeled in the best case scenario where isolation is sound, and completely owned in the worst case where containers are... containers.

Lofty idea but extremely difficult without making it a tiny domain. There are _multiple_ billion-dollar crypto projects aiming to do trusted distributed compute and so far none have shown anything but the most basic use cases.

<comment><USER7> AFAIK Codius doesn't provide any tool to compare outputs from different hosts. Even if the outputs from different hosts is the same, you don't have a proof that the output is correct. For me the point is: why would I use a machine managed by an anonymous person/organization, with no guarantees on execution (and QoS in general) while I can run stuff on AWS EC2, where at least I have a contract with Amazon.

> Codius billing is resource-driven, you should see a very strong correlation > between the load on your servers (and the number of servers required) and > the amount of money earned. from [https://codius.org/docs/running-a- > host/why](https://codius.org/docs/running-a-host/why)

Codius incentive system is weird to me. I am incentivized to be a "host" and run a codius node so I can make money when people use it, and I am incentivized in maximizing my profit by faking the amount of resources used by the apps I host.

I am _not_ incentivized to be a "guest": how can I verify that the billing is correct? How can I verify that the host is running my application correctly?

<comment><USER4> > AFAIK Codius doesn't provide any tool to compare outputs from different > hosts.

I'd love to see somebody make a browser extension that does just that!

There are a bunch of important ecosystem pieces missing from Codius still. Keep in mind that this current release of it just came out a month ago.

If I had a magic wand, the next things I'd introduce would be a Codius namespace system (have the design in my head but haven't had time to write it down) which can securely resolve an identifier like "alicescontract" to a JSON document like {"hosts":[...],"manifestHash":"...","hostPublicKeys":[...],"threshold":5}

(For the blockchain geeks in the audience: Note you wouldn't need consensus for that because names are not fungible, so some weak form of consistency would be fine.)

Then I would add a feature to Codiusd which allows a host to look up that identifier and then depending on the JSON become a proxy to that contract. What that would mean is that you could go to alicescontract.[any-codius-host] in your browser and that host would do the work of collecting responses from all the other hosts and respond once it has `threshold` matching replies. You could use whatever host you trust most as your proxy or, for the super- paranoid, you could run your own host and use that.

There are further optimizations of course but I'll stop here.

</comment></comment></comment></comment><comment><USER9> The idea that anyone can pay the bill is fantastic. I suppose only the crypto world can facilitate such a system.

<comment><USER10> Why do you suppose that? Just set up a Paypal donation button that feeds into the account that pays for hosting.

<comment><USER11> Not "anyone" can use PayPal.

<comment><USER12> Not "anyone" can use crypto currencies either.

<comment><USER13> Disregarding the difficulties and knowledge required to do so (yes, I know that's a big thing), it's still way easier than PP in unsupported countries.

</comment></comment></comment></comment></comment><comment><USER4> Codius co-creator here, AMA!

<comment><USER14> This looks interesting. Is it basically a hosting site you can pay for with crypto?

This makes other things possible: anyone can pay for it using crypto etc?

I can imagine some use cases, but since you've been thinking about this a lot longer, can you say a little about:

1\. Use cases

2\. Long term vision for different paths along which you might see this evolve?

Thanks in advance

<comment><USER4> > I can imagine some use cases, but since you've been thinking about this a > lot longer

I don't know the future but I'm happy to give you my prediction in case it's interesting for you now and hilariously entertaining when we look back in ten years.

> 1\. Use cases

We built it for fun but I could see myself using to quickly spin up small little hobby projects, kinda like how you might use Heroku.

We've also talked about the idea of "open services". Think "open-source" where the source code is free, "open hardware" where the blueprints are free, so this would be services where both the code and the data are free. You could fork the whole service including data kinda like a blockchain but without having to have the overhead of a decentralized service. You don't need Codius for that but open-services seem to mash more nicely with the anyone-can-pay mentality of Codius than just running on someone's AWS account.

Another use case is if somebody wants to create a decentralized application, today they have to run around recruiting hosts. I used to work at Ripple and we'd run around and ask people to please run validators. It required a whole team and a lot of Powerpoint to get to a decent number. Many other projects like BigchainDB went through a similar process. Codius basically makes this a one click affair, you just upload to whatever hosts you want, publish the source code and anyone can verify that the hosts claim to be running the code you say you uploaded. So people have to trust a majority of the hosts (which all distributed consensus systems provably require) but not you as the uploader.

Another idea we had was beneficial digital organisms. We already have "viruses", i.e. programs that replicate without permission. But Codius provides a platform where programs can run by paying without having to steal computing resources. So you could imagine programs that earn money and then pay to run longer or on more hosts.

> 2\. Long term vision for different paths along which you might see this > evolve?

I just started a company called Coil which is building tech so websites can make money. I think this could come together with Codius to make websites that earn money from users visiting them and then pay for their own hosting. Those websites could in principle survive their creators by centuries. I think that's pretty cool.

Obviously, all of these ideas have been talked about by others long before Codius but my pitch for Codius would be that it's a nice and pragmatic, web-y way to do it vs the clunky, blockchain-based approach.</comment></comment></comment>


Show HN: ExchangeRates.Pro: price comparison of Bitcoin and 33 cryptos worldwide - <AUTHOR> https://exchangerates.pro <comment><AUTHOR> Hi! We were working on this for last few months and now most of the features are ready. So please give us some feedback

ExchangeRates.Pro is a price comparison platform. We find the best rates to buy or sell Bitcoin and 33 other cryptocurrencies in any country and help choosing the safest and fastest exchange.

Our goal is to create something like Skyscanner for the cryptocurrency exchange industry. We compare the prices and conditions at various exchanges — trading platforms, brokers, P2P marketplaces, e-wallets and ease the process of picking the best one. We are seasoned Bitcoin users, so kind of know the struggle. )) Most of the functionality is ready and while we are adding more exchanges, etc. we'd love to hear what you like in our platform and what you don't. Thanks!</comment>


My co-founder is my boyfriend: How we made it work - <AUTHOR> https://medium.com/@nikla88/my-co-founder-is-my-boyfriend-how-we-made-it-works-215e23d214d4

<comment><USER2> I'm not sure I believe it until I see a successful exit. Did the companies succeed? Did the relationship succeed? (The latter is a tough one to measure since marriage isn't for everyone)

These aren't meant to be snarky - Please share if you have more info.

<comment><AUTHOR> Our company is still a work in process, but we've got paying customers and 5 on 5 as average review of the product ([http://apps.shopify.com/fanchimp](http://apps.shopify.com/fanchimp)), plus two seed rounds of funding.

Sentimentally we've been together for 7 years, working as co-founders for about 5 now. We're happy and we're focused long term.

I hope to have replied to your doubts. ;)

<comment><USER2> Great on both counts!

<comment><USER3> Thanks for the comment, yes we're still working on the startup and you're right, there aren't any big success with two co-founder in a relation. Although my friends at AgentPiggy and [http://www.gym- pact.com/](http://www.gym-pact.com/) are going pretty well.

<comment><USER4> Kevin and Julia Hartz are the two main founders at Eventbrite, currently valued at $700m and looking towards an IPO. There's an article where Julia explains how they make it work here: [http://www.businessinsider.com/how-to- marry-your-cofounder-a...](http://www.businessinsider.com/how-to-marry-your- cofounder-and-not-kill-your-200-million-startup-or-each-other-in-the- process-2012-2) .

</comment></comment></comment></comment></comment><comment><USER3> Hi guys! This is my story as entrepreneur and also as co-founder/girlfriend, I hope you'll appreciate it! ;)

</comment><comment><USER5> Awesome Nico! Hughs from Chile!

<comment><USER3> Thanks Felipe! ;) Take care!</comment></comment>


Ask HN: is it really hard to start a US business from Europe? - <AUTHOR>

Hi guys,
I've been working on a startup for the previous months. The original plan was to launch it worldwide, but unfortunately (or maybe it's a good thing to start small) this wasn't possible due to legal implications. I've decided that I will launch my product in the US only for the time being (until I figure out a way to bypass the European laws that prohibit what I'm doing). The reason that my product is allowed in the US is because the US has the First sale doctrine.
My question is: is it better for me to start a company in my own country (The Netherlands) or should I start a company in the US (LLC, Delaware) and still work from The Netherlands? I keep hearing that it is very difficult for non-US companies to get a foothold in the US because Americans would rather do business with American companies, but I don't know if this is true or just prejudice.
Thanks. <comment><USER2> I don't think the average consumer (not B2B) checks where a company is based before deciding to transact with the company (unless you're selling a tangible good and shipping is a consideration).

I neither know or care where browserstack.com (the last service I paid for) is based.

As for the legal and financial aspect of setting up in the US, I recommend looking through early posts on the freshdesk.com blog... there is great info there on setting up a US business (from India in their case).

<comment><AUTHOR> Thanks for your post! Some more information: it's a C2C / B2C online platform, there is no physical product.

About the legal aspects: I'm actively going to block users from other countries than the US, so I think the only laws that apply to my business are the US laws, but I will consult a lawyer about that.

Reading through the freshdesk blog now, nice site :)

<comment><USER3> Will you only target english?

<comment><AUTHOR> Yes, for the time being.

</comment></comment></comment></comment><comment><USER4> Not true at all.

I am American (lived in three countries) and can assure you that is not accurate. America has more foreign owned businesses than any nation on earth. When you think about it, America is almost entirely made up of immigrants. I have done quite a bit of business in Europe and would say that it would compare with London or Zurich.

</comment><comment><USER5> From my experience selling digital products to the U.S./international market, a very small percentage of visitors actually check the contact page (where they would find the business name/location). Unfortunately I did not A/B test displaying it more prominently so I don't know whether that would have improved conversions or not.

When choosing a payment processor, making sure that it handles the whole process should save you the hassle of setting up a merchant account (an account that allows you to accept credit card payments) with a US bank.

I am Dutch too and I know a B.V. (Dutch limited stock company) is allowed to be a "holding" company that owns all the shares in a foreign company - but I went to business school and not law school, so there might be some fine print you'd want to consult a lawyer about.

It'll be an expensive hassle though, so if you're not dealing with B2B I'd recommend getting the "trust indicators" consumers are looking for by getting a U.S. street address with Earth Class Mail and possibly a U.S. phone number (through Skype) that forwards to a Skype account in your company. You can always go the U.S. incorporation route when you have the revenue to finance/justify it.

<comment><AUTHOR> Thanks for your post. What would you advice for my C2C startup, a Dutch BV or an American LLC?

<comment><USER5> I would definitely start out with a B.V. since it would be much easier and cheaper to set up, and less hassle/paperwork when tax time comes.

Then, when revenues justify the investment, I'd set it all up properly in the US with the help of a good attorney and/or accountant.

An important point here is that as a B.V. you would be governed under Dutch law if someone sued you. This should be disclosed in your terms and conditions as it will be considered unfair trade practice otherwise. If you feel you don't want to hire an expensive lawyer, I think the KvK has an export desk where they can help with these kinds of questions.

But it all depends on what kind of startup you have - if you have already validated the idea and have some investor/savings money I would hop on a plane and get it sorted there straight away :)

<comment><AUTHOR> Thanks for your advice! Can I stay in touch with you in case I have some more (short) questions?

<comment><USER5> For sure! I just sent you an email (to the address in your profile).

</comment></comment></comment></comment></comment><comment><USER6> I don't think Americans actively object to doing business with foreign companies, but many aren't really used to it, so may balk if anything seems unexpectedly foreign. For example, if the checkout process is in Euros or includes a bunch of instructions about VAT, conversion will probably drop. But if the overall experience seems "normal", few people care where the business is incorporated.

That said, there may be other issues I'm not qualified to comment on. For example, if your business complies with U.S. law but not Dutch law, then I have no idea whether incorporating & operating it from the Netherlands will cause you trouble. Not being based in the U.S. may also make it more difficult to use U.S.-based payment processors.

<comment><AUTHOR> Thanks for your post. I figured out that Stripe and Braintree pretty much require you to have a US company, but I was thinking about using Skrill which doesn't have this restriction as far as I know.

The online platform will be fully localized for the US market. Unless you actively look for it, you won't notice that it's not a US company.

</comment></comment><comment><USER7> You cannot get a merchant account unless you have have a SSN.

Obviously, opening a company will not grant you a SSN. It will be hell to simply open a bank account.

It is easy to open a company, close to impossible to actually have a business.

I own an useless LLC in Delaware, btw.

<comment><AUTHOR> Merchant account? What kind of merchant account?

And why is your LLC useless?</comment></comment>


What the CSS? - <AUTHOR> https://medium.com/@gravis/what-the-css-86dff69f02cd <comment><USER2> Aside from this article, why css as a whole is such a unmenagable mess? The whole frontend "separation of concerns" is fucking stupid: data - html, look at any modern website - you see div soup holding no data, css - try making some runtime customizabily eg. change color, layout on ie11, js - contrary to popular opinion, js does what it should do :p

Maybe it was holding water when all pages was as complex as hacker news but currently we need something which is little more sensible

</comment><comment><USER3> I'm immensely confused by this: `It's totally ok to write class="75%" if you define it as .\35 0\%{} in CSS.` How is this:

        .\35 0\%{}

turned into "75%"? It looks more like it would turn into "50%". Why is there a space after the 5 (wouldn't that mean you're finished talking about the class and have moved on to explaining a descendent element?) and what does \3 mean?

<comment><USER4> This explains CSS escaping pretty well: [https://mathiasbynens.be/notes/css- escapes](https://mathiasbynens.be/notes/css-escapes)

\37 is the escaped hexadecimal number 0x37 == the ASCII character '7'

The whitespace after the escaped character is "eaten" (the whitespace indicates the end of the escape sequence)

0 is '0'

\% is '%'

(update: fixed \37 == '7')

<comment><USER3> Thank you!</comment></comment></comment>


So, 27 US states are farther north than Canada, eh? (2017) - <AUTHOR> https://blogs.sas.com/content/sastraining/2017/08/10/us-states-north-of-canada/ <comment><AUTHOR> Believe it or not, there's actually some code in this article, too (SAS SQL).</comment>


Show HN: Orat.io, simple PRO and CON feedback to replace blog comments - <AUTHOR> https://www.orat.io

<comment><USER2> I like the concept (though I'm not sure what the value is to businesses embedding the widget?).

Is this something you'd consider open sourcing?</comment>


Ask YC: using PEO for a startup, good or bad? (HR hack) - <AUTHOR>

We are considering using PEO for our company.  Anybody has any experience, positive of negative with this setup?
PEO basically employs everybody in your organization, and leases them back to your company.  That way the employees get larger group insurance, payroll, etc.  It sounds good in principle, but who knows how it actually works.
http://en.wikipedia.org/wiki/Professional_employer_organization
The most well marketed one is Administaff <comment><USER2> We are using ADP TotalSource for payroll and PEO functions. Though it is nice to have everything in more or less one place, the response time and customer service is extra-medium. By that I mean that most of the time if there is a problem with health care coverage, I end up personally having to call the provider, ADP merely provides a phone number. On the positive side, the prices are reasonable and the variety of plan offerings is good too. They just started up their west coast operations last year.

We looked at Administaff as well and the main reason for going with ADP was a pre-existing relationship via payroll.

</comment><comment><USER3> I worked for a startup that used Administaff.

Administaff basically sucks. They are expensive from a company perspective. The benefits (in Texas at least) are fairly poor and expensive.

Also, with noone on staff responsible for HR functions, there was a LOT of frustration when HR type questions and issues came up.

</comment><comment><USER4> I've heard lots of bad things about Administaff from an employee perspective...I don't know whether it makes up for it on the employer side. But I think keeping employees happy is pretty important, so it's probably worthwhile to figure out how to solve the problems without bringing in a known-to-be-ornery third party. We're going to have to solve those problems soon, as well, and I'm still completely at a loss on how to do so. So, I sympathize.

</comment><comment><USER5> I would definitely like to hear about this as well; right now we're outsourcing our payroll using PayCycle (<http://paycycle.com>). We're bringing on our first employee soon and definitely want to focus on our core business (ie, making cool stuff) and not administrative tasks.

</comment><comment><USER6> I use TriNet at my company, and the cost is about made up for by the savings in the health care plans alone. Factor in the benefits of someone else handling the work, and it is a no brainer for us. Note that the avg wage of TriNet companies is over $100k, whereas Administaff is around $60k. I think Administaff has a much broader base of client companies, but TriNet is higher end. TriNet's only weakness is not having an integrated 401k, but it is not too hard to link Fidelity to it.

</comment><comment><USER6> One more element to consider.....if you hire mostly young male engineers, then health benefits are not a big draw, and a PEO may therefore not be a good option.

</comment><comment><USER7> PEOs tend to be expensive but will allow you to offer much better benefits that otherwise possible. I've used TriNet and they were good. But pricey.

</comment><comment><USER8> The last three startups I have been a part of, all used ADP. I was not part of the decision making, but I thought it was worth noting.</comment>


You Probably Don't Need Derived State - <AUTHOR> https://reactjs.org/blog/2018/06/07/you-probably-dont-need-derived-state.html <comment><USER2> React is getting more and more unpredictable and confusing. Get derived state, get snapshot.. what? If you don't think users need this method, why put it out in the first place. I have been using React for 3 years, first time I am seeing this sudden shift towards weird patterns, pushed by all the new core developers

<comment><USER3> Hi there, thanks for feedback!

Let me address a few points.

 _> If you don't think users need this method, why put it out in the first place._

First of all, the article is not about the new method. It's about _patterns that has always caused bugs_. This is repeated several times throughout the article, for example:

 _> All of the anti-patterns described in this post apply to both the older componentWillReceiveProps and the newer getDerivedStateFromProps._

We realized that people don't often clearly understand better alternatives to these patterns (whether with old or new lifecycles) and write fragile and complicated code when there are simple solutions.

In this blog post, we tried to share some better solutions to those common patterns. I'm sorry if you didn't find them useful, but I'm glad that it seems like you've never made those mistakes. Many people did, and found the post helpful.

Now, onto the topic of the lifecycle method changes.

I don't know if you've seen my talk at JSConf Iceland about async rendering but it's really hard to explain the motivation if you haven't. I know it's a lot to ask but I would appreciate if you took 30 minutes of your time to watch it:

[https://reactjs.org/blog/2018/03/01/sneak-peek-beyond- react-...](https://reactjs.org/blog/2018/03/01/sneak-peek-beyond- react-16.html)

I'm sure you won't regret it, and I hope you will get as excited as I am about Time Slicing and Suspense. However, these features are not possible if we keep some of the less-clearly defined lifecycle methods like `componentWillUpdate` or `componentWillReceiveProps`.

Coincidentally, these legacy lifecycles tend to be the ones that people make most bugs or mistakes in. You might have already gotten used to them, but people have always been pretty confused about how they worked.

Most of the time those legacy lifecycles shouldn't have been used in the first place. For example, a lot of code that's placed in `componentWillUpdate` would work much better in `componentDidUpdate`.

 _> pushed by all the new core developers_

For the rare cases where those legacy lifecycles were actually needed, we introduced safer alternatives, but as you rightly noted, you probably haven't bumped into the use cases where you need them, so you don't need to worry about them. We couldn't just "leave them out" because we need to support all existing people's use cases. Having a migration path is a core principle of React. We're not "pushing" them.

Does that help at all? I know it's frustrating when something familiar has been replaced with something less familiar. But again, most users won't need them. And we can't drop them because we care about supporting even rare use cases. We think the new features (Time Slicing and Suspense) will be worth the temporary confusion for our users, and I hope that after watching my talk you will agree.

I'm happy to talk to you more on Twitter or somewhere else. ([http://mobile.twitter.com/dan_abramov/](http://mobile.twitter.com/dan_abramov/))

Cheers!</comment></comment>


Equifax takes down web page after reports of new hack - <AUTHOR> http://www.reuters.com/article/us-equifax-breach/equifax-takes-down-web-page-after-reports-of-new-hack-idUSKBN1CH2F3 <comment><USER2> I feel like this has to do with Equifax basically not being punished in any major way over the last breach. Their stocks are still priced reasonably well, most of their board is still intact, and US citizens are still required to work with them for credit reasons.

And the worst part is, I have no idea how I as a person could say "I don't want to do work with Equifax because I don't trust them." And if anybody has suggestions on that, I'm totally open, because if Equifax was a dripping faucet, they'd be flooding the house by now.

<comment><USER3> freeze your credit report with Equifax, and then if any company requests it, they'll be denied (because you have to request it be unfrozen for them to receive it).

If any company uses Equifax, you'll then be denied credit or they'll ask you to unfreeze it.. either way, you can complain to them, and make it clear you won't work with Equifax.

Of course, in practice, this will mean you'll get denied credit from any company that has a contract with Equifax.

<comment><USER4> Unfortunately you have no way to protect your tax returns from Equifax, which now has a contract with the IRS thanks to the infinite wisdom of our government.

[http://fortune.com/2017/10/04/equifax-irs-contract- hackers/](http://fortune.com/2017/10/04/equifax-irs-contract-hackers/)

<comment><USER5> From your link:

>"The Internal Revenue Service signed a $7.25 million contract with Equifax last month. The no-bid contract, first reported by Politico, is for Equifax to provide the IRS with taxpayer and personal identity verification services. The contract stated that Equifax (EFX, -1.34%) was the only company capable of providing these services to the IRS, and it was deemed a "critical" service that couldn't lapse."

The IRS in the US needs Equifax to provide tax payer and verification services? Seriously what does that even mean? The IRS bas no other way to verify citizens?

<comment><USER6> This is for something like the security questions when you reset your password except based on your financial records.

      - Do you recognize this street name?
      - Have you bought from this store?
      - How many mortgages did you co-sign?

Answering a set of these "knowledge" based questions is considered statistically probable proof that you're you.

<comment><USER7> They're derived from public records. Anyone who wants to hire the staff for legwork and pay all the individual municipalities for access can compile the same database.

</comment></comment></comment></comment></comment></comment><comment><USER8> Solution to the Equifax debacle:

1) If the value of the individual damages related to this breach are in excess of the market cap of the equifax company, all company stock should be seized and distributed equally among those affected by the breach.

2) In the future, if a company controls this amount of sensitive data, they should have mandatory breach insurance. This means that they are covered for a government mandated amount based on the legal liability if all their data was lost. This will mean that the insurers will do in-depth audits of the data security of the company, and they will be incentivized year-to-year to ensure their security practices are top notch. The present system incentivizes each CEO to have a head-in-the-sand approach to data security where a hack is considered a long-tail event unlikely to happen during the ceo's 3-5 year tenure and therefore is not really worth paying attention to. In addition, it would ensure that if the potential damage done if data is leaked exceeds the value of the business storing the data, the insurance will be prohibitively expensive and the company will not be able to continue with this line of business - as it should be.

<comment><USER9> I don't understand how that would work, do you mean liquidate the company? If you mean actually take the shares from shareholders, wouldn't the value of the stock go to near zero? Who would buy stock that could do that? But I agree with the general idea: they should go out of buisiness and whatever they have should be sold to reemburse people affected.

<comment><USER10> I wonder if the Feds could simply seize the company and issue treasury bonds to shareholders to cover the costs of their stake at the market's price. Eminent domain, or whatever legal term is latin for "we have the guns."

Then, yeah, liquidate everything and distribute the proceeds amongst the victims. It would be expensive, but...so what? The budget is $2T, and if the fine vastly outweighs the value of the company, then it is clearly a grave situation that demands an unusual response.

Maybe they could actually issue a realistic fine, and let the company deal with it. But the company would probably just distribute any remaining assets amongst their executives, fire everyone, and declare bankruptcy or something.

<comment><USER11> > issue treasury bonds to shareholders

who aren't members of the board

<comment><USER12> There's really no reason to exclude board members other than spite. If you're going to fine them then just fine them.

<comment><USER11> Okay, their fine is the value of their stock/options in the company. I think companies would care more about security if the board members were the ones we make examples of in cases like this.

</comment></comment></comment></comment></comment></comment><comment><USER13> We're just getting into an era where everything is hackable. We haven't even begun to understand the ramifications...! Privacy has been dead for a long time (did it ever exist?), but we're only just now being confronted with what this means. We have a choice to make: make the world work for everyone, or perish!

<comment><USER14> I agree: I think we have been blessed with a long period of innocence concerning the security of our services and devices. A period that is now coming to an end with increased attacks by increasingly powerful entities.

The dot-com-bubble showed us that businesses should not be valued simply because they leverage hot new technology (hold your AI comparisons...). These high-profile hacks and security failures will hopefully show us that businesses should not be considered secure simply because they stack up to other measures of value.

I would hope that in the future, a fault in a company's infrastructure security is considered as seriously as a fault in its core business model.

</comment></comment><comment><USER15> Yes, this was discussed earlier today: [https://news.ycombinator.com/item?id=15456221](https://news.ycombinator.com/item?id=15456221)

And debunked...it wasn't a hack of the Equifax web site, but a malware package delivered by 3rd party analytics company, Fireclick.

<comment><USER16> Not exactly. Equifax has hardcoded references to an akamai cache of a domain (hints.netflame.cc) in their own pages[1].

That domain was owned by Fireclick (né Digital River) at one time, but changed ownership on November 15, 2016. The current owner is a Thai national using a personal Gmail address as the registration info.

Equifax should be responsible for what 3rd party domains it is referencing in their pages.

[1][https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js](https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js)

<comment><USER15> That script was provided by Fireclick, so they're the ones that hardcoded it. It even specifically says "Please do not modify this code".

<comment><USER16> I'm not sure that bit matters, it's hosted on an Equifax server and served in their pages. And pulling in a script from a very sketchy domain.

<comment><USER15> The script they hosted was legitimate. The Akamai content that it loaded, was legitimate. But Fireclick let the domain lapse, and someone else is now impersonating them and serving malware, and not just to Equifax, either. Why is the story "Equifax hacked again" instead of "Akamai serving content from known spammer site"?

<comment><USER16> I'm reasonably sure the whole Fireclick infrastructure was abandoned, probably years ago. So Equifax's part was not having some mechanism in place to remove 3rd party references for 3rd parties that aren't delivering anymore. I strongly suspect that predated the change in ownership of the domain, which was almost a year ago. The fireclick.com domain is gone. The parent company (Digital River) doesn't mention offering any kind of analytics service.

So, yes, technically the vector wasn't directly an Equifax server. But it was only a vector because nobody removed the reference.

Right now, they also reference crazyegg.com in their pages. If crazyegg goes belly up, the domain will be dormant, and when it expires, somebody might take it over. Does Equifax have an onus to deal with that, or can they blame someone else?

<comment><USER15> I don't know, how can you reasonably defend from that sort of domain hijacking/repurposing? We fundamentally have to trust DNS at some level, but domain names are somewhat transient in nature. Is it fair to single out Equifax here, or is this just an example of an unsolved problem in the industry?

<comment><USER16> Somebody used to log into the backend that showed them the statistics. Surely they noticed when it disappeared?

Security scans also usually include breakdowns of 3rd party stuff.

But yes, there's ways it could go wrong. On the other hand, Equifax is one of very few places that has so much important data. I'd expect them to be leaders in this space, not lackluster followers. Subresource integrity, perhaps more due diligence on partners...stick with bigger players for code that shows up on your site, etc.

<comment><USER15> I'd have to guess that someone cancelled the analytics at the business level, but never bothered to write up a change request to tell the devs to take it out.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Something's doesn't sound quite right over at Equifax, I would have thought that with the scale of the last breach a full and thorough audit of all existing systems would have been a major priority!

<comment><USER18> Just a normal, slow moving, bureaucratic corporation.

But even if they were faster, I'm sure an audit of all existing systems is not as simple as making sure all the doors and windows are locked around the house.

<comment><USER19> You can hire a good group of independent pen testers or security companies, and let them hammer your public facing sites. They don't lack the necessary financial resources. At least they would have discovered that type of problems. It's not difficult when there's a will.

<comment><USER20> Knowing your vulnerabilities, fixing them, and caring about them at all are all different things.

</comment></comment></comment></comment><comment><USER21> The incompetence is mindblowing. Could this be a good argument for software engineers to get their professional license?

<comment><USER22> It seems abundantly clear that Equifax's incompetence is _systemic_. Under the presumption that they could have hired better engineers, I fully believe they would have managed them into submission.

<comment><USER23> The kind of licensing here would (or should) provide significant negative consequences for malpractice, possibly including revocation or suspension of the license (and therefore prohibition of working on projects requiring licensed engineers) and even civil or criminal penalties. It also carries credibility and protection: a licensed engineer has a duty to report employers' attempts to circumvent rules like Equifax hypothetically would have done, and legal protection for his livelihood when he does so.

It may not prevent truly unscrupulous or spineless engineers from capitulating, but it's better than the current situation.

<comment><USER24> Or you know punish the managers for once instead of the footsoldiers...

When Wells Fargo had their credit scandal the salesmen shouldn't have been punished, their managers should've.

These things start at the top. When deadlines are pushed onto you, you don't have time to write unit tests, refactor, update dependencies.

<comment><USER23> Licensing empowers the engineer to refuse to do something that violates sound engineering practice according to the license and have legal recourse against retaliation.

It isn't perfect, and the imbalance of power will certainly still be an issue. But that doesn't mean we shouldn't try.

<comment><USER25> > Licensing empowers the engineer to refuse to do something that violates > sound engineering practice according to the license and have legal recourse > against retaliation.

It would just put most legal liabilities on engineers vs the org. It's a great way to protect management, that's the only thing it's going to do. That's exactly how dumb traders end up being scapegoated with each financial scandal. Any engineer who would dare report any wrong doing would be blacklisted for life from the IT industry.

Business like Equifax already have legal requirements at the org level, let's not shift all responsibility onto engineers.

</comment></comment></comment></comment></comment></comment><comment><USER26> What % of Fortune 500 companies are already paying ransomware fees unbeknownst to their users/customers?

</comment><comment><USER27> The Web has gotten so much worse since we started putting serious stuff on it. It's kind of a population-terrorizing monster, at this point.

Could we, like... not do that? I seem to remember the world turning just fine when you couldn't push the right sequence of buttons and steal the personal data of half a country's citizens from the comfort of your home.

</comment><comment><USER28> Is Equifax particularly bad for a credit bureau, or are the other guys just as bad? This is cause for worry towards all of these organizations.

</comment><comment><USER29> After recently freezing credit at all three bureaus...Transunion does it right. Free acct can toggle a freeze anytime. They show a little ad when logging in, but that is fine.

Experian has no free acct login. Equifax will next year.

</comment><comment><USER30> Where is the action from the federal government? Are any representatives working on legislation for better data protection / handling regulations?

</comment><comment><USER31> Someone must not be having a good day over at Equifax. Where is the breaking point for a company like this?

</comment><comment><USER32> The credit services seem like a good candidate for nationalization or high levels of regulation.

</comment><comment><USER33> it's amazing how much the finance industry can get away with. like honest-to- goodness amazing.

it's really impressive how these people can have such a death-grip on society. honestly, i'm more curious than mad. how is such a thing even possible? i mean, wow.

<comment><USER34> Well, these guys are simply too big to fail. Equifax cannot go bust, otherwise loads of consumer credit (mortgages, car loans etc) would freeze up, causing huge harm to the economy.

The market likely knows this, hence the stable stock price.

<comment><USER35> _Equifax cannot go bust, otherwise loads of consumer credit (mortgages, car loans etc) would freeze up_

Nope - there are two others who will gladly take up the slack.

<comment><USER34> My company would be really hampered if Equifax went bust. We do use two other credit bureaus, but some functions depend on data only Equifax provides.

We also use the different bureaus together for cross checking, often one bureaus file will be out of date or have errors, while the other is fine. So we'd have a much harder job of calculating risk if one of the big bureaus went out of business, simply because we'd be losing a major data source that drives our business.

I am very sure this case applies to other financial institutions as well.

</comment></comment></comment></comment><comment><USER36> Pretty sure this is just how it is now.</comment>


How Simple works to be more inclusive - <AUTHOR> https://www.simple.com/company/how-we-re-working-to-make-our-world-more-inclusive <comment><AUTHOR> As someone who's nonbinary, I appreciate that they don't ask for a gender, and I like that they call me Riley instead of my legal name. Even if I were on the binary, the legal name change procedure is a pain.

You have to buy an ad in the paper for several weeks before they let you change your name, and there's no option for _no_ gender. The latter part isn't as big a deal since I'm somewhat okay with male pronouns, but it's easier and cheaper if the companies I use make gender optional.</comment>


Constraints will make you Awesome - <AUTHOR> http://www.nicehacks.org/2010/09/constraints-will-make-you-awesome/

<comment><USER2> I agree with this:

"Many barriers are in our heads and only in our heads. Don't let your constraints stop you. Embrace them. You don't need to be a genius, or own lots of money, or be networked with key people, or be skillful, funny, or good- looking to meet your goals. The ones who were remarkable in life were those who understood their limitations and bent them to their advantage."

I do believe, it is the sustained attempts at overcoming constraints and often overcoming them, that makes a person or company awesome.

</comment><comment><USER3> "Necessity, who is the mother of invention." -Plato

That said, I'm not sure awesomeness is a function of constraint. Most of the awesome people I know succeed in spite of rather than because of the constraints placed upon them. In this case, I wonder what would happen if they swapped PCs for a week?</comment>


ASP.NET MVC and WebAPI Tutorials - <AUTHOR> http://www.asp.net/

<comment><USER2> My biggest turnoff about ASP.NET MVC is the lack of documentation, namely a cohesive manual. I find the handful of links to blog posts at <http://www.asp.net/mvc/overview> ridiculous and absolutely not befitting the _only_ modern web development framework promoted by Microsoft.

Take a look at the great Django manual (<https://docs.djangoproject.com/en/1.4/>) to see what I mean.

<comment><USER3> Agreed. It feels like I have to get a book to really really learn MVC.

Documentation is one area where it feels like an open source approach is the way to go. Get the community to contribute, along with MS, to a single well- defined structured document.

</comment></comment><comment><USER4> I work with the ASP.NET team to coordinate some of the content for this site. We're always interested to hear what you like and don't like about the site, what you'd like to see more of, etc. Thoughts?

<comment><USER5> Not related to the site, but now there is an audience... regarding asp.net mvc:

Can we have support and out of band releases for asp.net mvc without having to go through connect or partner support, which are both to be honest, utter shit?

Also can you get the API right and leave it right so we don't have to piss around for a week with our container and testing environment.

And finally, can you give us something better than razor which has a parser that isn't made of broken twigs and has proper separation of content and programming language (its horrid sorry). Jinja2/django/golang templates FTW.

Oh and sort out SQL 2012 licensing. It's going to cost us £768,000 to upgrade out kit from 2008 to 2012. Postgres migration is an order of magnitude cheaper.

I'm coming from a _large_ asp.net mvc project and its not pleasant, sorry. Welcome to Microsoft centric development!

Content on the web site is pretty good though.

<comment><USER4> For your first few question: You can get signed nightly builds of ASP.NET MVC. Instructions are here: <https://aspnetwebstack.codeplex.com/>

Depending on the kind of support you're looking for, the discussions and issues on CodePlex may help as well. Otherwise, there's community support (often including ASP.NET team members) in the following places: <http://forums.asp.net/1146.aspx/1?MVC> <http://stackoverflow.com/> <http://jabbr.net/#/rooms/aspnetmvc>

There are some other view engines available if you don't like Razor. Since you mentioned Django, I'm guessing you've looked at NDjango(<http://ndjango.org/index.php?title=NDjango_Home>). Another one I've been keeping an eye on is Parrot (<http://thisisparrot.com/>) - still in development, but I really like the syntax.

After that it got kinda ranty so not sure if I missed some other questions.

<comment><USER5> I'm talking supported builds, not signed builds. You know with the pile of pre-paid support credits that we get with our partnership agreement which are supposed to result in solutions. Every support call requires a week long argument with the lowest grade of software support who phone me up and ask if they can close the call every day without escalating it. I'm aware of the support options you mention, which basically result in "yes, just limp along with the dependency injection problems with ActionFilters in MVC3 for 6 months" or fork and fix it yourself. We chose the latter, but it's expensive so we might as well forfeit the partner agreement, use Open Source software and pay someone to maintain our forks and contribute patches to the products.

We've looked at NDjango, but it's based on F# and as we well know, unless a product is a mainstream MS platform then it's liable to go out of the window on a whim or is shrouded constantly with uncertainty ( _choke_ silverlight, original workflow foundation, XNA? etc).

Sorry if this is rather critical and slightly ranty, but I'm slightly pissed off with maintaining this mess.

<comment><USER4> Can you send me some specifics (jon dot galloway at microsoft dot com)? At a minimum I'd like to make sure we've got a bug filed on the di / filters issue you mention, but more importantly I want to see what we can do about the support issues you're hitting.

</comment></comment></comment></comment></comment><comment><USER6> Now Azure just needs to hurry up and release .Net 4.5 on their servers. Until then no MVC4 ,WebAPI, or Entity Framework 5.

Scroll down to _New Features_ for a list of changes: <http://www.asp.net/whitepapers/mvc4-release-notes>

<comment><USER7> You can deploy .NET 4.5 to Azure right now if you use the Virtual Machines instead of the SDK. We're running a Windows Server 2012 VM with several .NET 4.5 sites on it right now for advancedrei.com and its supplemental sites.

<comment><USER7> You can also chain the .NET 4.5 installer to run inside a Windows Azure Web Role on deploy, but that is a bigger pain in the ass than a VM.

FYI .NET 4.5 will be supported in all roles later this month.

</comment></comment></comment><comment><USER8> I've never understood their sick obsession with attributes. When I first started using MVC, I thought it was clever to add HttpPost, HttpDelete, etc... After using a real routing library and then bringing one into my MVC project, it just looks, well... stupid. Gone are my RPC method names. Gone are my untestable Http method -> Action routing. Gone are my magical behavior mixed in due to something in a square bracket.

<comment><USER6> What's this real routing library you speak of? I actually just started using an Attribute Routing [1] library for my WebAPI project. I like having my routes defined on the methods that will handle them instead of hidden away in the global.

[1] <https://github.com/mccalltd/AttributeRouting>

<comment><USER9> I used AttributeRouting for a fairly large ASP.NET MVC 3 project. I found it really clean and useful - I preferred having the routing information declared on the methods themselves, rather than in some generic routing table, or a single catch-all route. With this library, you don't have to explicitly define a route on every method, there are convention-based approaches, and different levels at which you can define the base route, then more specific routes as you get closer to the methods themselves.

I also used T4MVC, which may have fallen by the wayside, but that kept a lot of the "magic strings" out of the code.

<http://mvccontrib.codeplex.com/wikipage?title=T4MVC>

</comment></comment></comment><comment><USER10> It's good to see Microsoft investing time and resource to recognize community contributions. They should open similar platforms for Mobile, Azure, SQL and Windows Developers too. www.windowsclient.net used to be a good resource for Windows App programmers, but it's been abandoned

</comment><comment><USER11> eckyptany. Can't you by a per core license for sql server 2012? how many cores do you have?

</comment><comment><USER12> Slightly off topic but I'm finding it difficult to find this information: How long are ASP.NET MVC releases supported for with bug fixes? MVC4 is out now and presumably next year MVC5 will be out -- does MVC4 continue to receive bug fixes?

<comment><USER5> Not for a minute. The releases are pretty much shelved after v.next. To add to that, the support you do get is crappy, even as a gold partner. ASP.Net MVC is awfully designed and rather buggy as well from experience.

I've been using it on a _huge_ project (145 controllers)since CTP2. I wouldn't use it again.

we're currently investigating werkzeug, python, sqlalchemy and postgresql as a replacement for a new project, particularly also because we got shafted by SQL 2012 per core licensing.

Stay away - you have been warned.

<comment><USER13> I've built a fair number of medium-small sites with it and like it pretty well...I'm interested in your perspective with such a large project. Why do you think it's awfully designed?

I did just run into a pretty nasty and obscure bug. (That was the first though.)

<comment><USER4> What was the bug? I'd like to make sure it's listed on <https://aspnetwebstack.codeplex.com/workitem/list/basic> if it's not there already.

<comment><USER13> This one: [http://stackoverflow.com/questions/8640950/null-reference- ex...](http://stackoverflow.com/questions/8640950/null-reference-exception- when-generating-a-url-with-urlhelper-action-method)

In my case it manifested on ajax calls but not the initial page load. I had a custom grid that worked fine on the first load but blew up when the user tried to page or sort it. And it only happened on production, because the prod server had the component mentioned in the link installed, but the dev and stage servers didn't.

Luckily the guy administering the web servers tracked down the configuration difference, googled, and found the above link, and I was able to make a small change to my code to work around it, pre-calculating the url on the initial load and just referencing the resulting string on the ajax call (specifically, using lexical closure instead of calculating the url inside a lambda). That fixed it.

This was on MVC3.

</comment></comment></comment></comment></comment><comment><USER14> I can't figure out why MVC and WebAPI are separate products.

<comment><USER15> They're not really. WebAPI is built on top of MVC, but uses some different base classes (which is annoying as hell at times). [Edit] Plus what vyrotek said [/Edit]

I think it has more to do with getting uptake among the WCF crowd than anything else. IF MS doesn't specifically call it out the folks that had bought into the kool-aid to use WCF for all services probably would never see it. As it is, only 50% of them will see it.

The MS stack has a LOT of 80% developers who are buried in the bowels of some organization happily doing the same thing they've been doing since they first learned .NET.

Heck, I had a call from an organization the other day looking for a senior developer, but they had to have intimate knowledge of a perticular third parties UI control library, because that was what they were using when they wrote the original application in VB6. Couldn't convince them that they probably don't need the 3rd party controls for an HTML app, not could I convince them that any senior developer worth hiring would be able to understand and use said library in a matter of hours if they were truly needed.

Over the last three years I've come to understand that it's I'm not that I'm awesome, it's that most developers are just bad at their jobs (present company probably excluded).

<comment><USER16> Web API is actually built on a completely different HTTP pipeline than ASP.NET products. When it moved to the ASP.NET team, there were a number of changes made to make it feel more natural to ASP.NET devs. Hence the slight variations when you dig under the covers. The question we need to ask ourselves, is why would the ASP.NET team agree to continue to support a completely new HTTP pipeline.

<comment><USER14> Implementation details. To the person using the products, they are nearly identical, with one being for web sites and one being for APIs. I see no reason why these should be separate. Please explain.

<comment><USER17> ASP.NET MVC is approx. 3 years old product and to support the features of the current ASP.NET Web API in an elegant way, lots of breaking changes would occur in ASP.NET MVC. This is just one of the reasons. You might also see this one as another impl. detail but it is the brutal truth.

Gleen Block has a 20 minutes long video on this topic if you need more info: [http://www.tugberkugurlu.com/archive/why-do-i-need-asp- net-w...](http://www.tugberkugurlu.com/archive/why-do-i-need-asp-net-web-api- when-i-already-have-asp-net-mvc)

<comment><USER14> What features? The difference between MVC and Web API, to those using it, is that Web API uses restful routing and MVC does not. That is all.

<comment><USER17> It's pretty impressive to see people who have no idea about the technology they are talking about. ASP.NET Web API doesn't force REST at all! Go learn what that FX does in the first place before leaving comments like this.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Oh man do I feel more and more pushed to upgrade our codebase to MVC4...

<comment><USER6> I'm curious, is there something specific in MVC4 that you need? Personally, I just want it for WebAPI.

<comment><USER19> The automatic support for routing to .mobile views is really nice, for one thing.

The small improvements to Razor (e.g. automatic ~/ parsing and conditional shortcuts) are also nice time/trouble savers.

<comment><USER6> I've been following MVC for a long time and I somehow completely missed the .mobile.cshtml feature! I can actually make use of this now. Thanks :)

<comment><USER4> The .mobile.cshtml is included out of the box, but you can also define other specific display modes with a lambda expression:

DisplayModeProvider.Instance.Modes.Insert(0, new DefaultDisplayMode("iPhone") { ContextCondition = (context => context.GetOverriddenUserAgent().IndexOf ("iPhone", StringComparison.OrdinalIgnoreCase) >= 0) });

After calling that, you can create a view (index.iphone.cshtml) and it'll be automatically picked up when the condition's matched. This example uses the user agent, but you can use any logic you'd like - cookie / database call / time of day / whatever.

<comment><USER6> Very nice! What's the best way to develop and debug mobile sites locally? Is there a quick way to force either my browser or VS to go into 'mobile' mode?

Edit - Found the answer :) [http://www.howtogeek.com/113439/how-to-change- your-browsers-...](http://www.howtogeek.com/113439/how-to-change-your- browsers-user-agent-without-installing-any-extensions/)</comment></comment></comment></comment></comment></comment>


Solution for Facebook: have a second, unfiltered feed - <AUTHOR>

So with the washingtonpost running a story on Facebook's unfathomable filtering, why don't we ask Facebook to create a second feed: Very simple stuff, show me my friends' stuff, I'll take care of the filtering... <comment><USER2> It seems like most of their advertising model is built on restricting others' access to YOU (force others who would normally show up on your feed to pay for promoted-posts if they really wanna show up). So, though an unfiltered feed might be great for the users, it seems like facebook would be generally opposed to it.

</comment><comment><USER3> Sure, ask away. From Facebook's point of view, there is no problem here.

If you _really_ care about that, stop using Facebook or any closed social network: join a decentralized one. If you don't control whatever happens with your data (I consider "how incoming feeds are displayed to me" as part of it), you will always be at the mercy of someone else. Just hope they're nice to you.

</comment><comment><USER4> There is a (mostly) unfiltered feed available, just change the sort order to Most Recent. You may find that Facebook periodically (or in my case, always) changes it back though.</comment>


Learning from Emilia Romagna's cooperative economy (2016) - <AUTHOR> https://thenextsystem.org/learning-from-emilia-romagna <comment><USER2> Extract from the article: "The founding principle was based on "common economic action as part of a general vision of society not based on individualism and self-interest".

</comment><comment><USER3> [https://news.ycombinator.com/item?id=16553606](https://news.ycombinator.com/item?id=16553606)</comment>