Ask HN: How to launch web app? - <AUTHOR> <comment><USER2> [https://stackoverflow.com/help/how-to- ask](https://stackoverflow.com/help/how-to-ask)</comment>


Are We Running Out of Food? - <AUTHOR> http://mises.org/story/2958

<comment><USER2> Please, please, please, no mises.org links.

<comment><USER3> I have actually enjoyed it. Author makes well-reasoned argument, no partisan attacks, not obvious fallacies, no inflaming of passions. Well worth the read.

I personally suspect the food shortage story is very convenient PR to the oil companies so there may be a connection there.

Over the long term there is going to be battle between old energy and new energy. Old one is well entrenched with money and, ahem, connections. New one has much better, greener, more humane PR story on its side and goodwill is an enormous asset - ask Google. From this angle it makes sense attack new energy where it hurts the most - undermine the message itself.

<comment><USER4> But what oh god what does that have to do with Hacker News?</comment></comment></comment>


Microsoft releases the original Windows 3.0 File Manager source code - <AUTHOR> https://techcrunch.com/2018/04/09/90s-kids-rejoice-microsoft-releases-the-original-windows-3-0-file-manager-source-code/ <comment><USER2> Could this be a boon to the ReactOS and WINE communities? Or is the code too disconnected and old to be useful?</comment>


Steve Wozniak says he was scammed out of $74,000 in Bitcoin - <AUTHOR> http://bgr.com/2018/02/28/bitcoin-stolen-steve-wozniak-fraud-70000-fake-credit-card/ <comment><USER2> I think Wozniak just has trouble with money. He and Jobs started with similar stakes in Apple yet Jobs became a billionaire and Wozniak has not.

<comment><USER3> From Wikipedia: [https://en.wikipedia.org/wiki/Steve_Wozniak](https://en.wikipedia.org/wiki/Steve_Wozniak)

> _US$100 million_

That's good enough for me.

<comment><USER2> True, but here's a man that got bilked into financing the US festivals in the 80's. While they were nice for the people that attended them he lost Millions. The sad part is that he wanted to put on a minor music festival but was conned into expanding it to a full music festival where the promoters and the bands got rich and he lost big time, something larger than $35 million. And that's not the only example.

He talks about it in his bio. It's a shame he's probably too nice a person and people are ready to take advantage. It's a shame to say but maybe nice guys do finish last.</comment></comment></comment>


A New Global Swarm of Weather-Sensing Satellites - <AUTHOR> http://www.theatlantic.com/technology/archive/2015/01/a-new-global-swarm-of-orbiting-weather-sensors/384935/?utm_content=buffer9f1b1&utm_medium=social&utm_source=linkedin.com&utm_campaign=buffer&single_page=true <comment><USER2> This is interesting, but not as groundbreaking as they make it out to be. People are already using GPS signals to calculate things like available liquid water. For instance, see [http://www.suominet.ucar.edu/](http://www.suominet.ucar.edu/) .

One of the main problems with something like this is that you get an integrated quantity, with no easy way of backing out the exact elevation this occured at. If you get a dense enough network, sure you may be able to work it back out, but you also don't really get a sense of the drop shape.

For comparison, the most advanced satellite weather system we have is the Global Precipitation Measurement(GPM) constellation. This uses a series of radiometers and radars to provide a much more detailed picture, that also includes 3d data. See [http://www.nasa.gov/mission_pages/GPM/main/](http://www.nasa.gov/mission_pages/GPM/main/) for more information.

If you stick to ground radar, you can get even more impressive by using polarization. By transmitting dual polarized signals, we can actually get a measure of the shape of the raindrops(based on the difference in power returned by the two polarizations). The US NEXRAD network recently upgraded it's radars to be dual polarization capable(finally). This also provides us with the ability to differentiate between ice and rain(Something we couldn't, strictly speaking, do before). We can also separate out the signals caused by bugs(which can be a huge issue), as well as other sources of signal contamination.

<comment><USER3> Do you know whether such techniques are also used for researching other planets than earth?

<comment><USER2> I'm really not sure. I mostly just keep up with terrestrial weather.</comment></comment></comment>


Show HN: Fictionhub, a place to share fiction - <AUTHOR> http://fictionhub.io/ <comment><USER2> For the signup, you should display your privacy policy, and probably any information related to licensing. As an author, I don't want to just throw my work on some site and have it come back to bit me later. :) The layout looks decent, and works nicely on a phone, which is where I do a lot of reading. I like how you've handled multiple chapters. In the future, adding a search box, or maybe the ability to define tags, and search by those would be nice to see. (Thinking of the point where the site could host thousands of stories) \- I hope this comes across as constrictive criticism, and not bashing :)

<comment><AUTHOR> Thank you for the awesome feedback!

You can find the search box and a list of tags on the stories page:

[http://fictionhub.io/browse/](http://fictionhub.io/browse/)

In terms of licensing - I have not dealt with any legal issues yet, but all the rights to submitted stories belong to their authors.

<comment><USER3> You need some basic rights just to do digital distribution. There is an implicit "well they uploaded it, so they must want it distributed/published," but that's a legal headache waiting to happen.

<comment><AUTHOR> I'll talk to the professional lawyer and ask about how to do this right. But legal technicalities aside, my intention is to make the licensing maximally favorable for writers, so that everyone preserves all the rights to their work.

</comment></comment></comment></comment><comment><USER4> You might get a big traffic from HN and don't get much out of it. People might just go, read a page and bookmarked it or think they will come back later. But they usually don't. If I was prompted or had a field where I could enter my email address to get the best story of a genre I picked at the end of each week, I would gladly enter my email address. Convert!

<comment><USER5> I'll second this. Great idea but I doubt I will remember to come back in a couple days. But other sites where I know I'll forget I freely give my email to get content pushed to me or reminding me to come back (ie. weekly highlights).

<comment><AUTHOR> You are right, as I've commented above - I will definitely implement this functionality. If you want - feel free to create an account, and I'll send you a message when the feature is ready.

</comment></comment></comment><comment><AUTHOR> My goal is to make fictionhub a perfect place for writers to post and discuss fiction.

It is like a blogging platform with discovery system and community features of reddit.

It is also open source:

[https://github.com/raymestalez/fictionhub](https://github.com/raymestalez/fictionhub)

You are welcome to join and upload your stories, and to ask me any questions =)

<comment><USER6> Speaking as a guy who wants to write books until I die, is there a way to filter out fan fiction? I'm REALLY uninterested in people's knock-off writing, and it makes me much less likely to participate in this community. It seems like you need a little more structure to allow people to self-segregate better.

<comment><AUTHOR> Hmm... I haven't encountered many writers who really dislike fanfiction, so I haven't really thought about that problem.

But it is very solvable. I will make it possible to subscribe to and unsubscribe from categories("hubs"), they will function just like subreddits, so all the things you are not interested in will be hidden.

<comment> rm_-rf_slash Perhaps upon submission there should be a required option to state whether the text is fanfiction. Regardless of quality, by including fanfiction among other works, you've reduced the average perceived quality SIGNIFICANTLY. Because everyone's seen one or two tremendous fanfic trainwrecks in their time and that's enough to make them avoid an inclusive community entirely.

It's ok to allow fanfic, just make sure it's clearly labeled and filter-able.

</comment></comment></comment></comment><comment><USER7> As a new author looking to get his work out there I was interested to take a look around ... and slightly disappointed that you don't tell me anything about the site! (the kind of stuff you explain below, where you say you want to "make fictionhub a perfect place for writers to post and discuss fiction. It is like a blogging platform with discovery system and community features of reddit.")

I would suggest including an easy to find About page where you explain the value of the site to people (both authors and readers).

As it is, I looked around for ten seconds and wondered what the value proposition was.

Good luck!

<comment><USER8> Oh apparently the Banner image is a link to a welcome page.

</comment></comment><comment><USER9> Reminds me of Fictionaut.</comment>


Hands-on With App Engine's New Runtime - <AUTHOR> https://developers.google.com/events/io/sessions/383758862

<comment><USER2> It's PHP.

They want the wordpress crowd.

I think it's a very smart move. In the real world, outside of the startup bubble, there is a need for a simple, scalable php hosting that never gets slashdotted.

<comment><USER3> I agree. Ruby would be illogical seeing as they already have Python which is pretty similar. PHP would bring in a totally different crowd.

I do think there is enough an overload of PHP hosting though, even good php hosting, so the competition will be fierce.

</comment></comment><comment><USER4> Why would anyone lock themselves to a Google-only infrastructure now?

<comment><USER5> Because it might be the best option for a next few years? I'm not saying it is, but some people did a right choice "locking" themselves to Adobe-only infrastructure (Flash), Apple-only infrastructure (iOS/Objective-C), Microsoft-only infrastructure (Windows/Office/.NET), ...

<comment><USER4> When you're on the client side you don't have much of a choice. On the server, there are various options.

And even then, GAE is more risky than, say, .Net - since you never actually buy the platform, you're subject to Google's changing prices and product priorities.

</comment></comment></comment><comment><USER6> Any new information on which language it is out yet?

<comment><USER7> My bet is on node.js meaning JavaScript :)

<comment><USER8> AppEngine is not build to support node.js async model, my bet is on Ruby.

<comment><USER7> I'm not a web developer so I have to ask whether Ruby is that different from Python so that another tool chain gets added and maintained.

Edit: your point about node.js makes sense though.

</comment></comment></comment></comment><comment><USER9> It's Go. Experimental now.</comment>


Show HN: Party Bot – A bot that helps find parties happening near you - <AUTHOR> http://partybot.partywithalocal.com/ <comment><USER2> Why the conversational UI? Think there are few problems that are best solved by chatbots, party-planning doesn't seem to be one of them.

<comment><USER3> Why not though? It's faster & easier being sent a (limited) list of curated events in chat than having to search for them on Facebook or other sites. Plus the weekly broadcast is a nice touch.

</comment></comment><comment><USER3> Looks cool! Great design & funny chat. Not that many events in my area but some good ones, this has a lot of potential!

</comment><comment><AUTHOR> Love to hear some feedback on Party Bot from the HN community</comment>


Show HN: JohnnyDepp – A tiny dependency manager for modern browsers in 862 bytes - <AUTHOR> https://github.com/muicss/johnnydepp?a=1 <comment><USER2> Maybe you should name this JohnnyDep so it's more an allusion and less the actual person's name? Dep makes more sense anyways, as dependency has one p.

<comment><USER3> Extending the subtlety vector a little more:

"Johnny"

<comment><USER4> or "Jack"

<comment><USER3> The config would be what you might call "guidelines".

</comment></comment></comment></comment><comment><AUTHOR> Hi Everyone - author here. I just wanted to give you some background on the project. JohnnyDepp came out of a feature request I got on another project called LoadJS ([https://github.com/muicss/loadjs](https://github.com/muicss/loadjs)) which is an async loading library. The request was for a higher-level dependency manager that:

      1. lazy-loads files
      2. handles JS/CSS/images
      3. handles nested dependencies
      4. makes it easy to manage dependencies among team members
      5. is extremely lightweight

I realize that many teams use RequireJS to manage dependencies but I saw an opportunity to make a library that could accomplish many of the same things but with a much smaller footprint and a simpler API. I hope you'll give it a try and let me know what you think!

<comment><USER5> Have you looked into <script type=module>?

When you use that, you have dependency management supported by the browser natively.

In that light, are custom dependency loaders still needed?

<comment><AUTHOR> Thanks for the recommendation! I wasn't aware of the modules feature or that it was already supported in Chrome/Safari/Firefox/Edge. I'll take a closer look at modules but if you're only targeting edge browsers then maybe you can do dependency management purely natively.

</comment></comment></comment><comment><USER6> This is without doubt the worst dependency manager I have ever heard of.

<comment><USER7> what qualities do you feel make it so?

<comment><USER6> It's a quote from Pirates of the Caribbean, about the character Johnny Depp played:

[https://youtu.be/wv9PWo-KLc0](https://youtu.be/wv9PWo-KLc0)

[https://youtu.be/CAt5JB96Cdk](https://youtu.be/CAt5JB96Cdk)

</comment></comment></comment><comment><USER8> Is he cool with using his name and likeness?

<comment><AUTHOR> Yes

<comment><USER9> Out of curiosity, how did you go about obtaining permission?

</comment></comment></comment><comment><USER10> Nothing beats my dependency manager, which I'll just call DrGonzo:

      var exports = {};
      function require(modname) {
        if (modname == 'jquery') return $;
        else if (modname.startsWith('.')) return exports;
        else { console.log("Unknown require()", modname); return exports; }
      }

(Of course you've gotta <include> the modules ahead of time -- I actually use this for [http://8bitworkshop.com/](http://8bitworkshop.com/))

</comment><comment><USER11> How's Johnny really managing his dependencies?

<comment><USER12> Given his behavior over the years: not well.

</comment></comment><comment><USER13> Cool, reminds me of this [0], it's 850 chars before gzipping.

[0]: [https://curiosity-driven.org/minimal-loader](https://curiosity- driven.org/minimal-loader)

</comment><comment><USER14> Please no. Write standard modules. Serve standard modules to modern browsers, optionally bundling to modules for production. Bundle to non-modules for legacy browsers.

Then we can all eventually move forward from this mess of non-standard module formats and loaders.

<comment><USER15> What are "standard modules" for modern browser? I don't typically frontend dev these days, so I'm likely a bit out of the loop.

The way I typically thought of dependencies with browsers was to bundle them all together. Is there some new solution to this problem?

<comment><USER16> Probably using the ES2015 import syntax[1], which allows you to dynamically load modules. I have my doubts whether your average medium+ sized JS app will be _that_ dynamically, so you'll probably end up slurping a whole lot o' module at startup. And without tree-shaking, more stuff to download and digest.

[1][https://caniuse.com/#feat=es6-module-dynamic- import](https://caniuse.com/#feat=es6-module-dynamic-import)

<comment><USER14> You can bundle modules together so you don't have a ton of downloads, but the basic module graph will at least be loadable. WebPackaging will also help in the future.

</comment></comment></comment></comment><comment><USER17> …why would you name this after a domestic abuser?

<comment><USER18> Agreed, this is an uncomfortable name.

<comment><USER19> Do you take similar issue with the framework Sinatra?

<comment><USER18> Sinatra's dead. Depp is a real, living actor and the value of his name directly affects his current net worth. Glorifying him, therefore, is different than doing the same for Sinatra.

</comment></comment></comment></comment><comment><USER20> nice name!

</comment><comment><USER21> I really don't understand modern web development. If people would build websites without shit, they wouldn't need stuff like this.

<comment><USER4> The web as a "document only" medium is long gone. However where I would slightly agree with you is new sites that could have a simple interface loading tonnes of JS. But for business apps delivered over the web, yes we need tooling to tame JS.</comment></comment>


Journey to the center of JRuby - <AUTHOR> http://patshaughnessy.net/2012/2/7/journey-to-the-center-of-jruby

<comment><USER2> nice explanation. well done.</comment>


Ask HN: What to do if everything but the .com is available? - <AUTHOR>

I have a startup and am looking to get a domain name, the dot com is available for $3000, I love the name but not the price, should I get the .net or .io? The startup is a hosting company.<p>Thanks HN! <comment><USER2> I would grab the .net and go with it or try to find a close variation on the .com.

With all of the ways of promoting & finding websites (SEO, ads, social channels, links, etc) I think the .com is less valuable than it used to be.

Good luck!

<comment><AUTHOR> Thanks!</comment></comment>


Ask HN: Any love for a math website? - <AUTHOR> I started this site a year ago (https://regressionbuddy.com). I am not particularly good at math but I found a guy who is and have him check my work.
The idea is it's a site with math practice problems. It's more for if you already know the math and don't want to forget it. Each question has a corresponding entry in the appendix so you're never left hanging. New problems and appendix sections get added each post. A ballpark guess is it will take about a hundred posts, which works out to four years, to cover everything.
I initially learned math because I was interested in machine learning. I started the math website because I saw, that at least for me, there was a need for a math knowledge retention website that was not being met anywhere else. I realized that while I might never be able to make any contributions to machine learning directly I might be able to help more by helping people learn and retain the math.
But so far the response has been luke warm. There are a few good guys contributing but in general it feels like there is no interest. I've emailed and wrote letters to about 30 local high school and college math departments asking if anyone would be willing to help and I got no responses.
I don't want to give up on the site but I absolutely do not want to be the moron who dumps a ton of energy into something no one has any interest in.
I've lost my ability to evaluate my devotion to this project. Your thoughts about what I should do with it are welcome.
* To be clear I'm not looking for an excuse to abandon the project. I'm more worried about creating something no one has any use for and wasting time on this instead of something more profitable. <comment><USER2> Read the rules for Show HN and consider submitting it there.

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

</comment><comment><USER3> That actually sounds really useful. I could definitely see using a service like that. I'll take a closer look when I get home later this evening.

<comment><USER3> At first blush, my initial thought is "I like it". To be really useful though, I kinda feel like you'd need a lot more problems. Two other features that I think would make this awesome would be:

1\. a way to "mark" a given problem as "I got it right" or "I got it wrong" and then have the ability to select problems only from the "I got it wrong" bucket. I used a site with something like that to prep for my ham radio license test and it was really useful.

2\. A way to attach (virtual) "scratch paper" to a problem. I'm picturing a way to input latex and render with mathjax so that one can "show their work" and help work through longer multi-step problems.</comment></comment>


Internet, Why So Blue? - <AUTHOR> http://www.theawl.com/2014/06/internet-why-so-blue

<comment><USER2> Related/unrelated, but reminds me of "Trying To Remember the Color of the Sky on That September Morning" [https://www.flickr.com/photos/jayfine/14019165410/](https://www.flickr.com/photos/jayfine/14019165410/) and [http://www.nytimes.com/2014/05/15/arts/design/spencer- finch-...](http://www.nytimes.com/2014/05/15/arts/design/spencer-finch-turned- to-the-heavens-to-honor-the-dead.html)</comment>


Ask HN: Are there anyone who does not use Google and Facebook accounts? - <AUTHOR> By Google and Facebook accounts I mean everything related to them, like Google/Facebook login for 3rd-party websites or WhatsApp (owned by Facebook).
Using Google search or viewing publicly available Facebook pages without respective accounts does not count as long as you remain anonymous to the service.
I am asking this because I thought most of people (even on HN) are using these accounts, but others seem to have different perception. <comment><USER4> I refrained for a very long time from using facebook and whatsapp - <USER3> relented to using them. I also actively researched ways to get rid of the google ecosystem - but what i realised is that, you cannot be on another ecosystem, if people whom you want to communicate with are using the very ecosystem you want to avoid. Its a collective problem and unless everyone is aware of the perils of using them, people who care / worry about these things are in the minority and unable to convince the majority to refrain from using google / facebook.

I have been getting a lot of stares for suggesting to people to not use facebook.(I finally put a facebook profile last year but am not active on it. I rarely login to facebook).

All the people i wanna communicate with are on whatsapp - i have no hopes of convincing people to switch over to signal and i have given up this pursuit.

I am tired of endless conversations to explain to people about the "bubble" and also the privacy issues that come along with using these products (we are the product anyway).

Worse, after all the convincing arguments i submit to people, people nod in acknowledgement and use those very products anyway. It's like noone cares. And i found myself increasingly isolated for quite some time, and finally relented to using fb(rarely)/whatsapp(use it like an sms app \- i have exited all the groups).

</comment><comment><USER5> Don't have Facebook account. I did get a Google account but only used it for the purpose of communicating to somebody on a Youtube Livestream. Now that I'm reminded of that I'm going to delete it... done!

I recommend Fastmail for email. It is pretty much for the same reason that Saul Goodman asked Walter White for one dollar.

I know I mentioned using Youtube in the other thread we were talking in - <USER3> actually I don't use it conventionally, I usually use youtube-dl to download 720p copies of the videos to my hard drive, and sometimes download entire channels that way.

It's so much easier than dealing with youtube's playback issues, it's a much higher quality experience.

</comment><comment><USER6> There are of course various other levels of participation. B-)

Facebook is only good for shitposting, because you cannot really engage in any "serious" discussion if at any moment your account can be frozen for weeks.

You have to be more careful with Google however. Professor Jordan B. Peterson's Gmail and Youtube-accounts were suddenly disabled "for good" without any explanations and no possibility to appeal. It is kinda difficult to use an Android-phone without Gmail-account.

</comment><comment><USER7> Use neither. Never plan to use either.

Your assumptions were distorted by being in a Facebook/Google bubble where you missed the forest for the local set of trees you could see.

<comment><AUTHOR> Yes, and this thread is my attempt to break out of the bubble. Thanks for your response.

</comment></comment><comment><USER8> I have neither a Google nor a Facebook account. DDG for search and OSM/Apple for maps are sufficient 99%/time. Only thing I have is WhatsApp, as all of my friends/family/work/etc have it..

</comment><comment><USER9> I had a facebook account but 6 years ago I decided to abandon it. I set a ridiculously log and random password for my account and never logged back in since then.

I don't use whatsapp, and other fb products.

</comment><comment><USER10> I have a Google account on which i am only logged from mobile phone and a Facebook account that i have disabled nine months ago and that i reactivate upon need.

</comment><comment><USER11> I have never had a Facebook account (or any other social media) and have not had a Google account for many years.

</comment><comment><USER12> I have a gmail account that is attached to an empty FB account that I use for logins and nothing else.</comment>


Facebook listening to conservations? - <AUTHOR> Today in our office my colleague was telling me how his dream would be to work in the maritime industry designing boats (he is a mechanical engineer). I have never searched for maritime related technology and have no interest in it. Tonight I have this suggested post from Facebook: http://www.bluewaterrigging.com/team/andrew-macdonald/ <comment><USER2> There's another possibility:

Your friend searched for it or read articles about it @ office. You two share the same geolocation and IP address @ office. Facebook figured out you _might_ be interested in the same topics as what others in your office are searching for. Facebook shows you potentially related articles @ home.

No audio listening required.

I'd be surprised if Facebook Product Managers haven't been doing the above. This is basic.

<comment><USER3> I don't know why in these threads people always go to great lengths to discount the possibility of this happening.

Facebook A/B tests all sorts of stuff, all of the time. I had 2 or 3 incidents like this happen until a year ago when I eliminated use of their app for good.

When Facebook addressed this question last year, the answer was: "[Facebook] does not use your phone's microphone to inform ads or to change what you see in News Feed". That's not a denial.

</comment></comment><comment><USER4> Well there's this: [https://news.ycombinator.com/item?id=14459417](https://news.ycombinator.com/item?id=14459417)

But that's legally plausible as just monitoring phone orientation to improve user experience.

</comment><comment><USER5> How possible it is to reverse the app looking for syscalls to the microphone api or something?

You should probably discard user initiated audio recording if available but looks doable for someone with the knowledge.

Disclaimer: I know almost nothing about reversing

</comment><comment><USER6> I would pay good money for a study on this.

Ex: Choose a hundred random subjects and assign them irrelevant, obscure keywords to speak loudly into their phones while the messenger app is open. Report back with resulting ads displayed over the following week.

</comment><comment><USER7> There have been numerous threads about this: [https://hn.algolia.com/?query=facebook%20listening](https://hn.algolia.com/?query=facebook%20listening)

</comment><comment><USER8> Yes they are listening!!! there are enough discussion about it in the /r/technology and even here at HN

</comment><comment><USER9> conservations?

conversations?

<comment><USER10> conservatives?</comment></comment>


GymPact | Never miss another workout. - <AUTHOR> http://www.gym-pact.com/ <comment><AUTHOR> This seems like a really cool idea. What are your guys thoughts? Also does anyone know their business model?

<comment><USER2> Their business model is probably something like: pay app + a rake.

In their FAQ:

> _The minimum bet is 5$ and the minimum reward is 0.5$_

> _Our users make it on average to 90% of the days they commit_

<comment><AUTHOR> Do those numbers imply they're taking a cut? It seems like they would have to mention that, no?

I was toying with a similar startup idea but for losing weight. (I haven't figured out how to verify users' weights though, gympact has the advantage they can use GPS to verify you're at the gym.)</comment></comment></comment>


Trail of Bits' Mobile Exploit Intelligence Project slides - <AUTHOR> http://www.trailofbits.com/resources/mobile_eip-04-19-2012.pdf

<comment><USER2> Hey, I'm the author of the above research. AMA. Also, there's a good discussion going on in the comments of this Threatpost article about my research: [https://threatpost.com/en_us/blogs/accountability-not- code-q...](https://threatpost.com/en_us/blogs/accountability-not-code-quality- makes-ios-safer-android-042012)</comment>


Nine startup dreams and industries Google crushed in 2009 - <AUTHOR> http://digital.venturebeat.com/2009/12/30/google-2009/ <comment><USER2> Every time I read an article like this, I think of Google Lively. Google entering a space != Google crushing the competition.

<comment> brown9-2 Agreed - this article would be better titled "Nine startup dreams and industries Google released competing products for in 2009".

</comment></comment><comment><USER3> Thought Etherpad might bear a mention in the bit about wave.

</comment><comment><USER4> "Don't be evil."</comment>


"Oh By" Is the Universal Shortener - <AUTHOR> https://0x.co/index.html <comment><USER2> Don't use this or any other URL shortener for any reason. It degrades online security[1], creates a bad UX, and breaks the web[2].

If you insist on using one, use one that is owned and maintained by a massive, stable company, like Google[3]. Smaller services, with no culpable business behind them, tend to die off[4][5].

1\. [https://www.schneier.com/blog/archives/2016/04/security_risk...](https://www.schneier.com/blog/archives/2016/04/security_risks_11.html)

2\. [https://t37.net/why-link-shorteners-harm-your-readers-and- de...](https://t37.net/why-link-shorteners-harm-your-readers-and-destroy-the- web.html)

3\. [https://goo.gl](https://goo.gl)

4\. [http://www.webpronews.com/study-claims-61-of-url- shorteners-...](http://www.webpronews.com/study-claims-61-of-url-shorteners- are-dead-2012-05/)

5\. [https://bit.do/list-of-url-shorteners.php](https://bit.do/list-of-url- shorteners.php)

<comment><AUTHOR> Hi - a few things...

First, URL shortening is not what this tool is for.

It _will_ function as a URL shortener if you put in a URL and _tell it to_ , but again - that's not what it was built for.

Second, I tend to agree with the notion that URL shorteners are "bad for the web". So, since we happen to have a (secondary) URL shortening function, I did two things:

1\. Made a commitment with actual resources to keep 0x.co running _forever_.[1]

2\. Had a short discussion with my friend Jason Scott[2][3] about giving Internet Archive and Archive Team an easy port for download/archiving. In our conversation he reiterated his (well known) position that URL shorteners are bad in general, but less terrible if there is a published (and maintained) spec for data exfiltration.

But _again_ ... URL shortening is NOT what this tool is for.

[1] simple, lightweight pages combined with massive, leftover rsync.net bandwidth/hosting resources make this trivial.

[2] [https://en.wikipedia.org/wiki/Jason_Scott](https://en.wikipedia.org/wiki/Jason_Scott)

[3] [http://ascii.textfiles.com/](http://ascii.textfiles.com/)

<comment><USER3> Yes, this is _not_ a URL shortener per se, although it can obviously be used as such.

Sad story, but I worked for a company named Netword exactly two decades ago that was going to do this in a big way, even got one of the major SV investment firms, Hambrecht & Quist, very interested (and their in with Netscape, who they helped take public, would have been important), as in, we launched, and they came to us....

But it was killed by devil investors who due to previous resource misallocations and bad risk management (MPV, MPV, MVP!!!) had gotten their hooks into the company about the time I started there. Weird and nasty denouncement, 13 of us resigned in masse one day from our lawyer's office, we had to fight to get our last paychecks (something state government enforcement agencies have no humor about at all), etc. etc.

It a very good idea, I think, and who knows, maybe it's time has come. Mr. rsync (who I'm a very happy customer of ([http://www.ancell- ent.com/1715_Rex_Ave_127B_Joplin/images/](http://www.ancell- ent.com/1715_Rex_Ave_127B_Joplin/images/) )), you're welcome to drop me an email check my info) for what we figured out in that effort.

Note that we were going to do "Networds(TM)", as in "Intel annual report", obviously one thing that made this less important was the increasing quality of search engines. This isn't quite the same thing....

<comment><AUTHOR> First of all, thanks for being our customer (at rsync.net, that is).

Yes, I'll email to hear your story - it would be interesting.

I think the key to what I'm trying to do here is keeping the product, and the interface, extremely stripped down and simple - which causes costs to drop dramatically (in terms of hosting, bandwidth, server costs, etc.).

Not having any advertisements or tracking or third party hooks, etc., makes that much easier - and makes for a much nicer product. The revenue model is selling custom codes, so _you are not the product_. The codes are.

<comment><USER3> _The revenue model is selling custom codes,_ so you are not the product _. The codes are._

That, BTW, was the business model of Netword, and in those gold rush days it worked very well. Today, resources are so cheap it ought to work as well, even if it doesn't really take off.

And you're welcome, and again, thanks for saving my email etc. from a tornado....

</comment></comment></comment></comment></comment><comment><USER4> How should someone unfamiliar with Oh By realize that the string "0x7DBZ3G" is a thing they can look up? Is your plan to get sufficient popularity that people will recognize them like they recognize URLs?

IIRC, the "Visit us on the World Wide Web at aitch tee tee pee colon slash slash" days lasted quite a while. (Not to mention the "colon backslash backslash" days.) I don't think I can just write "0x7DBZ3G" today (but maybe in a few years!); I'd have to write some reference to [http://0x.co/](http://0x.co/).

<comment><AUTHOR> "Is your plan to get sufficient popularity that people will recognize them like they recognize URLs?"

Yes, that is indeed the plan, and yes, that will be a challenge.

That's why we chose that domain name and that sort-of-phonetical-mouthing of it ...

</comment></comment><comment><USER5> Don't think of this as a url shortener, my use case would be something like pastebin or gist but with free private anonymous pastes. It also took me all of 2 minutes to get a python implementation working with the API. One suggestion, when I look up the codes if I include the 0x eg. "0xDV2HW7" or "0 x DV2HW7" it fails to lookup the code - it wasn't immediately obvious to me to discard the 0x on lookup.

<comment><AUTHOR> Hmmm .... we have it coded to accept _either_ :

[http://0x.co/EXAMPLE](http://0x.co/EXAMPLE)

or:

[http://0x.co/0xEXAMPLE](http://0x.co/0xEXAMPLE)

... so I wonder, how are you doing the lookup that it is failing without the 0x ?

EDIT: OH, ACTUALLY - are you looking up "0 x EXAMPLE", with the spaces in there ? No, that won't work - we just have the spaces in place on the webpage to make it easy on the eyes ... is that what you're doing ?

edit: and for anyone reading, you can do the lookup _even simpler_ with plain old 'nc' \- you can specify [http://](http://) (non SSL) address if you need to ...

<comment><USER6> If you decide that spaces aren't valid identifiers in 0x codes, then it might be worthwhile to strip all of them out when someone enters one.

<comment><AUTHOR> Ok, we now ignore spaces in the code inputs, so it no longer matters if you enter:

      7DBZ3G
      0x7DBZ3G
      0 x 7DBZ3G

... they all work the same way.

</comment></comment></comment></comment><comment><USER7> Question not covered by the FAQ: for the mathematically lazy, what kind of size are we looking at in terms of "oh by" code space? How many documents can be stored until codes become too long to store in the (human) working memory?

Will there be an option to generate a code "long enough" that it can not easily be brute force guessed?

<comment><AUTHOR> Right now, as in, launch day, we are handing out 6 character codes that are 0-9,A-Z (but excluding '0', 'o', 'x', '1' and 'l') ... so 31^6 codes.

But you can _purchase a custom code_ [1] and the price is based on the length (shorter being more expensive) and the max size is 32 characters.

So you can choose what you like, and it's as low as $8/year if it's 9 characters or longer...

[1] [https://0x.co/custom.html](https://0x.co/custom.html)

</comment></comment><comment><AUTHOR> There is an "HN FAQ" which we think addresses things HN folks will be interested in, as opposed to the "civilian" FAQ.

Not at all related to rsync.net, but yes, I'm the rsync.net guy.

Happy to answer questions here.

</comment><comment><USER6> The codes in your FAQs (0x7DBZ3G, 0xDY34NK) don't actually lead anywhere -- that might get confusing if they get handed out (e.g. start linking to malware) later.

<comment><AUTHOR> Thanks - we'll get those populated after lunch here...

</comment></comment><comment><USER8> Not working on Opera 12.16 (last Presto engine). Not working on Chromium 37

So. [https://www.ssllabs.com/ssltest/analyze.html?d=0x.co](https://www.ssllabs.com/ssltest/analyze.html?d=0x.co) \- and apache behind...

</comment><comment><USER9> The time that is displayed should include the timezone. No idea what timezone it's in, but it definitely isn't UTC.

</comment><comment><USER10> Another curious rsync.net customer taking a look.

I think you're actually offering a key-value store (aaS) with a 4 KB maximum page size, and one of the use cases happens to be a text/URL shortener.

It looks like someone is squatting on ox.co. You could contact them and hope they haven't seen your project yet..

How are the codes derived?

<comment><AUTHOR> "Another curious rsync.net customer taking a look."

Thanks for being our customer (at rsync.net).

"How are the codes derived?"

      # generate the ohby code
      use String::Random;
      my $pattern = new String::Random;
      my $size = 6;
      # don't use i,I,1,l,L,0,O,X,x etc..
      $pattern->{'A'} = [ 'A'..'H', 'J', 'K', 'M', 'N', 'P'..'W', 'Y' .. 'Z', '2'..'9' ];
      my $code = $pattern->randpattern('A' x $size);

(We disallow ILOX and 0 since that could get confusing)

Right now we are handing out random (free) codes that are 6 characters long, but at some point I suppose we have to increase to 7 ... like ICQ ...

</comment></comment><comment><USER11> It seems like a bad choice of domain, given the example usage. "0x" will be regularly confused with "ox", and ox.co is a completely different site.

</comment><comment><USER12> What language / framework is the backend programmed in?

<comment><AUTHOR> perl.

Also: view source on any page to learn _just what kind_ of a website 0x.co is ...

</comment></comment><comment><USER13> What does the public/private option do?

<comment><AUTHOR> At some point (not now) we will present existing codes as a searchable resource from the outside. I haven't decided what that presentation layer will look like, but the idea is that a lot of Oh By Codes will contain important or helpful information and benefit from being searchable.

But some won't. So if you want to keep the content of your code private/unindexed/norobots, you would set that flag to "private".

I think the expiration pick-list is self-explanatory, yes ?

</comment></comment><comment><USER14> Do you provide a .onion address?</comment>


Implementing Time Series Forecasts: How and Why - <AUTHOR> https://www.datascience.com/blog/introduction-to-forecasting-with-arima-in-r-learn-data-science-tutorials <comment><USER2> very useful intro!</comment>


Trajectory recovery: User privacy is Not preserved in aggregated mobility data - <AUTHOR> https://blog.acolyer.org/2017/05/15/trajectory-recovery-from-ash-user-privacy-is-not-preserved-in-aggregated-mobility-data/t <comment><AUTHOR> Direct link to paper: [https://arxiv.org/abs/1702.06270](https://arxiv.org/abs/1702.06270)</comment>


Ask HN: How do you rest? - <AUTHOR> <comment><USER2> I've been on a software development hiatus for about 8 months now and it's been pretty restful. Not ready to get back to it just yet though.

I was having issues resting and resetting day-to-day and that burnt me out and I found what I'm doing now (whatever I want) to be the solution.

</comment><comment><USER3> GET /api/users Parse JSON Profit

</comment><comment><USER4> I pull weeds in my lawn. Sunny weather is nice, but not required.

</comment><comment><USER5> I sleep.

</comment><comment><USER6> Everyday I am trying to read a book for a bit and take a nap after lunch</comment>


Unsplash: 365 photos, 10 MM downloads later - <AUTHOR> http://365.unsplash.com/

<comment><USER2> Just saw this.. unsplash is so fantastic, use it all the time, amazing photography on there</comment>


You Can't Name a File Con in Windows [video] - <AUTHOR> https://www.youtube.com/watch?v=bC6tngl0PTI <comment><USER2> Confirmed this still exists in W10 bit of web search and found there resrve from DOS days, others are AUX, NUL, COM1-COM9, PRN, LPT1-LPT9.

[https://answers.microsoft.com/en- us/windows/forum/all/file-n...](https://answers.microsoft.com/en- us/windows/forum/all/file-name-as-con-cannot-be-created-on-desktop- can/c41e136a-56ac-4385-b119-3773cdee7a9c)</comment>


Atari Video Music Teardown [video] - <AUTHOR> https://www.youtube.com/watch?v=INnpnJvDXDg <comment><USER2> Also recommended, the charming, rather British presentation of the Atari Video Music at the Techmoan channel:

[https://www.youtube.com/watch?v=wle0eqBwtL8](https://www.youtube.com/watch?v=wle0eqBwtL8)

</comment><comment><USER3> This is very interesting. I saw the schematics for the AVM some years ago and the main IC (and I think _only_ IC) was an Atari custom chip. Wonder what was inside the chip!</comment>


Why trees can't grow taller than around 100 metres - <AUTHOR> http://www.newscientist.com/article/mg21729004.800-why-trees-cant-grow-taller-than-100-metres.html <comment><USER2> In contrast, <http://news.ycombinator.com/item?id=5083564> describes a 2004 study that gives 130m as the limit, and claims a world record of 125m. Also, <http://en.wikipedia.org/wiki/Hyperion_(tree)> is 115m.

However, this theory is less observational; that, IMO, makes it a better one, even if the maximum height it predicts is of by 10% or so.

In fact, that is fairly typical for scaling laws. For example, bumblebees and swans are outliers in the field of flying insects, respectively flying birds. That is why, in those circles, a standard joke is that bumblebees cannot fly, and swans can fly, but cannot take off from the ground.

<comment><USER3> Iirc albatrosses actually can't take off from the ground. They need to jump off a cliff with an updraft. So they're very careful about where they land.

<comment><USER4> > Iirc albatrosses actually can't take off from the ground

Of course they can.

<https://www.youtube.com/watch?v=gKTfcs6LL6A>

<comment><USER3> Hmm...

Having now gone back and researched that a little better, it's only Waved Albatrosses I was thinking of and sources seem to disagree on whether they can take off from flat ground or not. They certainly prefer a cliff, and will make a long walk to get to one if necessary.

</comment></comment></comment></comment><comment><USER5> This is an interesting video with an alternate explanation - the pressure required to get water to the top of the tree. Normally you can only suck a water column up 10 meters, and that's using a perfect vacuum - but trees can grow higher than that. The secret sauce is that in a liquid rather than a gas, you can have a negative pressure.

<http://www.youtube.com/watch?v=BickMFHAZR0>

</comment><comment><USER6> So, how long until someone engineers some 'helper pumps' to assist trees in pumping nutrients around. Be nice to see some 1000-foot trees in manhattan to crowd out some skyscrapers.

</comment><comment><USER7> >>Sugars accelerate as they move

That's no way to describe the diffusion gradient.

Also, this paper does not cover all of Plantae, so for all we know, other Embryophytes may be limited in height by an entirely different factor.

<comment><USER8> The creatures that we call trees, and the Earth had experimented with a lot of different types of trees, are in fact much higher if we count the roots.

<comment><USER9> Yes, but the tallest trees (California redwood) have shallow root systems (a couple meters). Are there trees commonly over 100 meters counting the roots?

</comment></comment></comment><comment><USER10> I remember learning this in my high school biology class a few years ago. I recall the limit as being 120 meters because of the force of gravity.

Xylum and phloem... memories.

<comment><USER11> Gravity and cohesion-tension theory.

</comment></comment><comment><USER12> This doesn't seem to preclude a tree that's taller than that, but simply an outlier in its leaf size. Unless I'm misunderstanding something...

<comment><USER13> The New Scientist article isn't very clear. The paper proposes that tall trees are unable to gain energy from leaves above a certain length (my not great understanding is that a larger leaf can generally move more energy than a shorter leaf, but a longer stem can only move so much, limiting the useful leaf size).

</comment></comment><comment><USER14> This is why I love HN - the fact that this kind of post can make it to the front page.

<comment><USER15> It's pretty rare..</comment></comment>


Ask HN: Are ImagineK12 invites out yet? - <AUTHOR>

<comment><USER2> Yes. See <http://news.ycombinator.com/item?id=2538550></comment>


Machine Learning Engineers Will Not Exist in 10 Years - <AUTHOR> https://towardsdatascience.com/machine-learning-engineers-will-not-exist-in-10-years-c9cbbf4472f3 <comment><AUTHOR> Disclaimer: Don't know if the point argued is, or will be true, or not; but the article is interesting nonetheless...</comment>


When does your religion legally excuse you from doing part of your job? - <AUTHOR> https://www.washingtonpost.com/news/volokh-conspiracy/wp/2015/09/04/when-does-your-religion-legally-excuse-you-from-doing-part-of-your-job <comment><USER2> /u/space_lasers from Reddit clarified this far better than the Washington Post:

Government employees on the clock are not protected by the First Amendment, they are bound by it. The entire purpose of the First Amendment is to protect citizens from the government. When she's acting as an agent of the government, the Constitution protects us from her. She is not a private citizen when officially performing her duties; She is not Kim Davis, she is the Rowan County Clerk. She has no Freedom of Speech/Religion when speaking with the voice of the government because in that act she is the entity that Freedom of Speech/Religion protects us from.

So many people, most notably certain elected officials, completely misunderstand this very important distinction. This whole fiasco is nothing more than misinformed people kicking up a fuss about a very well-defined concept that they clearly don't understand.

Edit: [link to thread]([http://www.reddit.com/r/atheism/comments/3k5meq/george_takei...](http://www.reddit.com/r/atheism/comments/3k5meq/george_takei_just_nailed_it_on_kim_davis/cuv2dr3))

</comment><comment><USER3> I'm going with never. Find another job.

</comment><comment><USER4> A clear piece, but the situation for government employees seems highly convoluted.</comment>


Windows Live is dead - <AUTHOR> http://jasonlefkowitz.net/2012/05/windows-live-is-dead/

<comment><USER2> Microsoft has never really done a very good job explaining their approach to the layperson. In fact, the first time I saw "Windows Live" was when my MSN Messenger suddenly disappeared, and was replaced with "Windows Live Messenger". At that age, I was a huge MSN advocate, but after some confusion with version numbers, updates, plugins (Plus!), and features, I just dropped the program altogether. It wasn't really a conscious decision. It just wasn't worth using anymore.

To be fair, I do believe that there should be _some_ sort of connection between a company's products, but trying to make them all fit a "vision" is very limiting, and often comes across as forced. Do I like being able to use my gmail to sign into all Google services? Yes. Do I care if my YouTube page shares the same design as my GMail page? Not at all.

In fact, the product environment is flooded with terrible integration. Here are some examples:

\- Apple's iPhone is a wonderful product (and I use it), but having it integrate with iTunes is a horrible idea. My iTunes takes longer than my Windows Media Player to start up (about 6 times longer) and I honestly don't find it very intuitive at all. Syncing makes very little sense until you're used to it, and I still don't know where my old text messages are saved.

\- Windows 7 Phone is actually a pretty cool concept in my opinion. In fact, MSFT actually showed off a prototype at a conference I helped organize. For the longest time, I couldn't figure out (not that I tried to) whether "Windows 7 Phone" was a phone, an operating system, or both.

\- Google Talk and Google+ integration is probably the most annoying one. I joined the HN Google+ group, and since then, thousands of people have added me to some circle or another. In the beginning, I actually took the time to add them back into my "HN Circle". Unfortunately, random strangers then started popping up in my GChat, and I spent days setting everyone not to show. Since then, I haven't added anyone to G+, and I've stopped using it altogether out of frustration.

I'm sure there are ways around some of the things I mentioned, but the driving point is that it wasn't obvious. Companies need to stop ruining their awesome products with their shitty products.

<comment><USER3> I generally dislike the direction of the latest few versions of Windows Live Messenger. It has gotten more confusing and bloated over the past 3 years.

<comment><USER4> It seems like Microsoft can't just leave a product alone and move on to the next thing. They have to keep milking the same app brand for all its worth adding more and more features to the point of absurdity.

<comment><USER5> To be fair, that's exactly what they did with IE6

</comment></comment></comment></comment><comment><USER6> Funny, considering that we have something equivalent today: Google Play.

I can't even begin to comprehend how they renamed "Market" to "Play Store" and they have absolutely _nothing_ to offer worth the name _Play_ , to the consumers it is just as confusing as "Live" was/is.

A lot of people have no idea where their market have gone and they just can't find the Play Store, or more importantly - they have no idea why they should look for something such as the Play Store and when they see it they won't recognize it as something they want, just another form of adware. Just as Live, people knew they wanted MSN Messenger, at least microsoft kept the name Messenger so people could find it.

<comment><USER7> I also wondered about the "Play" rename. I assumed it happened because they have such a strong priority coming from above on movies/music this became the central thinking. And apps/books became less relevant.

<comment><USER8> I don't think Play was meant to exclude apps so much as recognize that the apps that sell the most tend to be games (or at least it looked that way the last time I compared the iOS and Android leader-boards).

Books, on the other hand... it's clear no one was thinking about them (but that's par for the course, I'd say).

<comment><USER9> Wow - last time I checked the iOS App Store, Pages and GoodReader were leading. You are right, it's mostly games now.

Conversely, the (German) Mac App Store is has almost _no_ games in the bestseller lists.

Now I'm really curious about Windows 8...

</comment></comment></comment></comment><comment><USER10> To quote: _The biggest problem Microsoft has, I think, is that there is nothing they're working on these days that makes a person like me look at them and think "damn, I wish I was working in their ecosystem."_

This. This is it. You can't qualify it or put in more concrete words what it is that's missing, but there's something missing. Much like Nokia has been kind of missing out for a decade, and definitely ever since iPhone came.

The common pattern with companies that are missing out is that they're lured into it by their heydays. They used to be really successful and many still are, despite this, but there's _that something_ missing, everyone can sense it, and it's only a matter of time when the void bursts in and the stakes of reinventing themselves go all-or-nothing.

With Nokia that is happening pretty much as I'm writing. Microsoft's ship is bigger and their product line is more versatile, so it'll be many parts going under at different pace while some parts might still be raising up.

<comment><USER11> I find the Azure platform very compelling and C# a very productive language. The upcoming enhanced support for asynchronous programming in C# 5 is something I wish JavaScript would have for Node.js programming.

<comment><USER10> I'm quite sure those aren't the only things at Microsoft that are compelling and productive. However, being good doesn't preclude being simultaneously on a downward slope. You have to be riding on the right wave, or better yet creating the right wave yourself, to succeed. And I see Microsoft floating steadily on their surfboard while several waves simply pass by.

</comment></comment></comment><comment><USER12> It's really not a question of Microsoft's specific branding strategy but an indication of how opposed Microsoft's big, bloated bureaucratic culture to the modern, fast, lean technological era we are proceeding in.

One thing that really upsets me and frustrates me more and more is how intensely complicated and centralized the environment is for Microsoft. You have this version, that version this technology, that technology clients and communication softwares that support this and that. I get it Microsoft, you're huge.

But because it's so huge it makes it so much more difficult to penetrate. Thus, when other companies make swift decisions to penetrate specific parts of their market and chip away at their usage or establish new markets which undercut Microsoft's existing market prowess (disruption), Microsoft goes crazy with these rebranding techniques.

When Microsoft does pursue a new brand (or rebrands an existing service), they, as per their culture, bloat their initiatives into these big, massive sweeps. However, these massive sweeps are generally empty, confusing and deliberately ambiguous because I don't think that Microsoft weighs the consumer input versus their own internal goals. I don't think they even bothered with really _empirically_ (via iteration, for example) discovering what the service was for because, as Microsoft does, they spend months-years working on these big projects and release them, hoping that people just eat them like they do Windows.

I think the market context for the way Windows is sold to consumers (big, sweeping changes) is very different to the rest of their products. Phones, web products, runtime environments are very substitutable and the resources to product companies that make these products are becoming more and more democratized. As such, a company like Microsoft really doesn't have the kind of stranglehold that it does. That's why things like Live suck and don't make sense. Microsoft is trying to push this top-down because they think we don't know what we want.

Bottom line: I think Steve Ballmer can take a really good cue from Eric Ries on why lean startups work well and disrupt the way they do.

</comment><comment><USER13> There must be a guy in Microsoft, converting all product names to Windows _generic_ , or Microsoft _generic name_. I am sure he is happily sitting somewhere at Seattle, waiting for acquisitions to rename them too, and I am sure he wears cool stuff and talks cool stuff. After Google Play, I suspect a similar guy now works for Google.

</comment><comment><USER14> The author suggests that Google has a unified product vision; I'd love to hear what it is. To me, Google has been all over the place in the last 5 years.

<comment><USER15> I believe it's about information flowing free and avaliable for everyone, apps running in browsers instead of the desktops and to use applications-as-a- service.

</comment></comment><comment><USER16> > there's no grand vision at the heart of the company's work anymore, unlike > competitors such as Apple and Google

The Google part was sarcasm, right?

<comment><USER9> You are getting downvoted but I scratched my head at that part too. What is Google's vision?

</comment></comment><comment><USER17> >I hope they get their mojo back. Because we need them, if only to prevent the future from being an Apple/Google duopoly.

huh?! a) What mojo..? b) yeah because a MS monopoly is really really good.

<comment><AUTHOR> Hi, author of the post here.

 _What mojo..?_

This may have been before your time, but believe it or not, at one point (late '80s through the '90s) Microsoft was _feared_. A standard question VCs would ask new software startups was "what is your Redmond Strategy?" -- meaning "what will you do if/when Microsoft decides your market segment is interesting and decides to take it for themselves?"

 _because a MS monopoly is really really good._

I don't want a Microsoft monopoly to come back -- one of the most liberating things about the Internet as a platform is how it let you skip the need for a Redmond Strategy -- but it would be good for everyone who buys/uses tech to have Microsoft as a healthy competitor on a level playing field. More choices equals more competition equals more innovation.

</comment></comment><comment><USER18> Microsoft's new venture So.cl <[http://www.so.cl/>](http://www.so.cl/>); has two log in options - Live and Facebook.

Unless Microsoft are using this as an opportunity to leverage Facebook user info on the MS platform, the days of Live may be soon over.

<comment><USER19> so.cl is a research experiment focussing on academics; it's not meant to be a big new venture.

<comment><USER20> Why bother releasing it at all then. It just confuses your customers.

Surely this area would be better tackled by a lean startup.

<comment><USER21> For experiment you need data. Maybe for that.

</comment></comment></comment></comment><comment><USER22> @mmmmbop your comments are autodead but you don't seem to be a spammer. You can send an e-mail to email@example.com to restore it.

</comment><comment><USER23> WTF was it anyway?

</comment><comment><USER20> Live and .net were both always a branding disasters.

Especially .net, so it's a programming framework but also the new name for Passport and Messenger, what the fuck were they thinking.

</comment><comment><USER24> Microsoft has been hobbled by unable to integrate services with Windows the way Apple has been doing because of the anti-trust oversight. Hell, the EU blows a gasket at them bundling the media player! There were some cool things in it like Live Mesh and the Writer. They couldn't even ship Skydrive with Windows. Since the oversight ended recently, they're going to integrate things with Windows 8.

<comment><USER25> If you can't do the time, don't do the crime.

<comment><USER24> I thought we were discussing why Live failed here, not whether the anti-trust trial was justified or not.</comment></comment></comment>


Ask HN: What would it take you to join a funded startup that doesn't have a MVP? - <AUTHOR> If I have a startup that's been funded with up to $1,000,000 but no MVP, what would it take for you to join given I do have a detail mock-up / blueprint? E.g., money, job security, environment? I want to build a technical team after some of the top 500 e-business agreed to be early adopters through connections. <comment><USER2> Not having an MVP doesn't bother me (or most people I can think of) as long as funding and a plan are in place (not based on lots of future promises). For example, I would never join a startup who has $50k in cash and promises for future money if X and Y are done. The reason is simple, I've seen the X and Y goals get moved on founders too often then everyone is screwed. Of course, it is different for founders/co-founders as it isn't rare to take $50k to prove something out then raise more money, but that isn't something most non- founders can accept as reasonable risk.

To be a bit more specific assuming you have actual cash in bank. Primarily the most important thing would be transparency about how much money there is, what the runway looks like and what's the plan to raise more. Transparency here would also have to inspire me that there is enough demand/support that the next round is possible and the product actually has some early traction even as just mockups.

Beyond transparency in all the aspects. Probably in order for me, I'd have to see a reasonably solid product idea, market and basic plan on how you plan to get from now to the next level and then the guesses how it goes from there on. I think most people in startups know anything beyond the first few months this early would be hard to predict, but knowing you have a plan is important. Along with this, understanding your experience and skills would be important.

After that it would boil down to a fair and real stock option offer on the table, not a 0.5% type situation, and some reasonable compensation.

I view finding people for early hires as not much different than wooing an investor, you need to convince those first few people you have a plan and can execute on it (with help of course) to get things moving forward.

Given where you are too, another option is forgo any employee hiring immediately and hire a consultant to create the MVP which can help you gain a little more traction and then start looking for employees as you get more funding.

<comment><AUTHOR> 1\. Solid product idea 2\. Business strategy 3\. Founder's skillset

Thanks. I'll refer back to this as the development progresses.

<comment><USER2> If I ranked my priorities.

1\. Complete transparency, 2. Solid business strategy, 3. Founders skillset, 4 Product idea.

I'd put "product idea" last only because if you have reasonable funding and are solid on the first 3, you'll figure out the product. Also with #3 it is really the whole team, but given founder(s) are probably the only ones in initially I say Founders skillset.

</comment></comment></comment><comment><USER3> how does one even get funding without having an MVP in place? just a detailed mock up? honestly, im shocked you can get funded with just a detailed mock up.

<comment><USER2> Two most common ways:

1\. friends and family round.

2\. Prior entrepreneur with a known or provable solid track record.

My guess for OP is #1 given the question, but maybe not.

Also, this actually used to be a fairly standard way to raise capital 20 years ago, you'd go to angels or other high net worth individuals with a basic business plan and pitch deck and raise on an idea and team. You might have mock ups (or non-functional prototypes) and/or a really basic product started but rare it would even be classified as an MVP in todays terms.</comment></comment>


The FBI stole an Instapaper server in an unrelated raid - <AUTHOR> http://blog.instapaper.com/post/6830514157 <comment><USER2> Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe.

\--

Obligatory statement on _NEVER USING SHA-1 HASHES_ to make passwords "safe".

Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU.

If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted, it's the government and they have better ways of obtaining such information, but if there is someone the FBI is watching on Instapaper's databases and they so wanted, storing the SHA-1 hash of the password all but handed them over to the FBI.

I am now glad my Instapaper password was generated randomly, 16 characters long, and I will now change it just to be safe.

For anyone running a database which stores ussername/passwords, take a look at bcrypt or scrypt. They're millions (no, I am not exaggerating) of time better than SHA-1.

(Edit: Grammar)

<comment><USER3> So if I'm using SHA-1 already to store passwords, what are my options for moving to a different system? I assume there's no way to rehash the passwords?

<comment><USER2> You have two choices that I see:

1\. The next time a user logs in to your system and you verify against the SHA-1 hash that they are who they say they are, recompute the correct hash for bcrypt. Then, _delete the SHA-1 hash_. It does you no good to have a bcrypt version if you keep the SHA-1 version around.

2\. Generate the bcrypt hash from the SHA-1 hash. That is, pretend that the SHA-1 hash is the user's password. This isn't as clean (your password authentication software will then have to do SHA-1 followed by bcrypt) but it means you'll be able to migrate your entire database all at once if you so choose. This also causes a very (very, very) slightly higher chance of password collisions, although there's not much to worry about from that.

<comment><USER4> Or you can do both, migrate everything to bcrypted SHA for now and then replace these with straight up bcrypt the next time the user logs in.

You ostensibly have a hash method identifier per hash, so just create "sha+bc" and "bc" along with your current "sha".

Also, why is the risk of a collision greater? It seems to me that, if anything, it should be lower, as SHA hashes always consist of a fixed number of bits, and thus aren't as likely to collide when hashed to bcrypt, assuming the length of a bcrypt hash is the same (or larger) number than a SHA one.

Basically, it seems to me that, if they're going to collide, they're more likely to collide at the SHA level, which is a problem either way.

<comment><USER2> Imagine you have two hash functions F and G, both mapping from the domain of integers to integers mod 2^128. Imagine they are perfect in that if you hash all the integers up to some large N, each hash is expected to recorded exactly the same number of times (probabilistically).

Now clearly if I hash a password F(P) and another password F(Q) there is a 1 in 2^128 chance they collide.

Now imagine we do G(F(P)) and G(F(Q)). We first have the chance of 1 in 2^128 that F(P) == F(Q) which implies G(F(P)) == G(F(Q)). However, that is not all!

We now have a new 1 in 2^128 chance that G(F(P)) == G(F(Q)). So we have (about) a 1 in 2^127 chance that the passwords will collide.

But, none of this really matters. Collisions aren't what you worry about with password hashes.

<comment><USER4> I see what you mean, and I agree that it doesn't matter, but it's an interesting exercise anyway.

I disagree that there's a 2^128 chance that they will collide. Trivially, I can show you a hash that will never collide for up to some N, and that is F(P) = P mod 2^128. This will never collide unless P is more than 128 bits long.

My rationale, above, was that SHA constrains the space to 128 bits. Therefore, for different SHA hashes (ones that haven't already collided), the probability that bcrypt will collide might be _smaller_ (or zero, as in my example above).

In reality it doesn't work like that, I know, but in theory you can't be sure that the probabilities of collision will add (or, well, multiply) up.

<comment><USER2> Point taken, it's probably true that the probability that G(F(P)) == G(F(Q)) given F(P) != F(Q) is less than 1 in 2^128. But it's probably also true that it's greater than 0.

Clearly it's impossible to be less than zero. So no matter what you do, Defining H(X) to be G(F(X)) will have strictly more collisions than F(X).

The reason I would argue it's greater than zero is that if a function H existed such that H(X) will never collide for X less than 2^128, it would probably have some cryptographic weakness.

<comment><USER4> Hmm, you're right indeed, since they're additive. I should have said that the second layer is less likely to collide than the first, not than both combined.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Surely there is a legal precedent which provides at least some framework for what can or cannot be seized during a warrant search? This can't be the first time government agents have mistakenly seized property in an otherwise lawful search.

Also, while I completely understand Instapaper's unwillingness to pursue this through the courts, that _is_ the way our legal system is structured. If you believe you have been harmed in some way by a government action, the courts are the avenue through which you must obtain recourse.

(Not a lawyer, so if I'm wrong about any of the above please correct me.)

<comment><USER6> It's called the constitution of the United States. If the enforcers don't follow it, your only recourse is the Supreme Court which will probably throw out your claim for national security reasons.

<comment><USER7> Not necessarily. I (also) am not a lawyer, but the question isn't whether the FBI has the authority, constitutional or otherwise, to seize the servers owned by the target of the warrant, the question is whether they overstepped their bounds in seizing three whole racks of servers. If it's shown they were careless or did not take sufficient caution in their raid to avoid seizing unrelated servers, they could be held liable for damages. In this case in particular, the number of unrelated companies that have been affected by this (and the number of servers present in 3 racks) makes a case for negligence.

Again, though, the question isn't whether they had the right to seize the servers they had warrants for - they did, and you won't get that questioned by any court - but whether they did so properly, and it's not unheard of for a law enforcement agency to get slapped for overstepping their bounds. It's not Common, but it's not unheard of, and it's not a 4th amendment issue either.

<comment><USER8> It is a 4th amendment issue: That's why they can't just take the server of people not under investigation...

<comment><USER7> Right, but for the courts the question is, did they intend to violate the 4th or did they just screw up? Intent matters - in this case, whether they intended an unwarranted seizure of the server racks or if they just screwed up. Because they had a valid warrant to seize some servers from that data center, I think you'd have a really difficult time pressing the case that they Intended to violate the 4th amendment rights of the other people whose servers were on those racks. Negligence, on the other hand, is a much, much lower bar, much easier to prove in these circumstances, and should be adequate to secure damages - and frankly, I've got a lot easier time believing it was negligence in this case than an intentional violation of the other individuals' 4th amendment protections.

<comment><USER6> "Uh sorry, I didn't mean to do that."

"Oh, phew, carry on."

You're kidding me, right?

</comment></comment></comment></comment></comment></comment><comment><USER9> The more I think about it, the more I think this should be treated the same as any of the other thefts of data information to have happened in the past few months. Sony, Toyota, Sega, etc. A potentially hostile group now has a ton of personal info. People should know.

<comment><USER10> A potentially hostile group that also has much greater resources at its disposal than LulzSec, and much more ambiguous motivations.

</comment></comment><comment><USER11> So, the FBI has a copy of Instapaper's complete database and a copy of their website code. The database includes:

\- Salted SHA-1 hashed passwords for Instapaper

\- Encrypted passwords for linked Pinboard accounts (with the encryption key stored in the website code)

\- OAuth tokens for linked Facebook/Twitter/Tumblr accounts (and presumably also the secret keys used by Instapaper to use those tokens).

That's (potentially) a lot of personal information.

<comment><USER12> As a real practical question out of curiosity: how would you design their system differently so unauthorized people having only your hard drives couldn't get any data at all?

<comment><USER10> You could always hash the e-mails, although this would make resetting your password impossible.

How much data do Facebook's OAuth tokens contain? By looking at one, can you tell that it's linked to Pavel Lishin's account?

<comment><USER13> Would splitting the data in half work?

I mean literally cutting the data sent into two pieces and each piece entering a different database server in a different country. Then, when requested, pulling both pieces and sending them to users who patch them together with client side script...?

<comment><USER14> There has been some academic work on this (CIDR'05), but I'm not sure if it has been used in practice.

<http://ilpubs.stanford.edu/659/>

<comment><USER10> Thanks, printed it off, will try to read on the train.

<comment><USER15> Sounds like a good use case for Instapaper :P

<comment><USER16> Might not want the FBI to know he read the article if they come back for a "followup visit"

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I think the OP was unreasonably harsh on DigitalOne (never heard of them let alone have any interests). It is very possible that they are consumed with FBI questioning, gag orders or who knows what else. I would give them a pass for a few days until more detail comes out.

<comment><USER18> I think so too. He says:

       I have no idea whether I'll ever see the server again

In this case the host probably doesn't know better than him. According to the NYTimes they are a swiss company, they only rent space and connectivity from the data center.

I see people jump up and down accusing their host being a bad host when their websites go down for 10 minutes. The thing is, shit like this happens all the time. Some years ago even Rackspace was taken offline because a truck hit their data center. Bizarre, right? Yes, but it did happen.

<comment><USER19> The problem with DigitalOne was a complete lack of communication around this event. It was a long time (and a lot of badgering) before any of us learned anything about what had happened. I can sympathize with being busy during a crisis, but total silence for 24+ hours, with no working website, email, status page, or twitter account, is not acceptable.

<comment><USER18> Yeah, that is what hosting companies often lack: communication with their customer during crisis. I totally agree that DigitalOne should inform their customers about the incident and they handled the case poorly. But, like I said, put all the blame on them is too harsh.

</comment></comment></comment></comment><comment><USER20> "a Swiss hosting company leasing blade servers"

If they are truly blade servers, then they were possibly sharing the same chassis, power supply and backplane. Could the FBI have pulled just the blades in question? Possibly. But I can very easily imagine the entire blade chassis being viewed as a monolithic component that they would want to be able to perform whatever forensic analysis they are planning. They could also have pulled whatever blades they were not after, and left them, but until you replace the chassis, you are dead in the water.

</comment><comment><USER21> To be clear, the server stopped responding, and the host he is paying for the server has not responded at all. The server could simply be unplugged, or all the network cables were unplugged during the raid. Who knows? I guess "The FBI stole my server is a better headline" though.

In my experience with our leased data center cages, we are expected to fly in to town if we ever need to physically manipulate the servers or even plug things in. The data center employees don't even go into the locked cages.

If the FBI forced open a locked cage, and did stuff in there, I would not expect anything to be addressed until DigitalOne showed up to fix it.

<comment><USER16> If DigitalOne's people are out of country, a truly evil tactic for the FBI would be to ask customs to reject any reps entry.

</comment></comment><comment><USER22> I'm trying to think of an analogy which can explain why this might be reasonable from the FBIs perspective.

Suppose you were using a shared storage space (shared servers, or server farm) with several other dudes. One of them is a drug dealer. One day the police/FBI decide to raid the storage space since the drug dealer has been using it to store illegal drugs.

Is it not reasonable to consider this collateral damage (which, granted, is totally unnecessary) during law enforcement operations?

I'm not saying this is OK in any case, but might this not be a reasonable move by the law enforcement agencies?

<comment><USER23> It is not reasonable if the FBI does not have a warrant for your servers(/storage space). Instapaper is completely right to call this "theft".

If his servers are included in the warrant because they were suspected of housing whatever it is the FBI was after, and the court granted the FBI the right to seize them, then yeah, it's reasonable.

If he was sharing a physical machine with the bad guys, then yeah, sorry, that's collateral damage. However, if he was on his own separate leased machine, there is absolutely no reason for the FBI to seize it. It'd be like them executing a seizure warrant on one of those self-storage spaces, and seizing the contents of all the adjoining compartments (which the person being investigated would have had no access to) just because.

<comment><USER10> Do we know what the warrant stated? If it authorized them to take the rack containing the server they were after, then this is legal, if unfortunate.

If the police have a warrant for my apartment, and you happen to leave your backpack and server, your stuff will most likely be confiscated, along with mine, if it interests the police.

<comment> brown9-2 No, this does not seem to be public knowledge. For all we know the Instapaper (and pinboard, etc) servers could have been included in the warrant.

<comment><USER19> There's a FOIA request out for the warrant. I'll be curious to see it.

[http://www.muckrock.com/foi/view/united-states-of- america/wa...](http://www.muckrock.com/foi/view/united-states-of- america/warrant-for-fbi-seizure-of-coresite-servers-on-2011-06-21/646/)

</comment></comment></comment></comment></comment><comment><USER9> All the more reason for data havens to exist. Run your server from a country where the police can't just take it with impunity.

<comment><USER10> Of course, then you have to keep careful tabs on that country's politics. The police can't confiscate your data in June, until a new bill is passed in July, and suddenly it's up for grabs.

Furthermore, I'm not sure I'd want to host my data in a country where the police cannot pursue digital criminals.

<comment><USER24> Like it or not it's still the wild west, and I suspect most people here trust their own ability to protect themselves more than they trust the sheriff who only investigates crimes against the mayor and can't even ride a horse or shoot straight.

</comment></comment></comment><comment><USER25> Why isn't Facebook having their servers seized? Google? Amazon? If the FBI is really targeting the "badguys" I'm sure there have been more badguys using facebook/gmail/AWS than any single colo.

Why haven't there been similar seizures of any larger corporate entities? Even if the current FBI practices are valid, should the application of those practices be a function of size/wealth/power? Which servers of Sony's were seized after distributing rootkits?

<comment><USER26> Good question. No solid answers here, but my guess would be some combination of more redundancy, better and more active lawyers, and the large players not talking about it when it does go down.

<comment><USER27> FB, Google, etc all provide a nice procedure for LEO to query all desired info. It is not necessary to seize equipment. Example: [https://www.eff.org/files/filenode/social_network/Facebook20...](https://www.eff.org/files/filenode/social_network/Facebook2010_SN_LEG- DOJ.PDF) (pdf)

</comment></comment></comment><comment><USER28> Looks like it's back:

<http://twitter.com/instapaper/status/84106275796946944>

"As of 2 minutes ago, my DigitalOne server is back online. The logs indicate that it was off and not booted during the time it was missing."

<comment><USER29> But that would mean that the FBI weren't bumbling morons who salted the earth after tearing out everything in the datacenter with a power supply...

I'm not sure I can deal with the possibility.

</comment></comment><comment><USER30> I think it may be prudent to begin encrypting all data on disk that can reasonably be encrypted while being able to set up the server remotely so that no one can just snatch your server and get all your data.

This could work by encrypting your database in a truecrypt volume that must be mounted by entering the password. Thus, the data is only ever saved on disk in encrypted form, and the key to access the data is not saved on the disk. Of course, it is still in principle possible for anyone to access that information if they have physical access to the computer while it's running, but at least this makes that much harder.

<comment><USER10> How fast is Truecrypt? How much would this slow down database and file access?

<comment><USER31> Truecrypt is significantly slower, especially on the higher strength encryption methods. The program itself has a benchmark in it, so download it and check it out for yourself if you're that curious. (Note that it is relative to your hard drive's speed)

</comment></comment></comment><comment><USER32> Turns out the server was not stolen!

<https://twitter.com/#!/instapaper/status/84106275796946944>

</comment><comment><USER33> I can't help to compare this raid with the feds raid to the Novus Ordo Seclorum hosting company pictured in Cryptonomicon.

<comment><USER34> Every HN post can easily have a Stephenson reference.

</comment></comment><comment><USER35> Looks like the FBI is operating from the Department of Homeland Security playbook now.

<comment><USER36> The FBI has been doing these kinds of raids for years and years, there just hasn't been one in the news lately.

</comment></comment><comment><USER37> It would make for an interesting Freedom of Information (equipment) request. "Give me my damn server back." But the damage is of course done.

If you are a voting citizen of the US I recommend you write (not email, write a letter, put postage on it and everything) to your elected congressional representatives and ask that Congress immediately put curbs on the police powers of the FBI when it comes to infrastructure seizures.

</comment><comment><USER38> You think it's a coincidence they nabbed Whitey Bulger this morning, after 16 years on the run?

His Instapaper account was probably full of stories about Santa Monica.

<comment><USER39> i think his Instapaper account was full of stories about Whitey Bulger and his old friends/partners/etc... and this is how they "Big Data"-sifting-found him :)

</comment></comment><comment><USER40> Contact the ACLU, they will probably take your case.

</comment><comment><USER41> What's the proper way of storing OAuth tokens in this situation? Given that all the tokens of users and your private key is on the server (even if it's embedded in code), there's no way for Instapaper for keeping those tokens secure in case of a compromise (by FBI or Lulzdudes or anyone).

Seems like Instapaper should change it's private key for, say, Facebook.

<comment><USER42> I would think encrypting the third-party tokens with the user's password would be a decent start.

When the user's password is verified, it could be used to unlock those tokens and store them in the active session structure in RAM. There'd still be some exposure, particularly in the case of being rooted, but an attacker couldn't just dump the database.

</comment></comment><comment><USER43> Update: <http://blog.instapaper.com/post/6854208028>

</comment><comment><USER44> is there a better solution that encrypting data and putting the password in the source? obviously this is for cases where you can't use a hash.

it seems to me that, at least, it would make sense to have the db and web server physically separate in that case (although i guess someone stealing hardware is not normally a common scenario).

</comment><comment><USER45> i am wondering why these companies wern't using EC2?

<comment><USER46> That brings up an interesting point: can the FBI seize EC2 servers?

<comment><USER47> Of course they can. If they get a judge to sign their warrant they can seize anything they please.

</comment></comment></comment><comment><USER48> Julian Assange stated that the feds have backdoor, no court order access to gmail, yahoo, facebook, et all.

Why worry about this?

</comment><comment><USER49> yet another reason to make regular backups of your site.

</comment><comment><USER50> Hmm. I've built something similar to instapaper for myself. (Using a native OS X app). People were making jokes at me how I was re-inventing the wheel.

Now I'm somewhat happy having done the extra work. At least the FBI doesn't have my "read later" bookmarks. (Which often consist of the words 'hack', 'malware' and 'reverse engineering'.)

I guess I will reinvent the wheel instead of using cloud services more often in the future.

<comment><USER10> An in between solution would be better - write an open source version of Instapaper that people could install on their own servers, instead of everyone rolling their own.

</comment></comment><comment><USER51> who watches the watchers?</comment>


If you're an expert, search for fresh jobs in technology using this job board - <AUTHOR> http://www.worktipper.com/ <comment><USER2> One suggestion, please improve your search. Results are highly irrelevant. I tried "product manager" and 35 results came up with almost 34 of them as completely irrelevant!

If there are not many product manager jobs currently available, then you may try to mention it clearly somewhere and then display other jobs below it.

</comment><comment><USER3> Just to see typed in "software engineer" in the Bay Area. Got 4 hits with many times more coming from ZipRecruiter. Why would I use this and not just go to ZipRecruiter or Indeed?</comment>


Mozilla Revives Eudora. You Remember Eudora, Don't You? - <AUTHOR> http://www.techcrunch.com/2007/09/04/mozilla-revives-eudorayou-remember-eudora-dont-you/

<comment><USER2> My college standardized on Eudora several years ago and it has served them well. It never made much sense for Qualcomm however.</comment>


What makes a great startup idea? - <AUTHOR> https://localizejs.com/blog/startup/good-startup-ideas

<comment><USER2> The key point that "The email client we built wasn't good enough for even us, the founders, to use ourselves." is buried in the middle, but essentially sums up the post -- if you can't / don't build something (quickly) that you use yourself, you're unlikely to be on the right track.

</comment><comment><USER3> Good ideas are a dime a dozen. Convincing people to become users - that's the hard part.</comment>


Show HN: Aegis Authenticator – open-source, secure and free OTP app for Android - <AUTHOR> https://github.com/beemdevelopment/Aegis <comment><USER2> Why aegis over andOTP?</comment>


Whatever happened to Asmallworld? - <AUTHOR> http://eu.techcrunch.com/2010/02/04/whatever-happened-to-asmallworld/ Asmallworld, the social network for a rather self-selecting elite, was launched several years ago by Swedish Investment banker and INSEAD Alumnus Erik Wachtmeister. Back then he'd deicded to tap into the evolving microcosm of social networking. In that era it was Myspace that was making its way as the leading social net aside from Friendster et al. Specialized social networks were still scarce. Wachtmeister hit up this niche of a an international network of affluent and influential people. Asmallworld grew to a userbase of initially 30,000 users, and later 500,000. So what happened? <comment><USER2> I'm not sure that the number of uniques is the right metric for success here. Presumably if the site is for "the elite," their membership numbers shouldn't go up indefinitely.

<comment><USER3> Yes, you provide a very valid point. The website prides itself on its exclusivity. I suspect a decline in the number of unique users is something in fact desired by its users - if they feel that the website is not giving them a "special" and "secret" service they may be less inclined to use it.

On an interesting side note - the author of the article appears to be quite an active user of asmallworld.net.</comment></comment>


Mailchimp to set default to single opt-in - <AUTHOR> https://blog.mailchimp.com/fresh-new-pop-up-forms-to-grow-your-list/ <comment><USER2> For those who aren't aware, "single opt-in" means, in effect, one isn't required to "confirm" a mailing list subscription.

For example: a "pop-up form" (what this article is actually about) appears, you type in your e-mail address, click the submit button, and you are now added to the list.

You might ask, "What is to stop someone from adding arbitrary e-mail addresses (such as those belonging to other people) to the list?". The answer is, of course, absolutely nothing.

As you might then guess, this was abused so much that "double opt-in" emerged. Double opt-in requires a "confirmation". If you've ever subscribed to a public mailing list (such as LKML, for example), you've seen this in action. After sending an initial "subscribe" message (or subscribing via a web interface), you receive an e-mail message requiring that you "confirm" your subscription by replying to it. The purpose of this is to prevent exactly the type of abuse described above.

MailChimp is, in my opinion, already one of the "worst" e-mail service providers, as far as the amount of spam goes. Just a week or so ago, I had an e-mail conversation with them about double opt-in and threatened to blacklist their entire IP ranges if it doesn't improve (NB: as part of $job, I manage several e-mail servers) -- this was after one of my _own_ e-mail addresses was added to a new list without any opt-in whatsoever! Unfortunately, it looks like the level of spam will only be increasing and I suspect I will eventually have to do exactly that.

If you're a MailChimp customer and you care about "deliverability" at all, I would recommend you to begin looking at alternatives. I would have made that recommendation anyways (before learning about this change) but now I really recommend it.

</comment><comment><USER3> This is going backwards. I already get a lot of mail that I never signed up for (because I have a common username), and this will only make it worse. Sorry for all the businesses where double opt-in reduces your subscription rate, but you're only making things worse because I mark as spam anything I never signed up for, even if unsubscribing is super easy.

</comment><comment><USER4> "There are plenty of articles talking about how important pop-up forms are for your website."

This is satire, right?

<comment><USER5> They are so effective it staggers me.

I previously had a side project ecommerce biz doing mid 4 figures a month.

My cofounder installed a shopify plugin that pops up an email form. That made me sick.

It converts at 10%. That makes me sicker.

The tools for harvesting sheep work damn well on sheep, it turns out.</comment></comment>