Elm for the Front End, Right Now - <AUTHOR> http://bendyworks.com/blog/elm-frontend-right-now-updated-for-0-18 <comment><USER2> I really want to like Elm. When I'm writing JS/React code, I sometimes think "this would be so much nicer in Elm!" \- especially for architectural issues. But the few times I've actually tried doing something in it, I find that the parts of what I want to do that fit cleanly within Elm's walls are really nice, but the parts that don't quite fit get hard quickly. Suppose I want to do something with the DOM that doesn't quite fit into virtual-dom's model -- I suddenly have to make a complicated JS interop and work around things to get at the raw DOM node... whereas with React I can just hack something together, try it with users, and learn that I should actually be doing something completely different anyway. Or maybe I don't actually know yet what I want to have happen in every possible condition? Maybe I feel this way because I just don't have enough experience, but it may be a fundamental trade-off involved in how Elm makes it hard to do things wrong.

Has anyone had some positive experiences with prototyping / rapid design iteration with Elm and can share some tips / encouragement?

<comment><USER3> Similar experience. Once you get to grids and calendar controls it is a hassle with no clear path.

I think two things are require for to solve this:

1\. Some way to make it easy to drop in components into an existing view. Global state makes this hard, but it may be possible with some of Haskell's funky features, or even just type classes.

2\. With the above we just need people to write some basic controls for Elm and give them more features. We need an ecosystem.

<comment><USER4> They really seem to be staying in the global state camp. I find it impractical too, but it would make their "time travelling debugger" and other similar tooling stop to work if components could have local state.

<comment><USER3> Global state is OK, but I think we need language features or sugar to help embed the components. If those language features can be nice mathematical generic features like you have in Haskell that is better.

An example is a calendar control, in a grid control in a tab. You click right to go to the next month. That event needs to be bubbled through layers of boilerplate code to direct it back to the calendar's view.

Also another consequence is that the model is a mix of business data and UI state data. The selected month shouldn't affect the business logic, but it is bundled with THAT data which is annoying.

Not sure what the solutions are though.

</comment></comment></comment></comment><comment><USER5> I wish they would stop making changes just for the shake of change. E.g. Up until 0.17 most code examples where using the prime ' character.

With 0.18, Evan decided that using prime is bad taste, so he decided to break any code that uses it.

Sure, it is not a big change, but it means they are not respecting user's time and it is a sign of things to come.

Sorry for the rant.

Edit: I hope my reply doesn't get misunderstood. I love Elm and use it in all my side projects. I think it made wonders for introducing new people to the ML world.

Edit2: Sorry, didn't meant to make so much fuss about it. It is indeed a small thing.

<comment><AUTHOR> I agree... I wish we still had the prime character. But since Elm isn't at 1.x status yet, that earns me an "irritated smirk" rather than a table-flip. :)

<comment><USER5> Yes, I am not saying it is a big thing. It's a small thing in itself, but breaking backwards compatibility for no good reason is huge red flag for the future.

<comment><USER6> > breaking backwards compatibility for no good reason

I'd say reducing weird syntax is a perfectly good reason. How is doing this while offering an easy migration solution in an early stage language a "huge red flag"?

<comment><USER7> A prime as an identifier constituent is not "weird syntax". The ancient C tradition of only allowing [_[:alnum:]] characters in identifiers is pretty pointless anyway. I really wish more languages would allow question marks and exclamation marks (and everything else), the way Lisp and Scheme do (e.g., [https://docs.racket-lang.org/guide/syntax- overview.html#%28p...](https://docs.racket-lang.org/guide/syntax- overview.html#%28part._.Identifiers%29))

There's a very good example in C++ of how this causes problems, where vector::clear and vector::empty are much too easy to confuse (which one of them deletes all elements, and which one of them checks if a vector is empty?). Replacing them with clear! and empty? (or is it clear? and empty!) would be a huge improvement. Whenever a language moves away from arbitrary legacy restrictions, that's a good thing.

<comment><USER8> The problem is that prime (as it's used, anyway) doesn't carry any meaning the way ? and ! (as they are used) do in Scheme, it's just used for "I couldn't bother to think of another name". Enabling clearer names is great, but the language allowing primes in names was accomplishing the opposite of that.

<comment><USER7> I think that's a coding style decision, and shouldn't be part of language specification. I certainly don't feel about primes the way you do: having a function f and a function f' usually means they are sort of similar with some specific difference between them, definitely not "couldn't think of a better name". E.g., in haskell a prime often denotes a strict function, it's a better convention than having f and f_strict. Plus, how are you going to decide _which_ unicode symbols should not be allowed? It can get a little random.

<comment><USER8> It's definitely a matter of taste, but I feel like settling for "similar except different somehow" is the same thing as "couldn't think of a better name". I would much prefer f-strict because then I don't need to be familiar with the punctuation conventions of the codebase to know how it's different from f, it's right there in English.

Edit: Plus, then you don't have to wonder if that particular function follows that naming convention; prime meaning strict isn't nearly as universally followed as ? or ! in Scheme, for instance.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I think that Elm is a fundamentally good language, being catered towards JS developers will hopefully attract more of them to FP development. However, I feel that the language is too restricted compare to other FP languages (Haskell, Purescript, even Scala), as a result you often need to write too much boilerplate and the Elm architecture doesn't seem to fit nicely for all kinds of components.

Which is why for now I'm looking into Purescript and GHCJS which support features such as Rank N types, generics, typeclasses, functional dependencies/type families. Even though I don't use many of those features directly, I do benefit from libraries that depend on them.

</comment><comment><USER10> Speaking of Elm I liked this video from Erlang Factory about using Phoenix and Elm together. They both have a functional flavors so I think it might appeal to same people:

[https://www.youtube.com/watch?v=XJ9ckqCMiKk](https://www.youtube.com/watch?v=XJ9ckqCMiKk)

The first half is about Phoenix, the second about Elm. I don't know much about front-end stuff but I did like the Elm bit as an intro, especially the debugging and nice error messages part.

</comment><comment><USER11> From what languages is Elm inspired? I've a Java/C#/PHP/JS background and I feel really uncomfortable with Elm syntax.

<comment><USER12> Completely logical. Java, C, PHP are said to be algol descendants. In two words: curly braces. JS wasn't supposed to but ended up curly because social trends are that strong. Now imagine JS function being the only thing you use, then that language users and designers evolving a syntax for typed js-like functions, rince repeat, you get ML, Haskell, Elm.

In time your brain realigns, depending on how much you appreciate the functional style or not.

<comment><USER13> Not quite. ALGOL doesn't have curly braces, just BEGIN and END blocks.

      BEGIN
      FILE F (KIND=REMOTE);
      EBCDIC ARRAY E [0:11];
      REPLACE E BY "HELLO WORLD!";
      WHILE TRUE DO
        BEGIN
        WRITE (F, *, E);
        END;
      END.

I've heard it said that the languages you mentioned are inspired by C's syntax.

<comment><USER12> Wow, couldn't be more wrong. It's indeed C family (BCPL, B). Thanks a lot for the note.

<comment><USER14> Well, I wouldn't be so hard on yourself. IIRC (and I hope someone corrects me if I'm wrong), algol introduced block scoping. Whether you use BEGIN/END or {/} I think is a pretty minor point.

C has braces to introduce a new scope. The irony is that JS (until recently) didn't have block scope. It just has braces :-).

Now this is where it gets screwy. You are supposed to (but don't have to usually) add a semi-colon on the end of each statement in Javascript.

a = 52;

This has a semi colon because it is a statement. There is another construct called an expression. An expression is anything that can evaluate to a value. An statement can be an expression (the statement "a = 52;" is an example of that because it also evaluates to 52 and is thus an expression). But there are expressions that are not statements. Here is an example of an expression

(5 * 27)

It evaluates to a value, but doesn't do anything so it is not a statement. Usually in computer languages, if "statements" are actually expressions. So you can say

if (1>0) {"Yay"} else {"Boo"}

evaluates to a value ("Yay" in this case), but doesn't do anything in and of itself. The blocks in the braces may contain statements, but the if is an expression, not a statement. Note the lack of semi-colon. Again, presumably because it is an expression, not a statement.

You can try the above in Node and it will indeed return the value "Yay".

a = if(1>0) {"Yay"} else {"Nay"};

In this case the variable a should be assigned the value "Yay", because the if expression evaluates to a "Yay". For some strange reason (that I don't understand), Javascript (or at least Node, when I tried it) does not accept that. It gives you a syntax error. You can not use if "statements" as expressions in Javascript (which sucks quite a bit).

All of this to say that Javascript appears broken to me, no matter what geneology you assign to it :-D. I personally really like programming in JS (or actually CS), but it is a beast unto itself, I think.

I'd welcome comments illuminating this issue if I've made a mistake with the above! As I said, it's easy to do.

<comment><USER15> >You can not use if "statements" as expressions in Javascript (which sucks quite a bit).

It does indeed, and it leads to some ugly code:

a = function() { if(1>0) { return "Yay" } else { return "Nay" } }()

<comment> ziad-saab You can also write:

a = 1 > 0 ? "Yay" : "Nay"

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> in case anyone's wondering, it performs about the same as 0.17:

[https://rawgit.com/krausest/js-framework- benchmark/master/we...](https://rawgit.com/krausest/js-framework- benchmark/master/webdriver-ts/table.html)

<comment><USER17> interesting that Elm's own benchmarks has it handily beating the frameworks it performs worse than in these.

<comment><USER18> It looks like the elm implementation isn't using "lazy"

[https://github.com/krausest/js-framework- benchmark/blob/mast...](https://github.com/krausest/js-framework- benchmark/blob/master/elm-v0.18.0/src/Main.elm)

[http://package.elm-lang.org/packages/elm- lang/html/2.0.0/Htm...](http://package.elm-lang.org/packages/elm- lang/html/2.0.0/Html-Lazy)

</comment></comment></comment><comment><USER19> I remember evaluating Elm and ClojueScript as an alternative to ES6 about a year and a half ago. Eventually I had to decide against both as we absolutely needed to render parts of our page server side (Google saying they'll index SPAs is a joke.)

If I'm not mistaken this wasn't possible in Elm back then, and felt uncomfortable or even hard in ClojureScript. Has that changed?

To be fair if I started a new project like the one I'm working at now I'd much rather use server + template for most pages and add interactivity through JS once it boots up.

<comment><USER20> In clojurescript we have RUM (another lib on top of react) where you can render your HMTL on the server (without using node, just on the JVM). It's also blazing fast and works very well.

</comment></comment><comment><USER21> why not flowtype/typescript+js es6+react+redux/mobx?

currently a pretty nice reactive mobx-state-tree is on the frontpage of hn.

<comment><USER11> I'm quite sure it's exactly for that reason, not having to choose between

\- Flow vs Typescript

\- ES5 vs Babel

\- React vs Angular vs Vue vs jQuery

\- Webpack vs Rollup

\- Redux vs Flux vs Mobx vs React states

etc...

Plus, probably lots of dev prefer Elm's syntax and design.

<comment><USER22> This is exactly the reason I'm interested in Elm. My team has gone from React to React + Flux to React + Redux to React + Redux + Immutable to React + Redux + Flow in the last 2 years. That's a _lot_ of change, and we're not even talking about the build tool side of things with Browserify, Babel, Webpack etc.

In Elm I can see the same kind of framework simplicity that attracts me to Go.</comment></comment></comment>


Brain is ten times more active than previously measured - <AUTHOR> https://www.sciencedaily.com/releases/2017/03/170309150634.htm?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+sciencedaily%2Ftop_news%2Ftop_science+%28ScienceDaily%3A+Top+Science+News%29 <comment><AUTHOR> The analog computation of dendrites looks like a very big deal. Is it about weight or something else?</comment>


Kpt: Packaging up your Kubernetes configuration with Git and YAML since 2014 - <AUTHOR> https://opensource.googleblog.com/2020/03/kpt-packaging-up-your-kubernetes.html <comment><USER2> Haven't tried this out but, from the write up, I don't see what the convenience of this is over just using git + {kubectl, kustomize, helm}.

The Kubernetes ecosystem is rife with tools like this, and it feels like such a chore to just keep up with every new templating system for YAML files. I have started to just write Go programs that directly talk to the Kubernetes API and manage my rollouts (one step away from operators).

<comment><USER3> One key distinction is that this is not yet another templating DSL like Jinja, or Go templates that present an anti-pattern for non-trivial deployments. As an example, take a look at the Grafana Helm chart:

[https://github.com/bitnami/charts/blob/master/bitnami/grafan...](https://github.com/bitnami/charts/blob/master/bitnami/grafana/templates/deployment.yaml)

It's more curly brackets than YAML :)

Instead, kpt's key design philosophy is to keep configuration as data. This makes it easier to develop tooling that operate on configs.

</comment></comment><comment><USER4> I don't understand why I would use this over Helm? I am even further confused when I go to the docs and it has guides for creating a kpt package from a helm chart: [https://googlecontainertools.github.io/kpt/guides/ecosystem/](https://googlecontainertools.github.io/kpt/guides/ecosystem/)

If you are going to introduce a new tool into an already crowded ecosystem the least you can do is describe why anyone should use it.

</comment><comment><USER5> Summary:

Kpt is an OSS tool for Kubernetes packaging. It uses a standard format to bundle, publish, customize, update, and apply configuration manifests. Kpt operates like kubectl, providing additional functionality to prune and delete configuration.

<comment><USER6> Single-purpose accounts aren't allowed on HN, nor are bots (if that's what this is). Also, it's not good to post summaries routinely. We want HN users to actually read articles. The less work readers do, the shallower and more predictable discussion tends to be.

I've banned this account, but if you want to use it to participate in the community as a regular member, you're welcome to email email@example.com and let us know.</comment></comment>


Ask HN: What CSS template do you use to start quickly? - <AUTHOR>

I'm starting to help on the interface of an open source project but I'm not an interface ninja.<p>Is there an (openly licensed) collection of CSS templates online? <comment><USER2> There are loads of "free web template" sites online that offer HTML/CSS templates that could get you started.

Personally, I think Theme Forest (<http://themeforest.net/>) has the best templates available, for a small fee (~$10).

Start with a template, hack it up to meet your needs, and go from there. So much faster and easier than doing it all yourself on an app where good UI is important, but isn't the point of the site.

</comment><comment><USER3> I'd definitely start with the Eric Meyer reset before writing custom css just to get rid of any defaults you might be unaware of...

<http://meyerweb.com/eric/tools/css/reset/>

I'm also a fan of the 960.gs grid, really quick to learn and good for the majority of structured layouts.

</comment><comment><USER4> If you are looking for just CSS frameworks try:

<http://blueprintcss.org>

<http://bluetrip.org>

or

<http://developer.yahoo.com/yui/grids/>

</comment><comment><USER5> It's not exactly a template, but I just used the 1140px css grid system this past weekend to get a side project up and going. I had no css experience before this, but the website turned out (i think) beautifully.

<http://cssgrid.net/>

Pros: \- Took a non-html person about 40 minutes to figure out \- Can look really nice without much effort \- Simple \- Free! Cons: \- I'm not sure it falls under the definition of a true template

</comment><comment><USER6> I don't consider Blueprint or other CSS frameworks _templates_ , but in general I think templates cause more work than they prevent.

Things look _nice_ to start with, but you quickly find yourself trying to figure out how to remove or change CSS styles instead of just building on top of.

</comment><comment><USER7> 960.gs has been very friendly with me so far!</comment>


Installing Cherokee With PHP5 And MySQL Support On Ubuntu 9.04 - <AUTHOR> http://www.howtoforge.com/installing-cherokee-with-php5-and-mysql-support-on-ubuntu-9.04 <comment><USER2> This is the first time I've heard of Cherokee. Has anyone used it and what do you think?

I recall reading that Apache is good for serving dynamic content and nginx is good for static. Where does Cherokee fit in?

<comment><USER3> I had exactly the same question, having just heard of it today.

You can obviously find more information at <http://www.cherokee-project.com/>, but basically, it seems to be Apache as it started (sans feature bloat). It's written in C, requires no additional dependencies, and has what seems to be a very nice web administration panel.

Practically, it seems like its performance sits somewhere between Apache and Lighttpd, with Lighttpd beating it in performance, but (unless I'm mistaken) not on features.

 __edit: I would also love to hear more from somebody who has actually used it as to whether or not there are less apparent reasons to choose it, and whether or not it's ready for production use.</comment></comment>


Lever – Introducing Gmail Sync - <AUTHOR> https://blog.lever.co/blog/2014/03/24/introducing-gmail-sync/

<comment><USER2> Why so so few company blogs + forums have an easy to find link to the main company page?

Having to head to URL bar and delete the "blog." is unpleasant.

<comment><USER3> Good point. Thanks for mentioning. Made the logo at the top link to [https://lever.co](https://lever.co), which probably makes more sense.

<comment><USER4> Hm, question is how to get to the root of the blog now to see all the posts...

</comment></comment></comment><comment><USER5> Congrats on launching this!

Out of curiosity, where do other popular ATSes fall in terms of email integration? (Jobvite I think is the popular incumbent?)

<comment><USER3> Email integration is usually done by manually BCCing or sending emails from an email address generated by the system. BCCing is difficult to do consistently, and replies don't get captured automatically. Sending emails from a special address has much lower deliverability and more importantly is awkward for the person receiving it.

We send emails as you over Google OAuth and Gmail SMTP. That way, the email literally comes from you and shows up in your sent folder. The advantage to doing this in a shared system like Lever is that everyone else on your team can see the full history among multiple people.

When you send another email in Gmail or the recipient replies, we use IMAP to listen on threads associated with Lever. That way, we capture emails much more reliably and they don't have to come from strange random email address. It is really cool stuff, and it happens just as fast as Gmail can show an email, because we are acting just like a full email client.</comment></comment>


Uber To Expand Private Car Service To Chicago, Seattle, Boston And D.C. - <AUTHOR> http://techcrunch.com/2011/05/02/uber-to-expand-private-car-service-to-chicago-seattle-boston-and-d-c/ <comment><USER2> Any thoughts on bringing it to Canada? Would be great!</comment>


A survey of the many jit projects. Parrot using llvm instead of own jit. - <AUTHOR> http://renesd.blogspot.com/2009/09/many-jit-projects-parrot-plans-to-ditch.html

<comment><USER2> Comment from Allison Randal, Chief Architect of the Parrot project:

 _LLVM provides a set of tools that look promising for allowing us to quickly develop a JIT, taking advantage of the platforms they already support. (Note that LLVM currently has limited support for Windows, so it's not quite there on all our target platforms.) The plan is to develop a rapid prototype of an LLVM-based JIT, to see if it might work as the primary Parrot JIT, or perhaps as one of several JIT strategies._

So it looks more like the Parrot team is going to try out LLVM and see if it meets their needs. Their current JIT seems to be unstable and they want to evaluate alternatives.

The list of good jit/great jit characteristics on this page: <https://trac.parrot.org/parrot/wiki/JITRewrite> is especially interesting. For example, the ability to "output generated machine code to an executable or object file" is really great. As I understand it, it is the Mono JIT's -aot option that allows the Unity team to deploy .NET games on the iPhone.</comment>


From developer to business MVP - <AUTHOR> As a developer I feel the business acumen is quite low as the focus is on coding. However these successful entrepreneurs once were coders but no obviously running businesses so the focus changes.
How does one move their mindset from developer to an entrepreneur. In my case I am developing the app as an MVP but not sure how to progress further to gain more traction and understand if their is a need for it (which i think there is but customers would be the real answer to this)
Would be good to get suggestions on this?
Thanks <comment><USER2> A common misconception among devs is that the product must exist in order to test if people will pay for the product. This usually causes the dev to never bring something to market because deciding when something is minimally ready is hard. Instead, consider:

Step 1 - spend time finding people who will pay you instead of building something speculative

Step 2 - you are now a business person, congratulations

Perhaps a few steps in between step 1 and 2 might be to understand market size, growth potential, realistic operating expenses, burn rate, etc.

<comment><AUTHOR> Thanks for the response.

That's another thing I need to do is go out and speak to people which is my next step</comment></comment>


Elon Musk teases NYC-Philadelphia-Baltimore hyperloop - <AUTHOR> https://twitter.com/i/moments/888074036823162881 <comment><USER2> I don't believe i will see this in my lifetime. A good proxy example is Shinkansen (bullet train) in Japan that also require almost straight line track for high speed. They are already building one from Hakodate to Sapporo in Hokkaido (180 miles). It will be completed in 2032 (15 more years) because 70% of track will be in tunnels that need to be bored. I can't imagine east coast population density making it easy to bore a tunnel from NYC to D.C.

</comment><comment><USER3> dupe: [https://news.ycombinator.com/item?id=14813273](https://news.ycombinator.com/item?id=14813273)</comment>


When using the address bar in Chrome, ads appear in autocomplete - <AUTHOR> Just today I noticed when searching about "building <something>" upon typing in "bu" 'burger king' showed up in autocomplete. Has nothing to do with my search history, this happens on any google account from what I can tell?
https://imgur.com/a/t4mLBEt
Ads in search results, ads in maps, ads in email, ads in autocomplete. <comment><USER2> Set your search engine query to: [http://www.google.com/search?q=%s](http://www.google.com/search?q=%s)

A new chrome update changed it to a new one that has spammy stuff in it.

</comment><comment><USER3> This doesn't seem to be a function of Chrome, but of your default search engine. If I set my search engine to Google, I get the same results as you did. But if I set it back to DuckDuckGo, I get:

Buzzfeed / Burger King / Buy Buy Baby / ...

...without the icons.

If I just type "b" with DuckDuckGo set as Chrome's search engine, the top result is "bing", which I can't imagine is something that Google wants me to see.

So it seems that Chrome is just returning the top few results returned by whatever search engine you've configured.</comment>


Ask HN: When will we have mobile browser extensions and ad-blocking? - <AUTHOR> Trying to browse the web on mobile is just a hostile experience. I have to close 2-4 popups before I can see any webpage. It feels like the early 2000s all over again and I don't know of any initiatives to move us forward.<p>How long are we stuck with this world? <comment><USER2> This is a limitation of iOS. Android browsers can support extensions just fine. In fact, every browser on iOS is just a skin of Safari since the App Store doesn't allow 3rd party browsers.

Safari does have a "content blocking API," but it's far more limited than desktop extensions.

People like to glorify Apple for being "privacy friendly," but with Android you have the power and the tools to improve your privacy significantly over iOS.

If you really need adblocking, I recommend AdGuard for iOS (which uses the content blocking API) and Pi-hole (for whole network DNS filtering). Good luck.

<comment><AUTHOR> I use Android, I wasn't aware of this stuff.

<comment><USER2> Then download Firefox or Firefox Preview and install the uBlock Origin extension.

To block ads in other apps, use AdAway (for a rooted device) or Pi-hole.

</comment></comment></comment><comment><USER3> On Android you can get FireFox, with add-ons. I only need 2:

\- uBlock Origin: For the ads

\- Video Background Play Fix: Allows me to listen to Youtube without having the screen on.

</comment><comment><USER4> Install Firefox. With Firefox you can install extensions, including uBlockOrigin, which will allow you to block the advertising popups.

</comment><comment><USER5> On Android, I have rooted my phone and installed adaway. It adds /etc/hosts entries to block ads. I haven't seen ads in a long time.

I also use Firefox with unlock sometimes.

On iOS, you could use a different DNS server to block ad domains.

[https://adguard.com/en/adguard- dns/overview.html](https://adguard.com/en/adguard-dns/overview.html)

</comment><comment><USER6> I have uMatrix and uBlock Origin on Firefox for Android. This has been available for a long time.

</comment><comment><USER7> For several years, I've been running Yandex Browser on Android with uMatrix, uBlock Origin, HTTPS Everywhere, BItwarden [password manager] and Privacy Bedger.

What are these "pop-ups" and "ads" you speak of?

Yandex Browser is also Chromium based, so loads faster than Firefox and has an absolute killer text-reflow feature [something Firefox used to have but, in a fit of insanity, got rid of several years ago]. It also supports pretty much any extension from the Chrome Webstore you want to install [and the ones that don't one-click install you can usually sideload in 'Developer Mode'].

 _Give it a go. Sometimes you 've got to look further than the end of your nose for solutions to your problems!_

<comment><USER8> Any concerns about it being Russian? I used to run Dolphin Browser, but I stopped -- there were some privacy concerns.

<comment><USER7> None whatsoever.

I really don't see what difference it makes whether my browsing habits end up in a data silo in Russia [or even China], rather than the USA.

In fact, given the choice, and even if I was up to no good, I'd PREFER the Russians or Chinese to be slurping my data, rather than any of the 'five eyes' nations. I think most three letter agency types are more interested in what their own citizens are up to, rather than worrying about what some nobody in a foreign country is doing.

</comment></comment></comment><comment><USER9> I've been using Purify on iOS since the content blocking APIs were released. It seems to do a great job, no complaints. Am I missing something?

<comment><USER10> Nope. It's just non-obvious to experiences desktop browser users because desktop browser ad blockers are extensions, not standalone apps. And Apple didn't do the best job of publicizing the feature.

I use Refine, fwiw.

</comment></comment><comment><USER11> I'm on Android and use Blockada. It's not a browser plug in, but a local pi- hole like service for filtering all content.

[https://blokada.org/index.html](https://blokada.org/index.html)

</comment><comment><USER12> My iOS setup:

1\. Install Firefox Focus, which has a built-in content blocking capability. FF Focus only allows one tab at a time, which is mostly suitable for quick, throwaway tasks. It's not _a browser_ if you want to have multiple tabs open or save bookmarks. To block _Bad Things_ in Safari, go to Settings > Safari > Content Blockers (under General) > Allow Firefox Focus. In FF Focus, go to Settings > Enable Safari Integration.

2\. Pi-hole (or NextDNS) to block spyware/malware on the DNS level.

It's not a 100% replacement for uBlockOrigin (especially if you like maxing it out), but it is good enough.

</comment><comment><USER8> Brave for Android has an ad blocker. It's based on Chromium. Brave was founded by Brendan Eich, creator of JavaScript and formerly of Mozilla.

[https://brave.com](https://brave.com)

</comment><comment><USER13> If you are using a device which doesn't let you choose your extension or browser (e.g. iOS) I would recommend setting up a PiHole and WireGuard VPN server if you have the expertise.

These can be spun up for a few dollars a month on a cloud provider, or perhaps even at home if you have a static IP allocation.

Depending on your device (e.g. a recent iOS device) you can then set up your device to _only_ tunnel DNS requests back to the Pi hole at either your home or server provider.

Admittedly this is rather involved, but works for all apps and webpages which rely on good ol' DNS to phone home and fetch ads.

</comment><comment><USER14> Anybody tried Bromite.. It has inbuilt ad bocker and privacy invasive features. [https://www.bromite.org/](https://www.bromite.org/)

<comment><USER2> I prefer Firefox, but Bromite is probably the most privacy friendly Chromium browser for Android.

</comment></comment><comment><USER15> Haven't seen 1Blocker mentioned yet, which is what I use on iOS: [https://1blocker.com](https://1blocker.com)

No complaints and for the reasons you mention, I can't imagine browsing on mobile without it.

<comment><USER16> Yeah I use 1Blocker on safari for both iOS and macOS and I think it works pretty great.

</comment></comment><comment><USER17> Wipr works wonderful on macOS and iOS. NextDNS is also an option. I use both together on my Mac's and iOS devices.

Wipr is one of the many content blockers available for Safari, be it iOS or macOS.

</comment><comment><USER18> Try edge in android, inbuilt adblocker and uses less battery

</comment><comment><USER19> When mobile devices and browsers are provided by organisations with a moral opposition to advertising and marketing.</comment>


Solu: the Finnish pocket computer that wants to take over the world - <AUTHOR> http://www.theguardian.com/technology/2015/oct/16/solu-the-finnish-pocket-computer-that-wants-to-take-over-the-world <comment><USER2> "Partially made out of wood" cool

"It's all stored in the cloud" :(

"You pay a fixed fee every single month..." D:

</comment><comment><USER3> neat idea but I don't want to pay monthly for it</comment>


Ask HN: How you keep yourself motivated for year long projects? - <AUTHOR> I have started few projects recently but not able finish any of them. Lost interest in all.<p>How you keep yourself motivated for long side projects? <comment> atom-morgan I'm currently in the process of writing a book covering automated testing within Angular (2/4).

The most practical advice for maintaining motivation is to look at things on a day or a week basis. I've described the process to others as running a mental marathon so I simply can't think about mile 26 right now. I have to think about the next eighth of a mile. Trello has been very helpful with this. I break up my work into small tasks and stack them into a completed list each week. Seeing that stack week after week has been very beneficial for my mindset by giving me the feeling of accomplishment. Without this, progress would be a lot more abstract.

The other motivating factor which I imposed on myself was to quit my full-time job. I saved up all year so I could work on this giving myself as long of a personal runway as possible but there is an end. That motivates me.

</comment><comment><USER2> 1\. Try to get as much motivations lined up as possible, and motivations that point in the same direction. E.g. "I care about this topic" _and_ "I can make some money." ([https://codewithoutrules.com/2017/08/03/stay- focused/](https://codewithoutrules.com/2017/08/03/stay-focused/))

2\. Avoid contradictory goals. "I want to make money selling a product" and "I want to learn a new tech stack" don't work well together.

3\. If you're trying to make a product, start with evidence there's real demand for it.

4\. If you're trying to learn, pick either a really short hard deadline, or something you will actually find useful. ([https://codewithoutrules.com/2016/09/09/side- projects/](https://codewithoutrules.com/2016/09/09/side-projects/))

Real example: I wrote a book ([https://codewithoutrules.com/saneworkweek/](https://codewithoutrules.com/saneworkweek/)).

1\. I wanted to sell a product, but also really care about the topic.

2\. I very carefully avoided spending time coding or learning new technology, focusing purely on writing (e.g. [https://codewithoutrules.com/2017/07/10/stop-writing- softwar...](https://codewithoutrules.com/2017/07/10/stop-writing-software/))

3\. I had multiple posts reach front page of Hacker News for this topic, clear evidence that people cared.

<comment><USER3> You would have better checkout conversion if you switched to Stripe.

That checkout prompt is too much on mobile.

Also, I wanted to see a preview of what is in the book ;_;, could not find and abandoned cart.

<comment><USER2> Thanks for the info! I'll see what I can do about the popup.

(Unfortunately on its own Stripe is problematic, due to things like EU VAT MOSS, so I'm limited in what I can use to services that do taxes for me.)

If you want to see a preview, you can sign up with your email to get an excerpt on the email form on the original page.

</comment></comment></comment><comment><USER4> Get a partner or two to work on them with — even if they're just acting as a sounding board once every couple weeks. It's much easier to feel accountable to another person than it is to be consistently accountable to yourself.

</comment><comment><USER5> Incremental feedback.

How this works depends on the project. Instead of one multi-year project, it needs to be broken down into digestible chunks, at the end of each you have to have a _mechanism_ that tells you a simple 'yes, keep going' or 'no, you need to adjust'.

I'd argue that this mechanism is almost always your end users. That feedback regenerates your interest periodically and will push you to keep working on the project.

Without feedback, it's harder to justify your time and effort when interest starts to fade.

</comment><comment><USER6> I have been working on 3 projects for nearly 2 years.. they are actually done, but I'm finishing up some testing.

Basically, they are creative ways to help you remember information in different ways, started out as 1 project and eventually turned into 3. No idea if they'll be a hit or not, but I never create projects for anyone else... I create them for myself, and then I share with the world.. if I'm using it.. I'm sure someone out there, eventually will use it too, free or paid.

When I get bored, I usually get another idea for another project.. and I start working on it.

Since the creation of those 3 projects that I won't mention at this time (as they are being saved for a Show HN) ... I've created:

[https://mypost.io](https://mypost.io) : allows anyone to create and publish web pages on the Internet in seconds.

[https://scamshare.com](https://scamshare.com) : helps expose scammers and scams to the world, specifically those scams being sent via email or text.

[https://callmeprivate.com](https://callmeprivate.com) : helps mask your real phone number behind a virtual number to receiving and make calls; great for individuals, entrepreneurs, or businesses.

[https://textmeprivate.com](https://textmeprivate.com): helps mask your real phone number behind a virtual number, designed specifically for SMS-only.

Working on these other projects has helped me to understand the original three and even optimize the code to clear up any "uncertainties" that I had when I first started. Now that I've completed several more projects, I can go back, and although I realize I could've coded something better.. I'm actually seeing that you can code things in different ways and still get the same process done.

As for what keeps me motivated to work on so many projects? Success or failure.. the creation of a project [ and sending it off into the world ] means success to me. The other contributing factor for motivation: I want to run my own [ SaaS ] business and get away from having to work for someone, except my customers, of course. The continuing motivation would obviously be: the more people that understand and use and even pay to use my projects will give me more incentive to keep working on them and create new ones.

<comment><AUTHOR> Thanks for very useful advice and really great projects.

One another question I have is what initial motivation for you to create above projects. These services already existed and I setback after some time if I see same kind of service and loose motivation to keep on working on it. Never finishes the thing.

Can you please provide advice how to deal with it and what should be my intial motivation and thoughts for recreating something.

<comment><USER6> The advice I have for you on initial motivation and recreating something, even if it already exists is this:

Facebook exists. Google exists. YouTube exists. Gmail exists. And the list goes on and on about everything that exists.

\- Thousands of developers have recreated Facebook and failed. The only ones who could defeat Facebook were a Russian social network and a Chinese social network, and only in those countries.

\- Google was a great example of seeing what happens when you try to "defeat" a giant. It failed with Google Plus.

\- Facebook was attempting to actually become "the next Google search" at one point and while it wasn't publicized crazily, it wasn't anything that could be measured as successful.

Facebook remains the #1 social network. Leave it alone. Google remains the #1 search engine. Leave it alone.

Stop trying to be the competition and start being the compliment. I know that sounds crazy, but when you try to be the competition, you either defeat or you get defeated. Almost always, you get defeated. When you try to be the compliment: you aren't trying to replace something, you are simply trying to be the alternative to something. While it sounds like competition, you are simply the backup if things go wrong with the main source, and people are turning to look for something else to use instead.

Take a look at Duck Duck Go. Not the most dominant search engine, but it is the alternative to Google. Why? Because they guarantee your privacy. Most major companies are dealing with hackers all of the time. Uber. Equifax. Just the latest examples. These massive companies have lost and exposed information that should have otherwise been private. Yet people keep using them and they don't care.

However, there are some people out there who truly do care about their privacy, and want to remain private and have some guarantee. This is the power that we, as "small developers" have over the big companies. Do what you can to secure and protect user information and it may just give you a huge edge, at least to people who are looking for more guaranteed privacy.

\</comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--

If you want to do a little extra reading, this is really how I keep brainstorming and getting new ideas for projects so I stay motivated and keep going:

The three projects I am working on, which have taken me the longest, and bless her for her patience... my girlfriend at the time, now my wife, would always ask me to remind her to do something. I would forget.. and she'd also forget, and later on, we'd kick ourselves. That was the initial motivation to even start a project like the ones I have been working on. So I created these projects to help her remind herself to do things so I wouldn't have to remember for her.

As for the others... they were a bit more personal. I've included notes to show you how they are all actually connected and how one idea led to another.

MyPost (2-3 months project) [free to use] ... I wanted to go to a place where I could write HTML and CSS without having to register for an account or enter in my email. There are tons of these types of programs out there now.. but just a few years ago, there was only one alternative I had found which was pen.io. But it was still not allowing me to do everything I wanted to do so I built my own. Gave it away for free.. and many people all over the world use it.

* Notes: It had been done already. The concept itself is not anything new or unique. But this project taught me: your projects don't always have to be unique and different. Sure, don't copyright it and steal it exactly as is. But if you can take an idea and make it even better and add your own twist on it, than why not? It taught me that I could do things my own way, do things that I would feel comfortable doing. I do create projects with people in mind, but first and foremost: I create it the way I would want to use it with user-friendliness in mind.

ScamShare (a weekend project) [free to use] ... although email platforms are now very good at picking up keywords, I would search google to see if these emails were even being mentioned anywhere, because I had read something about people being scammed out of their life savings.. and I wonder: how are people still falling for this? Where can I go to see if this email is really a scam? I'd search keywords and nothing was coming up. So this was created to help people identify keywords and types of emails as scam.

* Notes: If I can expose scammers and attract a whole community of people willing to help do the same thing, than maybe we can combat this epidemic. Billions of emails are sent every year. Why? Because its apparently still working. If 100,000 emails leads to 1 person being scammed and their savings being wiped out, that is probably a success to a scammer. * The same editor idea came from MyPost, which led to the idea of ScamShare -- a place where anyone could submit information about scammers without actually signing up for anything. Just post it and be done with it. No long registration process.. share the info you have!

Call Me Private (2-3 months project): Every day with the spam and scam calls.. how do I stop it? I realize the best way to stop it was to stop giving out my own phone number to everyone, except family. What could take its place? What number could I give to people I still want to do business with? How could I still make and receive calls? This led me to create a _Virtual Numbers as a Service_.

* Notes: The ScamShare project actually led me to come up with this idea along with the fact that my phone was ringing every morning nonstop. Since I've been using Call Me Private for my personal and business line, whereas I used to receive upwards of 7-8 calls every morning, I now only receive 1-2 scam calls a day.

Text Me Private (2-3 months project working on it at the same time as its sister above): To keep the service cheap and simple, I only incorporated calls into Call Me Private, while Text Me Private numbers strictly handle inbound and outbound text messages.

* Notes: The idea for this actually came from my brother WHILE I WAS WORKING on Call Me Private. He is always buying throw away phones. He's paranoid about the government spying on him.. I know, sounds crazy, but that's just how he is. Crazy family.. still love them. So I asked him, "How do you use your throwaway phones?" He said that he used them more for texting, which kind of put me to the challenge of: how do I create a virtual phone number for texting?

Be motivated for yourself, not for others, and that helps you to keep going. Tell one or two people who seem interested in using it or will beta test for you so they can hold you accountable for actually getting it done.

<comment><AUTHOR> Thanks a lot.

</comment></comment><comment><USER7> __Plan something to look forward to. __

Whether that 's a vacation, a long bike ride or a day of nothin' but Netflix, planning something in advance does a few things:

1\. It gives you a personal goal to look forward to that you'll know you hit as long as you're patient.

2\. It gives you a span of "work hard" time that you know will expire, and

3\. It gives you something fun to do in the future!

That's how I keep my head sane!

<comment><USER8> Makes total sense. In fact, there's a book called The Now Habit by Niel Fiore which advogates this structure ("guilt-free play"), which I can recommend.

</comment></comment><comment><USER9> I have been in this boat for the past one year. What worked for was make small goals and write it down and finish it and stop thinking about the final goal. Just keep ur head down and finish goals and take rest.</comment>


U.S. law to restrict government purchases of Chinese IT equipment - <AUTHOR> http://www.reuters.com/article/2013/03/27/us-usa-cybersecurity-espionage-idUSBRE92Q18O20130327

<comment><USER2> Well, the American government can decide not to buy things from Chinese companies right? Its not like China is any different in their preference to buy things from Chinese companies.</comment>


Is Makerbot going closed source? - <AUTHOR> http://blog.makezine.com/2012/09/19/is-one-of-our-open-source-heroes-going-closed-source/

<comment><AUTHOR> According to commentor Josef Prusa the Replicator 2 is not open source.</comment>


UPS Flight Forward Attains FAA's First Full Approval for Drone Airline - <AUTHOR> https://www.pressroom.ups.com/pressroom/ContentDetailsViewer.page?ConceptType=PressReleases&id=1569933965476-404 <comment><USER2> Ah, well, I guess my UPS delivery guy could get a job with Dominos Pizza.</comment>


Bank of England's Chief Economist suggests ditching cash for cryptocurrency - <AUTHOR> http://finextra.com/news/fullstory.aspx?newsitemid=27870 <comment><USER2> Just to clarify: the cryptocurrency idea mentioned here is still state-backed; the prime advantages of a digital currency are in rapid transaction and in giving the state Bank more direct control over the money in circulation.

At present, the bank can choose not print more money (leading to deflation), or print money to slowly increase the amount of money in circulation (leading to controlled inflation, reducing the value of money in private wallets and encouraging spending behavior).

Digital currency will allow the state to simply dirrctly reduce the value of money (negative interest) across all private wallets to encourage spending behavior.

It is a very interesting approach that I think challenges our intuitions about currency, and will take some time to get used to.

</comment><comment><USER3> I'm still usually using cash when paying for stuff. I don't use plastic, because I value privacy. However, I would be more than happy to ditch cash if I could use a cryptocurrency, that had good privacy, instead.

</comment><comment><USER4> What does it even mean to have a negative interest rate?

<comment><USER5> That if you put money somewhere that has negative interest, you have to pay a percentage for it, instead of receiving it. (=you pay for storing money, instead of getting a reward for it)

<comment><USER4> Ah ok, so the purpose is to cause you to invest or spend it.</comment></comment></comment>


Your new home for saved images and links - <AUTHOR> https://www.google.com/save/me?hl=en <comment><USER2> While this is cool, it only seems to be for images, which makes the title seem a little misleading (images and links). [https://support.google.com/websearch/answer/6329826?p=save_i...](https://support.google.com/websearch/answer/6329826?p=save_images&rd=1)

</comment><comment><USER3> So which browser extension was needed again? There was a brief message first time I looked at the link, now nothing. Anything I save with the "Save to Google Drive" extension seems to go elsewhere, so I'm guessing that's not the one.

</comment><comment><USER4> Another service from Google, which they will kill in a year or two?

<comment><USER5> That's exactly what I was planning to comment, but you were faster than the login process :p</comment></comment>


Ask HN: What to Start in 2020? - <AUTHOR> In 2010 you should have started a podcast. in 2011 you should have bought Bitcoin. What should I start in 2020 to be ahead in 5 years from now? <comment><USER2> Start a blog, like in 2000!

If there is one thing the past 20 years have told us, it's that nothing persists but the thing you actually own.

      - Medium rised but now partially closes it's platform
      - Facebook started as the universal platform for everyone on the internet but ultimately failed to become an open platform for discussion
      - MySpace once almost *was* the internet, until it was replaced by shinier new things (facebook, ...)
      - And today the end of tumblr and many more foreseeable...

So start a blog, use your own domain and you'll be able to create something that lasts!</comment>


A look at Assembly, the community that founds companies - <AUTHOR> http://cmxhub.com/a-look-behind-the-curtains-at-assembly-the-new-community-that-founds-companies/

<comment><USER2> The thing that I love about Assembly is that they're not afraid to take risks. There is a lot of unknowns about how this style of company might work and therefore a shitload of risk.

The potential upside is huge if this works but either way its interesting to watch.

</comment><comment><USER3> `Assembly` used to be the name of a famous demo party. [http://en.wikipedia.org/wiki/Assembly_%28demo_party%29](http://en.wikipedia.org/wiki/Assembly_%28demo_party%29)

So I was a bit confused first.

</comment><comment><USER4> How are maintenance and support revenue streams factored into this business model? I understand that revenue generated by the project/product is split among the partners, but I'm not sure how a (potentially) part-time core team is capable of building out and sustaining a basic 9-5 support team on an on- going basis.

Is this something that would require a potentially large amount of App Coins to be set aside at the beginning of a project (similar to how employee equity pools of 5-20% might be 'reserved' up front for retention)?

Perhaps for a wildly successful product full-time core team members would step up to the plate, presumably to be compensated with more App Coins from what is left of the dwindling 9.5M initial pool.

I read the FAQ and can't help but think I simply misread or didn't pick up on this aspect of Assembly.

<comment><USER5> Good questions.

Things like marketing, sales, maintenance, and support can be handled with the Assembly bounties. Over time I imagine we'll make bounties more easily map to these functions, but we've seen bounties work for each of them already. (For example, a bounty might say "Handle support on Monday from 9-5", and it would be rewarded with an appropriate amount of ownership in the product).

However, a team could also hire a contractor to handle support. When a product is making significant revenue the team can spend that revenue as they please, so if support is important to the business, hiring someone is a perfectly acceptable use of their revenue.

</comment></comment><comment><USER6> Is Assembly geared mostly toward software projects? Or stated another way, are there any physical product projects on (in?, under?) Assembly? The very first photo on the article shows an exploded view of hardware, but a quick perusal of the site seems to indicate that all the projects are software projects. Or maybe I'm missing something? Is there a separate category for hardware vs. software? Has any Assembly project raised funds from a Kickstarter (or alike) yet? Or is there a built in way to crowdfund in Assembly?

<comment><USER7> Hey (co-founder of Assembly)! We're focusing on software projects at the moment (there's a bunch of unique challenges in just software alone), but we definitely think there's room to expand.

We're working on a clear way for products to get funds into their accounts (like a Kickstarter).

<comment><USER8> Adding some sort of kickstarter functionality to this would be really interesting. Or making it possible to earn ownership points by investing money, though I imagine that might alter the purity of the community dynamic. Excited to see how it all comes together either way.

</comment></comment></comment><comment><USER9> am I the only one who is confused by the way ownership works here? The article itself is more of a dreamy PR piece. However, looking at the website and the FAQ itself - I cannot really figure out how "app coins" work. Who creates them? I understand that they are distributed by bounties, but how many app coins exist? Who creates / mints them? How does the originator of the idea get his share? Would be great to understand this!

<comment><USER5> Hey, Austin from Assembly here.

Here's an example of what an ownership breakdown might look like: [https://assembly.com/helpful/partners](https://assembly.com/helpful/partners)

When a new product is created, 10,000,000 App Coins are created, and 500,000 of them are allocated by the idea creator (often just to her or himself). Going forward, each bit of work is put in a bounty. The community can offer their opinions of how much a bounty should be worth – and the impact of those opinions is weighted based on how much ownership a user has in the product.

Additionally, each product has a "tip contract" to reward idea creation and product management. The default is that 5% of each bounty goes to the creator of that bounty, and 5% of it is split amongst the Core Team (this could just be the original idea creator, or could be several people).

Anytime the Core Team awards a bounty, the corresponding number of coins is minted and distributed.

<comment><USER10> > 10,000,000 App Coins are created, and 500,000 of them are allocated by the > idea creator

What happens to the other 9,500,000 app coins? Who 'owns' them for purposes of profit distribution and opinion weight?

> Anytime the Core Team awards a bounty, the corresponding number of coins is > minted and distributed.

I'm a little confused about the term 'minted' here. Are additional coins created, increasing the total past 10,000,000 coins, or are they subtracted from the 9,500,000 that were created but not allocated to/by the idea creator at product creation? If they are taken out of the 9,500,000 coins, what happens when there are no coins remaining?

<comment><USER7> > What happens to the other 9,500,000 app coins? Who 'owns' them for purposes > of profit distribution and opinion weight?

Effectively the product's wallet owns them, but opinion weight is based entirely on your ownership of "vested" coins. If you may have 5% (to start) of the total coins, but you have 100% of actively votable coins.

And yep, minting there was confusing. Minting happens only at explicit event so everybody can control their dilution. When bounties are awarded their coins come from the products "unvested" coin pool.

</comment></comment></comment></comment><comment><USER11> My question is how do hosting and credentials work for sites built through Assembly? Who makes the $$$ outlay for a site? Does the project creator have to front and control things personally to begin with? Or is there some sort of arrangement where a particular company hosts in exchange an ownership stake and special status project members have rights to push changes through to 'live'?

<comment><USER5> In most cases, Assembly will help cover costs of things like domains and hosting during development, and in cases where someone in the community spent money on a product, that will be tracked and reimbursed when the product starts to earn revenue.

Also to clarify something in the comment below this one, Assembly's fee is 10% of the royalties paid back to contributors. (so, 10% of profit, not 10% of revenue)</comment></comment>


Ask HN: Best city for a young new grad to start career?  - <AUTHOR>

With SF, Seattle, NYC, Austin, and so many other compelling cities, what's the best option for an ambitious 20-something? Keeping in mind things like living costs, atmosphere (as far as people), etc<p>What are your experiences in the city you live in right now and would you reccomend your city to a new graduate? <comment><USER2> Not sure what your career path is, but I'm going to make the assumption that you're a software developer. SF and NYC are silly expensive (I live in Silicon Valley, south of the city, and it's also very expensive). You don't list these places, but I'd take a look at Boulder and Denver. Both have thriving startup communities, and both are reasonable in terms of price of living. If you like big city, go Denver, looking for a more tight-knit community, check out Boulder.</comment>


What your framework never told you about SQL injection protection - <AUTHOR> http://www.codeyellow.nl/identifier-sqli.html

<comment><USER2> The PHP world is so adorable. It's like a bunch of little puppies, running into each other and falling over and tumbling around.

<comment><USER3> As the article mentions, this issue is not limited to PHP. Many ORMs have similar issues. For instance, I recently ran into essentially the same issue with DBIx::Class in Perl. The problem there was further compounded by the fact that many subroutines in Perl behave differently in different contexts, meaning that code like this may not be safe:

$resulset->search({ column1 => some_sub($arg), column2 => $value2, ...});

Many subs may behave in unexpected ways when using list context, such as returning an empty list. You may end up with values, which are normally escaped, becoming keys in the hashref. DBIC only does the simplest of checks on the key values, leaving your code open to an SQL injection.

This sort of issue is unfortunately prevalent. It is not just limited to PHP and dismissing it as such does everyone a disservice.

<comment><USER4> DBIC maintainer here: did you ever report the problem? Looking through my queues I don't see anything related, but perhaps I missed a report.

I am interested in removing all and any attack vectors, but I can't fix problems without knowing about them. So please do get back to me on this.

Cheers

</comment></comment></comment><comment><USER5> I'm a little lost here. Why would you give the option to the user to sort by any column in the database? Wouldn't a better idea to give the user a bunch of labels on the displayed columns, then map between those and your predetermined sort orders?

You'd then have to validate the input (horrors!) and then add the appropriate sort order to the query (builder) in your own code.

Thus you present the user with column labels such as "Item", "Description", "Weight", "Packing volume", "List Price", which internally map to something like %sort_orders = { 'Item' => \&item_sort_order, 'Description' => \&description_sort_order, … } with your code doing a lookup along the lines of if exists $sort_orders{$request_sort_label} …

Of course this isn't going to be as simple and elegant as allowing user input to pass directly into your database engine.

But then for every problem there is at least one answer which is simple, elegant, and completely wrong.

</comment><comment><USER6> Well this is just depressing (although it looks like these have been fixed by now in most of the frameworks mentioned,) as "just use a framework" has been my go to response to people starting new PHP projects because I had assumed they had SQL injection taken care of.

This isn't a PHP specific problem of course but I do wonder if it is a sign that frameworks in general shouldn't come with their own ORMs. Although, having seen PHP running in the wild that doesn't even bother escaping strings into SQL, I have to think that at the very least using a framework makes things safer if not safe, and makes _fixing_ this crap easier.</comment>


Ask YC: How are root keys stored in an exceptionally secure manner? - <AUTHOR>

"As the Internet's leading CA, VeriSign has the following responsibilities<p>* Storing VeriSign root keys in an exceptionally secure manner"<p>I've always been curious as to what 'exceptionally secure manner' means. Is this the technological equivalent of how KFC stores its secret recipe? <comment><USER2> I saw a talk by a woman who worked at a PKI auditing firm. She said they have a special hardware appliance that stores the keys, which of course costs an exorbitant amount, and has a redundant copy or three. I don't remember the details, but google away.

She mentioned that the machine wasn't even on a network, but I don't know why they would bother going that far.

<comment><USER3> Because if that little bit of secret gibberish (the private key for the root cert) were known to the wrong people it incurs liability in the billions of dollars. And an air gap is cheap and effective protection.

<comment><AUTHOR> > that little bit of secret gibberish

That makes me wonder if root keys are some of the most valuable information in the world (in terms of financial value per bit).

</comment></comment></comment><comment><USER4> <http://en.wikipedia.org/wiki/Hardware_Security_Module>

</comment><comment><USER5> Do you mean physical security considerations? or digital?

<comment><AUTHOR> Both. I remember something from Snowcrash(?) where they had to simultaneously infiltrate the virtual security (the ICE) and physical security (the real-time camoflauge, tear-gas).</comment></comment>


Tungsten: The Perfect Metal for Bullets and Missiles (2014) - <AUTHOR> http://www.bbc.com/news/magazine-28263683 <comment><USER2> >Because, as the people of Kuwait discovered after first Gulf War, depleted uranium leaves a potentially deadly dust behind after it burns. It sounds bizarre but, in the world of warfare, tungsten is the eco-friendly alternative.

i knew it is bad, just googled and according to some sources it is really bad, especially when it comes to birth defects : [http://www.huffingtonpost.com/craig-considine/us-depleted- ur...](http://www.huffingtonpost.com/craig-considine/us-depleted-uranium-as- ma_b_3812888.html)

It is not necessary radioactivity that makes DU that bad, it is its toxicity that does it. Unfortunately, DU is still better for armor penetration : [https://www.theguardian.com/world/2000/may/18/armstrade.koso...](https://www.theguardian.com/world/2000/may/18/armstrade.kosovo)

"Armour penetration is increased by concentrating the force of a shell into as small an area as possible, so the projectiles tend to look like giant darts. [ ... ] The other metal used for anti-tank rounds is tungsten, which is also very hard and dense. When a tungsten rod strikes armour, it deforms and mushrooms, making it progressively blunter. Uranium is "pyrophoric": at the point of impact it burns away into vapour, so the projectile stays sharp. "

<comment><USER3> For penetrators you want density, hardness, and other penetration aiding properties. Tungsten is very dense, but as you point out it blunts when hitting a target, reducing its effectiveness (but if you have enough it'll still work).

The guardian article you linked is a little bit off on the properties of Uranium. Uranium is self sharpening (which means that when it slams into a target it fragments splinters off, leaving behind a sharp point). Uranium is also pyrophoric, which doesn't mean that it burns away pieces into vapor, rather it means that when it scrapes along as it's penetrating through metal it throws off sparks, just as flint and steel does. Additionally, Uranium is more flammable than Tunsten. This means that a long rod Uranium penetrator can punch through thicker armor than Tungsten and it spits out a rain of sparks and splinters as a _burning_ hypervelocity rod comes through the other side of the armor. This leads to a very bad day for the target.

However, because of that pyrophoricity and that burning the result of using lots of DU shells on hardened armored targets is a lot of DU dust and vapor. Because Uranium is a toxic heavy metal this can have disastrous health effects.

<comment><USER4> > _However, because of that pyrophoricity and that burning the result of using > lots of DU shells on hardened armored targets is a lot of DU dust and vapor. > Because Uranium is a toxic heavy metal this can have disastrous health > effects._

Well, I imagine being hit by a tank round has so profoundly disastrous health effects anyway, the metal toxicity doesn't matter much!

(Yes, I know you probably meant adverse health effects for the people who wander into the area _after the crew is killed_ , much like it happens with nukes, but still. The considerations are bizarre, like the article said)

<comment><USER5> > Well, I imagine being hit by a tank round has so profoundly disastrous > health effects anyway, the metal toxicity doesn't matter much!

It's also toxic for the people firing the rounds because blowing up a cartrigde will also evaporate some trace amount of the bullet.

</comment></comment></comment></comment><comment><USER6> There are large tungsten deposits outside of China. The issue is, China has such a monopoly it controls the price.

I have been apart of at least three Tungsten Mine pre-feasibility studies. All they need to do is ramp up production, and the price falls to a point where NPV of your tungsten project falls to zero.

<comment><USER7> Prices aside, you probably also don't want to introduce a dependency on china in your weapons supply chain. This I believe was also the primary reason for the GM bailout.

<comment><USER8> What does GM make that is important to military readiness?

I can think of the Hummer, but that wasn't GM [https://en.wikipedia.org/wiki/AM_General](https://en.wikipedia.org/wiki/AM_General) .

<comment><USER9> Possibly the idea that a large number of subcontractors and suppliers would also have gone out of business.

I think it would be difficult to determine which rationales were sufficient to get enough votes for the bailout to pass, but the cost of creating a supply from scratch after a period of zero demand from GM might have been far more expensive to the aggregate economy than the bailout was. Therefore the cost was judged 'worth it' in spite of the implicit reward to GM for decades of mismanagement.

<comment><USER8> The bailout involved completely wiping out the equity of GM. The GM that exists now is a different company:

[https://en.wikipedia.org/wiki/Motors_Liquidation_Company](https://en.wikipedia.org/wiki/Motors_Liquidation_Company)

The bailout can still have been a sweetheart deal for the creditors of the company, but it didn't do the old GM any good.

I tend to think the motivation of the bailout was to reduce disruption in the job market, I don't think there would have been much more than a short term disruption in the OEM business.

</comment></comment></comment></comment></comment><comment><USER10> TAOFLEDERMAUS have done a few videos on Tungsten rounds / strength.

Tungsten carbide slugs: [https://www.youtube.com/watch?v=UDWD4VM-31E](https://www.youtube.com/watch?v=UDWD4VM-31E)

Shooting a tungsten cube: [https://www.youtube.com/watch?v=n5kEj5ijChc](https://www.youtube.com/watch?v=n5kEj5ijChc)

etc.etc.

<comment><USER11> Taofledermaus and AvE? I'll be off in the weeds for a while.

</comment></comment><comment><USER12> >Tungsten's only rival for this kind of application is the radioactive element uranium. Depleted uranium is (almost) as dense as tungsten and has an added advantage - from a military perspective - that it burns at the extreme temperatures generated as you punch your way through steel tank armour.

It's also self-sharpening (ie rather than smooshing like plastic on contact, parts break off and leave a sharp edge behind like flint), and because it's effectively subsidized by power generation and the nuclear program it's extremely cheap compared to Tungsten. Tungsten alloys are tougher[1] (actually, some of the toughest materials period) but penetration depends heavily on the armor type.

Hell, tungsten is toxic too and the military's biggest motivation is probably just as a really effective PR move. Uranium is definitely worse though, and I'm glad the US doesn't use it in munitions much. Uranium forms oxides that are very bioavailable (and even absorbed as gas through the lungs), and are really bad for you and even worse if you get pregnant.

[1]: [http://www.cam.ac.uk/sites/www.cam.ac.uk/files/news/research...](http://www.cam.ac.uk/sites/www.cam.ac.uk/files/news/research/news/110908-granta- design-chart.jpg)

<comment><USER13> Just PR? Really?

Isn't drag essentially quadratic to speed? Isn't needed input energy also quadratic to speed, while momentum is linear to both mass and speed? Hardness aside don't you have much harder hitting bullets with these heavy elements?

<comment><USER12> The density of tungsten is 1.04% higher than Uranium, and drag is compensated for by making the penetrator slightly longer rather than wider.

> Hardness aside don't you have much harder hitting bullets with these heavy > elements?

Maybe I'm tired but I can't parse this question.

</comment></comment></comment><comment><USER14> If you're interested then have a read about the development of Chobham and Dorchester armour. There is very little detail out there but fascinating to see how some of the military kit is made and what it can stand up to.

</comment><comment><USER15> Funny to see this article here now. For the last few weeks I've been geeking out on exotic materials, and especially Tungsten Carbide. I even went so far to buy a polished Cobalt binded TC 70mm sphere from China. It's virtually indestructible and very few materials such as diamond can scratch it.

<comment><USER16> My wedding band is made of tungsten carbide. I thought about is as a bit different (neither my wife nor I are fond of gold) but certainly not exotic.

<comment><USER14> That's an unusual material for a ring, I just hope you don't get into the situation where it needs to be cut off. That would put me off using such a hard metal for rings and jewellery chains.

<comment><USER17> First responders actually have a device which cracks tungsten rings (I have one), but they are easier "crack" than cut.

[https://www.youtube.com/watch?v=poM423pewRE](https://www.youtube.com/watch?v=poM423pewRE) \- "the home way"

[https://www.loupe- magnifier.com/tungsten_finger_ring_removal...](https://www.loupe- magnifier.com/tungsten_finger_ring_removal_tool.htm) \- "the professional way"

<comment><USER14> Interesting thank you. I'm still not sure I'd go for one but it's not as bad as I'd thought providing they know what they are dealing with.

</comment></comment></comment></comment></comment><comment><USER18> It's really not the perfect metal for neither bullets or missiles.

Tungsten will strip out any barrel, even normal copper jacketed bullets can strip a barrel after a few 1000's of rounds.

Some calibers are prone to stripping more than others which is why some high end rounds will be covered by a polymer coating that adds lubricity and protects the barrel (it also has the benefit of dampening some inconsistencies in the barrel itself which can improve precision).

Tungsten given enough velocity will go through pretty much anything, this isn't something you want with bullets both because you usually do not want bullets to go beyond their targets and that a bullet needs to be able to dump it's energy into the body to be effective.

Small caliber through and throughs leave much less tissue damage unless hitting a vital organ and even then a larger, slower round that deforms would transfer more energy to the target.

The velocity of the bullet has a hard limit and that is the energy that is stored in the chemical propellant.

As for missiles tungsten is heavy as fuck, it's denser than Uranium and Lead you want your missiles to have as long of a range as possible, be as fast as possible (to be harder to intercept) for that you need them to be as light as possible. If you can make your missiles take on more weight and you've already achieved the desired range and velocity then you better off just putting more stuff that goes boom than an inert metal that does nothing.

Tungsten, just like high carbon steel and depleted uranium is useful for only one thing and that is penetrating armor, in those cases you would optimize your penetrator for that task meaning you'll be using a small narrow profile (basically a dart, or well a flechette) which moves really fast and can compromise heavy armor.

The only real use for tungsten in traditional projectiles it to defeat composite reactive armor that would make shaped charges and other traditional anti armor munitions less or completely in effective.

Even in those cases the tungsten penetrator is more often used to either disable the vehicle by destroying it's engine block, turret controls, suspension and tracks or by compromising the main body armor and then finishing it off with a explosive anti armor around that would also cause crew casualties (in a war of attrition killing the tank crew is often more important than destroying the tank).

It's also important to note that tungsten penetrators are often not made out of pure tungsten since it blunts (relatively) easily, so carbides and other really hard materials would be used to make it even more effective.

Besides that Tungsten might be useful for gravity penetrators basically "bunker busters" although in that case DU and lead might be just as potent unless you are limited by the size of the bomb itself.

Lastly the only other real use of Tungsten is in DIME warheads, these warheads employ inert metal powder as the force delivery mechanism, they fill their effective area with micro-shrapnel that pretty much would tear and liquify all tissue within it's blast radius but due to the high density of the metal and the limited explosive charge have a very small blast radius for intended lethal zone reducing direct collateral damage to zero.

<comment><USER19> >Tungsten will strip out any barrel

I'd guess this can be prevented by using a tungsten core surrounded by a copper jacket, or an exposed tip as in m855a1

Strange that the article didn't mention who was first to field tungsten AP ammunition - it was the Luftwaffe

Edit: I didn't mean to imply m855a1 contains tungsten, rather that a similar design could prevent excessive barrel wear

<comment><USER18> IIRC the A1 actually ditched the tungsten core, it's a "lead free" round not AP, the M855 was supposed to be an "environmental friendly" round the tungsten isn't a penetrator really it's some sort of composite matrix but after studies showed that Tungsten is just as bad an even worse than lead as far as the environment goes they've redesigned the round.

The M855A1 is also lighter than the M855 so if my memory serves me correctly they've switched to a mild steel core.

The M955 does use a tungsten carbide penetrator and is classified as an AP round but the usual "green tip" (or well just "green" ammo now since the A1 doesn't have a tip color) ammo that is in use uses steel penetrators for the most part.

<comment><USER20> Interesting. I had assumed tungsten was environmentally friendly since it is permitted for waterfowl hunting:

[http://www.cabelas.com/product/Non-Toxic-Shot-Buyers- Guide/5...](http://www.cabelas.com/product/Non-Toxic-Shot-Buyers- Guide/532009.uts)

</comment></comment></comment></comment><comment><USER21> Interesting. In the SciFi series (and books) The Expanse the rail gun projectiles were tungsten. I thought it was just due to the heat resistance of tungsten but it might have been chosen by the authors for the additional property of density. I wonder if the electrical properties make it suitable for the mechanisms used for rail gun propulsion.

<comment><USER12> It's almost always chosen for density in scifi- most early railguns used tungsten because the density means you can have a very small cross section per unit mass, meaning low wind resistance which is important at super and hypervelocity. Of course it's irrelevant in space, but it carried over to sci- fi anyway.

</comment></comment><comment><USER22> Tungsten, the song.[1]

 _Tungsten, wolfram, makes the steel so hard._

 _It goes thru the side of an army tank as tho it were a paper card._

 _If you want to rule the world, never mind wrong or right,_

 _All you got to have is tungsten wolframite._

[1] [https://www.youtube.com/watch?v=qbhP6b_2IUE](https://www.youtube.com/watch?v=qbhP6b_2IUE)

<comment><USER23> this video is not available

<comment><USER24> [https://www.vagalume.com.br/malvina- reynolds/tungsten.html](https://www.vagalume.com.br/malvina- reynolds/tungsten.html)</comment></comment></comment>