Video Messages and Telescope on Telegram - <AUTHOR> https://telegram.org/blog/video-messages-and-telescope <comment><USER2> Regular reminder that Telegram's encryption protocol, MTProto, is not secure, and you should not ever rely on it for privacy. Use Signal or WhatsApp instead.

[https://eprint.iacr.org/2015/1177.pdf](https://eprint.iacr.org/2015/1177.pdf)

[http://www.cryptofails.com/post/70546720222/telegrams- crypta...](http://www.cryptofails.com/post/70546720222/telegrams- cryptanalysis-contest)

<comment><USER3> Regular reminder that while CiPHPerCoder might very well be correct about MTProto - technically speaking - I find the recommendation to just use Whatsapp weird.

Haven't we agreed that metadata is data?

Isn't everyone aware that Facebook has stopped charging for WhatsApp?

Has anyone presented a good reason for what their reasons for running WhatsApp for free?

Because I doubt it's because of the goodness of Zuckerbergs heart.

I.e. to spell it out: they find you metadata so valuable they are willing to spend billions (!) to get hold of them.

Now I guess I wouldn't care much if it wasn't for the fact that WhatsApp used to be the fantastic. Nice, user friendly, robust and with a sane and user friendly way to generate income.

<comment><USER4> The question you're asking isn't really about metadata, but rather who has custody if it. Your argument is not that WhatsApp is bad because it generates metadata --- WhatsApp leaks far less data to its provider than Telegram --- but rather than WhatsApp is bad because what metadata it generates goes to Facebook.

That's a fine, coherent argument. There are aspects of Scott's comment I disagree with too --- though I generally think most users are best served by WhatsApp.

If you don't want to use anything operated by Facebook, use Wire. Wire is based on Signal's double-ratchet model. It's encrypted by default. Wire's operators get much less data than Telegram's. Wire is operated out of Europe --- I don't think this matters but many people do.

The important thing is just that you not use Telegram for secure messaging. Telegram is deeply unserious about security. There are much better alternatives. If your friends want to use Telegram to decide which movie to see tonight, fine: I use Slack too, and Slack is probably only marginally more secure than Telegram. But don't use either of them for life-and-death secrets.

<comment><USER3> Yep. Now we are talking.

I readily admit that I don't trust the Telegram crypto. (And in case anyone wonders what that means: I might disagree with tptacek in a lot of things but here I agree. DO NOT use Telegram to send messages that might be dangerous if leaked.)

My point is that Telegram is good enough for what I use it for. It is probably more secure than many peoples email and unlike WhatsApp you can use it without supporting Facebook.

Again: DO NOT trust Telegram with your life. I disagree with tptacek in a number of issues but I trust him when he talks about crypto.

<comment><USER2> I know a lot of LGBT folks who use Telegram for non-serious stuff. Mostly shooting the shit, and using stickers for amusing reactions and whatnot.

My original comment probably should've used a semicolon before "Use Signal or WhatsApp instead."

</comment></comment></comment></comment></comment><comment><USER5> What I thought was more interesting was the ability to send money to Telegram bots. Maybe they are trying to take on WeChat as the "everything" app.

<comment><USER6> Definitely. This is the biggest development of the recent release. They have one of the best bot APIs out there but bot developers have been waiting for this for 2 years.

</comment></comment><comment><USER7> It's amazing how they entered the dense market of messaging apps and with superior UX, native clients and a bit of luck(brazil banning whatsapp for couple of days), they managed to get 100m MAU.

<comment><USER8> Totally. All crypto concerns aside--though I am on the side of the fence that says, while Signal is clearly superior, MTProto still hasn't really been cracked, and WhatsApp's server-side key reset is a bigger deal--the UX for Telegram's mobile (iOS AND Android) and Desktop clients (Windows, Mac, AND Linux) all kick ass. They're blazing fast, sync works phenomenally (except for secure chats, RIP), the ability to share arbitrary files up to 1500 MBs is awesome, Instant View is everything FB Instant Articles should have been, and the (admittedly gray-area copyright) stickers ROCK.

My closest friends/family all use Telegram now because it's just better. When I want truly secure messaging, I use Signal or PGP

</comment></comment><comment><USER9> Telegram is definitely the most feature-rich, customisable messaging app out there.

The stuff you can do with it is amazing. Aside from having a true desktop client not dependant on your phone, I've set it up so that I receive my favourite comics(XKCD, Dilbert) when a new one releases. I can also see and delete my mail through another bot, and I can get sport scores too.

The new instant view also opens up links immediately without loading times(Medium a few other sites only so far, but most major websites are apparently coming with the new update).

It also allows you to quickly go to any date in a chat you've had with someone else(What did you talk about on 2nd June 2015?) and it has a self chat feature which is essentially an unlimited cloud service. Since you can upload files unto 1.5 GB, you can store links, photos, text and files in your self-chat, and have it available on all your devices.

<comment><USER10> May I know how to get xkcd on telegram?

<comment><USER11> I would imagine this would be through a personalised bot that you can create very easily through IFTTT or Zapier.

[https://core.telegram.org/bots](https://core.telegram.org/bots)

</comment></comment></comment><comment><USER12> Awesome update.

By the way, any update on how are they planning to make money? It is still true that they don't plan to make money at all?

<comment><USER9> They've stated that they have enough cash from Durov's funding to last 4-5 years comfortably, and that if they ever need cash, they will introduce non- essential paid features.</comment></comment>


Why Computer Programmers Should Stop Calling Themselves Engineers - <AUTHOR> http://www.theatlantic.com/technology/archive/2015/11/programmers-should-not-call-themselves-engineers/414271/?utm_source=SitePoint&utm_medium=email&utm_campaign=Versioning&single_page=true <comment><USER2> Please check HN search before submitting a story. This is a duplicate many times over:

[https://hn.algolia.com/?query=programmers%20engineers&sort=b...](https://hn.algolia.com/?query=programmers%20engineers&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0)

<comment><AUTHOR> Thanks, I usually do for older materials like this one, but got lazy this time.

<comment><USER3> asdasd

</comment></comment></comment><comment><USER4> I disagree. Engineering is a discipline that has evolved over time. There were plenty of engineering mistakes throughout history as new technologies emerged. As lessons were learned, more structured approaches were devised.

Software, especially in large scale, has been around for a very short time. We're still in the learning phase. The "software engineering" problem is still unresolved: we still don't really know how to be successful at software.

Software projects are still a crap shoot, but we're better at it now than we were 20 years ago. I think when we talk about software engineering, we talk about organizing successful projects. There are many things that were invented to make the process more structured, such as agile planning, rapid delivery, continuous builds, improvements to software architecture practices, improved tooling, etc. People who built cars at the turn of the 20th century usually sucked at it, that didn't necessarily make them charlatans.

I agree that not every computer programmer can be called a software engineer, just as a mechanic is not necessarily a mechanical engineer. This doesn't mean that a new industry is somehow inferior to an established one as far as the evolution of its approach to problem solving goes. We simply haven't figured out how to separate "mechanics" from "engineers" yet, but we are working on it.

Just because this trade is still very young, it doesn't mean that we're not in the process of developing an engineering discipline.

</comment><comment><USER5> I guess I share author's sentiment quite a bit. Personally, I don't call myself an engineer even though I'm legally entitled to. Engineers build bridges and houses and space rockets. I just code some trivial stuff for a company.

When getting my engineering degree I actually felt proud. I even bought a safety helmet and wore it for my thesis defense, as a symbol. But just after getting the degree I came to the conclusion that my friend captured in words as: "If I'm an engineer, then I'm afraid to visit a doctor". That is, our (software) engineering titles were awarded for doing mostly simple shit (programming) any high-schooler could learn in his free time, and enduring academic bureaucracy for 3 years. We didn't feel proud of our skills.

Since then one of the things that fuel my drive to learn and improve in hardware-related skills and natural sciences is the feeling I need to at least learn something to make myself worthy of the title bestowed upon me.

</comment><comment><USER6> I suppose I enjoy arguments about word usage, but at the end of the day, the battle he's fighting is already lost.

Also, anecdotally, I've rarely heard a software engineer call themselves just an "engineer". They usually prefix it with the word software, or use the word developer.

</comment><comment><USER7> I would agree but I would also say that software systems are way way more complex than any other engineered systems. How? Well consider the number of factors that a engineer has to consider while designing the system. These factors could all be accounted _before_ the system design is started and the specific engineering discipline is all about knowledge of these factors and how to handle/control them. On the software systems side, there is no way in the hell that you could consider all the factors that would influence the system let alone come up with strategies to control and handle them. So yes, we should not call ourselves engineers, rather we need some other title which is about handling complexity levels of systems like software.

</comment><comment><USER8> Engineering is usually considered to be concerned with the application of science and math to build systems and solve problems. On a continuum with pure math on one end and applied physics on the other, most things that we think of as engineering fall more toward the applied physics end.

Computer science is much closer to pure math than chemical engineering for example. That said, I think computer engineering is a real thing and just because SV uses engineer as an aspirational title doesn't mean that writing code has nothing in common with engineering.

Software manages all kinds of critical systems from automobiles like the author mentioned, to auto-pilot in airliners, and control systems in power plants.

Maybe one day we'll have a recognized PE designation for pure software engineers too.

<comment><USER9> I think that software engineering is related with practices.

If you are capable (and understand):

+use a build and deployment system,

+use a testing suit/framework whatever,

+a bug-tracking system, a source control,

+good practices of programming (programming styles, pertinent programming patters, etc),

+capable of do good estimations (cost/time/human resources) to tackle a problem,

+you are capable of understand the pros and cons of software architectures (i.e. client-server, distributed, pipelines, multilayered system, etc),

+do metrics and estimations of progress (not only bugs found/corrected but also milestones met)

+and develop a roadmap (for example understand what tasks are blocking, what goals are reachable, what are secondary or skip-able, and what is shippable).

Then you are pretty much a software engineer.

Now this is not structural or civil engineering, and are not comparable. For example given favourable conditions (good foundations, no mayor disasters or other problems) a civil engineer is almost guaranteed to come up with a viable bridge design. But for software the design are not only the sketches, or diagrams, is the code itself, and even with favourable conditions (money, people, time) your software might fail.

Now for me a CS they are more good to do models. They are good to reduce a problem in models that are more close to logic and mathematics and therefore are more apt to be tested and proven. Yet that doesn't mean they could solve a software problem either. They could prove the model, but that doesn't mean that the model is realistic or that the best answer to a specific problem.

</comment></comment><comment><USER10> Next we can expect an article about how giving someone the title "Engineer" can give them some dignity and increase retention rates.

"sanitation engineers" should only refer to themselves as Waste collectors [http://www.thesaurus.com/browse/sanitation+engineer](http://www.thesaurus.com/browse/sanitation+engineer)

A "property engineer" was sent up to my sister in law's hotel room to unclog the toilet after my nephew finished his business there. [http://www.maintenanceresources.com/referencelibrary/ezine/h...](http://www.maintenanceresources.com/referencelibrary/ezine/hoteleng.html)

</comment><comment><USER11> imo the problem stems from reputable authority credentials not keeping up with the rate of change. it's why we have a situation where github is a more reputable authority for what you do than a resume. you could look at this and say the problem is we need to return to the way we used to do things or you can look at this and say we need a new way to credential people. I'm looking at decentralized reputation, set up the new credential system to keep pace with the rate of change.

</comment><comment><USER12> Previous discussion: [https://news.ycombinator.com/item?id=10513499](https://news.ycombinator.com/item?id=10513499)

</comment><comment><USER13> Why does a chemical engineer have more in common with an electrical engineer than a software engineer? The term engineer has been diluted ever since it first referred to people who made weapons for war.

Speaking of which, let's not pretend that everything an engineer makes is magically beneficial to society. Engineers have a hand in creating: low- quality garbage, harmful materials, weapons, sprawl, low-quality buildings, obesity, and on and on and on.

</comment><comment><USER14> [http://thecodelesscode.com/case/154](http://thecodelesscode.com/case/154)

</comment><comment><USER15> very stupid article. An engineer is not what the author wants to be; an engineer is someone that applies maths and science into practical problems.

And the difference in process between a civil engineer and a software engineer is because the nature of them is quite different. A bridge is expensive to change, meanwhile software is designed to change.

</comment><comment><USER16> What about people who drive trains? Are they not allowed to call themselves engineers? They don't build anything.

</comment><comment><USER17> I don't necessarily disagree, I actually make a point to never call myself an engineer, but a programmer.

However, I think the author has an idealized vision of actual engineers. It's not rare to see buildings with mistakes or things that were not properly thought out.

</comment><comment><USER18> I think it's pretty simple: you can call yourself an engineer if you graduated from an engineering program and have a P.Eng otherwise you're not and depending on your jurisdiction you may not be able to legally use the title.

<comment><USER19> That's tossing out an awful lot of people - the vast majority of PEs are in civil or mechanical. It isn't necessary for almost any other field - electrical, chemical, materials...

<comment><USER18> Agreed, addressing the fact that it's a self fulfilling prophecy at this point is a whole other issue. If very few developers are professional engineers, even less new graduates can become one.

</comment></comment></comment><comment><USER20> [https://news.ycombinator.com/item?id=10529613](https://news.ycombinator.com/item?id=10529613)

Stop, please.</comment>


Wisconsin Officials Urge People to Stop Vaping After Sudden Rise in Lung Disease - <AUTHOR> https://gizmodo.com/wisconsin-health-official-urges-people-to-stop-vaping-a-1836921788 <comment><USER3> I sort of hate these articles, because the comments always boil down to three main categories:

1\. I vape and this hasn't happened to me, therefore I'm an expert on public health policy

2\. I vape and because it's better than cigarettes, it's safe on those terms alone

3\. What the hell is wrong with you idiots, safer than cigarettes is not the same as safe

You're either irrationally defensive (1, 2) because you feel attacked, or you're a smug dick (3) that trivializes addiction.

<comment><USER4> Think link is about 11 cases identified (and a cluster of 8, whatever they mean by that).

That would not point to "vaping" being specifically dangerous, but a specific dangerous product batch either vaporizer or fluid causing lung disease. It wouldn't be surprising given the loosely/unregulated status of many of these things and the ease of importing supplies from questionable origins.

<comment><USER5> Some of the liquids causing this particular "pandemic" were obtained on the black market and included THC... May not even really be a case of something slipping by the professional sales of eliquids.

</comment></comment></comment><comment><USER6> Note that the black vape on the right in the photo is very much unlike the other two.

It's a dry herb cannabis vaporizer —- oddly, one of the very few that's a certified medical device. (it's a storz and bickel crafty)

There's a vast difference between concentrate/ejuice/distillate vapes and something like a crafty.

It would be nice if the two categories of vapes could be separated more cleanly when discussing health effects because it would separate a lot of the variables.

<comment><USER7> Agreed but I wouldn't try to infer from a stock photo to the substance of the story. The vast majority of vapes used, especially those by young adults and teens, are not black vapes.

<comment><USER8> It clearly says in the story they had all vaped 'THC', AKA a catch all term these days for dodgy shit.

More than likely, given how this hasn't happened in the rest of the WORLD, they vaped something extremely dodgy that they knew was dodgy.

if you need me to spell this out for you, this has NOTHING to do with vaping and everything to do with dodgy drug dealers.

<comment><USER6> Yeah this smells like "someone bought a street cart". You can buy unfilled 510 carts that claim to be Brass Knuckles or any other major brand, on alibaba, for pennies. Fill it up with whatever you want.

pro tip, don't buy carts unless it's from a dispensary. And even then, flowers nicer :)

</comment></comment></comment></comment><comment><USER9> They likely got a bad batch of THC cartridges, there's a ton of black market ones going around all over, with who knows what in them.

Millions of people use nicotine vaporizers daily with no ill effects.

<comment><USER10> Yeah, a local cluster of ~8-20 cases and the patients say they were using 'THC' cartridges in a state where it's illegal?

People were putting synthetic cannabinoids in e-juice over a decade ago, and I'd be surprised if there wasn't still a market for it. I'd also be surprised if the actual chemicals being used haven't evolved to keep up with regulations - at this point they'd probably be dozens of analogues away from what was presented in the original Huffman papers, huh?

I think it's probably a very bad idea to knowingly use that sort of thing, but I guess the underground market might not have very well-regulated labeling standards.

<comment><USER9> Yes, from own experiences, the cheap carts [dank/mario cart] which are black market only labels use thc analogues while the ones that make it here that _are_ sold in dispensaries are generally legit [rove/tko]

From what I've read about opiate analogues, whatever thc analogues they're using ~15 years after the Huffman paper are far removed from their original state.

I can also confirm there is a tremendous demand for thc carts in non-legal states.

<comment><USER11> Very interesting to see JWH discussed on HN. This stuff was BIGGG about a decade ago, and then I stopped hearing about it. It's crazy to see they are still playing the game of cat and mouse with these analogues, and even getting them into the black market carts.

I have medical so thankfully I don't need to mess with the black market at this point. I would _highly_ advise against using any synthetic cannabinoids.

<comment><USER12> > I would _highly_ advise against using any synthetic cannabinoids.

Any specific reasons to say this? Medical knowledge, personal experience or other?

I did have one experience with a synthetic cannabinoid and it was very bad indeed, took me days to recover. FYI. I'd not rule out trying it again but with great care. Though now it's illegal in the UK, so prob won't happen.

<comment><USER13> I remember there being a number of deaths from some cannabinoids, but after doing some research I can't confirm. This is what I found:

AMB-FUBINACA caused a "zombie outbreak" which sent 33 people to the hospital in Brooklyn: [https://www.nytimes.com/2016/12/14/nyregion/zombielike- state...](https://www.nytimes.com/2016/12/14/nyregion/zombielike-state-was- caused-by-synthetic-marijuana.html)

Anecdotally, AM-2201 seems to cause enlarged liver and other health problems with long-term use: [https://www.erowid.org/experiences/exp.php?ID=95702](https://www.erowid.org/experiences/exp.php?ID=95702)

I remember CP-55,940 and WIN-55,212 having serious side effects but I couldn't find information..

<comment><USER12> Comprehensive answer. I particularly appreciate you made it clear what you couldn't verify, or what was anecdotal. I wish I could upvote it twice for that alone.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> This is what happens when you make the drugs that have been safe for years illegal. People who make marijuana illegal don't care about children - <USER2> would rather have a few die as a moralistic lesson to others than allow anyone to get high. Because they're assholes. Full stop.

</comment><comment><USER15> Is their research on people who have ONLY vaped? Most people who vape are former/current smokers. For me, I vape when not drinking and smoke cigarettes when drinking. This means I smoke about 2-3 packs a month, the rest is vape.

It's harm reduction for me and allows me to still perform at a reasonable cardio level in beer leagues. Now my evidence is shotty, but my lungs "feel" better and I have a noticeable improvement in cardio when I haven't touch a cigarette in a few days and have just been vaping. My ability to stay on the ice (I play hockey) is noticeably better. I don't start getting really tired until the third period, whereas with cigarettes I am dead by the second period.

<comment><USER16> This reasoning seems pretty strange to me. Why not quit entirely?

<comment><USER17> There are often quite a few psychiatric issues that nicotine helps out with. Also, probably a good chunk o population has issues that are just slightly below threshold of what is considered a condition, but niccotine helps them out a lot.

As an ADHD-diagnosed person, to function properly I need some sort of a stimulant. It's really "choose your adventure" kind of a situation - I need either sugar, ritalin or nicotine, and the less I take of one the more I need of another to function properly.

Keep that in mind when you see someone smoking - unless you're 100% sure that they are neurotypical, you don't know if it's addiction or self-medication.

</comment></comment></comment><comment><USER18> 10 people go blind drinking moonshine, Wisconsin officials urge people to stop drinking. Wtf is wrong with them giving this overreaction after a cluster of bad cases of people who smoked "THC" juice.

</comment><comment><USER19> meh. Inhaling a bunch of chemicals was always gonna be a roll of the dice.

Better question is whether it's more dangerous than smokes cause people will want their nicotine fix one way or the other

</comment><comment><USER20> So, I am just trying to understand how it's worse than caffeine.

I vape but I simply don't get how bad it is compared to the normal smog and other impure air we breathe. Nicotine aside,what makes vaping risky? Like are there specific chemical substances? When i starter it I assumed it was nictone,water vapor and flavorings which have no known side effects on the lung.

<comment><USER21> What do the ingredients on your packet say?

<comment><USER9> Vegetable Glycerin, Propylene Glycol, Natural and Artificial Flavorings, Nicotine

<comment><USER22> Natural lung disease flavor.

Seriously, could they be any more vague than "Natural and Artificial flavorings?"

</comment></comment></comment></comment><comment><USER23> Is there a better source than Gizmodo? It's basically a tabloid

<comment><USER24> The very first link in the article is the original source - a press release from Wisconsin's Department of Health: [https://www.dhs.wisconsin.gov/news/releases/080219.htm](https://www.dhs.wisconsin.gov/news/releases/080219.htm)</comment></comment>


Exercise #1: Learning awk Basics - <AUTHOR> http://bashshell.net/stream-filtering-utilities/exercise-1-learning-awk-basics/

<comment><USER2> The post doesn't mention it, but the best source for learning awk is _The Awk Programming Language_ (<http://cm.bell-labs.com/cm/cs/awkbook/>) by Aho, Weinberger, and Kernighan. It's short and to the point, has a good tutorial and reference, and it's even co-written by Brian Kernighan. It's _that_ good. There's also a collection at resources at <http://awk.info/> .

Awk's pattern-structured rules are very powerful, and learning to use them well (rather than writing if statements, etc.) is a big part of using awk idiomatically.

Also, note which awk you're using - awk may actually be nawk ("new awk", the awk that book covers) or GNU awk, which, in typical FSF fashion, has grafted on a whole bunch of extra functionality. (Although the networking stuff is cool.) Things will probably make more sense if you start with nawk, and _then_ explore the sprawling extensions of gawk.

<comment><USER3> Actually, all three authors of that book (not just BWK) are the original authors of awk(1).

<comment><USER2> Correct, didn't think that sounded ambiguous.

</comment></comment></comment><comment><USER4> Awk is one of those tools I didn't know about until 6 months ago, and now I have no idea how I lived without it for so long. If you're manipulating text files, it's just so effortless.

</comment><comment><AUTHOR> This is the first of a 10 days series...

<comment><USER5> Thanks for this I look forward to the rest.

</comment></comment><comment><USER6> I really wish awk were less awkward to type (no pun intended). The single quotes plus the brackets is a brutal combo.

Does anyone know how to achieve the following command in a more type friendly way?:

awk '{print $1}'

<comment><USER7> cut -f1

<comment><USER6> Not working for me...

> echo '1 2 3 4' | awk '{print $1}'

1

> echo '1 2 3 4' | cut -f1

1 2 3 4

<comment><USER8>
       echo '1 2 3 4' | cut -d' ' -f1

By default cut uses TAB as delimiter

<comment><USER9> Not to be picky, but still not good enough:

       echo '1    2     3 4' | cut -d' ' -f2

'cut' fails when fields are separated by multiple spaces.

<comment><USER10> I usually pipe through a whitespace-to-single-tab command. So

      echo '1   2  3 4' | sp2tab | cut -f2

would be equivalent to

      echo '1   2  3 4' | awk '{print $2}'

but quicker to write.</comment></comment></comment></comment></comment></comment>


Ask HN: How do you come up with ideas for a website/product? - <AUTHOR> Many people have said: build something you need. It seems like all my ideas have already been done. <comment><USER2> Websites which irritate you: clue to UX design "do it better"

Websites which are incomplete: market demand proven, "do it better"

Websites off to one side: find your niche

Do one thing, but do it well.

Do one thing, but be comprehensive with pointers onward.

Be responsive to feedback.

Provide a service to people in your niche: finding websites with bad copy? write a simple tool to fix simple copy mistakes and give it away on github but sell the service of doing "moar" but applied to your niche.

Go to conferences, and talk to people in your niche and pick up on _gee I wish that x was done better_ signals

</comment><comment><USER3> Often my ideas have something to do with an inefficiency I've seen, or a nagging problem that doesn't seem to get the attention that it deserves.

Watch lightning in slow motion sometime. Many times before I come up with an idea, my mind is racing and seems to send out branching tendrils through resources, problems, techniques, news, people, previous ideas, etc. Like step- leaders in lightning, many alternate paths and branches are evaluated and activated. As this network expands, a solid connection forms between a problem and a solution, and BANG! An idea forms. Sometimes with many important details baked in.

I focus in on this active path, and debate the merits and ramifications and potential pitfalls. Sometimes this idea is valuable and new. Many of my ideas have nothing that would connect them to anything I've worked on before.

Often these Ideas will get lost if I do not write them down, so I always endeavor to do that. Reading through these old ideas is a good way to re- activate these pathways of invention again and generate new ideas.

</comment><comment><USER4> It's worth noting that if you look at the big tech companies (MSFT, Google, Apple, Facebook, et al) none of them started with a particularly original idea. They just executed far better than the incumbents.

</comment><comment><USER5> I wrote about this a few years ago and you might find it useful [0].

It is really hard to come up with good ideas.

0\. [https://www.tillett.info/2015/08/30/ideas-are-not- cheap/](https://www.tillett.info/2015/08/30/ideas-are-not-cheap/)

</comment><comment><USER6> Along the lines of build something you need, think about your life and the way in which it could be better. Do some research on your ideas, if a product exists then you've found a way to improve your life. If it doesn't exist, you have an idea. Either way, you win.

</comment><comment><USER7> Another way of looking at it is to focus on the process and see the idea as starting point.

Don't be discouraged if there's an existing solution as you are likely to end up in a very different place from where you started.

</comment><comment><USER8> Ideas don't matter much. As you've noted, most have been made many times. Do something you'd enjoy to work on and do it differently. Don't use the same tools for example.

</comment><comment><USER9> _Many people have said: build something you need. It seems like all my ideas have already been done._

For me at least this has been accurate (building something I needed). Tesults, [https://www.tesults.com](https://www.tesults.com), is an automated test results data storage/reporting web application. As a developer I had to implement a custom solution to do this for three different teams across two companies (employers) over a three year period. After the third time I noticed the pattern. I also noticed how we used it everyday, throughout the day in our dev team so it seemed like a fairly good problem to tackle in a general way, not least of all I thought that whatever was created could be used at my next job.

When you say your ideas have already been done are you sure they have been done exactly in the way you're thinking of, or done as well/polished as you would like? With the problem Tesults solves there are open-source and paid software alternatives out there that provides the building blocks to do something similar. Alternatively you could build something yourself like I previously did. Some people would definitely choose one of those two options. However at my job none of these options were great due to missing features we needed and maintenance concerns. As an employee this is was not the main part of my job so it was quite annoying not having something available to just handle this, I didn't want to manage the web app or database and my employer didn't want me to either really. So yes others did have the same general idea but they had not executed as well as I would have liked. It wasn't a slam dunk though, after the initial release it took over a year to get the first couple of paying customers (had several dozens of free ones) but that was because earlier iterations lacked polish and were missing key features (such as logs, screen capture, file uploads). Also I didn't have someone helping with service or marketing before.

I really think execution matters above all else and continuing to iterate is important. Tesults needs continuous work, it's updated every day, usually multiple times and there are years of work in the pipeline to make sure it remains the best way to report results data. If it wasn't for my seeing the problem in the wild as an employee I would never have done it, the idea would never have occurred to me sitting at home, I needed to have worked in the domain and I needed to be a domain expert. I think if you are a younger person you can perhaps think of cool stuff for you and your friends (b2c) but I'm an older person now with thoughts dominated by business issues and around being more productive. That and diapers (not my own).</comment>


Daily Stormer Founder Should Pay 'Troll Storm' Victim $14M, Judge Says - <AUTHOR> https://www.nytimes.com/2019/07/16/us/daily-stormer-lawsuit.html <comment><USER2> Good.

He should go to jail too.

<comment><USER3> It's unlikely he'll pay the fine or be brought to justice if they can't find him, but more importantly it will certainly give other such people pause when they think they can do this sort of thing with impunity.

<comment><USER4> It is not even known if Anglin is real and not somebody coming under a pseudonym</comment></comment></comment>


Package verification using gpg (2015) - <AUTHOR> https://github.com/npm/npm/pull/4016 <comment><USER2> Haha 'othiym23 must be the most-downvoted person on GitHub. He is constantly rejecting reasonable patches that make big improvements, because NIH. FOSS, you're doing it wrong.

It seems possible that npm having been burning all their development cycles on their new "community", which will allow them to reject patches and black-hole the record of that rejection. TFA was "archived" yesterday, so the voting has stopped, but it ain't a pretty picture. It will be so convenient when the next major vuln comes up, people say "why didn't you accept that PR?" and 'othiym23 will say "what PR?" If you're not going to fix your shit, why not spend some time building a GitHub clone so you can pretend that your shit is perfect? They are inspired by Ballmer-era M$...</comment>


Ask HN: What startups use Express.js or Node.js for their primary product? - <AUTHOR> It seems a lot of companies use it for side products only on a smaller scale. <comment><USER2> I'm lead dev at Tesults.com and we use this stack. Are you asking about VC backed up companies however? Tesults is bootstrapped and not massive yet so may be there is a reason it's not used more widely which means I'll discover why and have to deal with it soon :-) Although I hadn't heard it's only used for smaller scale projects, is this anecdotal or is there data?

</comment><comment><USER3> Interested in the answer too

EDIT: I actually use node for my primary product which is a mmo game but it's too soon to consider the organization as a start up.</comment>


The source of the e1000e corruption bug (2008) - <AUTHOR> https://lwn.net/Articles/304105/ <comment><USER2> > _But the other one was just as important: the e1000e driver should never > have left its hardware configured in a mode where a single stray write could > turn it into a brick._

... because, like, it's totally _okay_ for the hardware to be bricked by a single stray write?

Make like Microsoft and blame the driver. :)

It should be a basic manufacturing test to repeatedly write pseudo-random garbage to the entire I/O register space, and check that the hardware never gets into a state that is not recoverable by either a simple power cycle, or, failing that, a factory reset.

<comment><USER3> A long time ago in college I was in a silly play (as an actor) and also helping build a robot for the performance: I did the software, and a friend of mine did the hardware (and notably, he was like "a god of hardware"). One day, the robot _caught on fire_... like smoke seriously started coming out of it and we had to quickly turn it off and the logic board was charred.

My friend, whom of course knew his hardware was _perfect_ , immediately looked at me and was all "what did you do?!" and I was super confused as all I had done was written some code to let us control it remotely with a game controller. We go through my code, and he finds a place where I set two variables to true at the same time, and he explains to me that by doing that I shorted the robot's power transformer and made it catch on fire... :/.

What I am mostly known for these days is working on "jailbreaking" of iOS and Android devices. I can tell you that many early Android devices were easily bricked by just flashing a bad restore image from restore mode after having flashed a bad normal image. iOS is super resilient, and we have only very seldom managed to truly brick a device... one story, though, is quite topical: pod2g was demonstrating a new fuzzer he had written to do just what you describe to one of the NAND controllers to look for exploitable bugs... but on stage during the demo it managed to find just the right sequence of register changes to brick his demo device ;P.

Honestly, given the mental model of most hardware developers and how much trust is put in drivers, I'd just be glad that the e1000e merely bricked itself instead of burning your entire house down ;P.

<comment><USER4> Driving all FETs in an H-bridge with a microcontroller to save parts costs.

 _pop_ _smoke_

Didn't save part costs.

<comment><USER5> You jest, but there's truth here: it's disingenuous (as I suspect the GP knows) for GP's friend to claim that the hardware is perfect when in fact it's missing a simple protection against software bugs causing it to catch fire.

<comment><USER6> If I had a dollar for every time a silicon or analog designer said "well don't do that" when I identify a combination of register writes that will damage the hardware...

</comment></comment></comment></comment></comment><comment><USER7> Whew, kernel bugs due to complexities of live patching code! ([https://nickdesaulniers.github.io/blog/2020/04/06/off-by- two...](https://nickdesaulniers.github.io/blog/2020/04/06/off-by-two/)) high fives...anyone...anyone...?

<comment><USER8> Oh my, that last bit from Linus there. Been there done that, on a modern system!

So I was making Linux run on a PlayStation3 booting from an exploit, so that we could have full access to the hardware/GPU (not the locked down PS3 Linux support that it came with, and had since been retroactively removed in an update). This is running on top of a built-in hypervisor, on a PowerPC CPU.

I had to debug early bring-up code of the Linux bootloader I was writing from scratch (AsbestOS), and at that point you don't have any real hardware access. There is an internal serial port but it's not accessible to VMs, graphics is way too hard to bring up, USB is also a pain. No usable LEDs too. So what is there? Panic. The hypervisor panic hypercall had an argument with two modes: you could either reboot, or shut down with a beep. So that was my boolean output primitive, which at one point I used to "print" out an address, bit by bit, during debugging the assembler bringup code.

[https://github.com/marcan/asbestos/blob/master/stage2/start....](https://github.com/marcan/asbestos/blob/master/stage2/start.S#L81)

Once I got into C and I could start writing more interesting code, I eventually graduated from panic/reboot to using Ethernet. The Ethernet device was virtualized to some extent. You still had to write DMA descriptors to get packets out, but you didn't have to worry about low-level hardware init. So I stuffed some hand-crafted broadcast UDP packets in there, and the descriptors to blast them out, and called the "start transmit" Ethernet device hypercalls to get printf-over-UDP working. Fun thing is the PS3 has a built-in Ethernet switch with VLANs, so you needed to stuff VLAN tags into the packets if you wanted them to make it out of the Ethernet port. Until the PS3 slim, when they got rid of that switch, and then you no longer needed tags. Fun.

[https://github.com/marcan/asbestos/blob/master/stage2/debug....](https://github.com/marcan/asbestos/blob/master/stage2/debug.c)

I used this same UDP-over-LV1-hv-ethernet debugging tool to debug early kernel startup too, after the bootloader hands off, since we had to revamp chunks of the Linux on PS3 early memory startup code (as the memory config while booting in "Game" mode was very different from the formerly officially supported "Other OS" mode) way before graphics was up. This code was eventually upstreamed:

[https://github.com/torvalds/linux/blob/master/arch/powerpc/p...](https://github.com/torvalds/linux/blob/master/arch/powerpc/platforms/ps3/gelic_udbg.c)

By comparison, when I was doing (unofficial) Linux on PS4 we had the luxury of running on bare metal, and there were testpoints for a serial port on the motherboard, so we could just poke data out of there with some trivial UART code, and use the existing Linux earlycon support for the same after handoff (though the baud rate multiplier was wrong... and also, bizarrely enough, it's an "XScale" ARM variant 8250 port because the PS4's southbridge is a repurposed Marvell ARM SoC with a PCIe bridge to the x86!).

<comment><USER7> Wow! That's a great read, you should post a copy to your blog.

I remember running yellow dog Linux on my PS3 (as a kid) but didn't know the GPU was inaccessible.

For the hypervisor, did you have to do any kind of RAM training?

Are folks running Linux on PS4's these days? I haven't been keeping up to much with the system exploit scene (had exploited Xbox 360, PSP) other than the excellent YouTube channel "modern vintage gamer."

</comment></comment></comment><comment><USER9> This sounds familiar. Around 2002 I bricked a Pentium motherboard while probing the SPI address space looking for the fan and temperature sensors.

<comment><USER10> I bricked an expensive high end motherboard by ignoring the "Win98 or later" requirement listed on the box and trying to install Win95.

Actually, two of them...when the first one bricked I assumed that it had just been defective, so tried again on the second one we had.

It turned out that something in the Win95 device scan happened to trigger a BIOS flashing, what flashed garbage into the BIOS.

I really hate old buses where there is no mandatory and standard form of device ID, so the only ways a driver can find its device are (1) ask the user, or (2) read and write registers at likely addresses looking for ones that respond the same way its device would hoping that at addresses where the is something that is not your device your commands don't accidentally make what is there do something terrible.

</comment></comment><comment><USER11> I really respect Jonathan Corbet's writing skills. The article was clear, informative, and engaging.

</comment><comment><USER12> Oh the memories...this was something similar, but just an innocent RESET ATA command.

[https://www.zdnet.com/article/mandrake-linux-9-2-kills- some-...](https://www.zdnet.com/article/mandrake-linux-9-2-kills-some-cd-rom- drives/)

</comment><comment><USER13> Love the understatement: "As a general rule, bricking the hardware is a level of overhead which goes well beyond the acceptable parameters."

</comment><comment><USER14> > As it happens, doing nothing is a highly optimized operation</comment>


Show HN: Repository of open source space-related software and hardware - <AUTHOR> https://github.com/orbitalindex/awesome-space <comment><USER2> Some really cool stuff in here!

This looks like you could build some fun visualisations with it: [http://www.openexoplanetcatalogue.com/](http://www.openexoplanetcatalogue.com/)

<comment><AUTHOR> Thanks! Just added it.

</comment></comment><comment><USER3> Really cool. Not complaining, but I'd like to see someone create a pretty standard Hugo template for these types of repos, with fuse.js implemented. What this allows if for client-side searching and individual pages explaining what some of these are and do, with screenshots or embedded YouTube videos. It also integrates nicely into GitLab Pages.

</comment><comment><USER4> [http://ascl.net/](http://ascl.net/) is a nice one, since 1999.

<comment><AUTHOR> Oh excellent. I just added it.</comment></comment>


Patagonia donating 100% of Black Friday sales to environment organizations - <AUTHOR> https://www.patagonia.com/100-percent-for-the-planet.html <comment><USER2> Maybe they're feeling guilty for creating mostly polyester-based clothing that pollutes our oceans with microfiber plastic.

<comment><USER3> Is this a criticism of Patagonia in particular? They've done a lot to be environmentally aware. They've been using recycled polyester in their clothing for years. I also doubt that Patagonia-produced polyester clothing contributes even 0.01% of the polyester refuse in the ocean.

If you have specific criticisms of Patagonia, I would be very interested to learn more about them. Please share.

<comment><USER4> They commissioned this study. They also pioneered the use of polyester in outdoor clothing...

[http://brenmicroplastics.weebly.com/project- findings.html](http://brenmicroplastics.weebly.com/project-findings.html)

Has been reported in a few places... [https://www.theguardian.com/environment/2016/jun/20/microfib...](https://www.theguardian.com/environment/2016/jun/20/microfibers- plastic-pollution-oceans-patagonia-synthetic-clothes-microbeads) [http://www.outsideonline.com/2131886/its-time-retire-your- ol...](http://www.outsideonline.com/2131886/its-time-retire-your-old-unsafe- avalanche-beacon)

<comment><USER3> Thanks for the links. Why create a throwaway account to post them?

<comment><USER4> It's not a throwaway :)

Only an occasional reader, first time I've wanted to reply to something.

</comment></comment></comment></comment></comment><comment><USER5> This is rather disingenuously worded. It's NET sales aka profit, which is rather a bit different from the _gross_ sales you would assume from reading the giant headline.

<comment><USER6> Giving up NET profit for a single day is still huge.

That being said, the hyperbole doesn't bother me. Voting with your wallet is the single most important thing an individual can do (akin to reverse Citizens United). Giving consumers this clear cut prospective is an important function of that model (rather than crossing my fingers and hoping they don't invest those net profits in a sweatshop). My hope is that more business will follow suit.

<comment><USER7> Voting with your wallet is something, but it's certainly not fair, so not necessarily the "single most important thing an individual can do". Why? The votes (money) aren't evenly distributed.

<comment><USER8> Fairness and importance are orthogonal. The fact that money is unevenly distributed says nothing about whether spending money in ways that influence certain social changes is the "most important thing".

It's not fair that the I was born into a wealthy nation while some are born into impoverished war zones. Nonetheless it seems important that my money be put to good use.</comment></comment></comment></comment>


Ask HN: Is Your Google Analytics Down? - <AUTHOR> I'm getting 500 error from Google Analytics. Anyone else experiencing this right now? <comment><USER2> Yes. I'm also having issues with Google Optimize.</comment>


Our Dental Insurance Sent Us "Free" Internet-Connected Toothbrushes - <AUTHOR> https://wolfstreet.com/2018/04/14/our-dental-insurance-sent-us-free-internet-connected-toothbrushes-and-this-is-what-happened-next/ <comment><USER2> I read this article a few times, but I don't see any quotes of actual communication from either the dental insurance or the toothbrush company. If the second box contained a letter with the purported message, why not post it? If the author received warnings about being in violation of the "free" deal, why not post them? It's hard to tell here what has actually been said by the insurance or toothbrush vendor vs inferred by the author.

<comment><USER3> As the business in these cases usually takes place in a form of lie of omission, that _slightly_ bigger amount of data that is collected than promised, that slight adrenaline kick which free IoT toothbrushes were supposed to give OP that should have shut out all doubt about the situation.

And if anything _could_ proof excess data collection or whatever violation of privacy or human reason, it wouldn't be found in the carefully curated communication by any of the companies involved, but the source code that comprises the software running this thing.

<comment><USER4> I think the point is though, that a major premis of the article was "you must use these brushes and give us your dats OR ELSE", but it was entirely unsubstaniated.

<comment><USER3> What's it called when you look for a general wisdom in an everyday situation? ethics? That's all I see myself pointed to in the article.

Would we accept "OR ELSE" as a society? Should we? What laws does our government come up with so we can make sure "OR ELSE" doesn't happen past the certain extent it already does? Can we attach a metric for how much "OR ELSE" is too much?

<comment><USER4> But the article doesnt put forward that the 'OR ELSE' case actually exists. The author just hypothesis it (which is relevant itself!) and goes from there, without providing any sort of hint of evidence.

</comment></comment></comment></comment></comment><comment><USER5> Your toothbrush certainly does not need an app. But what's the game, I wonder, for the dental insurance company? I mean, _why_ do they want your data? Aggregate data on habits? The chance to shape behavior (better habits) of customers through nags, gamification, etc? Eventually rates tied to compliance? Advertising opps?

<comment><USER6> I would imagine the insurance company wants all of things you speculated on. Insurances companies would love to know which statistical bucket you fall into, so they can charge you more or less based on your risk of making a claim.

<comment><USER7> "According to our records your purchases of junk food have increased 16.2% since the previous calendar year. Your insurance premiums have been adjusted accordingly."

This is some Black Mirror level garbage. If this becomes common place there'll be an explosion of automation devices to "use" your toothbrush a couple of times per day.

<comment><USER8> We should be so lucky that our data would be used to encourage healthy living as opposed to to status quo.

<comment><USER9> Except when this would drive negative feedback loops. The following scenario may not be frequent or probable, but it is definitely plausible:

1\. A rural area has few healthy eating options.

2\. Everyone who cares about this sort of thing and has the means to move away leaves.

3\. Healthy stores close because there are not enough customers.

4\. Only junk food options remain. Now you've essentially increased societal segregation...

This may sound ridiculous, but it is already seriously hard to eat healthy in many areas of the country.

<comment><USER10> That's actually a _positive_ feedback loop.

<comment><USER9> You are right! I meant positive feedback driving a negative phenomenon.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'd be more inclined to fall in line with their data collection practices if dental insurance wasn't so utterly useless as an insurance product.

It almost always makes sense to save the premium payments up and pay out of pocket for any dental services you need.

<comment><USER12> It primarily makes sense as a benefit to employees because they don't generally get taxed on it. But because it's much closer to pre-paying than actual insurance I'm guessing it doesn't usually make sense for individuals to buy it.

ADDED: Interesting. It doesn't seem to be that expensive for an individual to purchase. (Maybe $400 or so.) I guess the theory is that most people just end up getting a cleaning or two and caps on policies reduce the amount you can get paid back.

<comment><USER13> In my experience, it's worth it if you can get it at a good price e.g. through a good employee benefit plan. Especially for a family with a couple of kids, think about paying out-of-pocket for 8 to 10 cleanings a year, plus cavities, the occasional broken tooth, etc. Regular dental care is actually pretty important, as untreated tooth decay can cause a number of other health problems.

<comment><USER12> Through an employer plan, it's usually pretty much a no brainer. I'm admittedly a bit older but I get far more out of my dental plan every year than I have to contribute through the occasional crown, etc.

</comment></comment></comment></comment><comment><USER14> I have the same insurance/tooth brushes. The thing that got me was they sent one of these for my 2 year old. Same thing as for me and my wife... they know how old the kids are ( 2, 5 and 6 ).. you think they'd "think of the children"...

</comment><comment><USER15> This is a great counterpoint to Google's insistence that there doesn't need to be a discrete "Internet access" permission in Android.

Their position is that if apps are all well-siloed then it doesn't matter if they chat to the Cloud because they can't leak data to which you have denied them access ( contacts, photos etc )

But that's only true for on-device data; here's an app that's relaying data from a Bluetooth source. Data which the user would prefer it didn't send to the Cloud. But without rooting there's no way to stop it doing so.

Please Google, give us the ability to block Internet access.

</comment><comment><USER16> This guy doesn't understand the difference between free 'you're the product' products and free-included-with-the-product, which is actually just the cost included with the product you bought, in this case insurance. The language he uses makes it seem as though it's OF COURSE going to be in the first category, even though it's an extra with his insurance.

If they included a not-smart electric touthbrush, would he also use 'free' in a suspicious way? No, because there wouldn't be an article because it would just be part of the insurers marketing.

Kind of annoyed me.

</comment><comment><USER17> And that is the number one selling feature of OneStar for car manufacturers in the US (where leases are the top way to "sell" cars)

<comment><USER18> Free toothbrushes? I'm not sure I understand the point you are trying to make.

<comment><USER19> I think they are talking about OnStar, the GM product that provides in person concierge service in additional to vehicle maintenance information and crash reporting. The connection to leasing they are trying to make is likely to say, by installing OnStar they can monitor how the user drives the car. However, the math behind leasing and payments etc is known upfront. When you return the car, they don't just say "Well you owe us an extra $10,000 because you accelerate hard."

</comment></comment></comment><comment><USER20> Maybe I missed something in the article, but how do you know the phone app is transmitting data to the insurance company?

<comment><USER21> I don't think you have to be very cynical to assume that's what's going on. It might not be happening now, but once the adoption rate is sufficient there's going to be a small update to the license, and the insurer will know enough to set your rates exactly right.

</comment></comment><comment><USER22> Surprised to find an ad at the end of this article.

It also uses Google Analytics.

What was all that about spying on your users, again?</comment>


Show HN: The Organizer for Freelancers and Creatives - <AUTHOR> https://freeter.io <comment><USER2> Here's (hopefully constructive) feedback after few minutes of using:

The file explorer is not useful as it only supports opening files. Maybe it is not necessary to support renaming, deleting and moving, but at very least I should be able to open folder in system browser to continue my work there. I know I can add this shortcut to Actions, but it makes sense to integrate this to File Explorer.

Contact list (and action list) should display item names. This might be an option, but when you have 15+ contacts, icons and colors will no longer be helpful.

UI feels generic. For all categories (toolkits, commands, webpages, contacts, actions) you go through same interface - manage category, add new item, fill in fields. It seems kind of bland and not adapted to specific needs. I've seen similar problem with CMSs that try to be everything for everyone.

I would like to have a box where I can glance at status of project, displaying progress on individual tasks. I understand that you have browser view so people can use whatever they want, but some sort of managed TODO list should perhaps be included.

It would be nice to include demo project where everything is set up. Then I could click around and get a feel for features.

On positive side, the user manual is superb. The software is easy to use and I can see it becoming very useful.

<comment><AUTHOR> Wow! Thank you for such a great feedback! I really appreciate it.

> I should be able to open folder in system browser to continue my work there

That's already on the to-do list. I'm planning to add "right-click" menus. For the file explorer there will be a menu item enabling to open a selected file/folder in the system browser. Will play with it and then think about adding the copy/move/rename/delete operations. I also had an idea of adding interactions between File Explorer instances, but not sure if that will have any value yet.

> Contact list (and action list) should display item names

Yeah, I agree with that. One of my projects already has about 10 actions and it definitely would be easier to find the right one if all their names were shown at once. Added to the to-do.

> UI feels generic

I will check what can be improved there.

> a box where I can glance at status of project, displaying progress on > individual tasks

Can you give some more details on how it should work to be a good fit for you? Something like a simple personal task manager?

> It would be nice to include demo project

Got it. Sounds cool. Will add a demo in the next versions.

> the user manual is superb. The software is easy to use and I can see it > becoming very useful.

Glad to hear you like it! Thank you! More improvements and features coming.

Cheers

</comment></comment><comment><USER3> That looks useful. If you can help cut down on the task-switching pain involved in setup and moving from one project to another, I know I would be grateful - and more productive. I'll try it when the Linux version comes out. Thanks for hopping on my radar. :-)

<comment><AUTHOR> Thank you! I already saved myself from the project-switching pain. Hope it will help you too when the Linux version will be ready. No specific dates yet, but it's on my to-do list :) Will try to release it on May.

</comment></comment><comment><USER4> It looks nice, but I wish the landing page was a bit more descriptive about _how_ it helps me switch between projects. The screenshot is pretty, but not really that clear without the context of _how_?

<comment><AUTHOR> Thank you for the feedback! Will improve the landing page. As of now, could you take a look at [https://freeter.io/user-guide](https://freeter.io/user- guide) if that makes things clearer.

</comment></comment><comment><USER5> Getting a JavaScript error with latest Chrome when I click "Buy"...

<comment><USER6> Yes, on firefox also.

This must be hurting their business pretty bad...

Hope owner receives some alerts whenever client-side errors happens...

<comment><AUTHOR> Just tested it on both Chrome and FF, couldn't reproduce it. Does a spinner appear when you click the buy button? Can you paste the error from the browser console? Thank you.

<comment><USER4> It appears the error is only shown when I have my ad blocker enabled. I use uBlock origin. Hope that helps :)

<comment><AUTHOR> Thank you! That definitely helped! It's a bug on FastSpring side. Sent them a note.

</comment></comment></comment></comment></comment><comment><USER7> Is it support for asana? and Wait for MAC release.. But Some of here people need the explaination about pricing terms

</comment><comment><USER8> I wonder, if using something like QT Toolkit, we would already had a Linux/OSX version?

Maybe the author can give us some technical background of the application.

<comment><AUTHOR> There will not be a huge problem with building a Linux/OSX version. It's built on top of Atom Electron which enables to create apps for Win/OSX/Linux. Just need to fine-tune os-specific things, docs, setup a certificate and app- signing for osx. Will try to release on May.

</comment></comment><comment><USER9> By creatives, does it mean exclusively web designers? I'm not sure I get the purpose of the software if it is not the case.

<comment><AUTHOR> Creative was the closest term I could find for those who create things such as sites, mobile/desktop apps, games, etc. I have lots of routines while I switch between and work on projects: open project files with different editors, execute command-lines, check task manager. All these things I can access with Ctrl+Shift+F and execute with a single click. That saves me a ton of time and effort. I'm not a web designer, I make web/desktop apps :)

</comment></comment><comment><USER10> Hi there, it's unclear as to whether pricing is one-time or reoccurring.. just fyi !

<comment><AUTHOR> Thank you for letting me know! I've just published an update, the buy page now clarifies that kind of things.

</comment></comment><comment><USER11> Is it an IDE ? Can you provide a YouTube demo ?

<comment><AUTHOR> Please try that one: [https://freeter.io/user-guide](https://freeter.io/user- guide) There are some screencasts showing the app.

</comment></comment><comment><USER12> What is it?</comment>


UN says 10 year window to act on global warming, 3 degree warming inevitable - <AUTHOR> https://www.apnews.com/bd45c372caf118ec99964ea547880cd0 <comment><AUTHOR> I thought adding some news from 30 years ago to the discussion might be interesting.

</comment><comment><USER2> This is amazing. They even have the 10-year prediction, which is very close to the 12-year prediction we hear politicians touting now.</comment>


The trade in fraudulently obtained airline tickets - <AUTHOR> https://link.springer.com/article/10.1007/s10611-018-9777-8 <comment><USER2> I once had some fraudulent charges made on a credit card I own. I was initially tipped off because a limo company sent a confirmation text to let me know they would be picking me up in Texas (I was in California). Interestingly, the text included an order number. I was able to use the order number to access the reservation holders personal info through their website. The personal info included a full name and the flight number of the flight they were taking, pick up address etc.

I was able to find the person, their place of work online based on the pick up location, which was their office.

I then realized that my credit card was also charged for a flight to SF. I used that info to call the airline and cancel the flight and cancel the limo after they had already checked-in. I was proud of myself, thinking that I taught this person a lesson. Now in hindsight, this person probably had no idea and that someone middle man was probably profiting off of the sale.

<comment><USER3> I don't understand why everyone doesn't have alerts for cc transactions greater than $0.01. You find out immediately when fraudulent transactions occur.

<comment><USER4> Excessive false positives. If your phone chimes after every store visit you will learn to ignore banking notification SMS/email, including actually suspicious transactions.

<comment><USER5> When done right (with chip&pin cards and notifying when the hold is placed not on final settlement), the notification is instant (as in, usually before the terminal even shows the transaction as approved, but sometimes a few seconds later).

If the phone chimes when you're paying, you'll rightfully ignore it. If the phone chimes at any other time, you'll check.

</comment></comment></comment></comment><comment><USER6> Brian Krebs has written a number of pieces on travel fraud.

[https://krebsonsecurity.com/2014/11/thieves-cash-out- rewards...](https://krebsonsecurity.com/2014/11/thieves-cash-out-rewards- points-accounts/)

[https://krebsonsecurity.com/2012/01/flying-the-fraudster- ski...](https://krebsonsecurity.com/2012/01/flying-the-fraudster-skies/)

>"The story is simple," Jeferi explained in a discussion thread that spans five pages and includes questions from dozens of skeptical and interested members. "The thing is, you are thinking as a criminal. Think about yourself as a victim of an online scam. You saw an advertisement of a "Travel Agency" in the Internet, and it seemed interesting. So you contacted them through a forum and finally arranged a deal. The travel agency told you that the tickets were last-hour tickets and that they were affiliate with the airlines, so they could offer these kinds of prices, and you thought they were legit. OMG! I never thought it was going to be a scam! Bastards!"

<comment><USER4> Most scams rely upon psychological weakness in the victim. People aren't stupid but when they're in the grip of fear or greed they are more likely to lose money. If it seems too good to be true, it's probably a scam, stolen goods, poor quality good/service, etc.

</comment></comment><comment><USER7> A few airlines will send collection agencies after whoever used the ticket to discourage ticket carding, pretty sure this scam isn't as lucrative as it used to be in mid 2000s during the card fraud heydey despite article claims.

<comment><USER8> Also, some Airlines (esp in Asia) will require the credit card at check-in. That way there's no way to use another person's credit card and fly on that ticket.

<comment><USER3> Yeah, learned the hard way that it's not a good idea to use a virtual cc# for airline tickets.

</comment></comment></comment><comment><USER9> May I ask why is this considered research worthy a scientific article? Serious question, not trying to downplay anyone's work, but it's just weird to read on springer something that looks and reads like a magazine feature

<comment><USER10> Criminology is a serious academic discipline. An acquaintance of mine has a PhD in it.

<comment><USER9> I'm not dissing criminology, I was just dubious about the specific scientifical value of this analysis.

</comment></comment></comment><comment><USER11> The TSA should be cracking down on this not hassling innocent passengers at the airport

<comment><USER12> With the exception of the Federal Air Marshal Service, the TSA is not a law enforcement agency and has no investigatory powers. This is a job for the FBI.</comment></comment>


Twitter Tells Facial Recognition Trailblazer to Stop Using Site's Photos - <AUTHOR> https://www.nytimes.com/2020/01/22/technology/clearview-ai-twitter-letter.html <comment><USER2> >"Widespread use of your technology could facilitate dangerous behavior and could effectively destroy individuals' ability to go about their daily lives anonymously," Mr. Markey wrote.

While this is true, there are many other technologies and companies that enable this, so just going after part of this company alone will do little to improve the issue.</comment>


Ask HN: matrix multiplication within PHP? - <AUTHOR>

I am implementing a PHP-based web site that includes a simple recommender system.  The key numerical calculation is a matrix multiplication.  I am worried that doing this in PHP might be painfully slow.  Does anyone else have experience doing numerical computations in PHP?  I looked at writing my own PHP extension ( http://www.tuxradar.com/practicalphp/20/0/0 ) to implement matrix computations in C, ... but then it struck me someone else must have already encountered and solved this problem.<p>Any recommendations? <comment><USER2> From my experience, numerical algorithms at all complicated in PHP tend to lead to major suckage. We use Thrift (<http://incubator.apache.org/thrift/>) to send the task to a daemon written in something more reasonable, most often either Python or C depending on required intensity. Works beautifully, few problems. Also, this lets you run the task asynchronously, so you can still return the page in N ms and then load the results on a lag: responsivity means a huge amount to users. Nothing's worse than the script dying from memory limits or timeouts and having the user get nothing (and PHP doesn't do threading).

<comment><AUTHOR> Thanks, I appreciate the link to Thrift. ... and I agree on the responsivity comment. I guess I'll look into setting up a daemon to my math in the background.

</comment></comment><comment><USER3> If I were doing this, first I would profile the code. It is hard to know if it is significant or not.

<comment><AUTHOR> Actually for small enough matrices (as you might imagine) the matrix multiplication in PHP is not horribly slow.

</comment></comment><comment><USER4> If it turns out to really be slow and you want to/have to stick with PHP, you could speed it up with the Strassen algorithm: <http://en.wikipedia.org/wiki/Strassen_algorithm></comment>


A Dutchman and his man-made mountain - <AUTHOR> https://cyclingtips.com/2020/05/a-dutchman-and-his-man-made-mountain/ <comment><USER2> "It had become more of an innovation platform than a building project; it was used by scientists and universities to think outside the box."

OK, I love whimsy and spitballing of wild ideas as much as the next person, but... innovation platform? Did anything actually come out of this? New ideas that have been put into use? Research that changed how we understand things? A focal point for education of the public, even?

I love the idea, but I see nothing in this article that backs the spirit of the claim "a meeting of minds that sparked a new wave of innovation in the Netherlands".

Design is cheap. And this appears to have never gotten out of the early CAD & Photoshop phase.

It's fine to just say "it was a wild idea and we had a lot of fun thinking about it".

<comment><USER3> The piramides must have been a very strange idea from the start. Transporting larger than life stones to build an abstract geometric monument.

Im glad they did because it speaks to imagination to build the impossible.

Imagine a mountain as high as the Alpes still standing there in 10.000 years.

I also think the first people to build dikes where seen as a bit strange. You are well aware that industry has made the dutch engineering name in the world.

<comment><USER2> OK, but... they _didn 't_ build the mountain. It's only the existence of the pyramids that inspires. We don't have any records of the amazing, inspiring, innovative plans to build the pyramids—or at least, if we do, they sure don't have cultural currency.

</comment></comment></comment><comment><USER4> I believe everybody knew there was not going to be a mountain. But people are curious creatures. The main question became: can it be done?

It is interesting a lot of money was put into the project while most people knew there would never be a mountain. But they learned so much from it. So I think you can't say it was a waste of time and money.

But for the coming years I still believe the Netherlands (lower countries) will remain flat.

<comment><USER5> They made a ski-hill in saskatchewan, which is definitely as flat as the netherlands.

<comment><USER6> There seem to be two artificial ski hills there, both quite small in comparison to this proposal, Timber Ridge and Blackstrap Ski Hill (closed), but also quite a few non-flat natural ski areas [1]. I think they have better building materials available than the Netherlands, though, which was proposing to use sand (dredged from the sea floor?).

[1] [https://www.skicentral.com/saskatchewan.html](https://www.skicentral.com/saskatchewan.html)</comment></comment></comment>


Australian government promises national space agency - <AUTHOR> http://www.zdnet.com/article/australian-government-commits-to-establishing-national-space-agency/#ftag=RSSbaffb68 <comment><USER2> I guess the 'ideas boom' didn't work out. This is simply floundering by an inept government. Some CSIRO researchers will get grants and it'll go nowhere.

</comment><comment><USER3> Step 1 should be eliminate the extremely onerous insurance requirements. Launching a cubesat shouldn't require a 750 million dollar insurance policy.

</comment><comment><USER4> Yep. Why build stuff when one can resell real estate.

</comment><comment><USER5> "Space 2.0 startups", dear god...

Are we going to have to hear space buzzwords now?</comment>


Ask HN: What am I missing about the protests? - <AUTHOR> English is not my first language, honestly I am trying to understand here.
I am confused why there are racial justice protests over George Floyd. Please hear me out.
yes his death was wrongful, and yes he was black, but I don't see anything that implies these factors were connected.
The officer did not have a history of racism.
In fact, it seems like a statistical certainty that these two factors would eventually collide and it would be caught on video.
So really I am starting to feel like I'm missing something - that this event is just confirmation bias on a massive scale combined with other external factors (virus masks, economic unrest).
I post this here because we are logical people and this is where I am with my logic right now, and I'd love to have my mind changed because I'm feeling crazy that I don't get it. <comment><USER2> Firstly, this is n=1, but many previous times something like this happened, the victim was black, too.

Also, "the officer didn't have a history of racism" is debatable. [https://apnews.com/69beaad97dcea2dce6c2184e0f5b5e4e](https://apnews.com/69beaad97dcea2dce6c2184e0f5b5e4e): "What she is certain of is how aggressive Officer Derek Chauvin became when the club hosted events that drew a mainly black clientele, responding to fights by taking out his mace and spraying the crowd, a tactic she told him was unjustified "overkill.""*

That the police doesn't have a record about this can be explained by institutional racism in the USA police force. People believing that there is can easily take yet another n=1 case as a trigger for protest.

I can't blame them in a country where nobody who sees the Amy Cooper video thinks it is satire (again n=1, but part of a pattern), but many would if the skin colors were reversed.

</comment><comment><USER3> People feel like it is happening to them all the time. Police stops for being 'suspicious looking', while walking on their own street. Friends who were shot by police, bad experiences, racist remarks spoken with impunity by policemen. The sound of car doors locking as you cross the street. Security guards following you around the shopping center. Security guards who reach for their mace when you try to talk to them. The list goes on. People are fed up and frustrated.

Confirmation bias, absolutely. Every situation starts to take on racial connotations. Going through situations wondering if it is all in your head isn't fun either.

The lockdowns absolutely have something to do with it. When you are young and rambunctious you absolutely want to engage in hooliganism. Get a group of people like that together and they feed off eachother. Throw in rationalizations about racial justice, add on heaps of frustration and combine that with unemployment, bordem caused by months of lockdown...

Let's talk about the white guilt too. White saviors are out there projecting their own guilt onto others, blaming society etc. They can turn that guilt into heroism in their minds.

Then there is the general political hatred and divisive atmosphere. The whole thing is basically a perfect storm. To assume that no one would manipulate these forces for political gain seems like a huge leap.

Add all of these emotional factors together with a history of documented police abuse. Do protesters need a reason? Does it matter if it is entirely rational?

This is the situation we find ourselves in. The proposed solution is more political bickering and blaming. Extra points if you can guess where that will lead.

<comment><AUTHOR> I really appreciate your response. It was thought provoking.

in fact it all makes sense.

but does rationality matter? in the context of society.. i think it has to. because what does its absence imply?

chaos?

blind idealism? aka radicalism...

if we are starting at "silence is violence" i am afraid to see where it ends

<comment><USER3> People sharing their emotions and looking to explore that in the public space could be rational. However not all of the conclusions and outcomes will be rational when there are powerful emotions at play. Political players seeking to benefit from these powerful emotions in election cycle doesn't seem irrational.

To rephrase that question, is it reasonable to expect strictly rational outcomes in an emotionally charged scenario? Appeal to emotion is an informal logical fallacy. Perhaps the expectation of a strictly logical behavior is overly idealistic?

If the larger society can empathize with these grievances and emotions, that is a benefit. Anytime we have more compassion we all benefit. In that regard it doesn't matter if the emotions follow a logical course.

Naturally, I share your concerns on how this will pan out. That said, my impression is that the media consistently over sensationalizes anything with political implications. The loudest voices are often the most extreme. This makes for better content, more clicks and views.

</comment></comment></comment><comment><USER4> > English is not my first language, honestly I am trying to understand here.

You're doing better than many English natives, who can't use their own language correctly. Some of the key misuses in this event are referring to "looters", "vandals", "arsonists" and other criminals as "protestors". Protestors protest, they don't invade, pilfer and destroy other people's private property.

A left-wing media is complicit in continuing these kinds of misuses of English to stir up people driven by emotion rather than logic. By failing to separate peaceful protest from violent crime, they've helped to drum up a wave of violence spreading over many US cities.

The people calling for this behaviour to spread are absolute hypocrites, because they will call for destruction and chaos under the excuse of "historic racism," but will never direct people to their own homes or businesses or provide them the box of matches to set it ablaze. It's OK apparently, to destroy _other people 's_ private property, but not my own.

Of course, racism has nothing to do with the violence and theft. There are two groups engaged in the crime: one is simply petty thieves who want a quick reward and are taking advantage of the situation to do it. The other is white "liberals" who feel they can use the opportunity to bring about a socialist revolution. I quote liberals because they only self-title this way but do not behave like a liberal (another case where correct use English is being dismantled: people believe that if they self-identify as something, it must be true, even if reality and action prove otherwise).

To be clear, what happened to George Floyd was a disgrace and the officer in question should be brought to swift justice. The emotionally driven mob seem to believe that if you are against the destruction of private property then you mustn't care about what happened to Floyd and other cases like his (which are absolutely not exclusive to blacks). They are unable to use logic correctly and will attempt to shame anybody calling for an end to the wave of crime spreading through American cities, labelling them as racist or whatever fits their narrative.

It's pretty clear that the protesting should be peaceful only, and should be about police violence, without the racial narrative. Police violence happens to people of every creed. It's kinda funny that these protestors will call for an end to injustice handed down by the State, but then go home and return to calling for a bigger State - the socialist state.

The root of the problem here is that the State does not work for the individual, it works for the State. The police are not there to protect you, they are there to protect the State. The worst-offender for misuse of English is the term "we" to try and convince people that the State is, or includes them, as individuals. Take note every time you see terms like "we", "ours", "we should", etc. in news print. Who are they really referring to when they use these terms? Are they talking about themselves, or are they talking about you? It is very important! If you can't understand the basic language, how are you ever going to make sense of reality?

<comment><AUTHOR> nicely reasoned perspective.

language is important, we must take care of our words, certainly, but they can fail us too.

if there is 1 looter and 99 peaceful protestors, is it a peaceful protest or a riot?

no doubt this is delicate so it scares me when I hear that "if you're not vocalizing your support you're taking the side of the oppressor."

so this warfare is not just happening on the streets, it's polarizing everyone's ideologies to irreconcilable levels.

I really don't like any of this.</comment></comment>


A thief about to snatch your encrypted laptop while it's on and decrypted? - <AUTHOR> http://git.zx2c4.com/knock-knock-token/tree/knock-knock-token.c

<comment><USER2> This seems like a rather unreliable way of protecting information on a laptop. I have a vague recollection of a program that uses Bluetooth to link a cell phone to a laptop. If the cell phone gets too far away from the laptop (if you walk away from your laptop, or someone runs away with your laptop), the program locks the laptop, requiring the password to unlock it.

<comment><AUTHOR> Bluetooth is a decent way of doing it too. However merely locking the laptop is insufficient for protecting the data on the hard drive, since even when the screen is locked, the encryption key of the hard drive is still in memory. The solution is to securely wipe memory and shut off.</comment></comment>


Facebook name extraction based on email/wrong password + POC - <AUTHOR> http://seclists.org/fulldisclosure/2010/Aug/130 <comment><USER2> In almost any web app you'd write this up as "Sev: Low", "Impact: Information Leakage".

But this isn't any web app; it's the most popular complex web app in the world. It seems like there's zero likelihood Facebook doesn't (a) know about this and (b) want Facebook to work this way. Presumably, it helps people like my mom.

It was always a bad idea to associate your secret anonymous email address that you use to send ransom letters with your Facebook account.

<comment><USER3> There are a lot of tradeoffs one makes with dealing with nontechnical customers which geeks might hate. Geeks do not have to worry about the "Facebook login" fiasco, but if you sell to my customers, are Paypal, etc, then login issues are a core business requirement. Note that site abandonment among users unable to log in is ridiculously high (I should track this...) and every time that happens Facebook loses revenue, shareholder value, and network effects.

</comment></comment><comment><USER4> Um, it's easier than that. You can do this with the graph API. Although current (but undocumented) rate limits make it infeasible to do much with it.

[https://firstname.lastname@example.com&ty...](https://email@example.com&type=user&access_token=..).

<http://developers.facebook.com/docs/api#search>

</comment><comment><USER5> The author states it might be useful in guessing valid company email addresses. Isn't it easier to create a CSV/Outlook compatible file containing hundreds of generated addresses, and then ask Facebook to find new friends for you. Plus, that will allow you to check many more adresses before Facebook senses something silly and disables the login form - which would happen if you use the login-form method.

Heck, this is perfectly possible with LinkedIn and twitter as well. I don't understand what the fuss is.

<comment><USER6> The author states that this does not check a user's privacy settings, but as another participant in the thread points out[1], importing an address book to look for new contacts respects privacy settings (i.e. a 'new contact' will only show up if their privacy settings allow their profile to show up in search results).

[1]: <http://seclists.org/fulldisclosure/2010/Aug/137>

<comment><USER5> Right. That makes sense.

However, since this solution isn't spectacularly scalable, I'm not too worried.

</comment></comment></comment><comment><USER7> Since GMail released their small revision the other day that put a more "GMail-like" GUI on the Contacts section, I've been sorting and completing my list of contacts. I had 5 ambiguous e-mail addresses left that I couldn't pinpoint who they belonged to. After reading this article I decided to give this Facebook feature/vulnerability a try. 4 out of 5 previously anonymous e-mails are now verified with their first, last name, and photo (it turns out I know all 4 in person so in all likelihood the results are correct). Not too shabby, and a little bit scary.

<comment><USER8> What did you find when you searched for the address in your conversations?

</comment></comment><comment><USER9> RapLeaf offers a service where you give it an email address and it returns the Facebook, Twitter and other social media accounts associated with it.

Now, I'm not saying they are using _this_ vector, but then they must be using something like this because how else could they offer the service. (This also means there might be other vectors to achieve this end result).

To me, this also makes me pleased that I use a unique email address against my email domain for each site I use.

<comment><USER10> Rapportive also does this.

<comment><USER11> Actually, I find this pretty creepy.

See the following including a link to see what is available via email address lookup.

[http://jeffreykishner.com/2010/03/what-anyone-can-know- just-...](http://jeffreykishner.com/2010/03/what-anyone-can-know-just-from- your-email-address-rapportive-and-rapleaf/) [http://petewarden.typepad.com/searchbrowser/2009/12/what- can...](http://petewarden.typepad.com/searchbrowser/2009/12/what-can-i-find- out-about-you-if-i-know-your-email-address.html) <http://web.mailana.com/labs/findbyemail/>

</comment></comment></comment><comment><USER12> I agree with the overall sentiment that this is a relatively minor vulnerability.

It could be put to malicious use by phishers. If I know your full name I can make more realistic phishing emails.

<comment><USER13> Well the problem with this vulnerability is that many spammers have millions of email addresses, only a fraction of them with the full name. With this Facebook issue they will get tens or hundreds of thousands of names connected, and will further resell this database.

This seems like quite an asset to me, because spam mails with the real name will have a much higher engagement.

<comment><USER14> I always use my real name when I send email, so email coming to me with my name on it is unremarkable and does not give me any reason to think it's "safe."

</comment></comment></comment><comment><USER15> I'm not so sure why this even matters. If you search for someone based on their email address within Facebook, it comes up with their name and photo as well. In my case, it's a feature. But true there is no point to it giving this information on the wrong password screen, but if someone wants this information they can still get it using Facebook.

Maybe Google should worry about this too...I usually type unfamiliar email addresses into Google and end up with far more than just a name and a picture.

<comment><USER16> You can block your profile from coming up in searches with Facebook's privacy settings.

</comment></comment><comment><USER17> nice find. The followup is correct; slight mispellings are corrected, allowing further guesses.

This coupled with the fbnames release earlier makes me think it's only a matter of time before someone crawls and "open sources" all accessible personal data from facebook.

<comment><USER18> I don't know that "marketing research" companies are not already generating databases from FB data like this

</comment></comment><comment><USER19> The same can be done for Gmail (and probably Google Apps) users through GDocs. Just share a document to an email address, and GDocs will show you their name.

<comment><USER20> But that ends up sending an email to the account you extend the sharing request to. It might raise a red flag to some people.

This 'vulnerability' doesn't contact the victim, so it can be done in combination with, like the report said, a phishing scheme to gain the real names of the users of an email list.

I'm not saying that this is some massive privacy issue. It opens up a vector to make other attacks, specifically email based attacks, seem more legitimate, which is a bad thing.

<comment><USER19> There is an option to not send an email. And it's not a request - once you share it, the recipient doesn't need to accept. The users can see them in their GDocs list though. But if you quickly unshare them and they're not currently viewing their list, they'll be unaware of it.

<comment><USER20> I didn't think that it was an option, but I did check. You are right. Of the three checkbox options, notifying the recipient of a share invitation is the only one checked by default.

Either way, my main point stands. This isn't a major privacy issue. Though, I've always been taught that when developing an authentication mechanism, one should not distinguish between a bad password or bad email address/user name in the error message provided to the user. Specifically the latter, since a "Invalid password supplied for John Doe" gives confirmation that the username provided is valid, and a bruteforce or dictionary attack on the name will probably successful.

</comment></comment></comment></comment><comment><USER21> Not sure if that's only on Facebook US servers or it's been disabled already, but from here in NZ there's no such info leakage, you get a very boring error page.

The only thing you can discover is whether the email address you entered is a valid Facebook login or not - you get a different error response for an email address that's not a valid Facebook login.

<comment><USER22> It works exactly as claimed from Sweden at least. It returns my full name a profile pic and corrects minor typos.

</comment></comment><comment><USER23> I guess they fixed it? It's not showing anything about me on a wrong password...

</comment><comment><USER24> Easier: install Rapportive.</comment>


Microsoft receives patent for restricting Windows functionality - <AUTHOR> http://arstechnica.com/microsoft/news/2009/05/microsoft-receives-patent-for-restricting-operating-systems.ars

<comment><USER2> Well... the reality of the 2008/ 2009 is that lots of companies are trying to find new ways to go on or survive, and MS is just doing that. Charging money for unlocking functionality has been used particularly in enterprise and desktop software for decades, and it's just that MS has also accepted it as a basic mechanism for their operations.</comment>


How Much Does a Software Developer in Portland Earn? - <AUTHOR> http://dyepot-teapot.com/2011/04/14/how-much-does-a-software-developer-in-portland-earn/ <comment><USER2> It depends on who you work for. If you work with us at BankSimple, you'd make the same as if you worked in our Brooklyn or SF offices. Normalizing salaries across our three locations is the only fair thing to do, regardless of the fact that we think talented developers are worth a premium.

<comment><USER3> I don't mean to come across as combative but how is that fair?

<comment><USER4> If you value software developer's talents at $x per year, it shouldn't matter where they're located in the world. Perhaps you'd pay a slight premium for in- house workers vs telecommuters but only if that made sense for your business.

Whether they're in New Delhi, San Francisco, or some no-name town in middle america, if they've got the skills to develop your software and provide a similar value (compared to each other), paying them a standard rate is fair.

edit: I'll also note that "fair" isn't the standard for business these days, but it's interesting to see some companies attempting to do things differently.

<comment><USER3> Sounds nice ... but if it costs one developer $4000 a month just to take care of bills/rent/food and it costs the other $1000 then that is hardly fair. You are penalizing one developer based on the cost of living of the city they happen to be in.

<comment><USER5> In this world of airplanes and shipping services, there's no non-medical non- legal reason why you're stuck in any particular expensive city. Choosing to live in a big expensive city is an expense choice that you make, just like buying a premium brand.

<comment><USER6> jobs? especially in the computer industry.

</comment></comment></comment></comment></comment></comment><comment><USER7> I would say the same as you would get anywhere else +/-10%.

There have been a lot of threads recently around salary. I'm pretty sure it is entirely based on your willingness to negotiate to the best of your abilities. Yes, you need to be willing to step up to the plate and negotiate.

Thankfully we work in a very mobile and fluid industry. I know people who live in Oklahoma and work for well known startups that get paid a very competitive wage even for NYC standards. Location is becoming less of a factor in the war for talent.

<comment><USER8> When I was looking at moving to Portland about 18 months ago, companies there wanted me to take a 40+% cut in pay versus what I'm making in San Francisco. Granted, I only talked to a couple of companies, so maybe I just picked the wrong ones. Things might also have changed since then, thanks to the economy picking up and the higher competition for software engineers.

<comment><USER7> That may be part of the reason Portland is not keeping up with other tech centers. Taking a 40% pay cut just to work in Portland is kinda... dumb.

I mean, did these startups accept a 40% cut in their valuation or funding rounds because they are based in Portland? Do they pay 40% less to host with Amazon or Rackspace? It's just ridiculous and kind of insulting. I once had someone pull that on me re. a job in Florida. The dude was like "hey, there is no income tax here!" And I was like "hey, bmws cost the same all over the country." (Not that I drive a bmw, mind you. I drive a 129$/mo honda civic. It's just the principle of it all.)

<comment><USER9> I'm pretty sure Portland based companies take more than a 40% cut in valuation and funding rounds, vs. SF based companies. (not saying this is a good thing, just that it is observed)

There is a weird valley (which Portland is still kind of close to the "uphill" side of, which SF/NYC probably are the top of) where sufficiently remote or small places are cheaper for a lot of things (real estate, mass market locally produced goods like restaurants and cafes, probably generic developers or IT helpdesk people), but then more expensive for certain specialized skills (if you absolutely must have one of the world's top 100 experts in COBOL working for your remote office in North Dakota for 2 months, you're going to have to pay him more than to have him work from SF).

</comment></comment></comment></comment><comment><USER10> Depends. Are you writing Haskell at Galois or JanRain?</comment>


Amazon Alexa and Google Home Fall Short of Real Conversation - <AUTHOR> https://www.ft.com/content/6d2ccc06-e61e-11e7-97e2-916d4fbac0da <comment><USER2> True, but if you think you can have a real conversation with any inanimate object you've fallen for the AI overhype. Maybe in the future but not now. The Echo and Google home are great if you keep your expectations in check.

<comment><AUTHOR> The question is not whether we can have a meaningful conversation, but whether we can have a "functional" conversation. Can the machine quantify a basic statement of my needs, conversationally clarify any fuzzy parameters, and properly execute my request? I believe it can, but only across a set of narrow fields, with much training data and effort.</comment></comment>