Ask HN: Who else uses adblockers for safety? - <AUTHOR> I have been programming immersive ads. I could modify from an embedded iframe the content of information sites, suck data out of people, manipulate data (like navigation history). And I got really not confident in what unethical people could do and seen no way we could detect misbehaving code.
I feel like the potential of vulnerabilities dynamic ads (JS based) exposes the users to is under stated by the industry.
I use adblockers to just protect myself. Who else does it?
And who else think their may be an ad-gate of the ads companies not stating the risks clearly? I mean to any coder that actually coded ads, we know what it actually can do, right? <comment><USER2> Over the last few years I've settled on using NoScript. Mostly it was more for security or speed reasons; that it happened to block ads was just a happy side effect and often not one that I pursued very hard. For many sites, I'd end up with a page that had a couple of ads still on it, rather than a dozen ads plus a popover. The only time I've spent much cognitive bandwidth on getting rid of the ads is when the ads are being disgusting or half-pornographic. (It is not per se that I "disagree" with skin, it is that I hate the advertisers for deliberately trying to bypass my rational brain with those images. It's a hostile cognitive move on their part.)

But it's getting harder. More JS frameworks that depend on JS to render anything other than an empty white page. Then you whitelist that site, and it needs a couple of other domains to render anything. Then you're playing "guess which domain hosts the JS framework", which is not obvious, then you can also go back and play "unwhitelist the wrong answers", which since we're probably talking about a page that takes ten seconds to render and fifteen to be _sure_ it didn't render when I blocked that site is quite a pain.

Also cloudfront is getting more popular, and that's all but an opaque domain now when it serves JS.

I'm getting seriously tempted to throw up my hands and do a serious adblock switch. I don't think using somebody else's list of domains is ethical, for various long and complicated reasons, but I'm finding myself having to balance that against the fact that the advertising industry doesn't seem all that worried about ethics at all, so I feel like I may be bringing an ethics knife to an ethics gun fight.

<comment><USER3> I've found Firefox reader mode can often give me the content when all scripts are still blocked. The blank page often still gives the reader icon :)

For those that don't trigger reader mode I'm increasingly hard nosed and just start ignoring that domain. I'll not enable JS just to read an article or see some images, only when it adds functionality. Most of the time I don't need to - most sites work remarkably well with little or no JS, so I can afford not to care about those that don't. I'm very reluctant to enable anything that's not the visited domain.

EDIT: uBlock+NoScript+Stylish almost always active.

<comment><USER4> > I've found Firefox reader mode can often give me the content when all > scripts are still blocked.

For some reason Iceweasel doesn't seem to display the reader icon. It's a bit of a nuisance …

<comment><USER5> Is Reader even part of Iceweasel? I was under the impression that it was something that Mozilla licensed from a third party.

</comment></comment></comment></comment><comment><USER6> This sounds like FUD. An iframe can get the page it's embedded in, but what do you mean by "suck data out of people?" and how do you manipulate navigation history out of an iframe?

What surprised me most from my time in adtech was the way companies used redirects to sync user ids, i.e. news.com/story loads an image from ads.com/user-sync-start?partner=data which 302 redirects to data.com/user- sync?id=123 which redirects to ads.com/user- sync?your_id=123&partner=data&our_id=456, which returns a 1x1 transparent pixel gif. If that bothers you, disabling third party cookies should make it impossible.

That said, I use adblockers for safety because ad networks seem like a great way to serve browser 0-days.

<comment><AUTHOR> Manipulating history belongs to one of the dark ages secret of "everlasting cookies" aka the zombie cookies you can't kill. Navigation history was globally accessible from any DOM elements when I was working in ad industry (2013).

[http://samy.pl/evercookie/](http://samy.pl/evercookie/)

Some of these have been fixed, some not.

</comment></comment><comment><USER7> I use adblockers (ABP and Ghostery on desktop, Crystal on iOS) mostly to minimize annoyances: videos that play automatically, malicious redirects to the App Store, multiple trackers that slow down browsing or suck down data.

I'm not worried so much about _safety_ (e.g., ads as a malware vector), but I know that happens. I don't have too much of an issue with data collection in of itself, unless a) the act of data collection impacts me (e.g., 1MB of tracking JS) or b) if your follow-on processes are sketchy and annoying (e.g., spam emails).

I have explicitly unblocked pure analytics platforms (e.g., Google Analytics), trustworthy ad platforms (e.g., The Deck), and a few "site optimization" libraries because some sites don't work without them (shame on them).

I totally get that ads are a revenue source. The problem is that you (as the publisher) need to convince me that your ad platform is trustworthy—not annoying or malicious. You have failed that test in the past and taken advantage of me as a consumer. So you now need to earn that trust back. It's not that I don't value your content, it's that _I don 't trust your infrastructure_. (And yes, from my perspective, a third-party ad network is still _your infrastructure_ because _you 've chosen to use it_.)

<comment><USER7> Wired is an example of publishers not "getting it". I get a big pop-up that reads "Here's The Thing With Ad Blockers".

It goes on to say, "We get it: Ads aren't what you're here for. But ads help us keep the lights on. So, add us to your ad blocker's whitelist or pay $1 per week for an ad-free version of WIRED. Either way, you are supporting our journalism. We'd really appreciate it."

As a reader: I get it! I want to support you! Of course I'm not here for ads, but _I don 't care_. I care about your malicious ad network—do you? You haven't proven that I can trust you to whitelist you, nor are you even showing that you _know what my problem is_.

So no, you don't get the trust in a whitelist. I might pay for your content explicitly, but I'm not paying $52/yr when I can get a year-long physical subscription for $10. And, back to trust, I don't trust you with my CC number either.

And finally: _I have another channel!_ I can go get all the Wired content I want through Apple News, which is a) trustworthy, b) ad-free, and c) easy to use.

<comment><USER8> ... and can trivially bypass WIRED's pop-up by just disabling JavaScript in your browser (just 2 clicks Safari if you have Develop menu visible) after the page loads but before you scroll.

</comment></comment></comment><comment><USER9> I just had this conversation with the director of IT yesterday. Given the rise of ransomware and malvertising, I think its absolutely time we consider ad blockers as important as anti-virus software. I realize how damaging this can/will be for content publishers, but the ad networks have nobody else to blame but themselves for how chaotic and dangerous online ad markets can be.

<comment><USER10> At Bromium we do complete task isolation in uVMs and use monitoring to watch what happens inside. Most customer infections we see come from ads, and they're mostly cryptoransomware. It's absurd.

</comment></comment><comment><USER11> Yeah I'm with you.

Neither publishers or advertising networks seem to want to care about sanitising the code they're letting be run in my browser, so screw them all. I'll sanitise it by blocking it.

It's not just that though. Browsing without adverts is a better user experience. This is just a side-effect of adverts, I'm afraid.

Now, I'm sure this probably fractures my license to read content on certain sites... But I'm selfish and detecting ad-blocking is possible. It's up to publishers now to decide whether or not they're really happy blocking 30-70% (demo-dependent) of their traffic.

</comment><comment><USER4> On my personal machines, I use µBlock (I'll always call it that, not uBlock …) Origin and NoScript, and only disable NoScript when I really, _really_ want to read a page which is so broken that it requires JavaScript to even display. Normally, I don't bother: people who break the Web don't really deserve to have their words read.

On work machines, I use µBlock origin and NoScript, but with NoScript set in blacklist mode, so almost all sites run JavaScript.

In this manner I reach what I consider pragmatic tradeoffs.

I'll admit though that I am absolutely, completely _livid_ at the continued destruction of the Web's ideals by JavaScript. The Web is about documents, not executables!

<comment><USER12> This is the real ublock origin:

[https://chrome.google.com/webstore/detail/ublock- origin/cjpa...](https://chrome.google.com/webstore/detail/ublock- origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en)

correct ? I am always wary that there is some clone project out there that hijacks the original intent of ublock and is somehow name-camping on some derivative of "ublock origin".

That's the correct add-on in the google chrome store, yes ?

<comment><USER13> That + uMatrix (using the u, not the mu, because I'm a human and actually want this tech to proliferate...) are made by gorhill - see the 'Related' tab on the Chrome store link you gave, 'Same developer' and you'll find uMatrix.

ublock-origin is the cut-down, simplified version, uMatrix is the 'power user' version, giving more finely grained control over what's blocked.

zeveb: you should probably just use uMatrix. Less memory consumption and deduplication of tasks. Not to mention the shady noscript under-the-table deals.

</comment></comment></comment><comment><USER14> I'm ethically opposed to adblockers as they deny content creators a means of making money for their work.

Yet, ads have gotten so out of hand that I'm about to install adblockers partly for safety, partly for other issues. They track my information when I would not expect it. And I just had a simple news website suck up 2GB of memory. And on my phone, simple websites with 1K text frequently suck up 5MB for ads - and I can't easily predict and control that.

Edit: ADP now installed. And it says it doesn't block "non-intrusive" ads unless I ask it to - which sounds pretty good from my perspective.

<comment><USER13> > I'm ethically opposed to adblockers as they deny content creators a means of > making money for their work.

Quick rebuttal:

\- People who use adblockers aren't likely to click ads anyway (maybe improving CTR for advertisers?).

\- Server logs can still tell you how many 'hits' you've had, which were bots etc. even if various JS analytics snippets are blocked. These can be shared with ad partners, even if 100% of your visitors use adblocking.

\- Advertising is not the only way to make money from writing/media and I'm becoming ever more convinced that it is even an immoral and hostile action on behalf of the advertisers and their partners (unless done in a mutually beneficial way, such as keyword bidding/ads relevant to expressed commercial needs).

Sadly the response to all this seems to be increased product placement. There are cultural divides between various countries and the web will most likely homogenise over the average at one point, but in areas of ad-desensitized culture we'll see the worst of advertising (or best, depending on your viewpoint).

EDIT(3): uMatrix + pihole user (uMatrix for me, pihole for everyone else on the network, mobile and tab included)

<comment><USER14> 1: I don't judge anyone for using adblockers because there's a lot of moral grey area here.

2: "Advertising is not the only way to make money from writing/media"

-> I don't think this is a very good argument. It may be the only reasonable way for that content creator to make money.

3: "I'm becoming ever more convinced that it is even an immoral and hostile action"

-> Some of these ads are hostile, but some are attempting to make money in a very reasonable way. You're demonizing the entire group, including some who are creating value for you and me.

Edit: A little anecdote: There is a project I'd like to do that involves investing considerable time and money in creating content that will be shared with the world and would help a lot of people. I'd like to make some money back out of it for my time and costs. Free but with ads is the best way to help the most people but still make money. However, it might be difficult to make much and I would have to deal with people attacking me for trying to make money off ads. This is a factor that is actually affecting my decision as to whether or not I pursue this project (which I will decide in the next several months).

<comment><USER13> Appreciate the further consideration of those points.

As for your project; do it! If it'll help people, write it all and release it under a creative commons licence. Spread it far and wide. It could be your legacy, long after you've left the earth and stopped worrying about money.

I self-published a book in 2011. I charged for it. It ran its course, the product lifecycle played out and I'd made more than it cost to put it together. It's now free to read on my site and will soon be added to the creative commons as a PDF to be freely shared. I continue to benefit from its existence in other ways than monetary.

If you really do want money in return for the effort, charge for the publication. Get it published professionally or self-publish and promote it widely. Do you think the ad model is best because you are convinced people will only find what they're looking for through a search engine or social media?

EDIT: Would the people you help with your publication be helped even more by the ads displayed alongside it? Who would click the ads to make the project pay?

</comment></comment></comment></comment><comment><USER15> Safety is the primary reason I use not just Ad Blockers but NoScript as well. Preventing cross-site tracking is a nice bonus (I don't mind Ads so much, but the networks cross a line because they track your browsing behavior which violates your privacy).

<comment><USER16> While the safety argument remains, you might want to look in enabling the Do Not Track feature in your browser. While I can't guarantee every bidder / adserver / etc.. respect it, it's a good way to insure some privacy while allowing sites you visit to survive.

<comment><USER17> It seems that the Do Not Track feature will only give you a false sense of safety and privacy. It depends on the advertising companies actually respecting your choice, which most do not, according to this article:

[http://arstechnica.com/business/2015/11/fcc-wont-force- websi...](http://arstechnica.com/business/2015/11/fcc-wont-force-websites-to- honor-do-not-track-requests/)

<comment><USER16> Without even needing to read it, it is, you're right. It becomes a bit of an ethical problem at this point where in order to get accreditation, adtech companies need to respect the header but, unfortunately, no one is forcing Advertisers or Publishers to work with an accreditated adtech company.

</comment></comment></comment></comment><comment><USER18> I primarily used adblockers to remove invasive ads that take over the page, but with more and more reports of malware served through ad networks I consider it safer as well.

The only ads I ever click on are ones I never meant to. Usually because the page loads so slow because of ads so content jumps under my finger on my phone.

</comment><comment><USER19> I use uMatrix, mostly to block malicious or intrusive JavaScript. It's not primarily intended as an adblocker, but effectively works like one since most ads are served by untrusted third parties.

But since more and more malware is now spreading through ad networks, I've taken it one step further and rolled out domain-level adblocking on my router (on the DNS level), mainly as a way of securing non-updateable devices like Android phones of guests.

Note that this means that I cannot whitelist ads for a specific domain, but since adblocking was never my primary concern to begin with, I consider that acceptable. I will always see ads if they are served from the same domain (or from any other domain that is not a known ad server), so there's a clear and easy way for publishers to get ads in front of my eyes, should they decide to give a shit.

</comment><comment><USER20> I installed an adblocker on my Mac after I was using mobile tethering with my computer muted, and some ad went through a huge video playlist in another window using close to 1 GB of data. It was worth around $20 at the time in local currency, and that was it for ads on the laptop.

I installed a hosts blocker on my Android phone after I found myself hitting a large number of sites which would popup ad alerts and then forcibly redirect to another site (where they'd try and get me to download and run an APK). This might be more prevalent in "poor" countries where the fill rate is bad, and so these kinds of scams end up being the only ads available and possibly aren't noticed by the networks.

<comment><USER21> Just a tip, Firefox has Android version too, and many plugins (including uBlock Origin) work just fine with it.

</comment></comment><comment><USER22> I browse mostly on mobile these days, with JS turned off. Sites load quickly, the small amount of actual content can be quickly consumed, and my monthly data allowance remains in trim.

Before this humungous amounts of JS and adverts blocked the screen, slowed loading times, tried to infect the phone, steal browser history data, and sucked down my data allowance greedily.

</comment><comment><USER23> This is my main usage of uBlock and Firefox Beta on Android. I cannot browse the web on Android with Chrome and without Adblock anymore because I got so annoyed by Malware/Scareware/Scamware which vibrates my phone and redirecting me to virus warn sites (which look like made from Google). Good example which is 100% safe (open with Chrome on Android): [https://shkspr.mobi/vibratescam/](https://shkspr.mobi/vibratescam/)

Try to explain to some non nerds or your parents what is happening on the last link ;)

<comment><USER13> My mother-in-law very much appreciated not having ads in her free apps recently, as well as browsing her favourite news sites quicker, ad-free, due to the pihole set up and used by the router.

I didn't put her up to appreciating it either, I'd just mentioned I'd done it and some weeks later when visiting she noticed the difference. They may not always be the most tech-savvy generation (in general), but some things are universal!

</comment></comment><comment><USER24> I use an adblocker because many ads are annoying and consume much CPU and bandwidth. And of course, the security impact is another reason to block all those ad networks but that was not my first intention.

Only very few pages are on my whitelist. E.g. Stack Overflow because they have good ads which are well-chosen.

</comment><comment><USER25> I use it for safety, bandwith reduction, performance gains, and to not get distracted while focussing/researching. In that order of importance.

<comment><AUTHOR> Do you tell your kins/friends about your safety concerns and advise them to do the same? Else, why not?

<comment><USER25> I tell them, but this particular topic doesn't seem to be a huge issue that interests them, like virus protection for windows. Some just default install free protection, some ignore it and re-install their computers from scratch yearly.

Perceived performance and (expecially on mobile) reduced bandwidth/energy usage is the seelling point for my non-tech friends.

</comment></comment></comment><comment><USER26> Does noscript count? You "miss out" on a whole boatload of ads by accident that way.

<comment><AUTHOR> it does to.

It is also a prophylactic measure that is efficient. And yes, I missed the non ads dynamic contents that could also be unsafe. Then I would get paranoid with thousands sloc of JS included of minified code per project build with complex build chains. Knowing that ff extensions are in JS, I should purely stop using JS with my reasoning.

But as pointed out it results on some websites to serve degraded contents.

So it makes you choose between full access of web content, or safe access to a smaller part of the web.

</comment></comment><comment><USER27> I've been putting ad blockers, one form or another on all my friends/family devices for some time. Mostly cause I hated wasting time cleaning up crapware infections. Security yes but also prevents wasted time.

<comment><USER28> This. I had been cleaning my parents' computer about thrice a year. I haven't had to do that ever since I added an adblocker.

Just the other day, I needed to get a print driver for my aunt's computer. I searched bing (which she had as the default), and this came up:

[http://share.rothamel.us/bing-hp-drivers.png](http://share.rothamel.us/bing- hp-drivers.png)

Yes, there is a muted gray "Ad" there, but the first two links - rendered like real links - are not to HP. And I'm pretty sure that's just asking for problems.

</comment></comment><comment><USER29> I use RequestPolicy. It gives fairly fine-grained control over which third party sites are loaded, and from which origin.

It's the best of both worlds for me. I'll see the ads I don't object to (those not served from an ad network), greatly reduced cross-site tracking, and the risk of exposure to malicious ad content is much reduced.

Occasionally you run into a poorly coded site that fails to render because facebook or twitter didn't return what it expected, but for the most part it's a good compromise between extremes of wide open and noscript.

<comment><USER21> I used to use RequestPolicy too. Then I found uMatrix, which simply has a much better representation for this, and allows finer control (cookie/image/css/plugin/script/XHR/frame). I suggest you to try it out.

As for the setup, I made it accept all first-party content, and images+css from third parties, and block everything else by default. Then you play the "guess the source" game for a couple of scripts that you as RequestPolicy user are already familiar with :)

<comment><USER29> Thanks, I'll take a look

</comment></comment></comment><comment><USER30> It costs me twice to see an ad. It costs me time to look at it (and possibly interact with it), which is fine because that's what actually pays for the site. However, the ads are costing me again because they are using too much of my limited data (esp on mobile). Sure, I don't go over my allotment usually, but it does prevent me from using that data somewhere else.

The advertisers need to figure out the latter in order for the ads to continue to be a viable revenue stream.

</comment><comment><USER31> I use ad blockers for all these reasons (safety, speed, readability), but also as a selective tool for often-visited web pages to remove parts of the website that i find distracting. For example I remove the divs of comment sections on news pages, irrelevant side bars with distracting features etc.

Edit: In particular also annoying navigation elements like gigantic top bars that stick to the browser top. I have a Macbook 11" and this have made many websites way more readable.

</comment><comment><USER32> Everyone on this thread categorising the question as FUD should read up on the Same Origin Policy of the browser and the context in which embedded javascript gets executed.

Definitely enough room for malicious behaviour.

Also, the threat does not just include ads, but the fact that too many a developer is very happy of pulling in 10+ 3rd party javascript libraries into their web application, effectively exposing their web application to risk in case one of these 3rd parties gets compromised.

</comment><comment><USER33> I've seen many cases of payloads being delivered through 3rd party ad networks. I also despise how ads will track users. Those are my two top reasons.

</comment><comment><USER34> > I use adblockers to just protect myself. Who else does it?

I use a javascript/flash/etc blocking plugin.

If people show me static advertising assets, I'm fine with that even if it lets them track me a little. If people try to run software on my computer I'm not comfortable with...that is a separate problem.

<comment><USER35> If you are concerned about malware, the first thing you must do is to ditch FLASH.

<comment><USER34> Yes, that is the purpose of the plugin. However, I need to use it rarely to test something I've had to work on so I can't disable it 100% of the time.

</comment></comment></comment><comment><USER36> I was convinced to install an ad blocker solely for the safety reasons. It is the new antivirus.

</comment><comment><USER37> I do. I'm the defacto tech support for most of my family and friends. The amount of spyware, viruses, and questions of "This website is telling me I have X problem!" type questions I've gotten over the past decade pretty much forced my hand. I used to setup their computers without adblockers, but decided to just install them by default a few years ago. It's cut down the amount of support requests from a few per year to almost none. Personally, I do whitelist sites I know to be safe and protect my privacy, but for everyone else, it just saves me so much time that it's a no brainer.

</comment><comment><USER38> Pure FUD.

Find me an example of any widespread attack from ads alone. Find me one major network (Oh wait, thats only adsense, FB, and bing) who allow anything malicious.

Dynamic ads don't allow custom JS, and you thinking they do is ridiculous.

Sucking data out of people? That is FUD if I've ever seen it. You mean, "collecting data"? Which some people have a problem with.

Your perspective is warped as hell, 80% of users don't care at all. The other 19% installed an adblocker and left it there. The 1% have noscript or JS disabled and are overly worried about security concerns and paranoid about data collection.

</comment><comment><USER39> NoScript (+ Custom ABE rules for specific websites) + uBlock \- Basically all external plugins like Java or Flash with Firefox

NoScript with ABE is pretty much what everyone needs but uBlock is there to block most of the non-JS ads (and save some bw) and from malicious js ads on the allowed ones but without enabling scripts most ads don't even run so basically uBlock is almost doing nothing (in at least a year it only shows 4% of request blocked so almost all the work is done by NoScript).

Still wishing someday to see NoScript on chrome.

</comment><comment><USER40> Is there a list of vulnerabilities one gets exposed to with these /immersive/ ads? Maybe making this problem more visible will help content owners stay away from bad ads companies.

</comment><comment><USER35> I use uBlock, Ghostery to block all trackers and ads. Lately I have been writing a DNS based blocker using Rpi, Most adblockers are as good as the list they maintain.

I started blocking ads when I realized they are used to spread malware using sites like adfly, bitly(in the beginning) ... then I got used to pages without ads, it's difficult to go back from that.

</comment><comment><USER41> I've developed some kind of blind spot for ads, so I'll accept them as long as they don't track me. For blocking spying ads and invisible trackers, I'm using Privacy Badger ([https://www.eff.org/privacybadger](https://www.eff.org/privacybadger))

</comment><comment><USER42> I use a lying DNS resolver where possible (my VPN, my home router). It redirects any ad-stuff to an nginx server that happily replies "204 No Content" to anything you ask it.

I had an adblocker at work until someone pushed a corporate admin-managed Chrome on my machine and I can't install and adblocker anymore.

</comment><comment><USER43> I use ad block because ads are annoying, invasive, don't add value, and are immoral (i.e. the way they're disguised to look like real content, the way they prey on ignorant people, install malware, etc.).

</comment><comment><USER44> I've been using Ghostery (with everything blocked) on all my browsers for the last couple of years.

I feel safer online and site tend to function better since I've started using it.

<comment><USER45> I would use caution with Ghostery. It's proprietary and closed source, which is _really_ suspicious for privacy software, doubly so when you realize that the company running it is in the advertising industry. It also phones home and is not entirely clear about what it's sending. I'd suggest using uBlock Origin instead.

<comment><USER46> _It also phones home and is not entirely clear about what it 's sending._

Are you suggesting that it does so other than to download library updates, even if you have opted out of their data sharing (which is a single option on the settings screen)? If so, please give details, because this is a common allegation but I've yet to see anyone substantiate it.

 _I 'd suggest using uBlock Origin instead._

uBO is helpful if you're happy with the defaults, but it's horrendously difficult to configure it or figure out what it's actually doing. This is something AdBlock Plus/Edge were always much better at, whatever their other limitations.

<comment><USER13> Just to chime in with uMatrix by the same dev as uBO - it has always been the 'power-user' version to rival noscript etc. A much more 'open' solution.

</comment></comment></comment></comment><comment><USER47> Somebody should develop an AI approach to ad detection.

And then make a webbrowser that uses a shadow DOM to remove the ads without the website noticing.

</comment><comment><USER48> I just loaded AdBlock Ultimate 2.18 and wonder if this is legit/non-harmful?

</comment><comment><USER49> Mix of reducing annoyances, security and reducing required bandwidth.

</comment><comment><USER50> Mostly for speed. I don't consider the web safe anyway.

</comment><comment><USER51> I run an adblocker to protect myself from "the latest steroid taking GNC by storm" and "This website sells apple products for cheap!". Its an eyesore and ruins my user experience.

<comment><USER52> This is fine as those are clearly scams designed to separate you from your money. But on the flip side you're missing out on the new skin treatment that a stay at home mother found that takes 20 years of your face (doctors HATE her). Hint: It's acai berry.</comment></comment>


Cangoroo: Pogo sticks are the new scooters - <AUTHOR> https://cangoroo.tech/ <comment><USER2> This is a joke right? One of those "make fun of silly startup" kind of things?

I mean... I think it is. But Poe's Law is real and startups are absolutely insane so... please someone tell me this is a joke.

<comment><USER3> It has to be, right? I mean, moving about with a pogo stick is fucking dumb. Why would anyone do it?

</comment></comment><comment><USER4> I was in the beta test for cangoroo. I booked 30 minutes, planning on going 2km in the time. When I was near my destination my cangoroo tokens depleted and the locking mechanism engaged. This caused me to abruptly stop bouncing and fall down, breaking an arm and causing large concrete scrapes. A bystander called an ambulance. My health insurance company is currently engaged in a legal battle with cangoroo and it looks like that is going to cause a downround as investors are cooling. /s

<comment><USER5> Is it bad that I thought this was a completely valid experience until the end?

</comment></comment><comment><USER6> Great idea but I struggle to see how this business is financially viable on its own. I hope they are investing heavily in self-pogoing sticks. The r&d will be tough but they have first mover advantage until Uber and Waymo catch up.

</comment><comment><USER7> This is obviously a joke, but even so, the site looks dead serious (except for the video which made me laugh with the gratuitous use of slow-motion). Usually those 'fake' startups have a we-are-only-being-sarcastic disclaimer somewhere, but couldn't find one here. At least, for their sake, I hope it's a joke.

</comment><comment><USER8> "Founder" is actually head of a creative agency - so assume this is a viral spoof campaign :)

[https://www.linkedin.com/in/adam- mikkelsen-5a32007b/](https://www.linkedin.com/in/adam-mikkelsen-5a32007b/)

</comment><comment><USER9> I'm just one point of view but I haven't seen a single pogo commuter in the 12 years I've lived in the Bay Area.

<comment><USER10> Looks like a company out of Sweden. Maybe pogo commuting is a big thing there.

<comment><USER8> I just got back from a week in Stockholm. Did not see any pogo commuters :P

</comment></comment></comment><comment><USER11> Best deadpan spoof I've seen in a decade probably. 10/10, A+.

</comment><comment><USER12> This is made by a Swedish adver^H^H^H^H^H creative communications agency called ODD Company ([https://oddcompany.se](https://oddcompany.se)) who makes these kind viralbait product campaigns. Not sure if it is made for another client or just as a way to get som press for themselves but they mention Swedish payment solution provider Klarna a couple of times.

</comment><comment><USER13> Same premise as the scooter, i.e. a company litters the sidewalks with dangerous toys and says "make sure you wear a helmet, have fun!", except pogo sticks are perhaps even more injury-prone.

</comment><comment><USER14> Check out the other projects by the ℅ company from the contact address [https://oddcompany.se/work/](https://oddcompany.se/work/)

</comment><comment><USER15> It is indeed a serious Venture. For more info on our long-term plans and additional vehicles to add to our fleet, please get in touch at email@example.com

Happy weekend!

</comment><comment><USER16> The only people who look cool on pogo sticks are the ones doing flips. Everyone else just looks like a complete dork.</comment>


Middle-aged men for rent in Japan - <AUTHOR> https://edition.cnn.com/2018/08/02/health/ossan-renting-middle-aged-men-in-japan-intl/index.html <comment><USER2> These kinds of "look how weird Japan is!" articles are an unintentional personal attack on an entire country. And the articles always come up more frequently in the software engineering / computer science social scene.

> Though it started slow, his website has roughly 45 ossan rentals a day now, > or 10,000 encounters per year

Really? That's it? There are no statistics on the rate of occurrence of this per population, yet this researcher has taken it upon them to tell the whole world that middle-aged men are for rent in Japan.

Someone should research why Americans have an infatuation with a few cultural aspects of Japanese culture. And it's always things like "young people don't want to date!" or "you can buy hentai at vending machines". Anecdotally, some Americans fetishize these aspects of Japanese culture, and I think that skews everyone's perceptions of the country. I think some fraction of Americans want so bad for Japan to be as weird as the anime they watch.

Everyone I've met from Japan seems completely normal in relation to these articles.

<comment><USER3> Don't worry the rest of the world has a similar infatuation with American culture, with the same biases, and the same "everyone I've met from America has been normal" phenomenon.

<comment><USER2> Please, let me continue to fantasize about morbidly obese gun-toting Americans

</comment></comment></comment><comment><USER4> 80% of the users are women, and according to the researcher:

..."All of this indicates to me that this is likely a casual dating site without saying so," she said, adding that "sex and romance" could be an "expectation on all sides involved."

Looks like the creator of the site wrote a dating column, so a sort of undercover hiding in plain sight dating website, that could be a simple explanation.

<comment><USER5> Maybe I'm being naive, but it seems reasonable to think that many people are using this service for purposes that don't include romance or sex.

</comment></comment><comment><USER6> I'm middle aged and in Japan. If you want to come and buy me beer, I'll happily chat with you for hours on end :-)

<comment><USER7> Friggen ageism. You know how hard it is for me as a young man in Japan to be a middle age man for rent?

For real though, given the use-case of the clients, foreigners would be perfect for this job. You can throw anything on them and not worry because they will skip the country soon. Only problem is the language barrier.

As someone that is very much here today, gone tomorrow, people have been exceptionally open with me. Maybe I _should_ start renting myself out.

<comment> your-nanny I have heard that in Japan a "foreigner" might live in Japan for forty years, be fluent in language, culture, and custom, and yet still called a foreigner and not Japanese; I have heard likewise that that is not the case in Taiwan, ie to be Chinese is to act Chinese. What do you think?

<comment><USER7> I think the only country where you can truly become not-a-foreigner are the young countries (US, Canada etc) because we simply haven't been around long enough to define our national identity on ancestry. Every other country does define itself on ancestry (some more nationalistic than others).

Don't get me wrong, your presence can become very much accepted and even appreciated, but you're always wai guo ren / gai jin. I'm struggling to think of a solid example right now.

I haven't lived in Taiwan. Do they call us laowai in Taiwan or is that just a mainland thing?

<comment><USER8> You can become a not-a-foreigner in many European countries if you are white and speak without an accent.

On the flipside, you can be classified as a foreigner even if you'd live your whole life in the country but aren't white.

<comment><USER9> It depends, many European countries are ethnically diverse enough that appropriately dressed people of many ethnicities can look like natives; on the other hand many immigrants, including very ethnically aligned ones, look like immigrants even after one or two generations.

</comment></comment></comment></comment></comment></comment><comment><USER10> I find it funny how they basically value the marginally informed opinion of a researcher in the USA over the word of someone actually involved in the story へ‿(ツ)‿ㄏ

<comment><USER11> Sabine Fruhstuck, the professor interviewed, appears to be more than marginally informed:

[http://www.eastasian.ucsb.edu/people/faculty/sabine- fruhstuc...](http://www.eastasian.ucsb.edu/people/faculty/sabine-fruhstuck/)

Her specialty area is listed as Modern Japanese Cultural Studies. She's researched and written on sexuality in Japan, Japanese military culture, Japanese leisure culture, men's issues, and more. I think a foreign researcher who had spent a career immersed in my culture (I live in the United States) could well have more insight into how pieces of it fit together than I would.

<comment><USER12> I imagine GP may have meant "marginally informed" about the company specifically - the article makes it sound like her judgment of it is based its website.

</comment></comment></comment><comment><USER13> My friend said he used this service to buy daily necessities when he was in hospital. He also said it was pretty useful. (I and he are both Japanese.)

</comment><comment><USER14> Shades of the "NEEDED: Generic Father Figure for Backyard BBQ" Craigslist ad.

</comment><comment><USER15> Makes me think I should start a website called Rent-A-Dad featuring experienced looking model types in the home page. Aimed at lonely single mothers.

</comment><comment><USER16> > Urban citizens may be desperate to get advice from an older, wiser person, > but they don't want to turn to the guy they've worked with for years or the > uncle who remembers the tears shed over a broken toy truck. Someone familiar > might judge them.

Maybe it's a cultural difference, but excepting dysfunctional relationships the idea that your close friends and family are the wrong people to give you advice is almost dystopian.

<comment><USER17> In the US, we have the understanding bartender or wise taxi driver stereotype. This seems like largely the same thing: somebody with some perspective on your situation because they aren't too bogged down with the minutiae of actually knowing you very well who can "buck you up" or dash off an insight that your spouse or friends can't.

<comment> S-E-P They make you comfortable as they attempt to give insight to something they don't understand, but it's not too personal and since they know little about you, there's not much room for judgement.

Kind of like a one night stand, same principle (though much like a real relationship is much more rewarding, it's also a lot more work, the parallels here are fairly apparent)

<comment><USER18> Yeah. It's amazing how much good you can do for someone just listening to them. It's "rubber duck debugging" in our industry, but the principle can be applied to your general life too.

It's also amazing how much good you can do for someone by just listening to them for a bit, and then deploying the correct platitude. No originality, no great wisdom, just the right thing said at the right time, from someone whom the listener doesn't have years of emotional callouses, defenses, and preconceptions built up to prevent them from hearing the simplest of words without hearing the echos of years past.

With a bit more effort you can do even better, of course; I'm not trying to oversell the goodness. I'm saying the _bang for the buck_ can be surprisingly good for people.

</comment></comment></comment></comment><comment><USER19> they have cuddle rooms as well, so this doesn't really surprise me either</comment>


Show HN: AWS Product Announcements, but without boring stuff - <AUTHOR> https://awsnews.info/ <comment><AUTHOR> Hey there, Vlad, the creator of [https://awsnews.info](https://awsnews.info) here.

One day I realized that ~30% of AWS product updates updates are some boring stuff like "some service just launched in another region" or "you can now add tags to your appsync api", etc.

So I decided to create a website which filters all the noise out and brings a more pleasant UI than [https://aws.amazon.com/new/](https://aws.amazon.com/new/)

Tech Stack:

* Frontend: React App built with Next.js

* Hosting: AWS S3 + AWS CloudFront

* Backend: AWS Lambda + AWS DynamoDB + AWS API Gateway

<comment><USER2> Good job, sir!</comment></comment>


Stitch Fix Algorithms Tour - <AUTHOR> http://algorithms-tour.stitchfix.com <comment><USER2> I was just talking with my wife about this tonight. We were discussing the 20$ styling fee that is charged each month, regardless if you keep any of the pieces selected. The idea portrayed to their customers is that is a 'styling fee' for the human that hand picked the box of clothes specifically for her. "If I was setting up this business today", I speculated, "I'd just use ML and algorithms to do this."

Ironic that two hours later I'm reading this. Granted, it does say that humans are involved. However, they point out that the requests made by customers are analyzed for key words to identify which pieces would match. Earlier my wife argued "I can tell Stitch Fix that I'll be going to Vegas for a wedding and will need a dress. Would an algorithm hand select a dress for warm weather?"

"No" I replied, because an algorithm has no hand. Other than that, the answer is yes. No need to start a fight though :)

</comment><comment><USER3> I tried out Stitch Fix expecting to return everything, wiling to eat the $20 fee. I have to say I am surprised with how well they have done, I have ended up keeping a fair amount of the stuff. Most impressive is how they can find pants that fit me.

Of course I've been wondering the entire time how their data operation works behind the scenes, so this post is really enlightening, cool graphics too... and only some minor scroll jacking.

</comment><comment><USER4> My wife and I have been using Stitch Fix for six months. The first box was magical, especially the fix for pants (as @xb noted). Part of difficulty (and noise) for SF feedback is that you get a discount if you keep the whole box. There's been a few items that I would return if I had to pay for it, but the discount i received covered the cost of the item so I kept it. That seems to mess with the feedback loop. The main complaint I have about SF is that after the fist few boxes it feels repetitive. The clothes all start to look alike. I now own three color variations of the same plaid shirt and two sets of the same shoe in different colors. My wife's complaint is that the 'I don't like pink' request made multiple times was ignored. She sent back the entire box last time. I will try and give them feedback and see what happens.

</comment><comment><USER5> I'm still wondering why google is so bad at finding me e.g. a pair of jeans of a specific brand and of a specific size.

<comment><USER6> Too broad a tool for such a specific search. With that being said, they _should_ have the data if merchants submit them via their product feed api. I too have always found google's product search capabilities to be lacking.

<comment><USER5> It is certainly lacking. Especially considering that Google is, as they say, using my personal data to offer me a better search experience. I'm starting to wonder what they are talking about if they can't even find me a pair of fitting jeans.</comment></comment></comment>


How Google CEO Larry Page Understands Search - <AUTHOR> http://www.huffingtonpost.com/2011/06/14/how-google-ceo-larry-page-search_n_877112.html

<comment><AUTHOR> also, related story @ [http://www.sfgate.com/cgi- bin/article.cgi?f=/g/a/2011/06/14/...](http://www.sfgate.com/cgi- bin/article.cgi?f=/g/a/2011/06/14/businessinsider-how-larry-page-thinks-about- search-2011-6.DTL)</comment>


Considering the correspondence between CEOs and shareholders as a literary genre - <AUTHOR> http://www.newyorker.com/magazine/2016/09/05/jeff-gramms-dear-chairman-boardroom-battles-and-the-rise-of-shareholder-activism <comment><USER2> Great read, but it really peeves me that the article cites the 76ers terrible, losing record and paints this as managerial failure on Hinkie's part. Instead, the 10-72 record _was_ a very obvious step on the road to "the vista", because it enabled them to draft the number one rookie this year, which is exactly what the author claims is "fine": to have a long term plan, as long as the end goal is profit. (This has nothing to do with the main narrative of the article, but the presentation of Hinkie as a man unsuccessful at long term planning made me uncomfortable). I understand the larger point, though (or maybe this is just a prime example of the gell-mann amnesia effect).

<comment><USER3> Hinkie had a great long-term plan. So effective, in fact, that the NBA is considering banning the tactics he used. In order for the 76er's to build a good team, he had the team perform intentionally poorly, stocked up on good draft picks, and waited out the storm.

Now the 76ers have some of the most promising rookies in the draft, lots of high value assets they can leverage to trade, and a bright future.

</comment></comment><comment><USER4> I'm amazed to see the New Yorker waffle about the size of the New Madrid earthquakes ("seismologists agree it was one of the biggest earthquakes, estimated at between 7.0 and 8.8").

Current consensus puts the biggest New Madrid quake at 7.6. Earlier estimates above 8.0 were due to a failure to appreciate how well Midwestern bedrock transmits seismic energy.</comment>


Argh-P-M – Dissecting the RPM file format (2016) - <AUTHOR> https://blog.bethselamin.de/posts/argh-pm.html <comment><USER2> I've authored many RPM packages, it's dead simple. Have a spec file, tar it, and run rpmbuild on it.

I don't really know why this guy was freaking out.

I also like the fact that transient dependency and repo handling is separated from the package handler itself. We have rpm to handle a single package, and we have dnf (yum) to handle trees of packages.

<comment><USER3> > I don't really know why this guy was freaking out.

That's clearly explained in the article. This is not about authoring from a specfile, so your comment is off. He wants to serialise a package into RPM without the traditional toolchain; it turns out to be much more difficult than the other serialisers he already has because of the rpm format's bad design decisions and accretions.

<comment> yjftsjthsd-h I don't think they're bad decisions; I think he has no idea _why_ it's that way and so is _assuming_ that it's terrible. The RPM format was designed when computers were smaller and slower, and is extremely flexible while forcing you to declare enough that it can validate the file contents as it goes. It's over-engineered, and there are certainly things I would change, but it's not just random stupid decisions. If you can't think of any good reason why it would be written the way it is, the main options are that you're missing something or the original spec authors were stupid. Of course, sometimes they were stupid, but maybe don't immediately assume that after your very first investigation into the format.

<comment><AUTHOR> The Deb file format was designed even earlier, yet it doesn't contain a matryoshka of metadata.

<comment> yjftsjthsd-h Debian under-engineered, Redhat over-engineered. In perfect hindsight, Debian probably made better tradeoffs, but that's only with decades of hindsight.

<comment><AUTHOR> I don't see how Debian under-engineered. Does it not fulfill its needs?

Plus, RH could have decided to make a proper v2 rather than build this lasagna of a format.

<comment> yjftsjthsd-h I suppose "under" is perhaps a stronger term than I really want, since it did in fact work out. I agree that Debian, indeed, fulfilled exactly what it needed, but _only_ what it definitely needed right then; a minimum viable product that turned out to be sufficent. RH built for everything that they could imagine ever needing, and left options to extend for anything they didn't think of in advance. Perhaps "just enough"-engineered vs over- engineered?

<comment><AUTHOR> I disagree, RH did not in fact built it for everything; if they had, they would not need headers-inside-headers or fixed "nonsense" values. What they build is an over-engineered yet _incomplete_ format, but also inflexible, so they had then to pile hacks upon it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> That's funny, I've always thought that the various Linux distribution using different packaging format was a huge waste of resources and wanted everyone to standardize on RPM. After reading this article, I still thinks it is a waste of resources but I'd prefer that everyone standardize on .deb not RPM!

</comment><comment><USER5> Almost no one who uses RPMs needs to know the internal format, and if they do they should use rpmlib (or rpm2archive if they just want to unpack the files). Does anyone not use JPEG because they think the internals of JPEG binary format are a bit complicated?

<comment><USER3> The point of the exercise was to not use rpmlib. The comparison to JPEG is inappropriate because it has dozens of interoperable implementations.

Formats defined by a single implementation are sickly and much less viable (remember the lessons of [http://libmng.com/](http://libmng.com/) ?); I applaud the reverse engineering effort from the article.

</comment></comment><comment><USER6> To plug it here: If you want to build an RPM via Maven (or just want to build one with Java using the underlying lib)

[https://github.com/ctron/rpm-builder](https://github.com/ctron/rpm-builder)

</comment><comment><USER7> True, RPM is pretty messed up as far as complexity.

But, let's consider that I have never had an RPM-using system have its package database corrupted beyond repair (you can rebuild it with rpmdb --rebuilddb), and unlike dpkg/deb, rpm fully supports downgrading packages, which is something I have missed on Debian multiple times.

RPM is too complex, but it's also a good format from a reliability standpoint.

<comment><USER8> > I have never had an RPM-using system have its package database corrupted > beyond repair

you've had that on Debian?

> rpm fully supports downgrading packages, which is something I have missed on > Debian multiple times

Huh? Downgrades are fully supported by dpkg and apt*.

<comment><USER7> > Huh? Downgrades are fully supported by dpkg and apt.

No, they aren't. You need to remove the newer version prior to installing the old one. RPM based systems allow you to downgrade to an entirely different distro release with one command.

> you've had that on Debian?

More than once, sadly.

</comment></comment></comment><comment><USER9> Yes, the RPM format is crappy. A normal person would have seen that quickly (or known it already), gotten their business done, and moved on. What's the point of dissecting every little piece to criticize, or of criticizing even the oversights or practices normal for their time as much as the things that are truly insane? It's just rage-bait.

<comment><USER10> To learn from past mistakes, probably. If you want to create something better, you first need to determine what's bad.

<comment> yjftsjthsd-h You also need to understand how it got that way. In this case, a lot of the things the author takes issue with are a combination of eternal backwards compatibility, really wide portability, and having originally been devised when memory was tiny and processors were slow. It's one of those things where if you rebuilt it yourself, by the time you covered all features of the original, you would be just as ugly.

<comment><USER11> I agree. For instance, one of the things the author complains about is the rpmlib(...) dependencies. To me, they are clearly a way to make older versions of rpm (which do not know anything about these features) fail cleanly with a "missing dependency" error.

</comment></comment></comment></comment><comment><USER12> Like @nailer says, this article is under-researched and starting from a prejudiced viewpoint. However I did love one comment.

> The <rpm/rpmtag.h> header has an enum with all acceptable values, but please > consider the environment before trying to print it.

</comment><comment><USER13> there was a chance to unify linux packaging in the last year around creating universal packages - what ended up happening instead was yet another war between snap and flatpak. Everyone flaunts some superiority or another - [https://github.com/AppImage/AppImageKit/wiki/Similar- project...](https://github.com/AppImage/AppImageKit/wiki/Similar- projects#comparison)

however, it would be incredible to have a single format

<comment><USER14> If you want a universal format, you have a compressed source tar-ball. Anything else will run into the whims (and on the ground circumstances) of maintainers and admins.

<comment><USER15> Or cpio. IIRC tar had its own set of issues once you consider old Linux distros or non-Linux systems in general.

<comment> yjftsjthsd-h Fun story: I once had to exchange data with a Solaris box, and discovered that its tar had no "z" flag. Ended up just exchanging uncompressed tar files because I didn't want to figure out .tar.Z files.

<comment><USER14> .Z is compress/uncompress, no?

<comment> yjftsjthsd-h Think so. And it was probably doable, but I realized that my network connection was fast enough that the transfer would be done before I could check.

</comment></comment></comment></comment></comment></comment><comment><USER16> (2016)

<comment><USER17> Dude, it's been insane for decades

<comment><USER14> And still some of the biggest name distros use it.

There are times i wonder if IT has some innate attraction to masochism...

</comment></comment></comment><comment><USER18> The only reason RPM is still being in use is RedHat, the company, that did well to provide the very needed service for actual businesses.

There is no competition between package managers, there is only competition between distributions.

<comment><USER5> How about SUSE and Mageia?

</comment></comment><comment><USER19> This person tries inspecting the format with a hex debugger, implying he hasn't done any research. Rpm2cpio then extract the RPM file. It's a binary and a text .spec file. The spec file format is divided into sections to build, make etc the app and while ancient (like dpkg) not hard to learn.

<comment><AUTHOR> From what I can tell, spec files are just for source packages, whereas the author was analyzing (and trying to build) a binary package directly.

<comment><USER19> That's even worse. Why would you analyse a binary RPM to inspect it, when present that as a normal way to analyse or build RPMs?

> the author was analysing trying to build a binary package directly.

To analyse, there's two approaches that have been well documented for around 20 years now:

\- open the .src.rpm for a package

\- Run the rpm binary over the .rpm, which can dump spec file contents too

To build:

\- Make a spec file

Again, there's lots to dislike about RPM (my main issue is how the sections are macros and so are the autoconf macros), which confused a lot of new people) but this article in incredibly unresearched.

<comment><USER20> Keep in mind that the author tried to build an independent implementation, so your complaint is like "Why are Gecko developers wasting time on reverse- engineering websites, instead of installing Chrome?"

For this purpose it's fitting to do a deep analysis of files actually produced, rather than trust the documentation to be entirely complete and sufficient. Such low-level dump is also needed to debug interoperability issues when files produced by the new implementation are rejected by existing tools.

I'm developing cargo-deb, which builds Debian packages without need for spec files. It doesn't use Perl, and can even build Debian packages from macOS. I had to learn and reproduce the structure of the deb files, which was relatively easy. I would need to go through exactly the same horror as in the article if I wanted to add RPM support the same NIH way (so RPM tooling may be good and easy, but RPM as a format is a failure.)

<comment><USER19> If I was making something to build RPM packages automatically (like the author states), I'd still leverage the existing tools.

But even if I wanted to _recreate RPM_ which the author does (although he doesn't state this) I'd start with the source code.

<comment><AUTHOR> _although he doesn 't state this_

Yes, he does, right in the first paragraphs.

 _I 'd start with the source code._

He started with the formal specification of the RPM format, which includes relevant pieces of the source; how is that not a good place to start?

<comment><USER19> No. He states:

> I ship configuration as system packages. Every distribution has their own > tooling and process for building these packages, but I eventually grew tired > of the ceremony involved in it, and wrote my own system package compiler.

Which to most engineers would mean making a tool that builds.rpm files, not reimplements the rpm build tools.

<comment><AUTHOR> Read a bit further: _I stubbornly refused to add dependencies and use existing tooling (i.e., the rpm-build(1) command). I wanted to serialize the format directly from my own code, like I did for Pacman and Debian packages._

<comment><USER19> Yeah. That's his problem - it's not "to make matters worse" (as OP writes) it's the entire issue.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


The Fuck – An app which corrects your previous console command - <AUTHOR> https://github.com/nvbn/thefuck <comment><USER2>
      [~user/]$ rm -rf /
      rm: it is dangerous to operate recursively on `/'
      rm: use --no-preserve-root to override this failsafe
      [~user/]$ fuck
      sudo rm -rf --no-preserve-root /

_fuck!_

<comment><USER3> Rule for this behavior disabled by default, but you can enable it. Also you can disable confirmation or use `fuck -y` for more fun.

<comment><USER4> I feel like they missed an opportunity to use 'fuck yeah' as the automatic override.

<comment><USER5>
        alias just=sudo
        just fuck -me -up

<comment><USER6> This is Art. Thank you for doing Art on HN.

</comment></comment></comment></comment></comment><comment><USER7> I use this regularly, for everything ranging from the forgotten sudo (instead of running "sudo !!") to typos across the board.

But it does get me into interesting situations! Just the other day I was demo- ing something to my team + Director of Engg on the projector, and I ran an incorrect command, followed by "fuck" to fix it, leading to so many stares :P

Just as an FYI, you can change the prompt from fuck to something else by changing your .bashrc eg.:

        eval "$(thefuck-alias fixit)"

I'm not changing my alias though! ;)

<comment><USER8> funny!, next time i am demoing, i will try to do it, to show off obviously

</comment></comment><comment><USER9> I often set `alias fucking='sudo'`.

        >$ make me a sandwich
        permission denied
        >$ fucking make me a sandwich
        [or]
        >$ fucking !!

<comment><USER10> I have the same.

        # Because sometimes you gotta be harsh.
        alias fucking="sudo"

        # And sometimes you gotta be nice.
        alias please="sudo"

</comment></comment><comment><USER11> Previously discussed at [https://news.ycombinator.com/item?id=9396116](https://news.ycombinator.com/item?id=9396116).

<comment><USER12> I see why you linked that.

My brain nearly double faulted from learning new things too fast. Great thread.

<comment><USER13> Hi. Thanks for catching the JS injection and shock site redirect bug. I fixed it.

<comment><USER12> Ah, good to hear. Sorry it happened.

Since [https://news.ycombinator.com/item?id=14144814](https://news.ycombinator.com/item?id=14144814) got locked (which, to provide context for anyone else reading, is why this reply is here in this thread) maybe you could repost it now.

FWIW, this idea in and of itself is worth spending a bit of time on. The page itself is very... basic right now, and I wouldn't discount that this may be one major reason why nobody is taking the concept seriously.

Which makes sense: nobody knows what your areas of specialty and experience are, what you're capable of, and all they've got is this very barebones page. Noone knows what to suggest for you to do!!

Spending some time on the page design and specifying the kinds of things you're capable of - and, most importantly, the things you're most interested in - might just turn things around a fair bit.

Thanks for the ping :) and hopefully you see this.

I note you have not yet put any contact info on that page :P (Gmail happily forwards, and Outlook (which forwards too) also has aliases)

My email is in my profile FWIW. You could also drop your username on the page and tell people to "find your email on HN". That could be a good filter.

</comment></comment></comment></comment><comment><USER14> If you mistype _fuck_ , does it properly recurse up the _fuck_ chain?

<comment><USER15>
        > fsck
        ERROR: volume / is mounted with write access. Re-run with (-l) to freeze volume.
        > fuck
        No fucks given

</comment></comment><comment><USER16> Another step towards the Anti-Mac user interface.

[https://www.nngroup.com/articles/anti-mac- interface/](https://www.nngroup.com/articles/anti-mac-interface/)

<comment><USER17> What would be the Mac design principle way of doing this then? Would every command line tool then be an Anti-Mac user interface?

<comment><USER16> More or less helping move from 'direct manipulation' to delegation. It's not so much that this is moving away from any particular Mac principle so much as towards the sort of system outlined in that essay.

</comment></comment></comment><comment><USER18> Would be nice to have some form of autocorrect directly in the shell, especially if it was aware of common programs and so could also autocorrect options. Obviously we could think of a few cases with destructive outcomes-- but that doesn't make it a bad feature.

git stauts

I mean, git knows enough to ask me "Did you mean this? status".

<comment><USER19> Add this to gitconfig file. It will automatically run the correct command after displaying what it is after a delay.

The value is in 0.1s (centiseconds) of seconds. So 20 means 2 seconds.

[help]

autocorrect = 20

OR run git config --global help.autocorrect 20

<comment><USER20> Wouldn't those be deciseconds? Also wtf unit. Use Millis or seconds as a float. Yay Linus making sure that git only makes sense to wizards like him.

<comment><USER21> The Linux kernel seems to have a centisecond obsession too. Probably from way back when HZ was 100 and your computer woke up once every centiseecond to make sure it still had nothing to do.

</comment></comment></comment></comment><comment><USER22> This will definitely help some co workers who aren't CLI-savvy and always tell me their commands "didn't work".

<comment><USER23> You have the problem too? Everyone comes to me when the get a conflict because they don't read the part that says when you're done, do `git rebase --continue`

</comment></comment><comment><USER24> An oldie that has been passed around in various incarnations since the 2000s is an alias also called fuck which repeats the last command with sudo. Either coincidence or perhaps it could be where the inspiration for this project came from.

        alias fuck='sudo $(history -p \!\!)'

</comment><comment><USER25> Didn't this appear on Hacker News years ago? I have been using it since and absolutely love it!

<comment><USER26> wow yeah, this is what, 2+ years old?

</comment></comment><comment><USER27> My favorite shell typo: dicker instead of docker. More funny if you speak German :)

<comment><USER28> Reminds me of [http://anafenza.tumblr.com/post/154944486277/humming-bird- mo...](http://anafenza.tumblr.com/post/154944486277/humming-bird-moth- discoursestorm)

</comment></comment><comment><USER29> Love it, have thought about it, but my one concern always is that it'll lead to a decrease in my typing skills instead of reinforcing good keying. But fuck, I just need to get stuff done sometimes.

<comment><USER30> Personally my typo rate has held pretty steady over the last decade, I don't think something like this would have any measurable effect on how well one types.

My concern would be that the extra keystroke to confirm would ingrain the skip confirm (fuck -y, or even just hitting enter before I'm prompted again) into my muscle memory, with potentially disastrous consequences (hence I've never installed this tool).

</comment></comment><comment><USER31> Is this any easier though than the using the carat style previous command substitution?

        ^bar^baz

Although I think the name might be more descriptive.

<comment><USER32> I don't understand how you think anything is easier than typing 'fuck' and have it identify and correct your mistake for you?

<comment><USER31> Lets see in order to use "fuck" I need to first install it and its dependencies. The caret substitution natively exists in the Bash shell.

Also I know that no matter what system I am on be it OS X or Linux the caret syntax is guaranteed to work.

I don't understand how you think anything can be easier than using the functionality that has existed in the Bash shell shell(or even C shell variants)since forever.

<comment><USER33> If that were how things worked, we'd never use any new technology. Obviously it is easier to pay a one-time up-front cost than to slog away inefficiently forever.

<comment><USER31> >"If that were how things worked, we'd never use any new technology"

Nice try. That's a straw man. This isn't new technology. Its simply replicating existing functionality.

>"Obviously it is easier to pay a one-time up-front cost than to slog away inefficiently forever"

Whats the average typo 1 character as in most of the demos for "Fuck"? So I can either type 2 carets and 4 letters for a total of 6 characters or I can type the 4 characters in the word "fuck", how is the former inefficient? Wow, what a slog. I can't imagine what I will do with all the time I will have left over after installing this"

<comment><USER34> Speaking of straw men, this program does more than simple typo substitution. The listed examples include prepending sudo and using git-suggested commands.

<comment><USER31> >"The listed examples include prepending sudo"

Which you can get by typing:

        sudo !!

and git completion is in contrib:

[https://github.com/git/git/tree/master/contrib/completion](https://github.com/git/git/tree/master/contrib/completion)

Not really a strawman is it?

<comment><USER34> Well, yes it is, because again, I was just giving examples. Look at the list under "how it works" in the readme, and there's plenty of items there that aren't simple substitution. It'd be a lot easier to just 'fuck' for most of those than have to mentally parse what you need to do to 'fix it'.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> This is wonderful.

</comment><comment><USER36> Every day:

$ git pish

$ fuck

<comment><USER37> alias gp="git push" has probably saved me hours of my life

<comment><USER7> Amen.

My bashrc has so many of these, and they're probably among the most common commands I use daily!:

        alias gs="git status"
        alias gb="git branch"
        alias grh="git reset --hard"
        alias gcdf="git clean -df"
        alias gf="git fetch"
        alias gp="git pull"
        alias gdom="git diff origin/master"
        alias gdomn="git diff --name-status origin/master"
        alias gd="git diff"
        alias gl="git log"
        alias glm="git log --author <my_name>"
        alias gc="git checkout"
        alias gcm="git checkout master"

<comment><USER38> Or how about git commit with a dummy message? :)

<comment><USER39> Like this?

      $ cat << EOF > ~/.commit_reasons; strfile ~/.commit_reasons
      Testing...
      %
      Testify...
      %
      Testarossa...
      %
      Does it work yet?
      %
      How bout now?
      %
      Oops.
      %
      Fixed a thing.
      %
      EOF

      $ fortune ~/.commit_reasons | cowsay | git -F -

<comment><USER40> Even better: [https://news.ycombinator.com/item?id=5666160](https://news.ycombinator.com/item?id=5666160)

</comment></comment></comment></comment></comment></comment><comment><USER41> Now do ffmpeg! (Seriously I would pay for autocomplete ffmpeg cmd line options)

<comment><USER3> It can't help with autocomplete, but I guses it would be easy to create a rule for fixing incorrect ffmpeg calls.

Create an issue about that in [https://github.com/nvbn/thefuck/issues](https://github.com/nvbn/thefuck/issues)

</comment></comment><comment><USER42> This seems fairly similar to the command auto-correction in Oh My Zsh.

<comment><USER43> It's zsh itself, not Oh My Zsh, controlled via the `correct` option.

<comment><USER42> Thanks, I wasn't too sure. I have always used them together!

</comment></comment></comment><comment><USER44> I use this app SO MUCH and recommend it to everyone. Great work!

</comment><comment><USER45> What if I misspell the word "fuck"?

</comment><comment><USER46> cursing is now provably productive

</comment><comment><USER47> It's a nice utility. But I stopped using it because it keeps messing up my bash history.

</comment><comment><USER48> +1 for not being PC

<comment><USER49> Actually, it does appear to work on PCs.

<comment><USER50> I think you are joking, but he meant PC as in Politically Correct</comment></comment></comment>


How to Be a Learning Machine - <AUTHOR> https://medium.com/@ruizhidong/how-to-be-a-learning-machine-7565aa22f54 <comment><USER2> Number of books read isn't the goal. The goal is reading outstanding books with such intensity that you exhaust what can be taken away from them.

One of those books, by the way, is How To Read a Book, by Mortimer Adler. Check out my notes here: [http://alvaroduran.com/how-to-read-a- book](http://alvaroduran.com/how-to-read-a-book)

<comment><AUTHOR> Cool! Will read your post and the book. Thank you</comment></comment>


Ask PG: Can we have another bar to mourn the passing of Dennis Ritchie - <AUTHOR>

<comment><USER2> Already there, aren't you able to see it ?

<comment><AUTHOR> Isn't that left over from Steve Jobs passing?

<comment><USER3> I don't think you lower a flag, that's already at half-staff, to quarter- staff.</comment></comment></comment>


Ask HN: How Does the FreeBSD Ports Collection Work? - <AUTHOR>

I am a long-time Debian/Ubuntu user looking to get started on a FreeBSD system. I am a little confused by how the Ports Collection works because it seems like all supported ports are stored on the system. Doesn't this take up a massive amount of space? How does the FreeBSD Ports Collection package manager implementation compare to dpkg on Debian systems? I'd appreciate any resources or guides! <comment><USER2> On BSD systems, the ports collection is simply a directory tree containing some fairly small text files. The various text files in a given port (subdirectory) include Makefiles, patches, description files and checksums. When you run `make` in a port subdirectory, the target software source code is downloaded, patched, built, installed into a "fake" directory tree emulating a target system, and then finally all of the stuff it just installed is gathered up into a compressed "package" archive. In short, the ports are used to create packages.

If you're new to BSD systems, it's much easier to use the pre-built packages.

[https://www.freebsd.org/ports/](https://www.freebsd.org/ports/)

[https://www.freebsd.org/doc/handbook/ports- using.html](https://www.freebsd.org/doc/handbook/ports-using.html)

<comment><USER3> Also, it's worth pointing out that the use of the ports collection is optional in modern BSD, as you can install anything that's in ports directly as a package instead using pkg.

<comment><USER4> The ports give you the option to configure the build, where as pkg uses preset options, correct?</comment></comment></comment>


How Futures Trading Changed Bitcoin Prices - <AUTHOR> https://www.frbsf.org/economic-research/publications/economic-letter/2018/may/how-futures-trading-changed-bitcoin-prices/ <comment><USER2> I'd offer a much simpler explanation. The buzz around Bitcoin reached a critical mass where people at home with no knowledge of cryptocurrencies or blockchain technology suddenly got caught up in a bubble. As the interest increased so did the price so it became a feedback loop.

People saw their friends and coworkers talking about huge gains and wanted to get in on it. Coinbase allowed anyone with a smartphone and a checking account to buy Bitcoin which further drove up the price. Meanwhile the supply was only going up incrementally. So you had a huge swell in demand and no corresponding increase in supply. This resulted in the price increase.

Then when the supply of buyers slowed down there were more sellers than buyers and the price dropped. This is the most classic form of a bubble and I'm surprised that people are looking for alternate explanations, like the introduction of futures, which I find absurd. If it were so easy to predict a crash simply because you now had a vehicle to short it, everyone would have done so. There are ways to short most securities that are traded and yet not all securities collapse in value. The author cites two examples of extreme bubbles- the subprime mortgage market and Bitcoin in late 2017- and blames the crashes on the creation of vehicles to short them. In reality the mortgage market didn't crash until people started defaulting on debt en masse and the vehicles to short the mortgages existed a long time before the market crashed.

<comment><USER3> > I'd offer a much simpler explanation. The buzz around Bitcoin reached a > critical mass where people at home with no knowledge of cryptocurrencies or > blockchain technology suddenly got caught up in a bubble. As the interest > increased so did the price so it became a feedback loop.

Yes. Those bubbles happen regularly in the Bitcoin world. Maybe the futures had some impact, but even without futures a bubble will eventually end in a crash.

December was crazy. I had several non-tech friends ask me how to buy Bitcoins. I strongly recommended against buying, but at least one of them still used a leveraged trade on some sketchy platform to buy. Needless to say that it didn't take long until the volatility wiped out 100% of his investment. I'm against regulation but seeing first hand how financially illiterate people behave I'm not opposed to a minimum level of regulation - e.g., why do retail investors need access to leveraged trading?

<comment><USER4> Non-accredited investors don't legally have access to leveraged trading in the US -- many were using it illegally and/or violating ToS of various exchanges. But overall, leverage was not what caused the bubble or the majority of the losses. The fact of the matter is that trading is mostly a zero sum game, and your typical emotional, uneducated retail 'investor' doesn't stand much chance of scalping a substantial profit from people and organizations who are either A. long term investors that bought very cheap and unloaded during huge rallies and more so B. professional traders that provide liquidity for the market and make extra money when retail emotion and high volume increase volatility.

You could ban casinos, the lottery system, as well as a number of economically necessities such as credit cards, publicly traded market systems, etc., and you STILL would be unable to protect some people from their own poor financial decisions.

So I say, as long as fraud in these markets is punished and disincentivized, there isn't much more to be done.

</comment></comment></comment><comment><USER5> This seems like it may be a victim of the narrative fallacy, trying to make this one simple narrative explain the results of a complex system (the bitcoin market).

Everyone has a pet theory as to why bitcoin crashed: regulation, "whales" selling large volumes at once, institutional investors, Futures trading, etc.

What's the real reason? It's probably a combination, and almost certainly more complicated that solely "bitcoin futures."

<comment><USER6> I totally agree. Current pattern is very similar to the four-five previous bubbles, which the author doesn't seem to take into consideration or even be aware of.

Besides, futures trading has existed a long time on chinese platforms before CME and CBOE joined the party.

It really is a waste of time to speculate why bitcoin price is going up or down on such timescale.

<comment><USER3> Also Bitcoin has been declared dead 299 times already: [https://99bitcoins.com/obituary-stats/](https://99bitcoins.com/obituary- stats/)

Maybe the futures will have some impact, but I wouldn't be surprised if in hindsight it will turn out that futures didn't have any impact at all.

</comment></comment></comment><comment><USER7> I don't know why people are still surprised by this. There are a _lot_ of people in powerful places that want Bitcoin to fail and die. Futures markets introduced a regulated way for them to make that happen.

Buy up a ton of Bitcoin during the lead up to futures trading, then short Bitcoin on the futures market while market selling thousands of the cheaply acquired Bitcoin on spot exchanges. You succeed in lowering the price of Bitcoin, killing the public's perception of crypto currencies, scaring away retail investors, and you make a killing in the process.

JPMorgan has been using futures markets to manipulate Gold and Silver spot prices for years while also accumulating huge amounts.

Look at an early article that was published prior to the launch:

[https://www.coindesk.com/cme-groups-leo-melamed-well-tame- bi...](https://www.coindesk.com/cme-groups-leo-melamed-well-tame-bitcoin/)

It was all planned ahead of time for Wall Street to get maximum profit at the expense of regular people. What else is new.

<comment><USER8> It's a good thing that Bitcoin's inherent scalability and utility as a currency makes it resistant to such manipulation.

<comment><USER9> Can't tell if sarcastic or not

<comment><USER10> Clue: it is sarcastic.

</comment></comment></comment></comment><comment><USER11> >> the mining cost of bitcoin should not affect its value any more than the cost of printing regular currency...

This is a frequently made logic mistake. Proof of work determines the value of the currency strongly because it is inherently interconnected with the sustainability of the underlying network operation. That is why it is often explained as "the ledger is the currency".

Mining is not only for creating new coins but also for validating transactions and propagating of the ledger.

Therefore cryptocurrency is a different paradigm where direct comparisons are not always possible and result in wrong conclusions.

<comment><USER12> Sorry but the complete opposite of everything you say is true.

Hashrate follows price only. Very rarely will the hashrate effect price

Miners have no say in what is a valid transaction. Mining system had only one purpose. To make sure miners have no say on what is a valid transaction

Miners have no control over how new coins are made. They disempower themselves by competing for the protocol dictacted reward

<comment><USER11> Don't want to go in a discussion and maybe you are completely right, but to my understanding:

Miners collect the transactions on the network into large bundles called blocks. These blocks are strung together into one continuous, authoritative record called the block chain.

Miners create blocks of transactions, and they have to create them in such a way that the rest of the network will accept them. One of the requirements is that the transactions in the block are all valid transactions. So yes, miners will validate transactions before they add the transaction to a block. If the miner cheats, and puts an invalid transaction into a block, then the rest of the network will reject that block, and the miner would have wasted their time doing the proof of work on that block.

[https://bitcoin.stackexchange.com/questions/148/what- exactly...](https://bitcoin.stackexchange.com/questions/148/what-exactly-is- mining)

<comment><USER12> Yes you're right. But people's first analysis is to give too much weight to miners

The protocol decides what is a valid transaction and the users enforce it.

If miners decide what is valid the price of bitcoin goes to zero. They are a slaves to the protocol and that is the only reason that the mining mechanism works. Miners disempower themselves by competing

</comment></comment></comment></comment><comment><USER13> Fake news, both CME and CBOE Bitcoin futures have very anemic volume. It is mere coincidence than the bubble popped shortly after the debut.

<comment><USER14> I'm not sure why you are getting downvoted. The OP is not providing any proof whatsoever of the CME futures influence.

Yes their volume is tiny compared to the unregualted market I can hardly think it'll have any effects.

</comment></comment><comment><USER15> Anecdote: the bozo content of the securities market went down after crypto. Particular in private equity and venture capital. The segregation of low- information traders in the crypto space may have made other markets more reliable.

</comment><comment><USER16> Well it might be correct in this case, but I'm not sold on there being a general connection between stuff getting shortable and the price going down. There's only one example given, and the mortgage market is not a great comparison since it didn't suddenly get its own futures. And there were plenty of ways for institutions to bet against mortgages OTC.

<comment><USER17> > Well it might be correct in this case, but I'm not sold on there being a > general connection between stuff getting shortable and the price going down.

Reallly?

Consider this.... If no one can short something then all you can do is ignore or like it. In that case it only takes one investor to make the price go up.

With shorting you get a much more accurate view of what people value something at as you can bet on the downside.

More importantly it allows for arbitrage, which is the very market force that keeps our prices accurate.

Shorting doesn't mean prices will always go down, you could have shorted China to disastrous results in the past 4 years but it does cause a dampening effect in prices.

Or maybe a more direct example, if shorting doesn't have any effect on prices decreasing then why do many markets have a short sale rule?

If shorting doesn't have a connection to prices going down, why did the US prevent shorting of financial stocks during 2008?

<comment><USER16> Sure, I understand those ideas. Just saying the example given was weak.

Weak for what it tries to support, in any case. You still have to explain how things went up so much when it was known futures were about to start trading, and why it would go down so much right after. Why would people be buying it like crazy if it was a generally known thing that when something becomes shortable, it goes down?

Maybe look at the introduction of other exchange traded futures rather than an OTC market.

Long term it matters whether things can be shorted, of course. But they're trying to say a very specific turn in the market was caused by this. And like the other poster says, it's not even true that it wasn't shortable.

</comment></comment></comment><comment><USER18> This is like saying when CME started trading weather contracts in 1999 it caused global climate change.

[http://www.cmegroup.com/trading/weather/temperature/us- month...](http://www.cmegroup.com/trading/weather/temperature/us-monthly- weather-heating_contract_specifications.html)

<comment><USER18> I don't understand the downvote.

If a future is cash settled it doesn't exert pressure on the underlying. No matter how many weather contracts you trade you can't change the weather.

</comment></comment><comment><USER19> Not one mention of an ETF (ie the availability of bitcoin to retail investors). The large run up in December was in anticipation of multiple bitcoin ETFs by major companies, the futures market was just the appetizer. And the fall was caused by the SEC putting them on hold.

<comment><USER20> not true. That happened in early-mid 2017. Yes, there were more applications late in the year, but the run up in Nov/Dec was just mania (Coinbase #1 on app store). Yes, volume manipulation, tethers, etc, etc, but that retail speculator mania was the main thing.

</comment></comment><comment><USER21> What is this guy talking about (from the article):

For example, they could sell a promise to deliver a bitcoin in a month's time at a lower price than the current spot price and hope to buy a bitcoin during the month at an even lower price to make a profit.

All BTC futures contracts are cash settled, there is no underlying asset being exchanged.

<comment><USER22> It could be more clear, but the strategy is the same. Sell a contract now and hope to buy it back cheaper in the future. It doesn't matter too much how it's settled.

<comment><USER18> > It doesn't matter too much how it's settled.

It matters very much how it is settled. Right now BTC drives the price of the future, but there isn't a mechanism for the price of the future to pressure the price of BTC.

<comment><USER22> You don't have to play in arena one or the other. You can say, hedge a long BTC position by selling futures contracts. Or if the markets get out of balance you can buy in one and sell in the other until they come into sync. If you sell a bunch of over priced futures you will want to buy a bunch of BTC to balance the book and that will move the price of BTC.

<comment><USER18> But if I have an unhedged futures position and I don't buy or sell BTC — and because it's cash settled, I never have to — I can't directly affect the price of BTC.

<comment><USER22> You're buying or selling the future position with another party and cannot control what they are doing. Most futures are cash settled and they affect markets all the same. Nearly $200b worth of S&P 500 E-Mini contracts traded _today_ and not a single share of stock will be directly involved in those contracts. But you better believe they move the market (just watch what happens when a monster ES order hits the tape).

</comment></comment></comment></comment></comment></comment><comment><USER23> author very erroneously throws in a number of $250 in 2015 cost of mining while discussing fundamental value seemingly unaware of minig difficulty and halving.

</comment><comment><USER24> TLDR: Bitcoin futures enabled short-selling which puts downward pressure on Bitcoin prices.

<comment><USER20> CME and CBOE volume paled (and still pales) in comparison to Bitmex, where traders can and did short Bitcoin well before the regulated markets launched.

</comment></comment><comment><USER18> This is an astonishingly bad piece of analysis.

The CME contract on bitcoin futures DOES NOT EXERT DOWNWARD PRESSURE on the spot price. Bitcoin futures are cash settled in dollars. "Bitcoin futures are financially-settled and therefore do not involve the exchange of bitcoin." [[http://www.cmegroup.com/education/bitcoin/cme-bitcoin- future...](http://www.cmegroup.com/education/bitcoin/cme-bitcoin-futures- frequently-asked-questions.html)] . Therefore when you buy a bitcoin future you exert as much pressure as betting on the NBA finals affect the outcome. There is a perhaps a media effect, but that is of second or third order.

If one were able short bitcoin, or one had to deliver or receive bitcoin on tract expiry, that would create downward pressure.

Similarly the authors contention that it was the growth of asset backed CDS which brought an end to the housing market bubble is simply not true either. ABCDS had been traded in volume for a long time before the crisis. The proximate cause was (as it almost always is) credit and leverage. When the liquidity dried up, the prices came crashing down.

<comment><USER22> Traders aren't limited to one market or the other and there are plenty of arbitrageurs who will buy/sell futures and do the opposite in the spot market to squeeze out any discrepancies. If the futures are "expensive" you sell them and buy BTC. Reverse if they are "cheap".

<comment><USER18> Where can you short BTC in the spot market?

<comment><USER22> Some overseas exchanges allow it (Bitfinex probably the largest), but that would also introduce some counter party risk. Large owners of BTC could be playing in the futures market or loaning their stake to hedge funds / prop shops.</comment></comment></comment></comment>


Ask HN: if you can learn only 1 programming language to make a living... - <AUTHOR>

To make a living over next 10yrs, what would it be and why did you choose it? <comment><USER2> Obj-C/iOS SDK or Java/Android SDK, unfortunately...

At least, if you want to do non-web development.

<comment><AUTHOR> I'm actually an ios dev, and looking to branch out.

</comment></comment><comment><USER3> It doesn't matter, each of them would do, no matter how niche if you can become really good at it.

...but if you can learn only 1 programming language, you won't.

</comment><comment><USER4> C++,Python, PHP & Ruby as I <3 building Web Apps

</comment><comment><USER5> Python most def :-)

</comment><comment><USER6> \- Can you create a poll for this? I will like to know people's choices.

<comment><AUTHOR> That would be ideal, but I don't have enough points to create a poll yet.

</comment></comment><comment><USER6> \- Java.</comment>