What do dynamic linking and communism have in common? - <AUTHOR> http://blogs.sun.com/rvs/entry/what_does_dynamic_linking_and

<comment><USER2> Debian, interestingly, has recently had a push exactly in the opposite direction, mainly for the "fixing bugs once fixes them everywhere" reason. Over the years a lot of packages have for various reasons statically linked in private copies of a library (sometimes on purpose, sometimes just because upstream did so), which causes the Debian security team no end of headaches, because they have to track down all of these and fix them if there's a security-relevant bug. Since Debian Stable tries not to push too many updates unless absolutely necessary, it also screws things up there, because instead of updating one package for one library's bug, they have to update all N packages that made private copies of the library, so sysadmins expecting rare, infrequent security fixes instead get presented with a big pile of packages that want to be updated.

<comment><USER3> This idea scares me a bit. Mostly for the rare awful occasions when people either rely on buggy behaviour, or patch around it on the caller side in some unexpected way.

I can see it making perfect sense for security updates, but if you have it then you have it for all library updates - security or not.

<comment><USER2> Yeah, though I think it's mitigated a little bit with a managed-as-a-whole system like Debian, at least if there's communication. Sometimes things break, but sometimes things do actually work, and the maintainers will talk to each other to coordinate updates, inform each other when a change is likely to break other things, etc.

</comment></comment></comment><comment><USER4> Like any technical measure, dynamic linking comes in good and bad flavors.

I generally like the idea of proper software libraries, shared code, and the one-place-to-fix-them-all mentality. For many things, that's the way it fits. However, what I don't like is the tendency to turn nearly everything into a library, even within a single program. For example, check out the directory /usr/lib/firefox-3 _; on my setup there are 15 different shared objects—all used by the one single executable. The same goes for a program that's merely a driver for a set of custom shared objects. And for frameworks such as Gnome: I'm pretty sure_ gedit* doesn't have to depend on 57 shared objects like mine does.

Dynamic linkage is good for linking through solid APIs. Like libc. Or OpenGL. Maybe some high-level compositions of Gnome or other desktop stuff. Generally, such stuff that rarely changes; stuff where the gestation period between version N and N+1 is years. However, dynamic linkage is bad for merely splitting code into manageable chunks. For that, just use static libraries for that and link them all together.

<comment><USER5> gedit is pretty complex.

        libgtksourceview-2.0.so.0
        libgconf-2.so.4
        liblaunchpad-integration.so.1
        libgtk-x11-2.0.so.0
        libgdk-x11-2.0.so.0
        libatk-1.0.so.0
        libgio-2.0.so.0
        libgdk_pixbuf-2.0.so.0
        libcairo.so.2
        libpango-1.0.so.0
        libgobject-2.0.so.0
        libgmodule-2.0.so.0
        libgthread-2.0.so.0
        libglib-2.0.so.0
        libX11.so.6
        libSM.so.6
        libm.so.6
        libpthread.so.0
        libc.so.6
        libICE.so.6
        libpangocairo-1.0.so.0
        libxml2.so.2
        libORBit-2.so.0
        libdbus-glib-1.so.2
        libdbus-1.so.3
        librt.so.1
        libXcomposite.so.1
        libXdamage.so.1
        libXfixes.so.3
        libpangoft2-1.0.so.0
        libfreetype.so.6
        libfontconfig.so.1
        libXext.so.6
        libXrender.so.1
        libXinerama.so.1
        libXi.so.6
        libXrandr.so.2
        libXcursor.so.1
        libdl.so.2
        libpcre.so.3
        libresolv.so.2
        libz.so.1
        libselinux.so.1
        libpixman-1.so.0
        libdirectfb-1.2.so.0
        libfusion-1.2.so.0
        libdirect-1.2.so.0
        libpng12.so.0
        libxcb-render-util.so.0
        libxcb-render.so.0
        libxcb.so.1
        libuuid.so.1
        libexpat.so.1
        libXau.so.6
        libXdmcp.so.6

How would you improve?

Outside the duplication of XCB and the libX11 based libraries, it's hard for me to see much that isn't at least justifiable.

I understand why the X extension libraries are all broken up. But, in the modern world, it seems likely the same set get loaded time and time again. It would be "simpler" if they were all in one library.

gobject/glib/gmodule and friends could get sewn up. Same as gdk/gtk/atk.

(Though, why the hell is directfb in there?)

<comment><USER4> Here's a rough logical grouping, based on whatever I might be interested as the "end-developer"—i.e. the guy who just wants to use these libraries and not be concerned too much about how they're internally stacked together.

Note that I simply recognize many of these libraries but I'm definitely not an expert on each one, so many of them might belong to some other logical group. YMMV.

First, GUI stuff: if I want to make graphical UIs in style of GTK, then I probably want all of these and more.

      libgtkgui.so:
      - libatk-1.0.so.0
      - libgdk-x11-2.0.so.0
      - libgdk_pixbuf-2.0.so.0
      - libgtk-x11-2.0.so.0
      - libgtksourceview-2.0.so.0
      - libpng12.so.0

Font rendering: if I want to render text I'll probably want all of these anyway, preferably facaded over one high-level API.

      libfonts.so:
      - libcairo.so.2
      - libfontconfig.so.1
      - libfreetype.so.6
      - libpango-1.0.so.0
      - libpangocairo-1.0.so.0
      - libpangoft2-1.0.so.0

Basic G-stuff: if I want to use the low-level glib etc. stuff without GTK and other gui stuff, I probably want something like this.

      libgbase.so:
      - libORBit-2.so.0
      - libgconf-2.so.4
      - libgio-2.0.so.0
      - libglib-2.0.so.0
      - libgmodule-2.0.so.0
      - libgobject-2.0.so.0
      - libgthread-2.0.so.0
      - libuuid.so.1

If I want to do X development, I probably can't avoid dragging most of these with me already, and I'm not particularly interested in which libraries might I possibly need. All I want is X.

      libx.so:
      - libICE.so.6
      - libSM.so.6
      - libX11.so.6
      - libXau.so.6
      - libXcomposite.so.1
      - libXcursor.so.1
      - libXdamage.so.1
      - libXdmcp.so.6
      - libXext.so.6
      - libXfixes.so.3
      - libXi.so.6
      - libXinerama.so.1
      - libXrandr.so.2
      - libXrender.so.1
      - libdirect-1.2.so.0
      - libdirectfb-1.2.so.0
      - libfusion-1.2.so.0
      - libpixman-1.so.0
      - libxcb-render-util.so.0
      - libxcb-render.so.0
      - libxcb.so.1

The very base posix environment: I'll have to link with many of these already so it would be handy to just umbrella them into one base lib. I would also not have to remember if I need libm or libpthreads separately as is the case with slightly different Unix environments these days.

      libposixish.so:
      - libc.so.6
      - libdl.so.2
      - libm.so.6
      - libpcre.so.3
      - libpthread.so.0
      - libresolv.so.2
      - librt.so.1
      - libselinux.so.1
      - libz.so.1

These are surprisingly non-dependent on other libraries so these could be bundled into one small library. I think.

      libxml.so:
      - libexpat.so.1
      - libxml2.so.2

Not sure if this would be part of my libgtkgui.so or libgbase.so or libposixish.so, or if they would belong to something called libgnome.so, so they're left here as separate libraries.

      libdbus-1.so.3
      libdbus-glib-1.so.2
      liblaunchpad-integration.so.1

I'm pretty sure there are niche cases where you would really want to reuse a particular sub-library only, but you could just depend on the big blob anyway. You see, the common parts of the big blob are in use and in memory already as the whole thing is mapped from disk to memory. But if nobody uses a particular sub-library it won't be loaded to actual memory either until someone touches its address space.

So, instead of linking with the sublibrary directly, you could just start using it within the big library, and the same process of loading from disk to memory will then automatically happen. Conversely, even if you have a gigantic 100MB libgnome you might just generally end up having only a part of it in memory.

</comment></comment></comment><comment><USER6> The VMS operating system has had dynamic linking for thirty years or so.

A simple version identifier match scheme allows for the requirement of at least a specified version or newer of the library (not running against an older version), or flagging that an incompatible API change has been made (not running against an incompatible version).

The dynamic linking mechanism then checks this pair of identifier values that is associated with each library, and allows (or disallows) activation of the calling application.

There's also a mechanism to redirect the activation, which allows you to maintain a private version of the library. And yes, there are security implications for some cases of this redirection.</comment>


Ask HN: How do Tumblr & Posterous make money?  - <AUTHOR> <comment><USER2> I've included links to a few relevant Quora threads here:

<http://www.quora.com/What-is-Posterous-business-model>

<http://www.quora.com/Posterous/How-does-Posterous-make-money>

<http://www.quora.com/Tumblr/How-does-Tumblr-make-money>

[http://www.quora.com/How-exactly-will-Tumblr-monetize- Other-...](http://www.quora.com/How-exactly-will-Tumblr-monetize-Other-than- premium-themes)

<http://www.quora.com/Tumblr/How-does-Tumblr-generate-revenue>

[http://www.quora.com/How-do-free-blog-publishing- platforms-e...](http://www.quora.com/How-do-free-blog-publishing-platforms-e- g-Blogger-Tumblr-WordPress-make-money)

[http://www.quora.com/How-do-you-monetize-blogging-as-the- blo...](http://www.quora.com/How-do-you-monetize-blogging-as-the-blogging- platform-provider-\(e.g.-Tumblr-Posterous-etc.\))

There is surprisingly little detail here, though, possibly suggesting that the companies haven't quite figured it out yet!

<comment><AUTHOR> This is a nice comment from one of your links: Luis Felipe Lanz, Intrapreneur, software architect, tec...

In my humble opinion, Posterous seems to be following the same strategy than Foursquare, Twitter or even Quora, start for free until get a consolided installed base users, then start side business around publicity.

<comment><USER3> That sounds uncomfortably familiar to us veterans of the '99 crash.

<comment><USER4> until adwords, what was the Google business model?

<comment><USER5> Wasn't it «being part of Stanford» originally?

<comment><USER6> Larry and Sergey started Google, at which time it was no longer a stanford research project, many years before AdWords.

In fact, they were very resistant to the idea of have any advertisements and were adamant in maintaining clean search results.

</comment></comment></comment></comment></comment></comment><comment><USER7> I don't know why they won't use nice looking ads from sites like Carbon or The Deck, which IMO add value rather than take away.

I just read that Tumblr has passed WordPress in terms of # of installed blogs, but I believe Matt's company makes tons more cash. Very interesting too, considering WP is OS.

<comment><USER8> Wordpress has also enabled lots of developers to make tons of money through templates and plugins. For example, woothemes makes millions/year selling wordpress templates.

</comment></comment><comment><USER9> Serious question: do they?

<comment><USER10> Yep: <http://mixergy.com/woothemes-adriaan-pienaar/>

</comment></comment><comment> e-dard I don't think Tumblr are making money at the moment. I mean, they might sell themes but that's hardly going to come close to their outgoings.

I guess they're working on the revenue generating bit, as seems to be the case for so many funded tech companies over the last few years.

<comment><USER11> They are making money but probably not much. David once said they would probably make millions if they put a single AdSense banner in the Dashboard, but they refuse to use regular advertising and want to make a more creative way of making money.

(Source: [http://techcrunch.com/2011/02/22/founder-stories-karp- tumblr...](http://techcrunch.com/2011/02/22/founder-stories-karp-tumblr- making-money/))

</comment></comment><comment><USER8> If they could fetch $1 cpm and sell their entire inventory they could pull $1M/day.

Correction: $1M every four days <http://techcrunch.com/2011/05/17/tumblr- pageviews-a-day/>

</comment><comment><AUTHOR> According to Techsmart Posterious a Funding:$5.14M! There has to be some brains behind it somewhere.

<http://www.crunchbase.com/company/posterous>

<comment><AUTHOR> Tumbler 40.3M! <http://www.crunchbase.com/company/tumblr>

</comment></comment><comment><USER12> I believe I saw something about Posterous adding affiliate codes to links unless you already have one on there.

<comment><AUTHOR> Can this generate enough revenue to run the service?

<comment><USER12> I don't think so, but I also know that judicious use of caching and Amazon S3 can keep your costs relatively low.

</comment></comment></comment><comment><USER13> With how terrible the Tumblr service has been the past year (I finally had to move every site I had off of it) I often wonder if they _are_ making money. I had read somewhere they make pretty good on the themes and "feature" piece, but not sure how that could amount to very much.

<comment><USER14> Must be just you, Tumblr been running great for my 30+ blogs.

<comment><USER15> Point Pingdom at it and see if you still think that. I get at least one downtime notice a week.

</comment></comment></comment><comment><USER16> I wonder how file hosting sites make money. Especially those without ads.

/threadjacker

<comment><USER17> Those with ads (like 4shared and megaupload) get money from annoyingly trying to get you to subscribe to get pirated content.

Yes, megavideo, I am looking at your 72-minutes limit.

About those without ads, probably their business model is to trying to get you to subscribe, by being less annoying than those without ads.

</comment></comment><comment><USER18> Posterous: Add affiliate links, special marketing deals with brands

Tumblr: Premium themes, featured directory listings, "digital stickers"

They could probably earn a lot more if they started with ads or premium accounts. Right now it looks like they're focused on acquiring users, the focus on profits will likely come later.

<comment><USER19> Two of Tumblr's three sources of revenue (featured directory listings and digital stickers to put on directory listings) are no longer after they ditched the old directory system a few months ago in favor of a curated one.

</comment></comment><comment><USER20> Personally, I think if they just offered premium themes at a fair price they would make a killing.

</comment><comment><USER21> they borrow it

</comment><comment><USER22> For Posterous, custom domains are $13 (or maybe $25, the custom domain signup page is a little confusing) if you register through them. There's a fair amount of markup there.</comment>


So You Want to Build an End-to-End Encrypted Web App - <AUTHOR> https://www.zfnd.org/blog/so-you-want-an-e2e-encrypted-webapp/ <comment><USER3> Speaking of E2E Encryption, the Jitsi Team is looking for feedback on their own implementation of E2E over WebRTC.

[https://jitsi.org/blog/e2ee/](https://jitsi.org/blog/e2ee/)

</comment><comment><USER4> The equivalent to the app signing cert for a web app is the TLS cert. If security is important to you, don't let third parties control your TLS cert!

It's so common now to let CDNs (primarily cloudflare) run your TLS frontend that this article apparently doesn't even consider the idea of hosting an app entirely from servers the app author controls.

That said, it's true that a TLS cert is necessarily more exposed than an app signing cert can be. If you're serious about security, your app signing cert will be on an airgapped machine. The TLS cert however has to be available on a networked machine in order to sign messages.

<comment><USER5> The technology you want is Delegated Credentials:

[https://tools.ietf.org/html/draft-ietf-tls- subcerts-07](https://tools.ietf.org/html/draft-ietf-tls-subcerts-07)

The _certificate_ is public, it's fine for copies of that to be in all edge devices, the problem today is that the associated _private key_ has to be on those edge devices too, and that's what Delegated Credentials solves.

<comment><USER4> That definitely helps, at least for short term compromise of TLS servers.

</comment></comment></comment><comment><USER6> > you can trust in TLS when you're downloading signed software too; but for > the web, you only trust in the connection, there's nothing else to save you > if you can't trust that connection.

While Signed HTTP Exchanges were originally developed for a more nefarious purpose (to allow the URL to be changed by a trusted proxy), I think the idea or one like it can apply to serving trusted web content. Think of it as instead of your current TLS cert verifying your host, it would also verify the full URL and content including headers. It's a bit untenable for regular use, but some apps could leverage it for extra trust.

> When designing E2EE protocols for persistent vs ephemeral applications, we > need to figure out where we need long-term identity in terms of > cryptographic keys, and where we don't.

I would hope that web apps always lean towards ephemeral key use whenever possible (i.e. key generation and post of public key in browser upon authentication, with private key only in local JS memory for just that page). If this means the webapp has to be built to work with 20 different keys for a user because they opened 20 tabs, so be it. I know people are afraid of doing anything like key generation in the browser, but we can't ride-off the possibility of e2ee web apps altogether. I fear the browser allowing access to the OS's key management or the system's TPM for key storage because it may lead to overuse/over-reliance on long-term keys, but I'm sure it'll happen if it hasn't already.

<comment> dane-pgp I'm hopeful that Signed HTTP Exchanges lead to what you describe, but another Chrome-originating technology that could be extended/abused to achieve a similar goal is the <portal> tag.

There is already a little trick[0] that can be done with bookmarklets (or locally saved files) which allow you to bootstrap a page with a known set of JavaScript code running on it, but it has the disadvantage that the URL bar doesn't contain a familiar domain. If the <portal> spec[1] ends up supporting SRI[2] integrity hashes in a sensible way, this little bootstrapping technique could actually be practical.

[0] [https://news.ycombinator.com/item?id=17776456](https://news.ycombinator.com/item?id=17776456)

[1] [https://wicg.github.io/portals/](https://wicg.github.io/portals/)

[2] [https://www.w3.org/TR/SRI/](https://www.w3.org/TR/SRI/)

<comment><USER7> Combine SRI with CSPs and cache-control: immutable and you could already commit a page to never change. All that's missing for TOFU is fingerprinting this combination, watching for changes and surfacing the information to the user.

<comment><USER8> Unfortunately that by itself does not guarantee security. The code that is verified by the bookmarklet could download additional code when it runs, and that code would not be verified.

<comment><USER7> No, preventing that would be the CSP's job.

<comment><USER8> My point is that verifying that the content doesn't change is by itself not enough. You also have to verify that it was secure to begin with, and that is much harder, especially for your typical end-user.

<comment><USER7> That's a separate problem to solve. But for audits to even make sense you first need to solve the problem of sites changing under your feet, i.e. enabling TOFU.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I haven't seen any mentions or this extension that allows verifying pages before they are rendered: [https://github.com/tasn/webext-signed- pages](https://github.com/tasn/webext-signed-pages)

Another thing is non exportable WebCrypto keys that can limit the damage even if the page is compromised.

</comment><comment><USER10> I started building an end to end encryption API once that includes server/client setups. I promise I'll finish it one day (there's still client - client to do. client - server is all done) [https://gitlab.com/DrRoach/NetworkAPI](https://gitlab.com/DrRoach/NetworkAPI)

</comment><comment><USER11> While this article points out there are still opportunities for a malicious actor to gain access to the private keys stored locally in the browser, wouldn't that still be an improvement over only using https and server side encryption?

I'm not a crypto expert--so forgive my ignorance.

</comment><comment><USER12> If you want to do this with something like libsodium there is a Key Exchange API

[https://doc.libsodium.org/key_exchange](https://doc.libsodium.org/key_exchange)

Knowing only each others public keys, two parties can exchange session keys for bidirectional encryption.

<comment><USER13> > Knowing only each others public keys

Do you even need a "protocol" if the clients trust each other?

Client A generates a random key, maybe a nonce - and a session Id - <USER2> encrypts that with Bs public key, signs with As private key - and sends that to B. Only B can decrypt the message, A and B now share a key.

Or maybe that _is_ the protocol.

Anyway, if you know someone's public key _and_ they know yours - you're already bootstrapped for a secure channel?

Ed: m seeing the page, I see this is more à link to the api for libsodium, and that obviously makes sense - to have standard implementation (and I guess this does some tricks for generating public/private _session_ keys from long lasting public keys?

</comment></comment><comment><USER14> > this basically boils down to TOFU (trust on first use), but the trust does > not perpetuate across uses, so it's more like, TOAU (trust on any use). The > trust is ephemeral, the meeting is ephemeral, the ID is ephemeral. For a lot > of meetings, this is perfectly acceptable.

I think I would call this TFSU (Trust For Single Use). Trust On Any Use sounds like complete and total trust.

<comment><USER15> Or Each.

</comment></comment><comment><USER16> It used to be possible to actually do TOFU without PKI in browser with caching, trusted sha signatures and user certificates but it was deprecated.

</comment><comment><USER17> > This is not just a theoretical either: Google Duo supports E2EE group calls > on Android, iOS… and web!

Google Duo does NOT support E2EE group calls on web... They actually don't support ANY group calls in the web app.

Lack of good support for e2ee multiparty calls is probably why - the hope is that adoption of insertable streams will change that.

<comment><USER18> Coming soon? [https://9to5google.com/2020/05/08/google-duo-web-group- calls...](https://9to5google.com/2020/05/08/google-duo-web-group-calls/)

</comment></comment><comment><USER19> I appreciate when technical writers use humor (those headlines!)

</comment><comment><USER20> E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave.

You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)

<comment><USER21> This seems to pick an arbitrary expansion of what "end to end" means, where "end" is "the OS layer on the source/destination computers".

What if the monitor is backdoored and sends copies of the display buffer to The Secret World Government? What if the keyboard has a hardware keylogger? What if we're all living in an elaborate computer simulation of a global pandemic?

As an alternate comparison: it's still end-to-end encrypted communication if I take the securely received message, print out a copy, and tape it to a bulletin board at the town square.

The "end-to-end" refers to the transmission path. It's a defense against MITM, and can be accomplished by plenty of systems that aren't Linux.

<comment><USER20> Yes, I understand perfectly what is _is_.

But people attribute security properties to it that it doesn't have!

What good is protection against MITM if I can just read it off your device while you type it?

You have no security with mobile devices. It is foolish to think so.

<comment><USER21> I feel like you meant the question to be rhetorical, but for the sake of clarifying: there is tremendous value in protecting against MITM, even if there remain other attack vectors.

Encrypting traffic end-to-end over the network protects against entire categories of attack. For some attackers (for example: ISPs), end-to-end encryption essentially removes their ability to compromise traffic contents. For other attackers, it forces them to ignore those categories of attack and instead narrows them to things like compromising the device. Notably, Linux is not magically immune to device compromise, even if you're running a magical open-source BIOS. And unlike Windows/OSX, Linux doesn't have Apple/Microsoft paying large, motivated security teams whose work is pushed to all their devices. At best, Linux has commercial distro providers like RedHat paying for security work. At worst, it relies on the good will and skill sets of open source maintainers. In trade, Apple/Microsoft offer lower customizability/visibility into the OS. But since the average user is not interested in (or qualified to do) security hardening of devices, Linux isn't likely to buy them anything meaningful in the field of device security.

All of this is to say "life is hard. We shouldn't make it harder by protesting the concept of E2E encryption due to the obvious fact that it does not cure all ailments."</comment></comment></comment></comment>


New Koch [January 2016] - <AUTHOR> http://www.newyorker.com/magazine/2016/01/25/new-koch <comment><AUTHOR> This seems like necessary context for anyone trying to understand the Mike Rowe / Koch brothers thing currently on the front page, [https://news.ycombinator.com/item?id=12427992](https://news.ycombinator.com/item?id=12427992)</comment>


Ask HN: Introduction to the Java Ecosystem for Someone Wanting to Learn Clojure? - <AUTHOR>

I've never been been particularly interested in Java, but I've found a recent interest in Clojure.  The problem is that, despite being a separate language, Clojure - along with its documentation, tutorials, and general usage - is heavily tied to the Java ecosystem.
As someone with a strong background in and working knowledge of C, C++, Python, C#, and other imperative languages, I have little interest in learning Java as a language, but feel somewhat lost when dealing with the baggage that comes with a language built on the JVM.
Is there a good tutorial or resource out there that outlines the basics of the Java ecosystem (e.g. JRE implementations, tooling, a basic outline of .java/.class/.jar/etc files, a very general outline of the Java standard library, etc), but does not try to teach Java as a language, or at least only introduces the very minimal set of constructs of the language necessary to understand the ecosystem?
Given the long history of Java, I feel it would be hard enough to find a reasonably up-to-date guide on Google, and even more difficult to find a guide for an experienced programmer looking for just a cursory glance.  Any suggestions? <comment><USER2> Leiningen does dependency management and builds, etc., for Clojure work. [http://leiningen.org](http://leiningen.org) Note the sample project on that page.

[http://clojure.org/cheatsheet](http://clojure.org/cheatsheet) is made of useful also

The community won't bite, ask when you're stuck.

Use the Oracle jre, or your package manager's default (linux).

There's this stuff if you need it. [http://docs.oracle.com/javase/tutorial/essential/environment...](http://docs.oracle.com/javase/tutorial/essential/environment/index.html)

Good luck!

</comment><comment><USER3> I'd suggest skipping Clojure altogether. The JVM cannot support tail call optimizations. Use of recursion will be muffled a bit. Not very lispy.

Newer is not always better. Try racket or common lisp.

<comment><USER4> I would respectfully disagree and perhaps my reasoning is incomplete as I am a Clojure newbie. However, the absence of tail call optimization has not been a limiting factor in my case; I have been developing clojure code ,which I am sure is non-idiomatic, that is effectively doing the job.

On the other hand, JVM ecosystem is vast. It means acces to the latest database drivers ( Oracle, Sybase , etc.) as well as NOSQL drivers. Almost all third party REST API providers( ASW, Google, etc.) provide java wrappers that you could use in your Clojure code.

<comment><USER5> The loop/recur syntax gives you recursion in constant stack space.[0] It was a bit of a speed bump coming from Scheme but it's just part of being on the JVM. Personally, I'm more than happy to take some ugly TCO syntax if it comes with the all the good stuff Clojure inherits from Java.

[0] - [http://clojure.org/special_forms#Special%20Forms--%28recur%2...](http://clojure.org/special_forms#Special%20Forms--%28recur%20exprs*%29)</comment></comment></comment>


National Rail Have Killed My UK Train Times App - <AUTHOR> http://mocko.org.uk/b/2010/10/29/national-rail-have-killed-my-train-times-app/

<comment><USER3> Talk about Old Skool British behaviour. I grew up with this mentality and have been merrily waving it goodbye for the past couple of decades.

As well as the suggestions in the article's comments, I'd drop a tweet to Glynn Moody (@glynmoody) who will certainly take this on. Also worthwhile tweeting would be Tim Danton (@timdanton) editor of PCPro (for USians, that's the UK's main commercial tech mag), and also Tom Watson (@tom_watson) our "Uber Geek in Parliament".

No harm in getting a petition going at Number10 and maybe asking the Open Rights Group (@OpenRightsGroup) to get involved and start a campaign of lobbying MPs.

In addition, open data is huge in the Euro Parliament, so write to all you MEPs via <http://www.writetothem.com/>

Don't ignore the latter, my experience with my MEPs has been excellent. One even sends a weekly newsletter giving his diary, what occurred, and what he's up to next. Once you engage with these folk, things really can start happening.

We need to fight to keep public data available, and there's loads of support in the places where it matters, so just start making some noise and you'll soon have your app back working, and hopefully you additional app too.

<comment><USER4> Problem is it's an association of private companies. Maybe a better way is to pressure the government Network Rail to offer a similar service, as they also have the information.

</comment></comment><comment><USER5> I fought this same issue with Routesy, my SF iPhone app, in 2009. Getting agencies to be smart about making data open is a challenge, but a lot of cities are coming around.

Once agencies realize that they can _not_ make a killing off apps and that they're better off having developers make great apps that increase ridership by making the systems less awful to ride, everybody wins.

If you're curious about the story of my battle and how I had to get a lawyer involved to get Apple to let my app back into the store, check this out: [http://sfappeal.com/news/2009/06/who-owns-sfmta-arrival- data...](http://sfappeal.com/news/2009/06/who-owns-sfmta-arrival-data.php)

</comment><comment><USER6> There seems to be a trend emerging where companies/organistions are killing off APIs with no warning, and the consumer of the API is powerless.

I blogged about this recently [http://andysinclair.wordpress.com/2010/10/25/your-api- killed...](http://andysinclair.wordpress.com/2010/10/25/your-api-killed-my- application/) as I was very annoyed that TFL (London's transport network) disabled one of their APIs which stopped 2 very popular iPhone applications from working.

<comment><USER7> Could this be because of the change of government? The new government is dismantling all sorts of other central government internet projects - <USER2> the data providers who were being pressured into making their feeds available are spotting a change in the political climate and a chance to keep the profits in-house.

<comment><USER6> I'm not so sure, I think it more a case of lots of these APIs and open data projects exist as "side projects" and do not receive the full backing and resources of the department/organisation.

I followed up the story of TFL and it turns out that the API stopped working because of a security patch that was applied, rather than more sinister reasons.

</comment></comment></comment><comment><USER8> So mock their API with BeautifulSoup or Hpricot :-)

<comment><USER4> Way to go. Just host it in a safe country, like Turkey.

</comment></comment><comment><USER9> I wrote to my MP about this very issue a couple of months ago, explaining that ATOC are abusing their position by making sure that their £4.99 iPhone app is the only option available. At the time I wanted to build something for Android, but was put off by cases just like this one. Here's the reply:

"Dear Mr ______,

Thank you for your e-mail of the 23 August.

The ORR regularly monitors Network Rail's operations both annually and more comprehensively periodically. Network Rail operates under a network licence. This licence contains a set of conditions under which Network Rail must operate. Network Rail is also accountable under its licence. The ORR's monitoring and enforcement of Network Rail operates under a regulatory framework designed to provide effective incentives, rewarding Network Rail for doing a good job. Where necessary, the ORR may enforce compliance with the network licence if Network Rail fails to fulfil its obligations, and we may also impose monetary penalties.

As the monopoly owner and operator of the UK rail network, it has control over timetabling and its relevant data. As you highlight, ATOC use this data for its National Rail Enquiries services, in agreement with Network Rail. Distribution of this information is at the discretion of Network Rail.

Its funding is derived from track access charges and station leases. It also gets a Government grant based on network improvements agreed with the Department for Transport. All funding information can be found on Network Rail's website (www.networkrail.co.uk) whilst all reviews from the ORR can be found on its website (www.rail-reg.gov.uk).

Thank you for taking the trouble to contact me.

Yours sincerely

Richard Benyon MP"

tl;dr: Network Rail operates under a network license and is regulated by the ORR (i.e. it's effectively government controlled) but that license says that they can distribute data however they see fit.

<comment><USER9> I forgot to mention: in a week or so I'm meeting the guy at Directgov responsible for data.gov.uk (for something at work and totally unrelated). I'll be sure to bring this up and see if he can help out.

<comment><AUTHOR> Thanks, I'd really appreciate that. ATOC's attitude really stinks. If you want to get in touch directly I'm mock at mocko.org.uk.

</comment></comment></comment><comment><USER10> They killed off MyRail Lite ages ago as well: [http://www.bluesnapper.com/blog/stuff/kizoom-myrail-lite- gon...](http://www.bluesnapper.com/blog/stuff/kizoom-myrail-lite-gone/)

</comment><comment><USER11> Hello. I suggest you try and contact people on and around the Transparency Board: data.gov.uk. @rchards supports the board and @nigel_shadbolt is on it, @countculture is also a good bet. Drop me a line matthew at refute.me.uk if you need some email addresses.

</comment><comment><USER12> Send this to Private eye - they love a well-documented case of bureaucratic bumbling like yours.

</comment><comment><USER13> I just opened the letters page of UK Wired Magazine and there's a letter from the chief executive of National Rail Enquiries (Chris Scoggins) pledging to open up their data.

I'm sure that Wired would be interested in your story, and it's worth trying to contact Mr Scoggins directly.

(I'm not a regular Wired reader, but it seems this is in response to a letter published in the 09.10 edition)

<comment><AUTHOR> Hi omh. That looks like an awesome point of contact. I can't find a letters page on their website, is his letter online anywhere?

<comment><USER13> I don't think it's online, and unfortunately i've now lost my copy of the magazine. It looks like part of an ongoing discussion though, so contacting Wired to get the whole storyis probably best. Good luck!

<comment><AUTHOR> I went out and bought a copy this morning :) Fascinating letter, the chief executive's commitment to opening data feeds is completely at odds with what they're doing here. I've left a comment on his blog post at <https://nationalrailenquiries.wordpress.com/2010/10/22/146/> so let's see if it elicits a response.

<comment><USER13> Now that I'm back at a computer, I found the 'From the Editor' letter that he was responding to:

[http://www.wired.co.uk/wired- magazine/archive/2010/09/start/...](http://www.wired.co.uk/wired- magazine/archive/2010/09/start/from-the-editor?page=all)

</comment></comment></comment></comment></comment><comment><USER14> It's entirely because they must be making a killing off their paid-for app and don't want you to offer a free alternative. How horrid.

</comment><comment><USER15> Guys, before rounding up a mob, please try to find out the story from the other side as well. To put it simply there was a complaint about Tfl killing an app last week or something, AFAIK that developer didn't get permission to use the data whether or not it was publicly available or whomever used that data. It states in Tfl's website that written permission is required for certain things and I wouldn't be surprised if they didn't get such permissions. In the article I noticed slight whining about other people doing the same thing which is (slightly)comparable to illegal downloading of films, countless people do it, but ultimately you have to seek permission from the content providers as you're utiliing _their_ services.

<comment><USER16> Quite.

One can't blame companies for being a bit protective of their timetable data. If this kind of data escapes into the wild there's a genuine risk of what is known in the biz as _'having more customers'_. When this happens there's a whole knock on series of problems that the companies need to deal with, not least of which is _'working out what to do with all the extra money'_.

I think perhaps this chap didn't consider these factors when he cooked up his little application. Will he be stumping up to repair any tracks that get worn out earlier due to increased passenger numbers? I think not.

<comment><USER7> I catch your obvious double meaning, but it's worth pointing out again that these institutions get a lot of tax money, so we most definitely do have to stump up extra when tracks need repairing.

<comment><USER16> Good point - the bastards have even less justification in hoarding the precious precious data.</comment></comment></comment></comment>


The amazing disappearing reappearing finger - <AUTHOR> http://www.badscience.net/?p=669

<comment><USER2> I didn't follow the first round of coverage on this story. Was the mainstream press really as gullible as the author suggests? Ouch.

<comment><USER3> Entirely. I was shocked at the original BBC article, which touted the claims as "hard science" and made it all seem like we could be regrowing our limbs back in no time thanks to this amazing new "extra-cellular material" discovery.

<comment><USER2> That's disappointing. Is it just me, or is the BBC getting noticeably softer in their science reporting?</comment></comment></comment>


Civil Disobedience (1849) - <AUTHOR> http://xroads.virginia.edu/~hyper/WALDEN/Essays/civil.html

<comment><USER2> ...,Thomas Paine, and Lysander Spooner:

Spooner advocated what he called Natural Law – or the "Science of Justice" – wherein acts of initiatory coercion against individuals and their property were considered "illegal" but the so-called criminal acts that violated only man-made legislation were not.</comment>


Ask HN: What questions did you ask (or wish you asked) your cofounder? - <AUTHOR> Hi! I finally met someone I really like and think she can really do something important for the mission. She seems to engage with idea just as much as I do and can definitely both embody it and bring specialized knowledge to the execution. I am already working with her to execute something I can't technically do. (Not Code BTW)
Nonetheless—I want to very thorough and make sure we get to know each other much more.
What questions should we be asking each other? What topics should we be broaching? How do we get to deeply know each other in as short of a time as possible?
The best way to learn this is by hearing about what y'all did or wish you did.
I have some ideas. First of all:
* Would you like to be a cofounder or just a service provider?
If yes, then I would ask Jason Lemkin's two questions:
* Are you willing to do this for the next 7–10 years? * And are you willing to go for 24 months until we have any real traction at all?
Then I think Mark Zuckerberg spending MONTHS vetting Sheryl Sandberg. He particularly wanted someone who wasn't afraid of people better than them. Possible question
* Who is better than you? Would you recruit them?
More ideas:
* What is your learning style? * Are you doing it for the likes, the mission, or the money? How do you rank these? * How would you manage a team? What would your weekly meeting structure look like?
Would love to get even more ideas from y'all! Thanks! <comment><USER3> The most important element, in my opinion, is one that single questions alone cannot discern: Is this person a workplace psychopath?

I'm not kidding, and this is a real issue. A lot of people who can be great entrepreneurs can also have detrimental effects on your culture, the trust of your clients, and your long-term sustainability. Drive, initiative, passion, aptitude - these are qualities present in great founders and appear to be present in workplace psychopaths.

Get to know this person, and get a strong sense of their values - not from what they say and want you to believe, but from taking in the context of their accounts of what has worked out, and what is not, in their personal and professional life. For people they speak dismissively or negatively of, find them and get their side of the story. You cannot do too much due diligence here - this is critical, especially if you start to become widely successful. Then you're locked in with your partner in the co-pilot seat, and you won't have the desire to bolt or ability to change your decision without significant if not disastrous consequences to your business.

Your values must align, and you must trust this person with your life. Your startup will be your life for the next 7-10 years, by your planning.

<comment><USER4> The straightforward though not necessarily reliable way to get a basic read on this is how they treat the waiter in a restaurant. Maybe conspire with said waiter to minorly screw up their meal service once or twice.

<comment><USER5> This is what the CEO of Schwab does, or did.

[http://www.businessinsider.com/charles-schwab-ceo-takes- job-...](http://www.businessinsider.com/charles-schwab-ceo-takes-job- candidates-to-breakfast-messes-up-their-order-2016-2)

<comment><AUTHOR> Fantastic article. Have the restaurant screw with the person for you so you can test their reaction. Thinking of other places where this might apply—maybe putting an extra 5 on one side of the bench press?

</comment></comment></comment></comment><comment><USER6> It's important to determine whether or not the person is qualified and capable. While questions have their merit I'd recommend a more creative exercise.

If you have the means, take a trip half-way across the world and live in close quarters for 3 weeks together (while you work to get the business off the ground). If you can't stand them by the end of the trip; walk away.

I've been working with my cofounder for 15 years now and together we've accrued more than ~$30M in combined revenue from a handful of projects. Being able to argue, disagree, make a decision, move on and then grab a beer after work like nothing happened is paramount. Your personal relationship with this person will be the first domino in every decision you make.

<comment><USER7> Clint Eastwood was on some talk show long ago, and he was asked about relationships, girlfriends, etc. He said he tests potential girlfriends by going on a three-hour driving trip. If they still have anything to talk about at the end of three hours, they have potential. I think that would apply very well to cofounders, too.

<comment><USER7> And a simple test of how well two founders work together is to take a two- person canoe down a course that demands teamwork. Be sure to switch off who is front and back. I've seen couples descend into cat fights in a canoe.

<comment><USER8> How about a botlane duo in league of legends

</comment></comment></comment></comment><comment><USER9> Tread carefully starting a business with someone you don't know. If you decide to forge ahead, you'll need to get to know the person not just professionally but personally. I've seen several co-founder relationships (including my own) break down due to personal circumstances that could probably have been predicted had there been a stronger personal relationship prior to starting out. Above all else, discuss at length "what-if" scenarios for every conceivable outcome, in particular the ones that you don't think will happen (like one of you deciding to leave). Get a founders agreement and get a lawyer to translate it into legalese. Put vesting in place so you don't run into tax issues clawing back shares if she decides to leave. Don't wait until you're further down the road, do it straight away.

As for determining if she is the right person professionally, I'd make a list of all of the things that...

1\. You suck at

2\. You hate doing

...that will be necessary to succeed. In a perfect world, she will excel at many/all of these things and love doing them - allowing you to divide the workload and each focus on your strengths. Don't take her word for it - <USER2> out, test her, check references, do whatever you have to do to be comfortable that she is the right person.

</comment><comment><USER10> Number one thing is discussing the equity split and what happens if one of you quits.

I have a friend who helped start someone selling a breakfast product. The plan was my friend would invest $20k and the partner would run it as a local business, and they'd split 50-50. Very quickly my friend got excited by the potential and started working full time to help, ends up investing hundreds of thousands of dollars, doing all e-commerce, marketing, negotiations, paying for industrial quality kitchen, etc, while the partner just mixed and packaged. Sales shot up and the company begins to have significant value, but still requires more investment.

They needed to switch from an LLC to a C corp so they could get funding and start giving stock options to attract/keep good employees. The partner conceded that my friend was doing the lions share of the work and had put a ton of money in while he had put in nothing, and that my friend should have most of the initial stock in the C corp. But they struggled to agree on an exact split.

So then the partner talks to friends and family who of course tell him "it was YOUR IDEA, you shouldn't have to give up anything!" and comes back refusing to sign anything (which scotches the C corp conversion). Eventually he's able to force my friend to buy him out for a totally unreasonable price.

So my specific advice is.

1) Never start a new venture as an LLC unless you don't plan to ever share equity with employees AND you expect it to be a cash flow business that will pay out all profits directly to partners.

2) Always force all partners to vest their equity over years. You can do incentive stock options, or restrict stock units, or however you want. If you can't afford a lawyer to draw it up yet, at least put the arrangement in writing and agree to it, so that if you have disagreements and need to part ways, you aren't being forced to buy half the business from some guy who mixed ingredients for 6 months.

<comment><USER11> Just because your friend botched his LLC us no reason not to use one. LLC can be fantastic. You think if they were a c corp 50/50 day one the break up would have been any better?

<comment><USER10> Well it would have been far easier to offer employees stock options, and far easier to raise financing. And faster and easier to codify a different split when his partner was amenable to it.

Tech Investors hate LLCs cause they hate K1 forms.

<comment><USER11> Converting LLC to S/C corp is not hard though! Your entire chain of evidence was about two founders who had very different commitment levels, and had trouble converting. Of course they had trouble converting. They also would have had trouble diluting for investment if you did not dilute 50/50\. There was an underlying problem there, and the corp conversion was the rip the bandaid off moment. It had to happen, and the sooner it happened the better!

Unless you know day 1 you are going to get investment (like, that is your entire goal of your business - say you already have ycom ready to invest), I still contest you should almost always start LLC. If say you putz around and bootstrap for a year, your taxes and accounting and everything else will be SO MUCH EASIER for the first year. Then sure, if you light on fire and need investments from traditional VCs, cool you can convert. What % of random startups founded on hacker news get to the point of VC investment? My gut would tell me 10% or less, but no idea how to measure this.

<comment><USER10> I actually agree with most of what you wrote, an LLC is cheaper/easier especially when you have no money and need to focus on building product.

But when do you bring on employees? ie non-partners. I hugely recommend giving them equity options and now you have to convert, which is more costly than being a C corp from the start.

Also your 10% figure isn't close. investment comes from family, angels, and VCs. Probably over 50% get some type, and now your tax returns and theirs just got much more complex. As does future investment.

If you can afford to start as a C corp, it's often worthwhile.

<comment><USER11> > But when do you bring on employees? ie non-partners. I hugely recommend > giving them equity options and now you have to convert, which is more costly > than being a C corp from the start.

I am not giving early employees equity, going market rate salary instead. But you can totally issue shares as an LLC though. In fact they are more flexible. You could add more rules or regulations around it.

Investments from family and angels do not need to be equity, it could also be various debt instruments. In these cases no tax magic to worry about, it stays very simple.

Perhaps my boat is different because from day 1 I was 90% not planning to get VC money. If your plan is 90% from day 1 to get VC money, then I guess you would want to optimize that path.

<comment><USER10> I highly disagree with not giving early employees equity. I've always given them even to the receptionist and they have a substantial impact on building a better team environment. It becomes "their company" and you get more commitment, better efforts and even more honesty.

And issuing employees shares in an LLC is a mess. Giving straight participation is taxable. Giving appreciation rights is complicated to do and manage. Doing it in a C Corp is basically automated with all the tax issues clear and codified.

Complicating your deal with Angels is also a good way to get them to walk away. You can use convertible debt if you are on the verge of a VC round, but you have to be a C corp in that case. And you have to agree on convertible terms that will attract Angels but not scare off VCs. Angels typically want to be investors, even most family members, and an LLC makes that a mess.

If you don't want to get VC money that's fine, but you better be sure.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> One that I wished I asked, knowing my situation now:

"If either one of us loses interest and wants to move on, how can we handle the situation?"

<comment><USER13> this site helps answer that one: [http://www.backofanapkin.co.nz/start](http://www.backofanapkin.co.nz/start)

<comment><USER12> Oh dang, that's awesome. If only I had it 5 years ago...

I actually just want to walk away, my point was more about how can I politely tell you that I don't want to do this anymore? Not so much the legal ramifications of who owns what.

<comment><USER14> Can't you just say that you've lost interest and want to do something else with your life?

Worked just fine for me at my previous company- client base shrunk to almost nothing and while we could still pay the bills and our salaries, I quit the company and moved to embedded software/hardware. Probably my best decision career-wise.

</comment></comment></comment></comment><comment><USER15> I think it's important to be on the same boat money-wise, while also expecting similar things for the near (or not-so-near) future.

Questions: * Do they have any loans that need to be payed? If yes, how would this affect future decisions to stay in the company? * Are they thinking about wanting to do something they haven't been able to do before (traveling for long, living abroad)? * How much do they need the stability of a regular job?

</comment><comment><USER16> Some topics worth exploring that I've seen become areas of co-founder conflict:

* When faced with a difficult decision and incomplete information, how do you decide what course of action to take? Can you talk through a real life example of a situation like this?

* Let's assume we decide to be co-founders and start this company together. What kinds of things would cause you to want/need to leave the company you helped start? Are there milestones, financial or otherwise, that the company needs to hit in order for you to keep working on it for the long term?

* When it's just the two of us working on the company, how would you like to divide responsibilities between the two of us? If we succeed in growing the company beyond just the two of us, what do you want your role in the company to be?

<comment><AUTHOR> Super helpful! Thank you. :)

</comment></comment><comment><USER17> This may be partially unrelated. If one of the reasons of you wanting to deeply know your co-founder is the fear of her leaving the company in future please consider having a vesting schedule with one year cliff. This will allow you ample time to know each other well.

</comment><comment><USER18> Do you have any (personal, business) debt and if so how much?

I worked with a person with the plan to raise money later. It turned out he didn't run his current business well and soon wasn't able to pay for rent, had to sell his car, stopped paying the rent for the office we were sitting in. Looking back it explained a couple of questionable decisions (e.g. claims to debtors, very much over-promising, aggressive release plans, side-projects to make extra money). I'm not saying you have to be well off before going into a months/years long project but living paycheck to paycheck isn't a glorious "[he|she] is hungry and eager to make this a success" but plain stupid.

</comment><comment><USER19> Partnership is harder than marriage, in part because getting on the same page, and staying on the same page is incredibly difficult.

Mix into this the shiny toy syndrome that co-founders can fall prey to over time, and it really becomes about dating before getting married.

Every partnership is about creating value through leveraging an opportunity together, not leveraging against each other.

If the partner's value is adding sales, their equity should be tied to vesting as a percentage of the lasting sales that stay in.

If they are creating value through code, it should be seen the same way.

I also very much value hacking on small problems in the desired space to get an idea if people can work together and ship regularly before going steady and getting married.

</comment><comment><USER20> "If we got an offer to buy the company for $X, would you take it?"

My team had a specific conversation about that when we started the company. We even picked "a number". 4 years later, we got an offer for that number, and one founder was hesitant to take it. We all pointed back to that conversation when making the decision to sell. Had we not had that conversation, it would have been real fight internally.

</comment><comment><USER21> Mistake #1 is rushing into the relationship. If you're excited or desperate, you'll overlook things that could bite you in the ass later.

Ask yourself a few questions first. Does your cofounder have a track record of execution or do they bounce from scheme to scheme without achieving anything? Are they sane and competent or do they have a criminal history and a troubling social media presence?

Do your due diligence. Run a background check (seriously). Don't be afraid to ask the hard and uncomfortable questions up front.

In my own experience, if I were to bring on a cofounder again I would write a honeymoon period clause into the Founders' Agreement. Something to the effect that if the relationship doesn't work out during an initial period of time, each party's risk is limited to only the money and time they put into it. I'd rather get an annulment than a divorce if possible.

</comment><comment><USER22> The questions are mostly useless. Work together for a significant duration. After a while, you'll know if you work well together, if you share the same general goals, and if the person is bringing serious contributions to the project.

</comment><comment><USER23> Speaking from my own personal experience, the most important thing about your co-founder is that she must be good at things you're not. If both of you are good at the same things then you're probably doing it wrong.

Also like that e-myth book, make sure whatever roles you're going to be taking, it is in writing and there is no confusion about who is doing what. This is especially important when the day comes and you have to take a big decision about your company and she sees differently than you.

</comment><comment><USER24> Be aware of your own human nature: you will want it to work, more than you will want to accept the signs that it won't (confirmation bias).

You will say to yourself that "little things" can easily be overcome, but people rarely change. People make most choices by their external circumstances and influences, even when they truly want things to be different.

</comment><comment><USER25> If you need to ask them these questions that's an employee, not a cofounder. Maybe it's an employee with a big chunk of equity, but in general you should have a pre-existing professional relationship.

Otherwise, there aren't enough interview questions in the world to tell you the important stuff.

</comment><comment><AUTHOR> Found this great article!

[http://web.archive.org/web/20160220013218/http://founderdati...](http://web.archive.org/web/20160220013218/http://founderdating.com/questions- to-ask-potential-cofounders)

</comment><comment><USER26> I recommend meeting some people they know family, friends, old colleagues.

<comment><AUTHOR> Great and simple idea. I actually LOVE her fiancé from our brief interaction. They had me over for dinner days after meeting and were super awesome. :)</comment></comment>


World Bank app competition - <AUTHOR> http://appsfordevelopment.challengepost.com/ In case anyone needs a project for the next month...  There is a lot of very cool data there. <comment><USER2> I'll design an app that helps you plan excessive infrastructure projects for developing nations that plunge them into debt so they can be exploited for political gain! The World Bank will love that!

<comment><USER3> And then the World Bank will write-off that debt under their Heavily Indebted Poor Countries Initiative (HIPC): <http://goo.gl/iaQfJ>

The fact that the US has a lot of control over the World Bank seems reasonable given that they put up the lion's share of the capital. As far as dictating terms and conditions, regardless of their merit, there aren't many banks that will give million dollar loans to bad credit risks w/o strings attached. What's the alternative scenario? No bank? They just give out money?

</comment></comment><comment><USER4> man you gotta be such a sucker to fall for this one.

debt, assumed by despotic and self serving governments, 20% of which goes to fund their militarily held regimes without providing growth, which enslave generations, all well documented, all neo-colonialism: suckers & selfishticos sign-up here, your dream awaits. join the world bank in its phony do-gooder endeavors.

god what the hell is wrong with people, is propaganda really this good? i mean, seriously. this is on the front page. people voting this up are very evil or very very very stupid, which these do you up-voters prefer to be?

<comment><USER5> _people voting this up are very evil or very very very stupid, which these do you up-voters prefer to be?_

I wouldn't want to be seen as stupid! I'd better agree with you!

Your comment reads like a rant: how about some links to educate us?

<comment><USER4> do your own homework. i'm not the one voting up the world bank. the voter uppers have the burden of responsibility for advocation. not all ideas are equal.

this site does not allow me to vote down, this means an unequal burden in defense of a down vote versus an up vote, despite an up-vote being an positive advocation. (this is not a brainstorming session, this is life)

and please note that i'm being called upon to carefully document a response to _propaganda_ on top of defending an idea against anonymous up-votes. hmmm. can you smell the bullshit? can you taste it? all i smell and taste are kangaroo court judges in a carefully constructed technolalaland.

and since the dumbsters really won't get it: if your head is appointed by the president of the united states, not to mention if only americans can be head, then this marketing effort is dictionary definition of _propaganda_ , that's not an opinion statement. (it's amazing how often one needs to pull out the dictionary in this joint)

<comment><USER5> _it's amazing how often one needs to pull out the dictionary in this joint_

Leave the dictionary: just give us some links to backup what you claim.

Look at it this way: you're complaining that people don't do X. You want them to do Y, and are annoyed that they don't. It would therefore benefit you to educate people about why X is bad and Y is good. If you don't at least try, I'm not sure you get to complain any more.

Let's avoid the name calling and rhetoric, recommend us some good reading.

<comment><USER4> no, i'm complaining that people DO X, please get it straight. They DO advocate X. They DO advocate the world bank marketing effort, which is governmental making it intrinsic propaganda.

Back up YOUR up-votes. why is the world bank a good thing to support? i mean, it's been around 50 years or so, you know, european post-war reconstruction all that. so...tell me, all the poverty...getting worse, yeah, so, how's that whole world bank working out for you, tell me?

i mean, i don't have to get into the neo-colonialism angle. as an atheist i can say to the christians in the bunch _by their fruits ye shall know them_.

so, you're backing up something, you think it's a good idea to read about, support, take action for. or no, it's just _interesting_ in some faux-amoral sense. but you still think that it's valid to accept that on face value, and you're doubtful about the concept of deceptive & self-serving propaganda as something to guard carefully against.

well, tell me, what do you know about this program? what independent analysis have you seen? why are you advocating? why are you so sure the dissent has the burden of proof when the dissent is not actually taking any actions except to dissent _in response_?

there is a rhetorical paradox presented here. also known as hypocrisy (since we're speaking of dictionaries)

p.s. as you can see, i think the weaknesses in our frameworks for debate are a far bigger problem than advocating the world bank. we propagate bullshit for generations. our frameworks are broken. our well annotated frameworks are broken. we're deceiving ourselves with some pseudo-victorian genteel ideal.

speak your fucking mind. why are we letting taboos rule our time? micro- managers rule our time.

we are screwed if we don't break free from this hypersensitivity and inability to consider and face our problems with our attempts to improve quality of life for more than just a few technostartopoliptocrats.

what good is free speech if we fear the inconvenient as much as this?

</comment></comment></comment></comment></comment><comment><USER6> I'm surprised by the anti-world bank sentiment here. You should read 'The Bottom Billion', which was written by the director of the Development Research Group at the World bank (2003-2008)

<http://en.wikipedia.org/wiki/The_Bottom_Billion>

<comment><USER7> The problem has to do with how much good debt does for people and how much influence the US government has over the organization. It's not unfair to see the bank as an arm of US foreign policy since the US has to agree to everything that happens.

The world bank insists on policies that we would never agree to like water privatization. That has lead to a lot of problems in poorer countries. It just seems like a scheme to transfer what wealth exists in poor countries and transfer it to the banks of the west.

If we really wanted to do good in the world we wouldn't give loans we'd give aid for these projects instead.</comment></comment>


The Cartel Gunsmiths - <AUTHOR> http://motherboard.vice.com/read/the-cartel-gunsmiths <comment><USER2> _"You could surmise that [the parts] are coming from the US, since most of the weapons that come down here illegally are from the US,"_

Perhaps, since the largest US source is M16s (and maybe M4s now) donated to the Mexican government and then stolen (second is Communist bloc stuff bought on the open market, it's much less expensive than making your own like this). There's not much utility in tracing any of these guns, except of course to propagandize for gun control in the US (see Fast and Furious for the most egregious example).

Which makes me wonder why this cartel felt a need to make their own AR-15s or M16s (the article didn't mention if these were 3 round burst or full auto, did it)? If they can get their hands on rocket propelled grenades....

Then again, this whole expose might be a lie (again, see Fast and Furious).

<comment><USER3> > Which makes me wonder why this cartel felt a need to make their own AR-15s > or M16s (the article didn't mention if these were 3 round burst or full > auto, did it)? If they can get their hands on rocket propelled grenades....

The use case for a rocket launcher is a bit different than the use case for a rifle. There is probably some overlap, but there are definitely situations where one is a far better choice than the other.

<comment><USER2> Sorry about my lack of clarity.

My question is, what's behind their "make vs. buy" decision. They pretty much _have_ to buy or steal RPGs if they want them, you really don't want to mess around with primary and secondary explosives unless you absolutely have to (or so I gather, I've steered clear of them, I like my hands intact), but if they can procure RPGs, they can much more easily procure rifles. Don't know what the cost for a AR-15 pattern rifles is, but I heard some time ago the price for an illicit AK-47 pattern rifle is around $100.

Lack of access to Mexican military supplies (their fighting with the Los Zetas might suggest that) plus logistics might be part of the answer, the latter as in they'd probably rather smuggle more drugs into the country than some rifles, especially if demand for marijuana exported to the US is low (everything else is much smaller size and weight). This picture [https://upload.wikimedia.org/wikipedia/en/e/e8/Matazets- inte...](https://upload.wikimedia.org/wikipedia/en/e/e8/Matazets- interrogationZetas.png) shows them armed with AR-15 pattern rifles and the guy in the front right has a LAW, which is a US Vietnam era one shot rocket launcher ([https://en.wikipedia.org/wiki/M72_LAW](https://en.wikipedia.org/wiki/M72_LAW)).

<comment><USER4> You can buy most of AR15 entirely legally, save for a small machining job on a lower receiver blank: exactly what they were doing. Much easier than raiding army arsenals.

<comment><USER2> Nope, they were not turning 80% receivers into 100%, they were starting with aluminum billets according to this article (see this page for a 0% receiver you can buy ^_^: [http://www.80percentarms.com/products/0-billet- ar-15-lower-r...](http://www.80percentarms.com/products/0-billet-ar-15-lower- receiver)).

But in either case, why build when you can, in theory, buy?

Each has different levels of difficultly, and in this case, if true, it was probably harder than buying or stealing. But a different set of risks....

I mean, I've heard of Afgans doing this by hand from scratch, but I've never heard of this level of organization making rifles, heck, most nation states don't.

<comment><USER4> Well once you have a CNC mill the only difference between machining the full LR and finishing a blank is in run time.

As to why, I obviously don't know. But the LRs being the only regulated, and at the same time trivially machinable parts probably have to do something with it.

<comment><USER2> Per the article and what I understand, there's moderately skilled work required in sourcing and perhaps adjusting the right CAM data for a complete billet -> lower receiver machining job. Plus a _lot_ more machining involved; as I understand it, a drill press can finish an 80% receiver. But I suppose such skilled people can be persuaded to do this sort of work for a cartel.

<comment><USER4> The difference between programming the 20% finishing and machining the whole part is not that large. Moreover, the finishing would require manual set up and zeroing out each semi-finished piece.

Aluminium is cheap material and machines really well, there's not much downside to machining the whole piece. Plus, you save the expense of buying hundreds of pre-fab LR blanks.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Wow, an additional gem of an unnerving punchline (at least for me) is close to the end of the article:

 _" (...) That's why Mexican cartels are building citywide CCTV networks[1], forcing kidnapped engineers to build secret radio networks[2], and shipping stolen iron ore to China in exchange for bulk meth precursor chemicals[3]. It's not a question of whether cartels beyond Jalisco can't get their hands on computerized mills to make their own guns, but how far up they're willing to scale."_

 _[1]:[http://motherboard.vice.com/read/cartel- cctv](http://motherboard.vice.com/read/cartel-cctv) _

_[2]:[http://motherboard.vice.com/read/radio- silence](http://motherboard.vice.com/read/radio-silence) _

_[3]:[http://motherboard.vice.com/read/inside-the-cartels- global-m...](http://motherboard.vice.com/read/inside-the-cartels-global-meth- ring-from-guangdong-to-gulfport) _

</comment><comment><USER6> Filing serial number off is generally unsuccessful as a means of rendering a firearm untraceable. Law enforcement can use a variety of methods to reveal the serial number due to the changes that the original stamping makes in the metal underneath the actual surface impression. While in theory using an impact tool or a milling type tool could work to remove the underlying metal there is a risk that the integrity of the part (in this case the lower receiver) could be compromised.

I would take exception to the author's statement that the lower receiver is the primary firing mechanism. While it does contain the trigger and sear the upper receiver contains the full bolt assembly, firing pin, and gas system (or piston if you feel like getting fancy).

My biggest question is that if they are creating lowers from billet and other parts as well, why they just don't equip these weapons with auto sears and make them full auto. Go big or go home, right?

</comment><comment><USER7> FWIW: the "Ghost Gunner" is hardly a _general_ purpose CNC machine. It's made specifically to finish an "80% lower".

<comment><USER8> This cartel group didn't bother with the "Ghost Gunner", which is a joke. They got a real Hardinge 3-axis CNC mill and made parts from solid aluminum blocks. Hardinge is an old-line US machine tool builder, in business for over a century.

There's stuff in the article about "where did they get the G-code" to cut the part. Any good CNC machinist, given measuring tools and a part, can model a part like that. It helps if you have SolidWorks or Autodesk Inventor.

Or you can just look up "lower receiver 3D model" and download the model from GrabCAD.[1]

Maybe gun serialization should include barrels. Good rifled barrels are hard to make, and require special purpose machinery.

[1] [https://grabcad.com/library/ar15-lower-solidworks- native-1](https://grabcad.com/library/ar15-lower-solidworks-native-1)

<comment><USER2> The best rifle barrels are probably hammer forged, and indeed that requires $$$ machinery and tooling, but I'm under the impression that button rifled barrels aren't that hard to make.

But certainly a _lot_ more than AR-15 pattern lower receivers, which are not highly stressed by firing (here's a 3D printed plastic AR-10 pattern lower receiver! [http://3dprint.com/54163/printedfirearm- ar10-piece/](http://3dprint.com/54163/printedfirearm-ar10-piece/)), you need good steel, a big lathe at minimum and I'm pretty sure heat treating is a good idea.

Any proposal to serialize barrels would be shot down, so to speak, in the US now and for the foreseeable future.

<comment><USER8> In Germany, serial numbers are stamped on frame, slide, and barrel. Glock puts serial numbers on barrels. Browning does on some models.

<comment><USER2> Certainly, for manufacturing purposes, you frequently want to do that, especially for guns like the Glock where all three of those are relatively easily swapped. But making it a legal requirement would be another thing altogether; heck, in the US gun serial numbers preceded legal requirements by more than a century, it's only been required since 1968 as far as I know.

Hmmm, there's also the other sort of legal requirement, dealing with lawsuits. Glock doesn't want to have liability for a FrankenGlock kaboom....

<comment><USER9> Kind of off-topic, but one avenue where serial numbers stamped on all major bits have been useful is to collectors. I've seen a few that Forgotten Weapons covered that went for a pretty penny at auction because everything had matching serial numbers...

But that's a really good point about liability since there's _so_ many after- market replacement barrels for Glocks. Heck, I've been tempted at times to get one just for the standard rifling (and I don't shoot lead).

</comment></comment></comment></comment></comment></comment><comment><USER10> What are the differences between an M-16 LR and an AR-15 LR? Is there anything that's keeping them from manufacturing select-fire M-16 LRs? Are the other parts of an AR-15 (e.g. barrel, stock, UR) incompatible with an M-16 LR? I don't understand why they would machine semi-auto AR-15 LRs if they have all the tools necessary to build their full-auto/burst counterparts.

<comment><USER11> It's just the extra hole to accommodate the M16's full-auto sear. Anyone finishing an 80% AR15 lower could easily drill that third hole, but in the US the resulting firearm would be considered "readily convertible" to fully- automatic and therefore only legal to manufacture or possess under a limited set of circumstances.

Buying a bunch of M16 trigger parts, while legal in the US might attract unwanted attention, but I think a cartel with machine tools could easily manufacture these parts themselves, or a full-auto sear of a different design.

If they're not making select-fire rifles, and it wouldn't surprise me if they're not, it's because using a fully-automatic rifle effectively requires a lot of training and discipline. Most people under most circumstances would use a rifle more effectively without having the option of full-auto; even the US military has questioned its value for the average soldier, using some models with 3-round burst instead.

</comment></comment><comment><USER12> Another similar gunsmithing story from Vice.

[http://www.vice.com/video/the-gun-markets-of- pakistan](http://www.vice.com/video/the-gun-markets-of-pakistan)

</comment><comment><USER13> How bizarre. Brand new M16 lowers are like $75 retail. I can't imagine the motive for making them, unless they're just hobbyists who happen to be drug lords.

<comment><USER14> Just a clarification for people reading this who might be unfamiliar with legal details. What you meant was probably AR15 lowers, not M16. I doubt you could buy M16 anywhere in the US sans the black market. You could make one out of an AR15 lower but that would be illegal.

<comment><USER13> Neither term is terribly precise. I mean "AR15/M16 platform". They're all basically the same from the perspective of organized crime.

<comment><USER6> It is true that in the military, much shooting is done in semi-auto mode. That said there is a huge difference in the volume of fire that can be generated in full auto vs. semi-auto. Companies like Surefire are now building 100 round magazines that are far more reliable than the Beta mags which weren't much more than a gimmick.

</comment></comment></comment></comment><comment><USER15> Nice propaganda, how about mentioning brilliant operation Fast and furious?</comment>


Google Cloud Print - <AUTHOR> http://code.google.com/apis/cloudprint/docs/overview.html

<comment><USER2> Very interesting, I've always printed next-to-nothing, but when I do in a pinch I get charged an arm and a leg for it. I'd totally use this, and think that adding scanning/faxing might be handy as well later on.

Shameless plug: my startup, CloudFab.com, is very close to the same thing as this but with 3D printing.

<comment><AUTHOR> Cloud Print should be live in Chrome version 9.0.597.1 and newer. You'll need to be on the Chrome 'dev' channel (not beta or stable).

Go to 'Preferences' (or 'Options' if you're on Windows), click on 'Under the Hood', and scroll to the bottom of the dialog to enable Cloud Print and print a test page.

</comment></comment><comment><USER3> If this starts to get traction, I think the printer manufacturers are going to be all over it. It will make for a great reason for people to buy a new printer. Here's hoping some will provide the functionality in a free firmware update for already network attached printers.

<comment><USER4> Printer manufactures make the majority of their money on ink, not hardware. I expect that the roll out of this will be relatively gradual, as with any hardware.</comment></comment>


Archaeobotanical evidence reveals origins of bread 14,400 years ago in NE Jordan - <AUTHOR> http://www.pnas.org/content/early/2018/07/10/1801071115 <comment><AUTHOR> Previous discussion from 9 days ago: [https://news.ycombinator.com/item?id=17546207](https://news.ycombinator.com/item?id=17546207) (162 comments)

(sorry, didn't saw that discussion)</comment>


Show HN: Kanmail – An email client that functions like a kanban board - <AUTHOR> https://github.com/Oxygem/Kanmail <comment><USER2> Don't sell an email client, there is a reason they are all dead: too much effort, too many edge cases (POP3, IMAP, Exchange, Gmail...), not enough margins.

Instead, sell me _a hack that can make Outlook look like that_. You worry exclusively about the UI, Microsoft does the heavy lifting behind the scenes.

Best case: you make a ton of money by selling to actual businesses (rather than annoying geeks and other weirdos who dare use uncommon clients); slightly-worse case: you sell it to MS.

<comment><USER3> How about a Chrome extension that makes Gmail look like that?

<comment><USER4> Already built in. Enable multiple inboxes in Gmail and use labels for all these.

<comment><USER5> We do a combination of labels and stars. The last ones are easier to change and if you only pick a minimal number of stars it is not that complicated to remember them and rapidly click through them until you select the right one. See more on the first video of my Youtube Channel: [https://www.youtube.com/channel/UCoPEE8RAtxJ3OhnlgeBVWEQ](https://www.youtube.com/channel/UCoPEE8RAtxJ3OhnlgeBVWEQ)

</comment></comment></comment></comment><comment><USER6> If there are people out there who are well invested into Gmail, then here's an alternative ([https://klinger.io/post/71640845938/dont-drown-in-email- how-...](https://klinger.io/post/71640845938/dont-drown-in-email-how-to-use- gmail-more)) that does not require a separate client application. The initial concept is focused on desktop usage, but with a small modification it can be adapted to mobile-based working as well.

<comment><USER7> For years I've used Gmail Filters to apply labels to specific "from" addresses. Takes a bit to set up as I have very long "from(@domain.com OR @domain2.com OR ...)" queries but ideally I'm also unsubscribing from newsletters etc. that I don't want.

I also use multiple inboxes as well. First, "Starred" (different colored stars means different things to me and this strategy is used consistently across multiple platforms inc macOS labels, Trello etc.), then "Alerts" (critical emails from various systems), then "Important and Unread", then everything else.

Most emails are not "important" and I do actively unsubscribe so the method is manageable for me. The last thing I need is my email inbox to be a giant todo list. Most important are tech/work related, current projects, finance/business. I try not to sign up for anything that I need to read, newsletters etc. That's what RSS is for. Email is for quick actionable item and some communication.

<comment><USER8> This approach works well, until you have to click on a star in each mail 4 or 5 times to get it to turn into a purple star, etc.

<comment><USER7> I star a handful of emails max. each day. Not laborious at all considering the work load offloaded to Gmail's filters and I use a red, orange, yellow, & green star system.

</comment></comment></comment></comment><comment><USER9> Jut a Headsup, Chrome blocked the download and a virustotal report look like this: [https://www.virustotal.com/gui/file/2e78fed158e9e6857db7bfc6...](https://www.virustotal.com/gui/file/2e78fed158e9e6857db7bfc6af37b3cc8abc2d7092fe63f64cb59e4ad10a3c22/detection)

6 engines detected this file

Do what you want with this information, cloud be false positive, cloud be something else idk.

</comment><comment><USER10> I'm a bit confused by the "open source but not free" statement in the readme. How common is it to refer to software with public source code as "open source"? I always thought the "open source" label applied only to those licenses officially certified as open source.

<comment><USER11> Yes, it's a misuse of the term "open source". It should be described as "source-available" [0], not "open source".

[0] [https://en.wikipedia.org/wiki/Source- available_software](https://en.wikipedia.org/wiki/Source-available_software)

<comment><USER12> Many popular "open source" projects are also not free...

<comment><USER10> Can you name some examples? According to the internet for most practical purposes the terms "open source" and "free software" refer to the same set of licenses [0]

[0]: [https://opensource.com/article/17/11/open-source-or-free- sof...](https://opensource.com/article/17/11/open-source-or-free-software)

<comment><USER13> I think they mean free as in free beer. So there can be Free and Open Source Software that you must pay for.

<comment><USER12> It's hard to sell air, until you compress it and put it in a tank. And it's hard to sell sand, until you put it in a bag. So the air and sand is free, but then it varies: Open core, dual licenses, packed with proprietary software, license clause's, etc. Why not just ask for a license fee? And why can't something be open source when it's not free as in free beer? So yes, what I mean is there are open source software that is not free as in libre, and there are open source software that are not free as in free beer. So why can't this software be called open source, when the source is... open? Open source comes with many advantages, not just that it's free as in free beer but also that you can fix issues yourself, and it makes it easier to create plugins, mods, etc.

<comment><USER13> > And why can't something be open source when it's not free as in free beer

There is nothing preventing you from charging a fee for Open Source or even for Free Software. You only need to distribute source code to users of your software. That means it does not need to be publicly available on a site like Github. You need to remember that users who receive the software and source code are still allowed to distribute your software for a fee or even free. This method of selling software is not common at all though, so I can't really name any successful projects doing it.

> So why can't this software be called open source, when the source is... > open?

The reason you can't call software like that as Open Source is because Open Source has a clear definition as defined by the Open Source Initiative[1]. Free Software has a definition as well[2]. The Open Source definition is a more expanded and detailed version of the Free Software's Four Freedoms. If the license you use for your software does not allow the things as described by those definitions, you can't call it Open Source or Free Software.

[1]:[https://opensource.org/osd](https://opensource.org/osd) [2]:[https://www.gnu.org/philosophy/free- sw.html](https://www.gnu.org/philosophy/free-sw.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I actually setup something similar years ago with a gmail add-on. Was pretty intuitive and liked it. It would be advantageous to add additional features over this such as:

1\. Adding points or estimated workloads to emails.

2\. Adding notes to emails

3\. Snooze emails (which would drop their priority on the board, but stay in the same lane until post snooze).

4\. Highlight who is in the discussion thread.

5\. Rules for lanes of work (for instance potentially emails from boss should go straight to "in progress")

<comment><AUTHOR> Thank you for the feedback, these are some really interesting ideas :)

1/2/3: It could be possible to implement points/notes/snoozes by using (abusing?) IMAP folders to store such information. Ideally such information would live on the server-side such that it would sync between devices ([https://github.com/Oxygem/Kanmail/issues/84](https://github.com/Oxygem/Kanmail/issues/84) / [https://github.com/Oxygem/Kanmail/issues/85](https://github.com/Oxygem/Kanmail/issues/85)).

4: Great idea, long threads make this really hard to see currently! ([https://github.com/Oxygem/Kanmail/issues/86](https://github.com/Oxygem/Kanmail/issues/86))

5: Currently possible using Gmail filters, but not part of the client itself of course. Would be really interesting to implement this! ([https://github.com/Oxygem/Kanmail/issues/87](https://github.com/Oxygem/Kanmail/issues/87))

</comment></comment><comment><USER15> Kanmail is built using pywebview, which is an interesting alternative to Electron. Lighter distributions thanks to using respective OS's native web view.

</comment><comment><USER16> This looks great! I'll give it a try. Congrats on launching! Email is a great communication mechanism, but as a manager, it's so hard to corral the process of following up on emails that take many days for people to do. It would be awesome if each column could have a suspended area at the bottom and I could set due dates and they would sort into that separate section until they are due.

</comment><comment><USER17> Looks good. I follow this 16 year old on Twitter named Ethan, and he's built something similar: [https://kanbanmail.app](https://kanbanmail.app). I know of him due to his prevalence in the indie maker community, and he streams his development on Twitch sometimes.

</comment><comment><USER18> The package.json in that repository says "MIT". How does that work with the propietary license agreement?

I also wonder if the author has any way to prevent copyleft code entering their project. What would be a nuisance for a free software project could potentially kill a commercial one like this.

I do not mean this as a comment against copyleft or this particular project, I am really interested to know if there is a Semi-Automatic license scanner.

<comment><USER19> License scanning is a big deal for enterprise, especially the ones deeply afraid of any "GPL infection". Black Duck is one such vendor of license scanning software.[0]

[0] [https://www.blackducksoftware.com/](https://www.blackducksoftware.com/)

<comment><USER20> and it gives a lot of false positives and false negatives...

</comment></comment></comment><comment><USER21> Very cool! It looks like the primary focus here is displaying the messages in multiple folders at the same time; I like the message opens where it has space to open.

The account management settings page mentions needing an application password for Gmail — you'll also need one to add a Fastmail account (it looks like it retrieves through IMAP and sends through SMTP).

When I added an account, the account's existing folders weren't displayed to me anywhere (I was expecting the sidebar), but it looks like you can add a column for an existing folder and it'll just work.

It also looks like the action of dragging a message from one column to another removes it from one folder and adds it to another, which makes sense for a kanban board, but might get a little weird with Fastmail's labels mode, where a message can exist in multiple folders! ([https://beta.fastmail.com/help/receive/labels- beta.html](https://beta.fastmail.com/help/receive/labels-beta.html))

<comment><AUTHOR> Thank you for the feedback, this is incredibly helpful!

\- Regarding the new account message I shall update this to point at the providers page ([https://github.com/Oxygem/Kanmail/issues/81](https://github.com/Oxygem/Kanmail/issues/81))

\- I like the idea of auto populating sidebar folders (without causing cluter, one to investigate) ([https://github.com/Oxygem/Kanmail/issues/82](https://github.com/Oxygem/Kanmail/issues/82))

\- Originally Kanmail did copy emails between folders/labels (matching Gmail) but moving emails is more IMAP friendly in general. However, perhaps an option to copy is the best solution here, giving the end user the choice ([https://github.com/Oxygem/Kanmail/issues/83](https://github.com/Oxygem/Kanmail/issues/83))

</comment></comment><comment><USER22> Would love it if any client would support grouping all messages per senders unique email and topic, sorted by date.

The result is almost like a conversation. It makes it easier to see each topic as well.

So far, I've only seen "Unibox" client on MacOS do this. (Not updates since 2018)

<comment><USER23> I think the upcoming hey.com service is going to do something similar to that.

<comment><USER22> Huh, very interesting. Seems to be created by Basecamp, so will certainly be reliable.

</comment></comment></comment><comment><USER24> That look super slick, congrats on launching it! It still looks a bit "noisy" to me, maybe you can reduce the information density a little as to me it seems a bit overwhelming. Super useful idea though and surely something that can be a success!

<comment><AUTHOR> Thank you! Agreed re:noisy-ness there's a lot going on currently; will be looking into tweaking that!

</comment></comment><comment><USER25> Thank you for using a model that respects users' freedom! I happily pay for source-available software, sometimes even when I don't really need it that bad, because I like to support ethical software :-)

</comment><comment><USER26> I have been wanting an email client where I can simply drag and drop emails as a TO-DO Kanban board. I will definitely give this a try.

</comment><comment><USER27> Is the $25 license per user or per machine, and per year or perpetual?

</comment><comment><USER28> This is one reasone that keeps me on Apple's Mail.app: open multiple windows for different mailboxes / folders / smart mailboxes and drag & drop at will between them.

Keep a window for specific smart folders if there are special keywords / people you want to give priority. Tuck it in a corner of the screen without taking up lots of realestate.

To be fair, Apple really screwed that workflow in 10.15 by disallowing customization of columns like they used to have since 10.0. But still, the multi-window organization is so much more flexible than the all-in-one-window setup. (For those concerned with tidiness, a window manager takes care of that problem.)

<comment><USER29> Thunderbird allows the same as far as I understand your wokflow (and has done for the nearly two decades it exists), if you want to look at alternatives (or occasionally have to use Windows or Linux)

</comment></comment><comment><USER30> One thing that I think should be clarified regarding licensing: On the license page it says "Licenses are $25 during the beta period.". It is not clear if this means either:

1) During the beta period, a lifetime perpetual license is 25$

2) License for the duration of the beta period costs 25$. After that you may or may not need to renew your license.

This looks really interesting, but I think there are others who are hesitant to invest into something that may end up costing ongoing licensing fees that are yet to be determined.

<comment><AUTHOR> You're absolutely right; I've expanded the copy on the license page. Any licenses purchased during the beta will last for the duration of beta and all of v1 updates.

</comment></comment><comment><USER31> I am trying this and I think I will move away from my over-configured "mutt" setup, just to use it.

My only "suggestion" is to please keep it functional and simple.

</comment><comment><USER32> I installed this and used it for a day. This UX model is dramatically better for business mail than the standard mess of random folders. Kanmail itself is still pretty early stage. It's too raw for my own day to day usage, but I'll check back later. I hope it keeps going.

</comment><comment><USER33> this looks amazing, will try it out. having the option show messages from all accounts at once is a blessing for me.

<comment><USER27> It amazes me that Outlook mobile will let me see all my email from all my accounts in one list but Outlook desktop will not.

</comment></comment><comment><USER34> Reminds me kanbanmail.app was in Hackers News 2 years ago: [https://news.ycombinator.com/item?id=17576024](https://news.ycombinator.com/item?id=17576024)

</comment><comment><USER35> My wife has a manual system for exactly the system in the screenshot, so I thought she would like it. "Nah, can't use it on my phone".

</comment><comment><USER36> I've been doing Thunderbird with quick folder extension to achieve near the same functionality however in Tabbed view.

nonetheless a great idea. will test it soon.

</comment><comment><USER37> It seems like that the software doesn't have STARTTLS, so it doesn't work with Protonmail's Bridge :/

</comment><comment><USER38> If this were solely a Gmail extension I would be 100% in and pay about $25/month.

<comment><USER39> Checkout 2 alternatives implemented as Chrome extensions: * [https://yanado.com/](https://yanado.com/) * [https://www.sortd.com/](https://www.sortd.com/)

</comment></comment><comment><USER40> If it has dark mode and good Linux support, I'll buy it. Will try out tomorrow.

</comment><comment> awinter-py for any service whose core data is a 'collection of things', BYO prioritization & queueing makes a lot of sense

too bad integration is really hard or this would be general

</comment><comment><USER41> Love it, but calendar is so tied to Outlook. Please save us!</comment>


Show HN: PerfectPixel Browser Extension - <AUTHOR> https://www.welldonecode.com/perfectpixel/ <comment><AUTHOR> Whenever you need to express your design mockup in HTML in a precise way you need a tool to check and compare — this is where PerfectPixel browser extension shines! PerfectPixel allows you to do it by placing a semi- transparent overlay on top of a browser page

Our potential user base are frontend developers and everyone who needs to compare images with what they see in browser. PerfectPixel already has around 200,000 of unique monthly users

Project is monetized through ads

Team consists of 2 co-founders with web full stack expertise (San Francisco, Saint Petersburg), 1 contractor front end developer, 1 contractor designer

We are a bit stuck on what do to next - how to expand our user base and improve our monetization - can you suggest us something? And we are open for partnership for sure

<comment><USER2> Cool, very useful tool! I'm going to try it</comment></comment>


Barry Diller Calls Free Web Content a 'Myth'... - <AUTHOR> http://www.bloomberg.com/apps/news?pid=20601087&sid=aZeenjkAYFIE

<comment><USER2> It's amazing how these people just don't get it. This is how the internet started out, then all of these 'media companies' fell by the wayside because there was so much free, useful, and relevant content available outside of their controlled platforms.

The fact that they think they can regain control is comedic by forcing us to pay.

</comment><comment><USER3> Fine if he thinks people will pay for things. They will have to actually provide added value. Like Zynga or Blizzard.

So Diller find out what people will actually pay for. Don't give us crap about how free is not free. Same goes for the NYtimes figure out some new business models. Stop trying to protect what the internet killed.

</comment><comment><USER4> Hey, the internet must be broken because I read Mr. Diller's words and didn't pay a thing.

Oops. Barry, you might want to consider your audience when talking to a reporter who works for an advertiser-supported publication.

That's rather an admission Diller hasn't really been to the clue store in a while.</comment>