Ask HN: I was hit with a SIM swapping attack; ideas on improving protection? - <AUTHOR> Yesterday I suddenly lost cell service while running errands.  Within a half hour I was home.  Upon checking my email I found notifications of financial transactions pending (thankfully on a delay).  I was able to resolve everything and all is well now but I'm left feeling like I need to rethink all of my online actions.  I'm quite careful with my security but once someone took my sim all of my passwords and two-factor authentication went out the window.  I was aware of this kind of attack but thought it was relatively hard to pull off.  I'm really small potatoes financially and didn't think someone would target me.  Apparently it's not all that hard to do this kind of attack. In researching ways to lower my risk I found this article had some good ideas:
https://medium.com/mycrypto/what-to-do-when-sim-swapping-happens-to-you-1367f296ef4d
I've asked my carrier to put an "in store only" id check to change the account. Does anyone here have any more ideas on ways to prevent this kind of attack?
Thanks <comment><USER2> I wouldn't trust the carriers at all. You have to unlink everything from your phone number unfortunately.

<comment><USER3> This. Use a Yubikey or similar for 2FA instead of your phone.

</comment></comment><comment><USER4> Don't be shy, shame the carrier - let us know which company allowed this.

<comment><USER2> Don't be swayed by anecdotes; _all_ carriers are totally insecure.

</comment></comment><comment><USER5> Which is your carrier?</comment>


Ask HN: Need reverse image search engine for my one-night webapp - <AUTHOR>

Tonight, I am working on a webapp to find pictures of yourself online, by feeding Facebook pics into a reverse image search engine. I plan on charging $1 to check all of your Facebook pictures, or $10 to monitor all of your pictures for 1 year. I am also considering pivoting and providing professional photographers with a service for ensuring that other people do not re-use their work without permission.<p>Tineye didn't pass my tests and Gazopa seems broken. Please advise. I want a good hack night. <comment><USER2> Interesting concept overall - Maybe do a freemium with a free first check that is a "lite" scan and the $1 for Facebook afterwards? Or, do the check and show the first 10 results and charge for the rest. Give them a taste of it first before asking for money maybe :)

</comment><comment><AUTHOR> Update: Bob Cavezza (rcavezza) suggested Face.com on StartupGuild, so I am testing that now. If Face.com doesn't work, I hope to hack Google/Bing related images, or locate images with unique filenames.

</comment><comment><USER3> I was going to recommend Tineye but it seems it didn't work for you. I'm curious to know what didn't work.

<comment><AUTHOR> I am testing against images on <http://natanyellin.com/about> and there are no matches. It also failed to find my current and past Facebook profile pictures, which were all public.</comment></comment>


Birgitta Jonsdottir leader of Iceland's Pirate Party asked to form a government - <AUTHOR> http://www.bbc.com/future/story/20161207-the-first-pirate-politician-in-power <comment><USER2> The Icelanders are big supporters of Wikileaks and Birgitta herself was a member.

Potentially this could mean an invite to Iceland for the occupant of the Ecuadorian embassy or Edward Snowden.</comment>


Disruptive Innovation: Anticipating Effects of the Single Serve Coffee Market - <AUTHOR> http://www.scaa.org/chronicle/2012/07/06/disruptive-innovation/ A great article talking about the increased tension between quality and convenience that the single serve market is introducing, and the potential inevitability of single serve erasing the divide between the two.
The closest I come to being religious is in how I go about selecting what coffee I brew and how I go about brewing it (locally roasted, fresh ground beans in a french press). I often spend the night at my brother's place when we are heading out for a long-weekend bike trip, and am perpetually fascinated by the convenience of his Keurig (http://www.keurig.com/brewers/special-edition-brewing-system) and inescapable draw that convenience affects on me.
As somebody who is downright unreasonable when it comes to skimping on quality coffee, I think the author nails it when he highlights the threat that increasing quality of K-cups pose to cafes selling single cups. A fundamental truth when it comes to brewing coffee is that to get the best cup, you have to grind your beans directly before you brew. This is unassailable, right? But what happens if K-cups whittle down the difference in quality between their method and fresh ground in blind taste tests? Should the perpetuity of this quality gap be dismissed?
The mass market is the mass market, but I wonder how many pro-sumers of coffee K-cups could one day lure away, despite their resistance on quality grounds. <comment><AUTHOR> A great article talking about the increased tension between quality and convenience that the single serve market is introducing, and the potential inevitability of single serve erasing the divide between the two.

The closest I come to being religious is in how I go about selecting what coffee I brew and how I go about brewing it (locally roasted, fresh ground beans in a french press). I often spend the night at my brother's place when we are heading out for a long-weekend bike trip, and am perpetually _fascinated_ by the convenience of his Keurig (<http://www.keurig.com/brewers/special-edition-brewing-system>) and inescapable draw that convenience affects on me.

As somebody who is downright unreasonable when it comes to skimping on quality coffee, I think the author nails it when he highlights the threat that increasing quality of K-cups pose to cafes selling single cups. A fundamental truth when it comes to brewing coffee is that to get the best cup, you have to grind your beans directly before you brew. This is unassailable, right? But what happens if K-cups whittle down the difference in quality between their method and fresh ground in blind taste tests? Should the perpetuity of this quality gap be dismissed?

The mass market is the mass market, but I wonder how many pro-sumers of coffee K-cups could one day lure away, despite their resistance on quality grounds.</comment>


Solar Power for your Ham Station – for when the grid goes down - <AUTHOR> https://www.youtube.com/watch?v=g-hqt6pvGxo <comment><USER2> That is actually a pretty darned good introduction to working with solar power!</comment>


Perl One-Liners Explained, Part VII: Handy Regular Expressions - <AUTHOR> http://www.catonmat.net/blog/perl-one-liners-explained-part-seven/

<comment><USER2> These regexps might be useful as first approximations - but they are not as robust as the article suggest they are (for example numbers can contain decimal point or decimal comma depending on your language, parsing email addresses is a subject for an essay and I've heard the correct Perl regexp for that takes about a page of text). This article is harmful - because those who can benefit from this kind of basic regexp examples are also those who will not understand the limitations.

<comment><USER3> > because those who can benefit from this kind of basic regexp examples are > also those who will not understand the limitations.

I share your sentiment. The article is certainly useful for learning regexps. But IMHO it should also point to the correct way of doing things - often, the correct way is using a module and thus the resulting code is not much longer than the code in the article. For email address validation:

        use Email::Valid;
        print (Email::Valid->address('email@example.com') ? 'valid' : 'invalid');

as a oneliner:

       perl -MEmail::Valid -E"say (Email::Valid->address('firstname.lastname@example.com') ? 'valid' : 'invalid');"

Other than installing the Email::Valid module with a

        cpanm Email::Valid

it is not much longer than the example in the article.

<https://metacpan.org/module/Email::Valid>

<comment><USER4> I guess you guys just read the code and not the text:

`Notice that I say "looks like". It doesn't guarantee it is an email address.`

And yeah, you can find the full regular expression in the back of one of O'Reilly's Perl books (the regular expression handbook I believe).

It's nice to see perl code from time to time, even if it's just one line :)

<comment><USER3> Point taken - what I primarily wanted to show is that the correct way is not much longer than the "looks like" solution. Yes, the Regexp is long, but it is nicely encapsulated in the Email::Valid module.

</comment></comment></comment></comment><comment><USER5> I think this collection clearly shows the simplicity and utility of short, potentially imperfect regular expressions. Reading and writing expressions like this--even if you never use them in your code--is a skill that almost every programmer would benefit from.

</comment><comment><USER6> In #117, the sentence ends too:

        The second regex matches hello because.

<comment><AUTHOR> Fixed now!

</comment></comment><comment><USER7> This is really the essence of Perl and also its "problem".

If you need a book to explain one-liners, it will be challenge to comprehend a program with 20 such one-liners.

<comment><USER6> I approach these articles as a way to show off the expressive abilities of a language, not to provide code snippets for cut-and-paste.

As others have mentioned (and as the articles themselves repeatedly mention), most of the time, if you have a common problem, you should find and use a CPAN module already built to solve it.

I have never used a code snippet from a one-liner compilation in one of my programs, but I have learned a lot of new constructs by reading them.

EDIT: Or, what tikhonj (<http://news.ycombinator.com/item?id=3219843>) said.

</comment></comment><comment><USER8> Man, I _like_ perl, and learning how to operate these sorts of regular expressions is useful, but a lot of the the "one-liners" are infested with magic variables and the sort of freakish syntactical constructs which give the language a bad name.

Good Perl is basically 72% of Ruby. (Less syntactic sugar. Less-structured reflection. And mildly crufty sigils - not that you'll notice those after your second week, though.)</comment>


Ask HN: Where do you host medium-scale start up sites? - <AUTHOR>

I have been using HostGator shared hosting as a low cost solution to host some of my start up ideas over the past year or so.  Unfortunately any time a site gets a decent amount of traffic, my account gets disabled for server load or something of that nature.  For those of you that outsource your hosting, what sites have you used that you like?  My main requirements are PHP, SQL, ruby, and python.<p>Thanks! <comment><USER2> <http://linode.com> its a vps so a little more manual, but full control over your stack

[http://www.linode.com/?r=bde45b7ba8346eec9a56d7276f536caea70...](http://www.linode.com/?r=bde45b7ba8346eec9a56d7276f536caea70c6004)

is a referral link :)

<comment><USER3> I second Linode.com

It's the first real VPS I've used and it's been pretty straight forward to learn. We're using it to host <http://rumplo.com>

</comment></comment><comment><USER4> Personally, I have a dedicated server, there's plenty to be had out there for a relatively cheap price. ($50ish range, they're out there, I'm hosting at <http://securedservers.com>)

A dedicated server is a good opportunity to learn about server administration too!

</comment><comment><USER5> Rackspace "Cloud Sites". It is like shared hosting, except it scales. PHP and .NET only.

</comment><comment><USER6> Media Temple is pretty sweet, and they have a friendly user interface.

</comment><comment><USER7> Liquid Web or Storm on Demand (Liquid Web's cloud solution)

</comment><comment><USER8> Serverbeach folks have great infrastructure.

</comment><comment><USER9> Rackspace</comment>


PHP 7.0.0 Release Announcement - <AUTHOR> http://php.net/releases/7_0_0.php <comment><USER2> Some enlightening performance comparisons:

        - https://kinsta.com/blog/hhvm-vs-php-7/
        - http://talks.php.net/fluent15#/

PHP 7, in addition to give the language some nice new features and deprecating some ancient garbage, is lockstep with HHVM performance-wise. It's definitely a major milestone in the language's history.</comment>


Show HN: OJ – A Clojure library for talking to your database - <AUTHOR> https://github.com/taylorlapeyre/oj

<comment><USER2> I don't get few things.

1\. Queries are executed by passing your query and db-config to oj/exec. So, does it mean that with any new query there will be new connection to db? How do you manage transaction, when doing inserts/updates? I suppose there must be some magic I don't understand, because if that stuff actually is unsupported that would make all thing pretty much unusable, wouldn't it? Well, if you are not using MySQL/MyISAM anyway.

2\. I suppose that library does some internal sanitizing, because it is what such libraries usually are for after all. There isn't much sense in using keywords instead of strings if it is the same plain SQL you would write manually (well, you wouldn't make a typo in the word WHERE, but that's all). But I don't see any mentions of types whatsoever. So if I pass some variable foo to that query, how does it know how to validate and sanitize it? If it is allowed to be NULL? If it should be passed to query as INT or string or maybe DATETIME? As it is minimalistic I would assume it doesn't use schema (and how would it if it's not an ORM, but just some query composer?), so how does it work then?

There are few other things I frowned on, but these are the major points.

<comment><AUTHOR> I'll try to address your concerns, but keep in mind: this is a very new project.

1\. When you "exec" a query, all I'm really doing is compiling the query map into an SQL statement and passing it into java.jdbc[1] with the database configuration that is given. This database config can be stored as a regular Clojure map in a config namespace in your project or however you wish. To answer your question, yes, at the moment java.jdbc is called for each query that is executed and I can only assume that that means that a new connection is made. Obviously there is room for improvement here, which will be addressed in the future.

2\. I've provided a thorough specification for what makes a Clojure map a "query map" in the SPEC file[2]. Before any query map is compiled into SQL, it gets validated by a function that ensures that it meets the specification. If not, it throws an error.

Hopefully this answers some of your concerns! Like I said, this is a new project that I made for fun and for personal use. I plan on working on it for a long time, and I'm sure that many things will be improved! I hope that others find it useful (or at least interesting) as well.

[1]: [https://github.com/clojure/java.jdbc/](https://github.com/clojure/java.jdbc/)

[2]: [https://github.com/taylorlapeyre/oj/blob/master/doc/SPEC](https://github.com/taylorlapeyre/oj/blob/master/doc/SPEC)

<comment><USER3> Regarding point 1, java.jdbc can accept a variety of types of connection maps. The simplest scenario is you pass in a map that contains the connection information, and you get a new connection and transaction for each call. However, you can also pass in live connections/transactions that can be reused. The with-db-transaction form is one way to accomplish this. It's really pretty flexible.

(And btw, your library looks really quite good! I'm glad people are trying to address the issue of generating SQL within Clojure.)

</comment></comment></comment><comment><USER4> While we're on the Clojure topic, what's the preferred quick-start guide to learn the language and tool-chain?

<comment><AUTHOR> I like Clojure for the Brave and True [1], although it can be a little goofy at times.

Leiningen [2] is the standard build tool, and Clojars is the standard package repository [3].

For web development, Ring [4] is the standard HTTP solution, while Compojure [5] is generally used for routing.

[http://www.clojure-toolbox.com](http://www.clojure-toolbox.com) is good for everything else.

[1]: [http://www.braveclojure.com](http://www.braveclojure.com)

[2]: [http://leiningen.org](http://leiningen.org)

[3]: [https://clojars.org](https://clojars.org)

[4]: [https://github.com/ring-clojure/ring](https://github.com/ring- clojure/ring)

[5]: [https://github.com/weavejester/compojure](https://github.com/weavejester/compojure)

<comment><USER5> It's also worth mentioning Pedestal[1] - in place of Ring and Compojure. Pedestal is set of libraries for building web services that is fast and secure by default. It fully embraces async capabilities (unlike Ring which is inherently synchronous), and maintains most Ring compatibility. It sits upon battled-tested technologies (Jetty, Tomcat, JBoss, Undertow, etc).

[1] [https://github.com/pedestal/pedestal](https://github.com/pedestal/pedestal)

</comment></comment></comment><comment><USER6> Looks really promising. We're using HoneySQL now, but OJ might be even lighter.

<comment><USER7> If you're looking for a _really_ light SQL library for Clojure, I recommend yesql: [https://github.com/krisajenkins/yesql](https://github.com/krisajenkins/yesql)

<comment><USER8> +1 - This is by far the sanest approach to rdbms interaction I've seen. It's kind of sad that we're stuck with SQL but while we're stuck with it we should stick to it. :P

<comment><USER9> I agree and it's what I've used for all of my pet clojure projects that need to talk to a database. However, the drawback it suffers versus a lot of the approaches taking by most of the alternative libraries is that it doesn't provide any way to compose queries.

I'm talking about the kind of stuff something like Korma or SQLAlchemy enable where you build up a query to be executed dynamically based on, for example, user filters.

I haven't need anything like that on any of my pet projects so I've been deliriously happy with Yesql. But, while working on those pet projects I do often find myself thinking about whatever I'm doing in my day job and I haven't come up with a good way to support composability within the context of Yesql. I would love to see a solution to that.

</comment></comment></comment></comment><comment><USER10> It would be good to have a section which compared this to other Clojure database libs. I've only used Korma but I would like to know what you're doing differently to them.

<comment><AUTHOR> I explain the difference between OJ and Korma here:

[https://github.com/taylorlapeyre/oj/issues/4](https://github.com/taylorlapeyre/oj/issues/4)</comment></comment>


Activision CEO Bobby Kotick now one of America's highest paid executives - <AUTHOR> http://arstechnica.com/gaming/2013/04/activision-ceo-bobby-kotick-now-one-of-americas-highest-paid-executives/ <comment><USER3> "Even spreading that stock award out, though, puts Kotick's 2012 compensation at more than $20 million."

He'd just make the list of the top 20 highest paid baseball players. $20 million is a lot of money, no question about it, and it's a lot of compensation for any CEO. However, I fail to see why baseball players with so- so stats should make more than a guy running something worth as much as all of Major League Baseball combined.

Should they all make a lot less money? Why do I care? If I disagree with ATVI's compensation policies, I'm free to not own the stock (or even buy their products). If I don't like how much the Phillies are paying Cliff Lee, I'm free to never attend their games. And so on and so forth for the rest of the economic sphere of products and services and companies.

<comment><USER4>
      2013 Top MLB Player salaries = ~$20MM
      2013 Average MLB Player salary = $3.4MM [1]
      2012 Minimum MLB Player salary = $480k [2]

One could argue that the salary disparity between the top MLB players and the average player salary (40x) is much smaller than that of the average US company CEO and employee (300x+).

Of course, we should probably consider the minor league players:

      Minor League AAA Player Salary range: $5k/mo ~ $25k/mo for a 6 month season [3]
      -> $30k/yr ~ $150k/yr

(I think signing bonuses and whatnot for top draftees are just outliers)

So if we suppose that a AAA player gets $100k/yr and a top MLB player gets $20MM/year, then the salary disparity is now 200x, approaching the salary disparity of US corporate employees and their CEOs. That's actually quite a striking similarity!

[1] <http://www.cbssports.com/mlb/salaries/avgsalaries>

[2] <http://www.spotrac.com/terms/mlb/mlb-minimum-salary-69/>

[3] [http://www.quora.com/How-much-does-the-average-AAA- baseball-...](http://www.quora.com/How-much-does-the-average-AAA-baseball- player-make-in-salary-The-highest-paid-The-lowest)

</comment></comment><comment><USER4> I did some digging in Oracle's SEC filings and in fiscal 2009, Larry Ellison (who in FY 2012 was still the highest paid CEO in the country) was given ~$80MM in compensation, where 97% was in "variable compensation" (stock option grant + performance bonus)

      Name - Lawrence J. Ellison

      Size of Option grant in FY09 (Shares) - 7,000,000

      Accounting Grant Date Fair Value of Option Grants in FY09 ($) - 78,421,000

      Intrinsic Value of FY09 Option Grants as of 5/29/2009 ($) - <USER2>

      Intrinsic Value of FY09 Option Grants as of 8/10/2009 ($) - 3,640,000

[http://www.sec.gov/Archives/edgar/data/1341439/0001193125091...](http://www.sec.gov/Archives/edgar/data/1341439/000119312509179868/ddef14a.htm)

The disparity between the intrinsic value of the option grants between May and August must mean that the shares increased in value by about $.50 in those ~3 months.

I'm always astonished that Ellison still owns ~24% of Oracle.

<comment><USER3> I find his dividend income astonishing: 0.007 * $36 billion ($252 million per year)

Of course Steve Ballmer does even better: 0.029 * $15 billion ($435 million per year)

<comment><USER4> Yup, with that kind of cash flow, he can easily absorb the operating losses from the Lanai island businesses that he purchased a couple of years ago to reduce his tax exposure X_X

</comment></comment></comment><comment><USER5> At first I found this upsetting. But this is how games are. Good for him. His mission of taking the fun out of making games is really paying off. There are small, weird, indie games that can be fun to play, but there's no money in that. Millions of people play Call of Duty. He's making games tons of people love and making money doing it.

<comment><USER3> There's no money in Minecraft and Kerbal Space Program and Torchlight and countless others?

Turns out there's a massive amount of profit to be had in successful indie games. The distribution channels are spectacular today, from the general Web to Steam to Amazon to Xbox Live etc.

<comment><USER6> But being successful isn't enough. For an indie game, making ten million in revenue is a dream come true. For Activision, a game with an expected revenue of 10 million isn't worth the distraction. It's like trying to pitch a CRM for taxidermists or a Haskel IDE to VC funds: it may be a great idea, but the market isn't big enough to interest them.

</comment></comment></comment><comment><USER7> "The firm's stock price has risen nearly 16-fold during this long tenure..."

I think that sums it up pretty nicely.

</comment><comment><USER8> Why do we care how much money other people make? It seems like an unhealthy fascination.

<comment><USER4> One reason would be to scrutinize and consider whether top executives deserve the mammoth compensation that they receive these days. Recall that executive compensation is at an extreme all time high these days relative to even just 2 decades ago.

<comment><USER3> Executive compensation seems so out of whack because it has kept up with inflation, while real wages haven't even come close. Why? Allow me to explain.

The S&P 500 now gets half of its profits and sales from the rest of the world. The boom in countries like Brazil, China, India etc has vastly expanded the rest of the world's share of the global economy relative to the US. CEO's are compensated for this performance, but labor is paid based on local / domestic factors, not the profit generated in foreign markets.

The CEO wage numbers in the US demonstrate how horribly the US economy has fallen behind when it comes to labor keeping up with global growth. You can easily test this by scaling the corporate sales backwards, eg to the 1960s, and adjusting CEO compensation for inflation.

Everybody likes to talk about worker to CEO pay ratios, but what they never want to talk about is the destruction at the root of the problem: the Fed destroying the US Dollar. CEO pay has kept up, worker pay has not, and the why is easy to understand: the US economy is being flushed down the toilet.

By tapping into global growth, multi-nationals have been able to keep up with the horrific dollar devaluation that has occurred since the 1960s. CEOs are compensated on that basis. Meanwhile labor directly suffers the full intensity of the dollar's destruction. It is thus that the American standard of living has plunged over 50 years. Minimum wage has fallen from $45k to $50k per year ($1.25/hour in 1964, inflation adjusted), down to $14k or so today.

Americans used to be able to more than get by on one income, while a spouse stayed home to raise a family of four. The savings rate was radically higher also.

Fundamentally it's the same reason why wealth can survive inflation, but wages cannot. One can easily be shifted to defensive assets, the other drowns.

Even running just 3% real inflation per year is massively destructive to the standard of living over the course of a single decade. You have to generate 34% wage increases just to tread water.

</comment></comment></comment><comment><USER9> Tis only a matter of time till us little people get the same pay package!</comment>


MQTT: An Implementer's Perspective - <AUTHOR> http://vasters.com/clemensv/2014/06/02/MQTT+An+Implementers+Perspective.aspx <comment><USER2> I've been working on a project to do building monitoring. I'm building a library in C that talks to an Akka/Scala backend.

I initially chose MQTT to connect from the C library (that runs on the device) to the Akka system, via RabbitMQ's support for MQTT.

As I get deeper into the implementation, I'm thinking about ripping out MQTT. I just don't know what purpose it has. I think a better pattern is to have some kind of TCP terminator that the client/device connects to, which then fans out into an AMQP-like messaging system. Pushing messaging away from the core, far towards the edge doesn't seem like a good idea in environments where you really care about whether something is up/connected, and also, the wire protocol you use from the cloud to your device can be a lot different from that which you'd use in a core/cloud/racked messaging system.

I also don't care for MQTT's security model.

All in all, I'm pretty disappointed with it as a protocol. I'd take something written in protobuf and well-documented any day over mqtt.

My project, in case anyone's interested: [https://github.com/prefiat/iotelemetri- feederd](https://github.com/prefiat/iotelemetri-feederd)

</comment><comment><USER3> This write up is right on the mark. There are quite a few things about MQTT that seem to have the goal of supporting legacy expediency. At the same time, these dubious design elements undermine the nominal goals of the standard and in some cases flat out contradict those goals.

We know how to design modern, efficient, flexible wire protocols that can be driven at the rates required by M2M communication patterns. MQTT does not fit this description nor even makes an attempt to reflect best practices within its current scope.

<comment><USER4> For the life of me I can't find anywhere that says "extensibility" is a goal of MQTT. The main goals are clearly stated to be "simplicity" and "lightweight". Extensibility is the enemy of both. A lot of Clemens' points are based on the concept that MQTT is supposed to be extensible. When you realize that's not even a goal, most of his concerns become moot. He says "I'm not trying to create another AMQP" but if you think about what he's actually saying, it's quite the opposite.

<comment><USER5> There are not many modern app-level protocols and much fewer messaging protocols that don't allow for any end-to-end message metadata; at a minimum declaring what the payload content of a message is, when the message was generated, and an end-to-end ID. Content-type could be a mere byte the client sends to the app and where 0x01 spells "JSON". CONNECT shows how you can have a bitfield that can control the presence of headers. You can control the presence of 4 subsequent optional headers with 4 shape options in one byte. That's as simple as what happens in CONNECT and just as compact.

There are also not many modern app-level protocols that constrain their opcode-set to 4 bits quasi forever, so extensibility also means to have runway for future extension.

<comment><USER6> > There are not many modern app-level protocols and much fewer messaging > protocols that don't allow for any end-to-end message metadata; at a minimum > declaring what the payload content of a message is, when the message was > generated, and an end-to-end ID. Content-type could be a mere byte the > client sends to the app and where 0x01 spells "JSON".

Sure, and suddenly you're limited to 256 content types, or, more likely, burning an extra byte and _still_ frequently needing to communicate the actual substantive content-type in the payload. If you are going to bother having content-type be part of the messaging protocol, do it _right_ rather than by half-measures.

As I see it, there's a continuum of messaging protocols from barebones (requiring smarter components) to full featured (that require the components to do less because the protocol and broker do more). ØMQ sits close to the first extreme -- call it "the left" \-- and AMQP pretty close to what would then be "the right" (at least, the closest of any current open protocol that I am aware of); MQTT seems to be just to the right of ØMQ (I mean, it _has_ a broker).

</comment></comment></comment></comment><comment><USER7> He says:

"Unfortunately, MQTT defines this assurance model only for the publish gesture and not for its own, inherent operations.."

OK, but then says:

"That means the client is forced to retry under any such circumstances. The specification already anticipates this with making subscriptions effectively idempotent and requiring that a subscribe command matching an existing subscription must be replaced by a new subscription and that the message flow must not be interrupted. "

So what exactly is the problem? If the client doesn't get the SUBACK it retries. The server has to deal with it. If the server gets a SUBSCRIBE, it has to be durable because the client might have received the previous SUBACK.

Why add one more turn around by acking the ack? This seems like extra complexity for no reason.

Also he talks about lack of flow control:

"Not having any flow control can get fairly dicey when there is significant work to do for processing a message and there might be several different subsystems on the receiving end of the MQTT connection where the work differs."

But there is flow control: it's TCP. Do not read from the TCP stack unless you can handle the message, then the flow control will work. On the other hand there is no concept of trying to multiplex multiple streams over one connection (where then you start to worry about head of line blocking). If you need this, open a different TCP connection for each stream. This is not an unreasonable design choice to make...

<comment><USER8> How do you know if you can handle the message, until you read the message? Or is MQTT's flow control inherently insufficient for cases like that?

Basic example, say for a chat client: to ensure delivery, you probably want to read the message, save it to a database, _then_ confirm receipt. Is that possible, or would that delayed-ack have to be done via some other means?

<comment><USER7> That's the normal use case for QoS 1 and 2 messages: the client must acknowledge each received message otherwise the server will try to resend it. From the MQTT V3.1 Protocol Spec: [http://public.dhe.ibm.com/software/dw/webservices/ws- mqtt/mq...](http://public.dhe.ibm.com/software/dw/webservices/ws- mqtt/mqtt-v3r1.html#retry)

What you don't want to do is read everything offered into memory faster than you can write it to disk / database. You could potentially fill the memory until you run out and crash. Instead control the flow by not reading until you are finished with the previous message (or better, allow N unacknowledged messages to be read, where N is just enough so that the application is as fast as it can be).

</comment></comment></comment><comment><USER9> Great write up! We found many of the same issues as you did when we tried connecting devices, so we created dweet.io.

We are not a substitute for MQTT, but we made dweet to help you get your things online quickly and easily so you can concentrate on making apps. Standards take forever to hash out, so we made something that can get you going really quickly.

Have you had a chance to look into dweet? [https://dweet.io](https://dweet.io) is the homepage, so let me know if you have any questions.

Thank you again

<comment><USER10> This comment's sales pitch tone really comes to a crescendo around "Have you had a chance to look into dweet?", just FYI you may want to avoid this type of language in the future.

<comment><USER11> So what's wrong with that? He built a service and he's suggesting that someone who might have an interest take a look at it.

"Build stuff, tell people about it."

</comment></comment></comment><comment><USER12> We selected MQTT because our mobile apps are sending frequent data packets over cell-phone data tariffs. Our thinking was that a light messaging protocol such as MQTT could mean the difference between an £100,000+ monthly data bill, or £10,000.

I'm no expert, but I'm finding MQTT pretty bare bones, I can see the appeal of STOMP or messaging protocols that have more support for patterns such as RPC.

</comment><comment><USER13> I'm so glad this was published because I had essentially come to the same result and thought I was missing something given all the hype around MQTT.

</comment><comment><USER14> Btw there is a RabbitMQ plugin that does MQTT

[http://www.rabbitmq.com/mqtt.html](http://www.rabbitmq.com/mqtt.html)

</comment><comment><USER15> What an extremely well thought-out piece. There is a certain bias towards MQTT's suitability for building Azure-scale services (the article says as much), but I just wanted comment on a few general points.

> you cannot return connack (which confirms establishing or recovering a > session) until all server nodes have access to a replica of this fact. The > spec doesn't say that.

The spec should not have to say that. If you're building high-availability, distributed _brokers_ (which MQTT makes no claims about), the semantic implications of each message should certainly be considered carefully, but a protocol specification is not a "how-to" guide enumerating every use-case. A brief note calling into consideration special cases may be welcome, but should not be required.

> With a "pull" based model that separates establishing subscriptions and > message solicitation, you can leave delivery resumption control to the > client, with MQTT those two aspects are coupled.

This behavior is a non-issue if the clear session flag is set. If it's not being set, the assumption is that subscription state is actively managed by the server. Leaving more work to the client is half-hearted and would complicate the protocol into something like AMQP's. (I have thoughts about whether pull models are best suited for stateless operation, but that's neither here nor there.)

Client IDs are indeed mis-named. To be fair, the 3.1.1 spec allows for server- assigned client ids. That doesn't completely mitigate the security risk, as user credentials are allowed to be shared among endpoints. This can be "fixed" at the broker level by requiring unique credentials, depending on the use case — it likely wouldn't work for Azure.

The objection to the (lack of a) payload encoding is unclear. Being payload- agnostic actually a nice feature, especially on the broker side. Crucially — and please correct me if I'm wrong — MQTT is not designed as a generic mechanism to communicate with unknown clients, vis-a-vis HTTP. Clients are assumed to have awareness of the payload structure. Metadata can be further signified via a structured topic (again, clients know the format of the topic).

The article calls the structured-topic approach a hack, but it is a easy, readable method to impose simple structure or namespacing, and allows for things like metadata-based routing without any special effort from the broker. Hence, the need for explicit metadata (content-type, etc) seems unnecessary.

Regarding flow control — unless the spec declares otherwise, the broker is free to implement specific policies regarding the number of in-flight messages. For example, Mosquitto handles ACLs out-of-band. Otherwise, you can rely on TCP buffers to limit in-flight messages, or delay a QoS response until the next message can be handled. This also applies to data management policies, e.g. state or message retention, QoS-2 allowances, and so forth. Spec ambiguity is not necessarily a bad thing here. Over-specifying could constrain other use-cases; the insistence on "watertight assurances" doesn't always hold water.

Multiplexing is not really an issue, unless you are sending large payloads — although if you are, I would venture to say you're not using the right protocol anyway. I will place fault with the protocol for allowing 256MB payloads — this really just goes to show the incongruity between MQTT's frugality with headers and wastefulness everywhere else.

All this assumes the user is using MQTT as it was designed: for _simple_ pub- sub. What it allows out-of-the-box may not be flexible enough for many use cases. These problems can be mostly fixed with small changes to the protocol, or fixating on certain assumptions. This usually necessitates writing/modifying your own broker, but fortunately MQTT is simple enough that it isn't a heroic deed. Of course, this doesn't apply if you're building a SaaS broker like Azure — but for any other purpose, MQTT can be viewed as a springboard.

Granted, all this sounds like it requires thinking too much about details that should otherwise be solved by things like AMQP. Maybe so. However, more sophisticated systems have many more knobs to tune, and the complexity rises accordingly. MQTT doesn't have that problem out-of-the-box.</comment>


Move your office for a month to another country - <AUTHOR> http://quodis.com/journal/one-month-working-and-living-in-berlin

<comment><USER2> Sounds like an awesome idea if you have the budget and the logistics don't interfere too much with life.</comment>


Microservices [video] - <AUTHOR> https://www.youtube.com/watch?v=y8OnoxKotPQ <comment><USER2> I love the joke. But, it is a serious problem.

One key part is that naming is important. This is always a fight I am willing to take. Acronyms, fantasy names, names of teams or legacy names that does not represent the functionality of the micro-service plague many companies.

If you will not name a method "Jimmy" or a local variable "Galactus", why developers are naming their micro-services in such a bad way?

I do not know what I find more frustrating, the bad naming per se. Or the fact that the same developers would lose their shit if they saw this:

      class Galactus {
        boolean Jimmy;

        void turnOn() {
          Jimmy = true;
        }

        void turnOff() {
         Jimmy = false;
        }
      }

Sometimes it feels that software development is more a religion that an engineering discipline. That there is rights and wrongs based in tradition instead of sound practices. That is why worse than the naming is the lack of self-introspection that let us here.

<comment><USER3> > One key part is that naming is important. This is always a fight I am > willing to take. Acronyms, fantasy names, names of teams or legacy names > that does not represent the functionality of the micro-service plague many > companies.

This has been happening way before microservices became popular but it's gotten out of hand. Teams have nonsensical names as do their services. Outsiders coming in have a huge hill to climb to learn the domain because god knows why.

<comment><USER4> We have something between 3 and 8 user profile services that you might interact with on a daily basis depending on where you sit. If they all had "good" names they'd all have roughly the same name. It's dumb for onboarding, but I have to say I see how "racoon" became a name.

</comment></comment></comment><comment><USER5> This was linked to me right after coming out of a meeting with my product team where I was the engineer in this video. Worse, I had a large hand in defining how our software architecture is designed so I can't even blame other people. It's largely my fault.

<comment><USER6> Thanks for sharing this, not easy to admit. In retrospect what would you have done differently though?

<comment><USER5> That's a good question, a lot of the issues we hit now are mostly due to early assumption informed by our business requirements at the time that didn't hold true long term (argh blaming the business trope sorry). Our company being a a startup still learning market fit for our product went from being SASS first to doing mostly on prem and private cloud installations for example. That changes a lot of how I would have approached the design to reduce operational complexity had that been obvious early on.

Similarly, we did a lot of learning from the tools we used that is probably very much just something you earn with battle scars. For example the behavior and issues we hit with our choice of core stack components (celery, redis, rabbitmq, kubernetes,...) are often things you learn by using them and gaining experience.

The next thing is there were a lot of conscious tradeoffs that I would still argue we would take today. We prioritized speed of building features to make the product viable and attractive to customers at the expense of quality of those features and reliability. Doing the hard real world testing instead of relying on simple unit/integration tests before shipping. That's something we now are having to address but the question is was that something we should have done differently? No sure I would, we may not be around now if we hadn't built the feature we needed to sell the product and prove market viability.

On the topic of this video. I think the issue it not using microservices or building a monolith but controlling complexity. The biggest thing I dislike about our current infrastructure is the cognitive load and complexity that a new engineer joining has to deal with to be productive. That can happen in any architecture if you aren't careful. Sure having to run multiple services, tracing and testing acrross them (basically the usual gripes about microservice architectures) dealing with inter-service calls, performance tradeoff etc.. is not as good as I'd like it to be but it could be improved. What sucks most is there a lot of raw edges we left exposed that trip new people and that I think was a mistake we should be prioritizing fixing those as they come up and think of them while buidling up our core framework and components more thoroughly.

</comment></comment></comment><comment><USER7> This was my exact experience working at Nike 4 years ago. In this scenario, I was the guy sitting. I got this type of "talking to" when I submitted a bug ticket because jQuery was being loaded 3 times on the same page.

The Nike.com software group was over 1,000 employees working on a microservices mess that performed horribly on the customer side. They could have built a much better product with about 50 competent software professionals.

<comment><USER8> Brooks's Law in effect, same as in all the other places where managers believe that 9 women working together could make a baby in one month. [https://en.wikipedia.org/wiki/Brooks%27s_law](https://en.wikipedia.org/wiki/Brooks%27s_law)

</comment></comment><comment><USER9> For every microservices system I've seen, this feels about right.

It oversimplifies things a bit, though.

It's odd; I've never seen a "monolith" simplified by moving to microservices, but everyone seems to be doing them.

<comment><USER10> Microservice design was not meant for [only] a simpler system but ease of dividing people into smaller teams where a team could focus on a single objective without worrying about rest of the company.

If the microservice architecture has made you less productive than the top leadership is to be blamed.

<comment><USER11> This is absolutely right in my experience.

Microservices are all about scaling development agility in exchange for _increased_ technical overhead.

In many cases this tradeoff is atrocious. If you can say "we can easily take on (large feature XXX) and deliver that", microservices are all pain and no gain.

Where they really start feeling good is when your "two week sprints" turn into about two days of available dev work because the remaining time is spent regression testing your changes and trying to keep the build from breaking because of tests you didn't touch failing (spooky action at a distance is real and it hurts). A clear API contract that both sides of the fence can develop against means that you can keep making progress.

At least until it's time to integrate against the real world, not your mock ;-)

<comment><USER12> I think there are plenty of examples of monolithic architectures that also have huge technical overhead, builds breaking for unrelated changes, huge amounts of regression testing, not to mention the build times...

Microservices can be a great pattern to deliver quickly _and_ maintain high availability/low technical overhead, that's their point. I think the problem arises when developers try to over-optimize or over-engineer a system, or they want to get promoted so they write a new service, ending up with huge entangled webs like in the sketch.

Individuals and interactions over processes and tools, every time

<comment><USER11> > I think there are plenty of examples of monolithic architectures that also > have huge technical overhead, builds breaking for unrelated changes, huge > amounts of regression testing, not to mention the build times...

Yes – I was talking about those same monolithic architectures in that comment ;-)

</comment></comment></comment></comment></comment><comment><USER13> Modular software is a great idea, always was; and fundamentalism doesn't make software better, never did. Good ideas are compromises.

The latest system I designed professionally was an ordering system that's divided into two parts; a local application with a database and an HTML document and a PHP script on a server.

The application itself doesn't need internet access to work.

The data needed for the online customer order module is uploaded to the server via FTP as needed. Online orders are stored on the server and polled via FTP on request from the local application.

The result is modular, very easy to maintain, and performance is good enough to be considered a feature.

But the reasons for the choices I made are all about the problem being solved, not organizing developers and keeping them from stepping on each others toes.

</comment><comment><USER14> We haven't gone through the "microservices" craze for pretty scientific reasons: I dislike smug talking "Chief Wizards/Architects/Scientists" who've been writing posts and giving talks on architecture, clean code, and refactoring, based on that one project in the eighties. Reminds me of those phony martial arts "gurus" who are all about abstract ideas and "energy" channeling, complicating the simple to sell seminars and subscriptions.

Anytime something is discussed, we ask ourselves if that change will improve users' lives. I am sure these are useful for other people at different maturity levels of software, but it is not for us, right now.

This is why we don't use React, Angural, Webpack and a ton of other things and libraries that are useful for others but add no value to us and only increase. We avoid adding complexity unless it's _really_ worth it, and worth it for the users, not to give us pleasure of using a new library. We have side projects for that.

<comment><USER15> I've recently been using StimulusJS [0] and found it to be a really nice mid- point between spaghetti and a heavier framework. It has conventions out of the box, it does things in a reasonably disciplined way then it disappears.

[0] [https://stimulusjs.org/](https://stimulusjs.org/)

</comment></comment><comment><USER16> The only 2 valid reasons I have come across for using microservices based system architecture:

1) There is a codepath in the application that has _radically_ different load characteristics.

2) We want to give each team in the organisation ownership of (most of) their stack, release cadence, SRE etc.

(2) seems like an attempt at engineering but is often about management - empowering the teams yada yada.

There is a thread here about: "Technology opinion-sphere is a FAANG monopoly" aka "Dude, we got like 3 paying customers!". I'll leave that for another day.

<comment><USER17> Actually 1) isn't a good argument. There is nothing wrong with having regular sized services. Most applications already do that. They separate databases from web servers.

</comment></comment><comment><USER18> The current trend of adding microservices all over the place feels an awful lot like DLL Hell. Don't know if it will ultimately end up that way, but it sure sounds like a rhyme.

</comment><comment><USER19> I remember reading a blog post some months ago here from a former AirBnb employee where they talked about how some senior manager in the company wrote an incredibly detailed spec for a CRUD feature which required them to invent a datatype because they insisted on using no more than N bytes to store some inconsequential field. There was also a description of how the author had to crawl through a parking garage to escape a meeting wherein he insisted that nobody was allowed to leave.

I feel like there is no accountability for these clowns. They'll inevitably switch jobs and ruin the work lives of so many developers with their stupidity. There is a culture of not wanting to name your abuser for some reason. It's weird.

<comment><USER20> I believe this was at Snap Inc. I'll try to find the link later.

<comment><USER21> This is it: My Time at Snap [https://news.ycombinator.com/item?id=21122123](https://news.ycombinator.com/item?id=21122123)

</comment></comment></comment><comment><USER22> Hey let's design looking backwards and ignore all future needs. Everyone will be happy. Because they all are about saving face and give minimum effort, enough to keep things working as is. It doesn't matter if it sacrifices future opportunities nobody can test that. Then it will be just a matter of fact. We will all just pretend this was unavoidable inherent complexity.

Imagine playing competitive RTS game and decisions were made with this attitude, tomorrow-not-my-problem as others don't have domain expertise to tell otherwise or they don't simply care to put themselves as opposing force and do your work to find better solution. In game you'd be doing seemingly ok and then get destroyed all of the sudden.

<comment><USER23> Sounds like League of Legends to me.

(Edit: at the casual level)

</comment></comment><comment><USER24> As an engineer, I am finding i very difficult to decide on things like capability/modularity boundaries, layering constraints etc w.r.t architectural decisions for a B2B, cloud native, SaaS software solution. No matter what resource I refer to, there's a lot of conflicting info.

Is there an equivalent of "cyclomatic complexity"(McCabe count of code) for cloud/distributed systems/μServices architecture? Cant find any such objective measure, apart from a few dated research papers.

IMO, it could be useful for many of us. Sometime back, I had tweeted tagging @copyconstruct and @kelseyhightower asking this question, but haven't got a response - may be it went unnoticed.

Would love to get to know if there's any such method/framework to measure and manage architectural complexity, for the world in cloud.

<comment><USER25> I think if you don't know, don't. That's a good place to start :)

</comment></comment><comment><USER26> Not exactly related to the video, but why do some people choose gRPC and others choose event sourcing for microservices communication? Is it just a matter of unneeded complexity in event sourcing? Are there performance issues as well?

<comment><USER27> It's the difference between service orchestration and choreography, respectively.

There are pros and cons to each approach, and the details matter with regard to how services will be scaled and the coordination of that scaling happens.

There are lots of finer points in the details, but knowing the difference between the two approaches can help with the decision making process on which path the adopt.

</comment></comment><comment><USER28> I've watched this only about 50 times nbd

</comment><comment><USER29> hits too close to home.</comment>


Ask HN: Can I rent your garage? - <AUTHOR>

My friend and I, from Menlo Park, are working on an automated machining process and are looking for a place to set up shop.
Noise precludes us from using commercial office space, and commercial industrial space can be a bit expensive.
Anyone have any suggestions for renting exclusive access to a space we could use?
I was hoping that in the time-honored tradition of the peninsula, someone might lend a garage...
Thanks! <comment><USER2> Checkout NIMBY in Oakland. Not sure if there are places in Menlo Park or nearby that are similar or not.

</comment><comment><USER3> I know useless comments are frowned upon, but this title/post really gave me a strong chuckle.

<comment><USER4> Useless x 2, reminds me of:

[http://www.hulu.com/watch/2330/saturday-night-live-the- herli...](http://www.hulu.com/watch/2330/saturday-night-live-the-herlihy-boy- house-sitting-service)

</comment></comment><comment><USER5> If noise keeps you out of office space I would imagine that the neighbors near your proposed garage would be similarly affected.

<comment><AUTHOR> being 15 feet and one wall away from someone who's rented space specifically to work is VERY different from 100+ feet and many walls away from a home during the daytime...</comment></comment>


AdHole: A simple, transparent ad and tracker blocker in Go - <AUTHOR> https://github.com/drbig/adhole

<comment><USER2> I didn't realize this made to Hacker News...

As for the current comments:

* Using hosts file is a local, per machine solution. Similarly, AdBlock is a per user per browser solution. None of which may be available on your phone. And AdHole is not meant to be a replacement for anything - it's another tool.

* I have a very restrictive list, including some CDNs known to host tracking software. Surprisingly it breaks none of the websites I use regularly. For the odd cases I implemented the /debug/toggle method. At this low-level there will always be a trade-off between blocking and breaking.

I also use AdBlock on all the 'big computers', but my block list is still more restrictive. And the biggest value is that I get ad and tracking blocking on all my Android gear without doing any additional work.

</comment><comment><USER3> It's simpler to just use a hosts file for blocking ad domains. A HTTP server serving replacement ads is optional. An adblocking proxy only becomes necessary once you start rewriting the contents of pages.

I used to use AdBlock but nowadays I only use a hosts file (one from [http://someonewhocares.org/hosts/zero/](http://someonewhocares.org/hosts/zero/) ) and I haven't noticed any ads that don't get blocked, while memory usage is lower and performance higher.

<comment><USER4> The main thing ABP does for me is to filter out things that match the "signature" of an ad (image tags with size matching standard ad-sales sizes) even when they're hosted on the same domain as the origin.

</comment></comment><comment><USER5> This is interesting.

I wonder what the long-term efficiency of blocking trackers/ads by DNS is. There will be a point where these things could run on the same networks as other things which you wont necessarily want to block. What if google began serving its ads from google.com for example?

What are HN's thoughts on this? I'm tempted to run an ad blackhole service on my router or dnscrypt server; it's a line I haven't investigated yet as adblock + privacy badger do the job just fine on Chrome.</comment>


Show HN: Explore any Android app's permissions - <AUTHOR> http://appethics.org

<comment><USER2> It's a good tool, certainly much better than the play store's almost hidden "View permissions" link.

Perhaps it can be enhanced to take into account API level differences too, since that sometimes has a significant impact on what the app is allowed to do.

For example, READ_CONTACTS allows an application to read the user's contacts data, but in IceCreamSandwich and lower, it also allows the app to read call logs, which is an altogether different set of data in the eyes of an end user.

Combine that with INTERNET permission, and basically you have an app which can send all your call logs to whomever it wants.

<comment><AUTHOR> Interesting, I did not realize READ_CONTACTS gave access to call logs in <= IceCreamSandwich.

I wish Android used a permissions model similar to iOS, where the application prompts the user for specific permissions as needed, rather than up front.

<comment><USER2> Perhaps the most reliable way to know _exactly_ what all a permission allows, is to write an analyzer tool that analyzes android platform sources and/or bytecode looking for calls to permission APIs, creates a list of such calling methods, and finally maps these callers to what data they affect.

Not sure if the underlying native binaries too use these permissions, but if they do, they too can probably be analyzed.

I wonder if such a tool already exists.

</comment></comment></comment><comment><USER3> For what it's worth: I've forever been on the lookout of an app that sits in the background and informs users of bad apps -- and suggest cleaner alternatives.

I'm tired of watching my non-technical family's phones slow down to a sludge because of these apps. Give them a rotten tomatoes like score collected from users, and pretty soon users will stop installing the low scored, ad filled, battery hogging apps.

<comment><AUTHOR> Thanks for the feedback, especially around the rating system.

I am planning on surfacing some type of rating or score, derived from the required permissions, in the near future.

</comment></comment><comment><USER4> Cool site, but it doesn't seem to work. It doesn't display the same list that the app displays. Reading the list the app displays looks scary. Reading the list on the site makes it sem ok

<comment><AUTHOR> Can you provide more information? What app is giving you a discrepancy?</comment></comment>


The rise and fall of Limux - <AUTHOR> https://lwn.net/SubscriberLink/737818/5b7cd538561e8a06/ <comment><USER2> Previous discussion [https://news.ycombinator.com/item?id=15661372](https://news.ycombinator.com/item?id=15661372)

</comment><comment><USER3> Microsoft has a large office in Munich. Coincidence that Linux got replaced with Windows? Probably not. Sure, I cannot prove anything, but I think Microsoft probably lobbied the heck out of it.

And for myself, I finally was able to get rid of Windows by using VFIO. Basically, I only need it for gaming anyway and I can do that in a VM now!

</comment><comment><USER4> This submitted link bypasses the LWN paywall.

If you support articles like these, please consider subscribing at [https://lwn.net/subscribe/Info](https://lwn.net/subscribe/Info)</comment>


An interesting gotcha in Java unittesting - <AUTHOR> http://blog.notdot.net/2012/07/An-interesting-gotcha-in-Java-unittesting <comment><USER2> This is not a gotcha. Any non-junior Java programmer knows the difference between == and equals. By the same argument one could say using arrays instead of ArrayList is a gotcha...</comment>


Nanotech Could Make Incandescent Light Bulbs as Efficient as LEDs - <AUTHOR> http://news.sciencemag.org/technology/2016/01/how-get-old-fashioned-lightbulb-glow-without-wasting-so-much-energy <comment><USER2> Finally a worthy application for nanotechnology.</comment>


LOLcats founder is perplexed by company success - <AUTHOR> http://www.techflash.com/LOLcats_continue_to_gain_national_media_exposure_53341932.html

<comment><USER2> The linked blog post is just a summary of a longer and detailed Time magazine article found here:

[http://www.time.com/time/magazine/article/0,9171,1916286-1,0...](http://www.time.com/time/magazine/article/0,9171,1916286-1,00.html)

<comment><USER3> what's up with the date of that article?

<comment><USER4> interesting. Either a typo or it's meant to correspond to the print date? Perhaps it hasn't been printed yet.

<comment><USER3> It's from the future!

<comment><USER5> Of course, it is _time_ magazine.

</comment></comment></comment></comment></comment><comment><USER6> Surprise, people enjoy websites that make them laugh.

lolcats and failblog require absolutely no intellectual investment at all. It's like eating a nice steak...it triggers that part of your brain that goes "this is good", but doesn't actually require you to do anything.

This does, however, bring up another point...are there any other animals that experience humor?

<comment><USER7> This gibbon sure as hell appears to: <http://www.youtube.com/watch?v=H9n_moGyTlw>

</comment></comment><comment><USER8> He didn't found LOLcats, which isn't a company and wasn't started by this man / icanhascheesburger.com, or by The Times (who also publish a LolPets section), but by 4Chan.

Kudos to him for taking something niche and making it accessible to the mainsteam though.

</comment><comment><USER9> Irony at it's finest: Ben _Huh_ is confused.

<comment><USER10> ⸮

<comment><USER10> Since no one got my stupid joke :)

<http://en.wikipedia.org/wiki/Irony_mark>

</comment></comment></comment><comment><USER11> I want to honestly send this guy a $100. I can't count the number of times I've cried due to laughter from reading any one of these sites. The content is amazing.

<comment><USER5> If you like failblog you may like dontevenreply.com, which is the only other site that produces similar responses in my experience :)

</comment></comment><comment><USER12> Heck, I (and my friend) was doing pigeon English comedy articles AND hybrid catheads (where the head is half of 2 cat's faces with eyes bulging intermittently), in 1997!

<comment><USER13> Intended as a helpful correction: You mean 'pidgin English.'

</comment></comment><comment><USER14> I can haz sup0r successful startups?</comment>


RAID-Z (and the problems with regular RAID) - <AUTHOR> http://blogs.sun.com/bonwick/entry/raid_z <comment><USER2> Sun really is coming back into focus now as an innovator. This is a cool post, even if it was lower level in the details than I normally get with such infrastructure topics. I've been looking at their hardware actually for my startup, having been interesting the SmugMug dude's reviews.</comment>


Ask HN: Suggestions for learning English language? - <AUTHOR> Hi HN,
This question came from my mind because I feel that my English language doesn't improve in every single day. When I was writing this question, for example, I got stuck in the middle. I have something to say, but it's hard to write it on sentences. Beside that, I fear that I have grammar mistakes.
English is not my first language. If there is vocabulary that I have never heard before, I check out on the dictionary. I tend to improve my English. Writing, listening, speaking, and reading are my goals (order means the priority). So, how do you learn English language?
Note: if you suggest books, resources, or even stories, please don't hesitate to share it.
Thank you. <comment> happy-go-lucky Four essential skills in learning a new language are reading, writing, speaking, and listening (not necessarily in that order).

Learn to read. Read good stuff written by native speakers of the language. Learn correct pronunciation. When you come across new words, look them up.

Learn grammar. Practice writing. Start with small sentences. Write about anything you like or experience. Show it to an authority and make sure it is grammatically correct. Learn from your own mistakes.

Start speaking the language. Be around those who communicate in the same language.

Practice listening. Listen to native speakers, radio programs, podcasts etc. Be attentive.

Keep visiting HN. Read comments. Observe how HNers express their views. Learn from contextual usage of the language.

That is just a beginning. Carry out those activities regularly.

<comment><AUTHOR> Thank you for suggestions. I will do it.

</comment></comment><comment> happy-go-lucky IMO, how good you are in your native language influences your learning of a foreign language.</comment>


Aaron Swartz and the YC Community - <AUTHOR>

I just saw the new Aaron Swartz documentary, "The Intenet's Own Boy." It chronicles the tragic destruction of Aaron at the hands of a brutally cruel government. They crushed him emotionally and also financially. His legal bills were in the millions of dollars. Frankly, I'm disappointed that the tech community did not do more to support his struggle. YC in particular. He was after all, one of their own. One of their success stories so to speak. With all the billions that the community has at their disposal, should more have been done to support a young visionary when he decided to step outside the profitable world of tech and into the dangerous, unforgiving world of politics? We all claim to want to "change the world" but Aaron took that motto to its word, and paid for it with his life. What does that mean? Do no-financial struggles matter, or is it all about making that first billion? <comment><USER2> I thought that YC's strong advocacy of Title II requirements and net neutrality--when other open internet tech luminaries have fallen down on the job--was in someway a tribute to his work for a free and open internet. A bit understated and in the subtext--but nonetheless and a meaningful and effective tribute. All the more meaningful because it promises real, lasting change instead of chest thumping and gestures.

</comment><comment><USER3> I thought about that too when I watched that documentary. You should check out what pg thinks of Aaron in this recent video: [http://www.youtube.com/watch?v=YMqgiXLjvRs](http://www.youtube.com/watch?v=YMqgiXLjvRs) at around 7:42

<comment><USER4> That was really interesting to watch. I liked the description of Aaron realizing at 13 that he could just start acting like an adult, and doing so. pg is right, many of the lines that keep kids in check are not real, and only work because so many people buy into the idea of what kids are supposed to be like.

</comment></comment><comment><USER5> I agree. The power is where the money is and that money is at the big corps. They will do everything at their power to keep that status quo. What surprises me is that their so few people who try to fight that power imbalance. Is this because people think they can hardly do anything about it? Or don't they care, because they are ok? Or are they afraid for the consequences? In case of Aaron Swartz the government (backed up by some lobby group?) succeeded in creating this feeling of fear to fight the system.

</comment><comment><USER6> I too share the shock- Why is the valley so cold?</comment>


How to get 2TB cloud storage for free with Baidu Pan (Drive) - <AUTHOR> http://www.taigeair.com/how-to-get-2tb-with-baidu-pan-disk-for-free-for-life/

<comment><USER2> Here's a list of the access rights that the Android app requires..

Privacy:

read phone status and identity, read and edit your text messages, take pictures and videos, gps location, read/modify contacts, read/write call log, modify or delete contents of USB storage, disable screen lock

Device Access:

connect and disconnect wifi, full network access, view network connections, view wifi connections, retrieve running apps, run at startup, draw over other apps, control vibration, prevent phone from sleeping, mock location, modify system settings, send sticky broadcast

No thanks.</comment>


Thank you, next (On gerontocracy: government run by old people) - <AUTHOR> https://blog.dcpos.ch/thank-you-next <comment><AUTHOR> > Every society has a process for generational transfer, renewal, some kind of > changing of the guard. When the seats of power are filled with people over > 75, it's direct evidence that this process has stopped working.

> Our president, the house speaker and senate majority leader were all born in > the 1940s. Their median age is now 78.

Reading this explains so much in light of the news of the US Senate proposal to ban end-to-end encryption: [https://www.judiciary.senate.gov/press/rep/releases/graham-c...](https://www.judiciary.senate.gov/press/rep/releases/graham- cotton-blackburn-introduce-balanced-solution-to-bolster-national-security-end- use-of-warrant-proof-encryption-that-shields-criminal-activity)</comment>


Quantum Bogosort - <AUTHOR> http://www.mathnews.uwaterloo.ca/Issues/mn11103/QuantumBogoSort.php

<comment><USER2> I'm suprised to see that popping up everywhere. I was one of the editors of that campus paper when that was written.</comment>


CVE-2018-0492: Local privilege escalation in Linux program that plays a beep - <AUTHOR> https://holeybeep.ninja/ <comment><USER2> This is satire, yes? The footer links to [https://github.com/dirtycow/dirtycow.github.io](https://github.com/dirtycow/dirtycow.github.io) , which is a real vulnerability. Further, this is the proof-of-concept from [https://holeybeep.ninja/am_i_vulnerable.sh](https://holeybeep.ninja/am_i_vulnerable.sh) :

        #!/bin/sh
        # TODO: Backdoor this machine?
        modprobe pcspkr
        beep -l 1000 -r 3 -f 44000

<comment><AUTHOR> The website is tongue-in-cheek but the exploit patch is documented here:

"Debian Security Advisory DSA-4163-1 beep -- security update"

[https://www.debian.org/security/2018/dsa-4163](https://www.debian.org/security/2018/dsa-4163)

<comment><USER3> Apart from confirming the vulnerability, that page doesn't really give any technical info. Does anyone have any details on the problem? It's such a simple program that I'm fascinated by the fact that it has a security vulnerability.

I was looking at the patch that Debian shipped and it seems to me that there was some kind of a race condition when opening the console device multiple times, but I can't figure out the exact source of the problem.

<comment><USER4> [https://news.ycombinator.com/item?id=16753013](https://news.ycombinator.com/item?id=16753013) has more discussion, but so far nobody has figured out what exactly is going on.

</comment></comment></comment></comment><comment><USER5> I figured that the joke was encouraging folks to run unexamined, downloaded shell scripts.

</comment><comment><AUTHOR> I thought this was interesting as a cautionary tale that even tiny open source programs that are widely installed for years can contain critical security exploits. I don't understand the trend of security exploits getting their own website, name and logo though.

<comment><USER6> This site seems to have been created by a company specializing in giving security exploits their own branding:

"I want to brand my next vulnerability. Can you make a logo for me?

Great idea! Please contact our sales department."

It's definitely not associated with the person who discovered the beep vuln:

"Holey Beep is a community-maintained project for the bug otherwise known as CVE-2018-0492. It is not associated with the Linux Foundation, nor with the original discoverer of this vulnerability. If you would like to contribute go to GitHub."

Strange.

<comment><USER7> April Fools' was recently. Someone's is making light of the vulnerability names and certain purple going off on these like it is the end of the world.

</comment></comment></comment><comment> semi-extrinsic Yet another reason to blacklist the pcspkr module.

<comment><USER8> So you didn't read it.</comment></comment>


Amazon Has Too Much Power - <AUTHOR> https://www.nytimes.com/2020/07/29/opinion/amazon-union-congress-antitrust.html <comment><USER2> Okay, so I do believe in worker's rights and in general that Amazon is too large. Especially that city bidding mess where it was just a way to get free data from cities about their future plans.

But I don't like the argument in the article. It lays the responsibility of government to fix something that the public can have a bigger influence on. It's something I do. Don't buy from Amazon. I don't approve of their warehouse policies. Thus, I choose not to buy from them. It's not like they are the only shop on the web. The convenience argument is rather petty too. At a certain point, you have to put adult pants on. You are just funding them in doing what you don't like if you wait for someone else to "fix" the problem.

<comment><USER3> Unionization, as argued for in the op-ed, is something that's legal right now. We just need government to enforce the laws already in place. Laws paid for with the blood of the labor movement in the early 20th century. Unfortunately regulatory capture has eviscerated the agencies and government bodies tasked with upholding those laws.

<comment><USER2> Doesn't help when the general public bank rolls companies to fight laws and regulatory actions. That's my point. The money Amazon uses doesn't magically appear. These companies dont use spells to generate income, it comes from the people. I swear, it seems like folks dont know how business works these days. The people are voting with dollars saying Amazon is doing the right thing when they buy from Amazon. That's the reality.

People generally dont want to see themselves as being accessories to this mess and just say, "the gov isn't doing enough to stop Amazon from abusing workers... I totally need to buy that new widget, good thing I have Prime shipping."

<comment><USER4> > The people are voting with dollars saying Amazon is doing the right thing > when they buy from Amazon. That's the reality.

And how is that justification? If people buy cheap stuff made from prison or child labour does that justify the practise? It just tells us that people by and large are indifferent to the conditions under which their goods are produced, it's not a justification for it.

That people don't care about Amazon labour conditions doesn't tell us that Amazon is doing the 'right thing', it tells us that people don't care about worker rights.

That's what laws and governments exist for. People also never cared that their palm oil consumption endangers biodiversity and destroys the rainforest, because they don't suffer from it.

<comment><USER5> I'd go even further and say simply that it tells us that human behavior is complicated.

Someone is perfectly capable about caring about workers rights _and_ ordering from Amazon at the same time. What if you forgot to get a birthday present and need next day delivery? Amazon's kind of the only game in town, and that's an understandable compromise lots of people might make.

I think it's more about the lack of alternatives to Amazon (they are both great at customer service and at snuffing out competition) and the collective action problem than anything else. And I agree that's part of why laws and governments exist : ).

<comment><USER2> Dont forget to get a present? I mean, the world has existed great for a long time prior to Amazon's existence. Now everyone acts like Prime is an essential service to life itself. It's pretty pathetic. Like, really pathetic. Your own failure of planning isn't an excuse to break your own ideals, but then turn around to act pious to that ideal. In essence, you then dont actually stand or believe in it, you just do it, when convenient for virtue signaling and cheap warm/fuzzies.

<comment><USER5> You're absolutely right. It's not an excuse, and the example/hypothetical I shared would be a violation of my ideals.

But that's my point. We're flawed. Which isn't an excuse. It's like, when the experts talk about how to change habits, they say the best way to do it is to change your _environment_. Because of the powerful influence our environment has upon us.

And most models of change for behaviors like smoking or weight loss (and it's becoming increasing clear that computers/screens/apps/the internet share the addictive qualities of those behaviors) incorporate relapse as one _step_ of a change process.

It's an old book and a simple one, but as far as I know their research on how people successfully change behavior still holds up: [https://www.goodreads.com/book/show/46680.Changing_for_Good](https://www.goodreads.com/book/show/46680.Changing_for_Good)

Most studies show, I think, that positive motivation is a better tool than shaming/blaming/judging, in most situations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I actually wish Amazon had more power. They have done an amazing job of putting the customer first when everyone else was trying to figure out new ways to screw people over and tell them it was their fault. They opened a marketplace for small businesses that normally would not be able to obtain shelf space at a major store. They created an awesome computing platform and made it available to everyone who can't afford to build their own. I think they have earned their position.

My only wish is that they would pick up their boxes and reuse/recycle them when they drop off the new ones.

<comment><USER7> > They have done an amazing job of putting the customer first when everyone > else was trying to figure out new ways to screw people over and tell them it > was their fault.

They used to do an amazing job at putting customers first.

Then once they got traction, they pivoted to putting themselves first by commingling inventory with random resellers who can insert counterfeit or bad product into their inventory. They even went so far as to remove the option to filter for products only shipped and sold by Amazon.com.

They did this because retail margins suck and they would rather collect 15% for being a platform rather than a few percent accept and they get to shed all the inventory risk as a retailer. So now they're just a more expensive Aliexpress, as far as I can tell.

<comment><USER6> I'd argue that neither problem is unique to Amazon. E-Bay was notorious for being the dumping ground for burned out/damaged computer parts, though they did start weeding out people that do that because sold as-is or not, it caused a lot of problems and damaged E-bay's brand. Best Buy has been the target of return scams forever because they are easy marks. If you live in Texas then your probably familiar with Fry's Electronics - when I used to buy parts from them we started marking all of the stuff we returned so that we wouldn't buy it again.

I've had > 99% good experience buying from Aliexpress but you have read carefully and make sure you know what your ordering. Only bad experience I had was ordering a dozen i2c multiplexers and receiving a child's leather minidress instead, seller would only speak to me in nonsense sentence fragments regardless if I contacted them in English or Mandarin, and it took three weeks to get a refund. But on the bright side the exact same nail files that CVS sells for $10 each I can get 5 for $1 if I'm willing to wait 2-3 weeks.

</comment></comment></comment><comment><USER8> What I would like is a product search responsive web page that would search all local stores, including big box, and Amazon. You could start with a simple Froogle-ish search, and add discovery features as time goes on.

This would disrupt the current model, both online and offline.

<comment><USER9> Sounds like what Alibaba already does in China, where they digitize local stores and their stock but make it available on their platform. Imagine Square, Shopify and Amazon all rolled into one to help digitize your brick and moartar.

<comment><USER8> Yeah, that would be great. I'd like to be able to support local businesses, and if not available locally then price compare Target/Walmart/Amazon.

</comment></comment></comment><comment><USER10> Show me something better that aligns with my needs and I'll switch.</comment>


Writing Node.js modules in ClojureScript - <AUTHOR> http://blog.sourceninja.com/writing-node-js-modules-in-clojurescript/

<comment><USER2> I have to ask: why? It's server-side, so why not just write Clojure and take advantage of the JVM performance, scalability and everything Clojure gives you that just isn't available in ClojureScript?

<comment><AUTHOR> In our instance we were publishing tools for Node.js, so that's why we did it. Id'e rather write code in Clojure than JS or coffee script.

<comment><USER3> Would you rather write ClojureScript or real Clojure though?

<comment><AUTHOR> Real Clojure. You have access to more of the language, better tools, more libraries, better performance. Anytime you target JS it's like running with lead weights around your ankles.

I think the argument for Node.js was that it is typically difficult to write asynchronous code, and they made some effort to make that better, and the one language across front end and back.

With Clojure you can write asynchronous code just as easily with much better performance. I can also share code bases across my backend (cascalog, storm), mid-stack (noir), and front-end ClojureScript.

The arguments against Clojure is that some people have difficulty learning it and functional programming in general.

<comment><USER4> This is totally awesome, thank you for writing this Matt.

That said, my argument against Clojure is the sheer weight Java interop demands (I always found myself dealing with _far_ more Java than I would have liked). And with Clojurescript, the tooling feels incredibly raw to me. Getting started sucked up most of a weekend, and even then it was considerably less pleasant than parenscript.

That said, clojurescript really just felt very young to me, and could become something amazing with time and momentum. Perhaps you could write a short article about your setup (backend-mid-frontend), and some tips for people testing the waters? Would be highly appreciated!

<comment><AUTHOR> Yeah I can do that, I'll add that to the queue.

The high level is Rails on the very front for legacy reasons, and it's easier to find libraries that do, authentication, authorization, billing etc... that speaks to solr or a restful service running on noir hosted by tomcat, cassandra is the main DB. All backend tasks are performed by Hadoop or storm, and those jobs are all written in Clojure.

To be honest I feel that the Java interop isn't that bad. It's easier than doing interop from ruby/python down to C or C++. It provides access to lots of high quality libraries and you get the JVM. I think it's more than worth the price.

Although I know many functional programming languages, Clojure is the first that I've stuck with long term, and I think the strength of the ecosystem has a lot to do with it. Languages like Erlang, Haskel, and lisp are really interesting, but the breadth and depth of the libraries isn't comprable. Being a small company we need to be careful how we allocate resources. We contribute back where we can, for instance we contribute to clj-hector and cassandra.cascading but we're only a two man dev shop.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Hey, just published my after action report on publishing my first Node.js module written in ClojureScript. I was trying to fill some gaps in the existing documentation and pool together the research I did for the project. Hopefully some people here will find it useful. I would appreciate any feedback pro or con. Thanks!

</comment><comment><USER5> thank you

</comment><comment><USER6> hardcore!!</comment>


Rachmaninoff Plays Symphonic Dances – Newly Discovered 1940 Recording - <AUTHOR> https://www.marstonrecords.com/collections/frontpage/products/rachmaninoff#tabs-2 <comment><AUTHOR> This was apparently done without his consent -- since he never wanted to be recorded live.

Here is the official YouTube preview, with captioned explanations:

[https://www.youtube.com/watch?v=L3Xp2Djqh3s](https://www.youtube.com/watch?v=L3Xp2Djqh3s)</comment>


New Walls Aim to Hold Back Rising Seas Off Tanzania - <AUTHOR> https://www.scientificamerican.com/article/new-walls-aim-to-hold-back-rising-seas-off-tanzania/ <comment><USER2> Don't seawalls have a bad track record? I.e. the Fukushima Daiichi nuclear disaster and New Orleans flooding in 2005 happened despite seawalls intended to prevent such incidents in both cases...</comment>


Deolalikar's Claim[ed P!=NP Proof]: One Year Later - <AUTHOR> https://rjlipton.wordpress.com/2011/08/11/deolalikars-claim-one-year-later/

<comment><USER2> > The online community desires quick reactions and assessments. However, > intricate mathematical arguments by their nature do not allow for them

Interesting that he called this out explicitly

<comment><USER3> > There is immense power in the web as a method of understanding mathematical > claims. The proof attempt was read by many, and this quickly led to insights > about it. From Fields Medalists to professional mathematicians to amateurs, > all helped with the analysis of the claim. We were amazed at the power of > the crowd in this situation.

Even though it's what people have been saying about potential for a new style of peer review, this call-out was more interesting to me. It's worded as if it might have gotten some royal 'we' interested in doing web-style collaboration, or at least taking it seriously.

</comment></comment><comment><USER4> That headline is confusing. It's a claimed proof that _P≠NP_ , not P=NP.

<comment><AUTHOR> Thanks; fixed.

</comment></comment><comment><USER5> Wow, it's already a year? Time goes so fast I haven't noticed... I remember the HN discussions about this proof like they would happen last month.

</comment><comment><USER6> While we're here, any word on the supposed proof of the Collatz Conjecture that came up a couple months ago? I haven't been able to find anything about how it's holding up since.

<comment><USER7> [http://mathlesstraveled.com/2011/06/04/the-collatz- conjectur...](http://mathlesstraveled.com/2011/06/04/the-collatz-conjecture- is-safe-for-now/)

(At the end of the comments you'll see that the author of the proof withdrew the claim.)

</comment></comment><comment><USER8> Duplicate from 4 days ago: <http://news.ycombinator.com/item?id=2873972></comment>


Honest Question: is this at all helpful as a hack for starting on a new language? - <AUTHOR> http://www.fourhourworkweek.com/blog/2007/11/07/how-to-learn-but-not-master-any-language-in-1-hour-plus-a-favor/

<comment><USER2> Yes, though I find that the process takes a bit more than an hour, mostly because a native speaker isn't conveniently placed in front of you and because language books are simply not organized in this manner. It's a shame that they aren't. Instead of giving you a basic overview of the language most tend to slowly build up in a manner children learn the language which isn't all that useful (to me, at least) if you're in college or learning it for fun; you just don't have the amount of time it would take to memorize a language in that manner.</comment>


AskHN: Phrases/moves/words HN would be better without? Complain here - <AUTHOR> For me it's "Fun fact:" - I'm so sick of seeing that! It's not cute. And "pro-tip". I just saw that twice.. Do they add anything except length?
Also saying that someone is "biased" or "has an agenda" and thinking you've done enough to win the argument. These seem mostly just like disguised versions of "I'm right, you're wrong!", with no more substance.
What things bug you like that on HN? Thank you! :-) <comment><AUTHOR> I also loathe seeing complaints that a book isn't just a page of bullet points, but is, you know, a book. That it isn't it's own abridged version, summarised, Cliffs notes version. People are so desperate not to waste a millisecond? There seems as many complaints like that as mentions of books nowadays.

</comment><comment><AUTHOR> Well, after 4 hours this has disappeared off the Ask list, so no way anyone can see it - that's a shame.

edit: except the person who saw this in New, I suppose and downvoted - <USER2> for that. (This comment was meant to be mostly a note to my future self on what happened to this submission, why no responses.)</comment>


Infographic: Android vs. iOS Mobile App Development - <AUTHOR> https://www.cleveroad.com/blog/android-vs-ios-mobile-app-development-infographic <comment><USER2> The info graphic could at least include more sources

The rating for Android Studio vs Xcode had some arbitrary graphics with numbers attached. It took clicking around to find the original source which still vague. Also the target markets is misleading as more accurate would be income demographics as opposed to regionality.

[https://www.strategyanalytics.com/strategy- analytics/news/st...](https://www.strategyanalytics.com/strategy- analytics/news/strategy-analytics-press-releases/strategy-analytics-press- release/2015/11/11/strategy-analytics-android's-developer-tools-lag-behind- apple-and-microsoft#.Vp4-FXWLRy0)</comment>


Show HN: Control Amazon.com use with facts and gorgeous photos of the Amazon - <AUTHOR> https://chrome.google.com/webstore/detail/reclaim-the-amazon/homocecfbbmmljacijppegoeipleelci <comment><USER2> I really love this! The pictures are beautiful, the facts are interesting - it's genuinely pleasurable to see. And if it reminds people to be a little less consumeristic, so much the better!

</comment><comment><USER3> Pretty cool extension! I think we all could use a while lot more life and a little bit more color among the drab pages of today's monolithic web.</comment>


Show HN: Interactive Maps for IoT Search Engine Shodan - <AUTHOR> https://maps.shodan.io/#36.421282443649496/-99.228515625/5/green/apache <comment><USER2> Very cool. But you're using basemaps that require attribution[0], which you're very conveniently covering with the Shodan Maps logo.

[0] - [http://wiki.openstreetmap.org/wiki/Legal_FAQ#3a._I_would_lik...](http://wiki.openstreetmap.org/wiki/Legal_FAQ#3a._I_would_like_to_use_OpenStreetMap_maps._How_should_I_credit_you.3F)</comment>


The Dangers of the Minimal Viable Product - <AUTHOR> http://blogs.hbr.org/anthony/2012/04/the_dangers_of_teh_minimal_via.html?awid=6693366944205131247-3271

<comment><USER2> I think this article misses the point that you'll likely need to actively re- launch your company once you have the complete product. You need to make the initial users feel like they are early adopters. You shouldn't be going out to them and saying "look, it's done, we're ready".

I think was does get missed is the ability and preparation to iterate rapidly and COMMUNICATE that you are constantly changing based on feedback. I suspect many companies will loose a significant number of users, but as long as you are replacing these lost users with new users because your product is improving, you'll get to the point where you are no longer an MVP and you will hopefully see those original users come back.

Think of Twitter. How many of us signed up at SXSW or shortly after in 2006, and then never came back before 2008 or so when it had achieved critical mass. If I'm correct, it wasn't a consistent hockey stick.</comment>


INSIDE KOREA'S CRYPTOCURRENCY DRAMA: SUICIDE, DIVORCES AND BROKEN HOPES - <AUTHOR> A report suggested that 3 out of 10 Koreans invest in cryptocurrency and most of them were between the age of 20–30 years. The word, " To the Moon" and "Lambo", spread out fast, all thanks to the super connectivity — a Korean teenager uses their mobile device for more than 4 hours a day, all homes have internet access and 88 percent owns smartphones. <comment><AUTHOR> Read the full article here: [https://hackernoon.com/inside-koreas- cryptocurrency-drama-su...](https://hackernoon.com/inside-koreas- cryptocurrency-drama-suicide-divorces-and-broken-hopes-67866e26145f)</comment>


Google and Verizon's net neutrality proposal explained - <AUTHOR> http://www.engadget.com/2010/08/09/google-and-verizons-net-neutrality-proposal-explained/

<comment><AUTHOR> well articulated article on what the "joint policy" proposal is all about. I am not sure I like the "Wireless Broadband shouldn't follow the net neutrality" clause.</comment>


Google settles copyright lawsuits with publishers, authors - <AUTHOR> http://www.infoworld.com/article/08/10/28/Google_settles_copyright_lawsuits_with_publishers_authors_1.html

<comment><USER2> This is really, really, important.

Imagine, 2-3 years from now, when you have access to just about any book ever written through your web browser. If it's out of print, you get it right away for free. If it's being sold somewhere, you pay some sort of fee, and have it immediately.

This is what Google's settlement makes possible.</comment>


Resources for learning load balancing and building scaleable web apps? - <AUTHOR>

Hello.  I'm a skill and competent programmer but haven't really delved into the realms of server administration beyond a single server.  I'm working a project that requires me to scale an app across multiple servers as traffic increases and want to know some resources for learning the ins and outs.  Books, online resources, etc.  Load balancing, database clustering federating or whatever the terms are, software architecture and how to go about administrating the servers, etc.<p>I want it to be similar in nature to google's app engine in that once the app is built it scales automatically and I don't need to modify the code after the fact as things get bigger. <comment><USER2> Here is one,

<http://highscalability.com/>

I bookmarked an AskSlashdot thread on a similar topic a while ago but Slashdot has archived the original thread so here is the google cache entry, look at the O'Reilly books they should answer a lot of your questions.

[http://126.96.36.199/search?q=cache:eugOZQ5ltGwJ:ask.slashd...](http://126.96.36.199/search?q=cache:eugOZQ5ltGwJ:ask.slashdot.org/article.pl%3Fsid%3D07/08/23/1447220+Learning+high- availability+server+side+development+site:slashdot.org&hl=en&ct=clnk&cd=1&gl=us)

A final word of caution though, There is no silver bullet. You are your applications best scalability expert.</comment>


The NSA even eavesdropped on cardinals as they prepared to select the new pope  - <AUTHOR> http://www.washingtonpost.com/national/on-faith/report-says-us-tapped-cardinals-phones-ahead-of-conclave/2013/10/30/9293708a-419f-11e3-b028-de922d7a3f47_story.html

<comment><AUTHOR> I am starting to believe the philosophy at the NSA is "because we can".

It is like giving police pepper spray and tasers, sooner or later they all are going to start escalating everything to where they get to use them, where if they didn't have them, things would have been resolved less aggressively.</comment>


A Conversation with bfeld on Startup Communities in Toronto - Oct 30, 2012 - <AUTHOR> http://startupnorth.ca/2012/10/05/a-conversation-with-brad-feld/

<comment><USER2> This will be fun... hope I can actually make it! Reading his book now. Some interesting stuff. Keep drawing parallels to Waterloo and Toronto in my head which makes reading less fast.

</comment><comment><USER3> Thanks for organizing, Dave.

</comment><comment><USER4> Bought my ticket already.</comment>