Play framework 2.10 released - <AUTHOR> http://www.playframework.com/ <comment><USER3> Release announcement - [https://groups.google.com/forum/?fromgroups=#!topic/play- fra...](https://groups.google.com/forum/?fromgroups=#!topic/play- framework/hZMXw1p6sjo)

Major highlights of this release include:

* Migration to Scala 2.10

* Migration to Scala concurrent Futures

* Modularisation of Play itself

* Modularisation of routes files

* Better thread management and HTTP context propagation in Java projects

* Managed controller instantiation

* New Scala JSON API

* New Filter API with built in CSRF protection

* RequireJS support

* Content negotiation

* Improved Iteratee API

<comment> iso-8859-1 and SSL: [https://groups.google.com/d/msg/play- framework/FeTUDQwaEPg/q...](https://groups.google.com/d/msg/play- framework/FeTUDQwaEPg/qjBEt6LsLr0J)

But not TLS (and client certificates, yet), that is for Play 2.2: <https://github.com/playframework/Play20/pull/475>

<comment><USER4> Since when is 10 < 2? (2.10 < 2.2)?

Edit: the title is wrong, it's play 2.1.0, not 2.10!!

<comment><USER5> yep, it can be easy to confuse that with scala 2.10

</comment></comment></comment></comment><comment><USER6> Does anyone know a good Django/Play comparison or Rails/Play comparison? Or a tutorial along the lines of "Play for Rails developers" or "Play for Django developers"?

I'm learning Scala and I want to play with it for webdev, but I know how much "hidden effort" is in learning any framework so i's really love something like this...

<comment><USER7> I'm also an Django developer and did a play application some time back[0], so maybe I can give some insight on development with Play!.

My background in functional program was non-existent at the time so going in I was already going to have problems. I choose to create my project as Scala project since I wanted to learn the tech. While Scala can be done with normal OOP/procedure programming I wanted to have the full affect of using Scala .

(These are my findings over the 2.0.x branches of Play! but should still be relevant to the current branch) Management:

Starting of a project is pretty simple, I have to say the Play! has done a great in baking in a good cli right into their framework and making it easy to plug in your own custom commands. I should mention that I was developing on a Windows 7 machine, in normal cases this wouldn't have been a problem but at the time with the 2.0.x version there were quite a few bugs with the project builder. For one, I couldn't use google closure compiler support due to some path finding issues "\" vs "/" and the stage, staged/start command didn't take windows into mind when generating the script. But for the most part these were small problems. It also has a less compiler ,which had a few problems causing me to patch my local ivy install, but should be all addressed now.

* Routing :

The routing files is located in conf/routes, which has a pretty simple DSL for defining your routes in a simple format :

<http_method> <path or regex> <method with option for defaults>

On thing that was lacking was the option to define multiple http methods for a route, meaning I could have a GET and POST route handled by the same function. While this may not be the best way to handle, but in some cases say with a /login route [1] it would be nice to have it all handled in one function or alteast defined once, but you have to declare both [2]

* Controllers:

Think of Play! controllers as Django class based views(cbv), the only difference is that Play! uses controllers are static, in all intent and purposes they still work the same and allow you to structure your code into sections of your site.

* Data Modeling:

Play! doesn't have an ORM/mapper per-say but they have a small jdbc wrapper that allows you to map your classes using Scala combinators syntax [3]. In a simple app this is easy to do, but you are still writing SQL and prone to errors. In my case I went with Squeryl [4], I tried to use ScalaQuery (which is now named Slick) but didn't like the api, maybe on my next project I'll revisit Slick since they have some nice features. By using Squerly I was able to get back the ORM mapping you would get with Django by first defining my Schema in code[5] (also provides sql create statements),Then I was able to easily map to Scala case classes, a win win here.

* Schema Migrations:

The default play doesn't have an eloquent way of managing schema changes, with Django you have South and it works fine most of the time. With play, you have a simple <revision>.sql setup stored in conf/evolutions/. Simply you tag your "up" and "down" schema changes and run a command in the cli to apply them.

* Templating:

The default Play! template system is pretty robust by its self, you can embed some scala code in it if needed. On thing about the template lang is that you must declare your templates with scala markup, so if you start a Play! project with Java you will still have to learn a bit of scala. Following with the how type safety of play and JVM technologies, the templates allow follow suite.This is good but sometimes you will run in a few problems when you want to pass a subset of data to templates, it took a while to realize that to access session information inside a template(again this maybe wasn't the best way to handle my problem) you had to declare an "implicit" value to gain an handle to the Request object. There are some other templates like one forked from Grovvy that are more advanced then the default system. But you can get pretty far by using the default templating engine.

* Request Handling:

Now this part I really liked, each request in Play! is handled by an "Action", and you are able to compose multiple actions together and come up with some nice implementations for say validating permissions. For instance, I needed to validate that a user had access to edit content for a giving dynamic domain and came up with a easy way[6] to just do

      def updateProfile = Authorize {
        implicit artist => implicit request =>

      }

and have the associated artist and request all accessible without having to fetch the artist in my controller for example. You can also defer requests that may block so you can retain full non-blocking support throughout your codebase.

* Forms:

Play! has a great form api, its simple and pretty expressive [7] and provides validation, but I ran into the problem where I wanted to convert my posted data set into a Scala case class for instance or wanted to convert to a Double rather then an Integer. So I had to implement a "Binder" ,to implement this was actually simple then I thought after looking at the source. With a custom "Binder" I was able to say pass a string to the controller and its associated values and have it marshal to a Scala case class and then simplely invoke my method, its better to show by example then explain so check out the following [8][9]

So take you have a request like GET stats/metric&range=30days, rather then having to do the request parsing,database fetching in you controller you can create a binder and have it all done for you, so when it reaches the controller you are working with an data object rather then primitive values (Interger,Strings etc):

      def plays(range: Range) = TransAction {
        Authorize {
          implicit artist => implicit request =>
            Ok(g(Play ~ range))
        }
      }

As you see you pass a string value for "range" but since you are asking for an Range object, with the Binders Play! will convert in-between the two. The ~ syntax is just my sugar to quickly apply the range against the chosen metric (in this case the total Plays for an artist for the last 30days) and have it outputted back to the client all in json format (the "g" method is just a helper to convert the Scala case classes to json string output, I got tired of writing Json.forJson over and over). All the code that handles the actual querying is done by the "Play" metric providing an interface to apply the "Range" rules onto a predefined query, all type safety. I have to say I was pretty amazed and proud of myself for this setup alone, it made it really easy to build new metrics one I had the framework setup.

* Deploying :

Deploying on Django requires a few extra software to get everything going, you need a webserver and some workers (uwsgi,gunicorn etc). With Play! you just run "play start" into the cli and that's it. There is a command to stage your changes that will execute its own start script. But unlike other Java web frameworks there is no need to have container (tomcat for example) in-front of your application, let along any webserver. This allows for quick development but in production you may want to add a web server or caching proxy in-front of it for best practices but its really isn't needed.

I could probably go into more detail (and may if others see any value) but Play! is a good framework for the Java/Scala community. Its not feature rich as say Django or Rails but with every problem or "Man I wish this was baked in" it wasn't that hard to do it my self, and this is from a guy that has never developed in Scala and Play! was my first introduction the Scala and the Play! framework as a whole.Ofcouse there were some "What were they thinking" moments and odd default configurations but you get that with anyframework I would guess. I did have lots of fun in the process and it made coding fun again, so I would definitely use Play! again, it seems now its more polished and some of the problems that I had have been addressed not the mention the new Json api is just beautiful.

[0]<https://github.com/cideas/bulabowl> [1][https://github.com/cideas/bulabowl/blob/master/app/controlle...](https://github.com/cideas/bulabowl/blob/master/app/controllers/Application.scala#L204) [2][https://github.com/cideas/bulabowl/blob/master/conf/routes#L...](https://github.com/cideas/bulabowl/blob/master/conf/routes#L16) [3][https://github.com/playframework/Play20/blob/master/samples/...](https://github.com/playframework/Play20/blob/master/samples/scala/zentasks/app/models/Project.scala#L42) [4]<http://squeryl.org> [5][https://github.com/cideas/bulabowl/blob/master/modules/commo...](https://github.com/cideas/bulabowl/blob/master/modules/common/app/models/SiteDB.scala#L104) [6][https://github.com/cideas/bulabowl/blob/master/app/actions/A...](https://github.com/cideas/bulabowl/blob/master/app/actions/Actions.scala) [7][https://github.com/cideas/bulabowl/blob/master/app/models/Fo...](https://github.com/cideas/bulabowl/blob/master/app/models/Forms.scala#L147) [8][https://github.com/cideas/bulabowl/blob/master/app/binders/p...](https://github.com/cideas/bulabowl/blob/master/app/binders/package.scala) [9][https://github.com/cideas/bulabowl/blob/master/modules/commo...](https://github.com/cideas/bulabowl/blob/master/modules/common/app/models/Stats.scala) and [https://github.com/cideas/bulabowl/blob/master/app/controlle...](https://github.com/cideas/bulabowl/blob/master/app/controllers/Stats.scala)

<comment><USER8> Great writeup, but I have a comment on deploy: do you mean that "play start" can be used for production? Because otherwise, Django has runserver for development. It just shouldn't be used for production.

<comment><USER9> `play run` is sort of the equivalent of `runserver`. `play start` is one of the recommended[0] ways of running Play applications in production.

[0] <http://www.playframework.com/documentation/2.1.0/Production>

<comment><USER10> There is also `play dist` and `play stage`. They both wrap up all necessary assets / dependencies so that you don't even need play installed in order to start a play server (as the play framework jar gets bundled too). We use this for deploying rather than `play start`. The difference between dist and stage is that dist creates a single zip file in the target directory, whereas stage does not. Both create a file named 'start' in the target directory. The docs are not completely clear on that point.

[http://www.playframework.com/documentation/2.1.0/ProductionD...](http://www.playframework.com/documentation/2.1.0/ProductionDist)

<comment><USER11> You do not need "play" installed, as Play is using SBT as the package manager.

So without the framework installed and in your PATH, you can just go to an app's directory and do "sbt start". It will download all dependencies needed, compile your app and start the server.

</comment></comment></comment></comment></comment></comment><comment><USER12> Congrats Play team! You really have a winning framework on your hands! Coming from a Java background, it was easy to learn; I was able to launch a dynamic MVP in three days on heroku (shameful plug): carsparkapp.com

It keeps getting better with each release, and as more plugins are written. The docs are really clear, and the community is thriving. Very good stuff!

</comment><comment><USER13> When they say "predictable and minimal resource consumption (CPU, memory, threads)", what kind of numbers are we talking about, roughly?

<comment><USER14> They say they're using Akka to provide actors. And Akka seems... _fast_ and small:

<http://akka.io>

<comment><USER13> How fast and how small? How many K of memory?

</comment></comment></comment><comment><USER15> This is an amazing effort by an amazing team. I have been using Play exclusively for two years now and each version keeps getting better and better

</comment><comment><USER3> I have been using 2.10 RCs for couple of days (all non-blocking stuff), and I must say it's amazing! I am impressed.

Way to go guys! :)

</comment><comment><USER16> IMO Play framework is the most important thing happening to Java right now.

I hope this brings Java back to everyday web development :)

</comment><comment><USER17> It's all about the JVM these days, guess I should learn it.

</comment><comment><USER18> Things are moving fast... I am still on 1.2.X for my applications as I fear the migration models, controllers and especially of Groovy templates to Scala templates.

Especially the increased compilation times when I hit reload are a turn of.

<comment><USER19> Yeah - Play 1.2.5 is still pretty awesome, too. It's still my go to (Java) platform for mocking up sites quickly, especially for APIs.

Play 2.1 seemed a bit slower to develop on. At least for me, it was definitely not as quick to get something up and running ASAP. Will need to check out 2.10 soon.

</comment></comment><comment><USER20> Love it. Exquisitely type safe. Just one thing: Weren't we supposed to get WAR deployment support in 2.1?

<comment><USER21> They haven't done this because the Servlet 3.1 spec has not been released yet. Play 2 supports some features that cannot be supported with Servlet containers <3.1 (probably stuff like web sockets). However, there is a 3rd party plugin that provides this functionality (as long as you avoid the unsupported features): <https://github.com/dlecan/play2-war-plugin>

</comment></comment><comment><USER22> I went through all RCs (from 1 to 4) with two applications. Happy to see release now. Great framework.

</comment><comment><USER23> I've been eyeing Play for a bit now, but I've been wondering what kind of server it would require for a modest app with basic CMS functionality.

So, for example, will it run fine on a 128MB RAM VPS (assuming average IO speeds), a remote db and nginx?

<comment><USER24> As the other comment said, no need for NGinx unless you're dealing with external assets you don't want to add to your project structure.

That said, I will say I run my Blog on Play 2.1 (RC2 IIRC) and 512MB means I have to set some tuneables to limit the max memory to 384MB. I haven't figured out how to get those to work with 'play dist' either, so I got it running by cloning the source and installing Play locally. Which isn't much fun.

I'm sure with a little more digging I could figure it out. That said, the default limit of 1.5GB is probably there for a reason. It seems well suited to EC2's m1.small instance (1.7GB).

Considering the in-memory caching, I'd just pony up the $44/month for such an instance for anything more than my personal blog.

</comment></comment><comment><USER25> Play 2.1 = awesome, scala 2.10 = awesome, and loving the new website. This is a good time to be a web developer...

</comment><comment><USER26> Mods, can you fix the title please? It's "2.1.0", not "2.10" (it runs on Scala 2.10, but the version is 2.1.0).

</comment><comment><USER27> Why all those fancy effects of things flipping in your webpage?

It confused me for a while, until I understood it, then I think it is fancy, and useless.

But impressive maybe, if it was done using the tech they want you to use.

<comment><USER28> It's just a flashy thing to do nowadays in web dev, probably using jQuery Waypoints. I personally think it's quite cool, despite it's apparent uselessness.

</comment></comment><comment><USER29> Why did they decide to use static methods for the controllers?

<comment><USER30> Stated by Guillaume Bort here[1]

 _Play uses static methods only when it makes sense: \- in the controller layer, because controllers are not object oriented. Controllers act as mapper between the HTTP world (that is stateless, and request/response based) and the Model layer that is fully object oriented._

[1]: [http://stackoverflow.com/questions/5192904/play-framework- us...](http://stackoverflow.com/questions/5192904/play-framework-uses-a-lot- of-statics)

<comment><USER31> It only 'makes sense' on a theoretical basis. On a practical basis, unit testing tons of static methods is a nightmare.

<comment><USER32> I find it pretty easy to test static methods. To me, testing a ton of static methods would seem a bit easier than testing a ton of classes, since static methods are usually stateless and so require less setup/cleanup work.

Could you explain a bit more about what makes static methods harder?

<comment><USER31> Static methods can be easy to test, if they are zero or near-zero dependency. e.g. Math.log(x) is easy to test.

However, a static method that accesses other layers is often very hard to test (at least in isolation). For example if you have a static controller method that accesses some service layer you would normally want to mock that service layer for testing so you can test the controller code in isolation.

If the method is non-static and that service layer object is a class member, it is very easy to replace your production service layer with a mock (using dependency injection or mockito, etc).

However if your controller is static, it can only access static members of its class or instantiate the service object with a 'new' operator. Either way there isn't a 'seam' in the code where something like dependency injection or mockito can intercept your app's wiring to replace the service object with a mocked version.

Worth noting I'm coming from the Java side of things here, perhaps Scala is built in such a way that 'new' and 'static' type things are interceptable in a way that allows mocking.

</comment></comment></comment></comment></comment><comment><USER33> This is awesome news. With this release Play has reached a level of maturity and elegance that will definitely make me consider it for my future projects.

</comment><comment><USER34> Speaking strictly about the website redesign, I think that (although nice) it fails to communicate the framework biggest selling points. Some comments on that:

* The code-save-refresh workflow: this is mentioned briefly as "hit refresh workflow" which is confusing to say the least.

* Some other weird or 'meh' bullet points like type-safety (you're using either scala or java so you take that for granted) or stateless-web-tier.

* The introduction video is long. It's fine as a tutorial, but being the first thing you can click on I expect you to sell me the framework in 2-3 minutes or so (it can be done, play is fantastic).

Disclaimer: I love play and used it a lot last year. In fact I was part of the team that put the first play application into production on LinkedIn (featured in the bottom of the play site).

<comment><USER35> > * Some other weird or 'meh' bullet points like type-safety (you're using > either scala or java so you take that for granted) or stateless-web-tier.

I think type-safety is mentioned because unlike Play 1.x, almost everything is type-safe in 2.x, such as templates and route definitions.

</comment></comment><comment><USER36> new json api is bloody awesome! and when you add reactive mongo in the mix... oh my god

</comment><comment><USER37> 2.0.4 had bad defaults and documentation.

Some highlights:

\- half baked config (no array. multiple values can be hacked as `foo.bar={a: 1, b: 1}`)

\- can only set logging level in the config. and, xml logger config doesn't have application.conf values (logger.* in .conf are useless)

\- routes dsl (meh)

\- bad db connection pool. it kills all other connections if a connection fails, and goes into error state instead of re-connecting (it does reconnect for subsequent requests when pool is in error state)

<comment><USER38> the config has arrays, it is a json superset. foo.bar = [1, 1]

<comment><USER37> oh, i think i missed productIterator() in [http://www.playframework.com/documentation/api/2.0.4/scala/i...](http://www.playframework.com/documentation/api/2.0.4/scala/index.html#play.api.Configuration)

It could have been better if document had some examples: [http://www.playframework.com/documentation/2.0.4/Configurati...](http://www.playframework.com/documentation/2.0.4/Configuration)

I can't even grep for productIterator on these projects: <https://github.com/typesafehub/config/> <https://github.com/playframework/Play20/>

That probably means there's no test, example, poor documentation..

Actually, it's Product.productIterator, which is in scala api. I'm scala noob.

thanks.

</comment></comment></comment><comment><USER39> I've been looking for a way out of Rails. I dislike not having a compiler & analyser as I'm very comfortable with CLANG and LLVM.

Recently I've been looking at GoLang and Scala. Not sure which to go with, but Play seems better than most web frameworks for Go.

But my concern is always ecosystem. Now before you say "You have access to Java ecosystem" please take a look on how amazing the ruby eco system is.

</comment><comment><USER40> I am planning to evaluate play! on some small projects.

Does anyone knows what are pros/cons using play with java/scala?

</comment><comment><USER41> a question (not about the framework, but about the linked webpage) - <USER2> awesome effect where i scroll down and the pictures (next to the "Developer friendly" headline) "fold up", is there an animation-lib that does this? how is it called? it's awesome, i want it.

<comment><USER42> Ask @iamwarry on Twitter - Maxime Dantec did the site design. Talented fellow.

</comment></comment><comment><USER43> Looks very interesting. Good job.

</comment><comment><USER44> Anyone use the play framework inside of IntelliJ IDEA? What's that experience like?

<comment><USER45> IntelliJ is the next best thing after sliced bread. You should definitely try it. It has great official support for Play.

</comment></comment><comment> iso8859-1 Issues closed with version 2.1: [https://play.lighthouseapp.com/projects/82401-play-20/milest...](https://play.lighthouseapp.com/projects/82401-play-20/milestones/137248-21)

</comment><comment><USER22> BTW, error in title, Not '2.10' but '2.1.0'

<comment><USER46> yup! Play 2.1.0 with Scala 2.10 :)

</comment></comment><comment><USER47> nothing that awesome to make me switch from Grails.

<comment><USER48> Is it easy to do non-blocking code in Grails? I have played with Groovy lately and it is definitely a productive language.

<comment><USER49> Is not as easy as using the Scala Future API or Akka Actors.

In Groovy you have to use Gpars (<http://gpars.codehaus.org/>), a third party library which is not as simple as Scala Futures, IMHO</comment></comment></comment>


Mars Curiosity Rover model - <AUTHOR> https://www.shapeways.com/model/1672836/mars-rover.html?li=my-models&materialId=6

<comment><USER2> Or you could just get the awesome new Lego Cuusoo set.

[http://shop.lego.com/en-US/NASA-Mars-Science-Laboratory- Curi...](http://shop.lego.com/en-US/NASA-Mars-Science-Laboratory-Curiosity- Rover-21104)

<comment><AUTHOR> Yeah but 3D printed stuff is quite cool as well. Have a Space ship tow laying around and it is awesome (needs a better pic). See: [https://pbs.twimg.com/media/BduYkJLIcAEpOMC.jpg](https://pbs.twimg.com/media/BduYkJLIcAEpOMC.jpg)</comment></comment>


10 Android apps account for 43pc of usage - <AUTHOR> http://www.telegraph.co.uk/technology/google/8709783/10-Android-apps-account-for-43pc-of-usage.html

<comment><USER2> would be nice to find out which 10 apps are dominating the android scene.</comment>


What entrepreneurs can learn from stand-up comedians  - <AUTHOR> http://www.huffingtonpost.com/rachel-weiss/a-startup-walked-into-a-b_b_1834958.html

<comment><AUTHOR> _"... In comedy, I actually took a class where we learned what to do if a waitress drops a tray in the middle of your set and how to move forward. Acknowledge what happened and then adjust. I think about this lesson on a daily basis. ..."_

Improv is an underrated skill. The ability to be adaptable & flexible in real time.</comment>


As Apple offers $200k for iPhone vulnerabilities, Black Hat firm offers $500k - <AUTHOR> https://9to5mac.com/2016/08/10/iphone-hack-bounty-apple-exodus-intelligence/ <comment><USER2> I had no idea companies like Exodus Intelligence existed. I see a few government agencies in their client list. The whole business seems pretty shady to me.

Can anyone realistically estimate how many "zero days" Exodus Intelligence possesses and distributes? I have no idea...</comment>


Flat UI Design - A showcase of the best examples of the flat UI design aesthetic - <AUTHOR> http://fltdsgn.com/

<comment><USER2> Yuck. Horrid examples. Not that I've seen a flat design that is usable yet. Microsoft did a pretty good job with WP8 but it still stinks.</comment>


Motives Aside, the NSA Should Not Spy on Us - <AUTHOR> http://reason.com/archives/2013/06/23/motives-aside-the-nsa-should-not-spy-on

<comment><USER2> No, let's not place their stated motives aside and presume their premise is simply misguided. Their premise is full bologna and a palpable excuse for the uneducated.

From the article: "...But if their purpose is to protect us, why worry?..."

If their motives were that genuine and honest, why are they not freeing American girls or otherwise from slavery? arresting cartel leaders or crooked politicians or perhaps crushing insider trading?

The answer is that the NSA/CIA/FBI and all the other "alphabet soup" agencies fear the public at large and are scared and want to protect themselves and their institutions only.

I know I over-simplified but the last nation to do this was the Soviet Union and they feared their public too.

<comment><USER3> >I know I over-simplified but the last nation to do this was the Soviet Union and they feared their public too.

And this is why/result/symptom of the US collapsing. We've seen these things time and time again. An empire who has no enemies makes an enemy out of itself.

Interesting take on the US collapse preparedness from someone who experienced it in the USSR:

[http://www.resilience.org/stories/2006-12-04/closing- collaps...](http://www.resilience.org/stories/2006-12-04/closing-collapse-gap- ussr-was-better-prepared-collapse-us#)

</comment></comment><comment><USER4> Shouldn't have been posted to Hacker News, solely because what it says is already obvious to most people who read here.

</comment><comment><USER5> I think the best solution would be to have the NSA and other security apparatuses stop or significantly scale down their surveillance programs for a few years.

Two scenarios would play out:

1) Nothing happens or a maybe Boston Marathon Bombing-style attack once a year at most.

2) Bombs go off in a major shopping center or movie theatre every week, perhaps a few in the Bay Area. This is similar to what happened in Israel in the 90s.

In the first case it would mean that the surveillance really was for nothing and the matter would be easily resolved.

In the second case, we would at least be in a position to make an informed decision about whether the surveillance programs were worth the security it gained us. I suspect people would have a different opinion about the surveillance programs if scenario two came to pass - because preventing the second scenario _is_ ostensibly the motive behind them.

<comment><USER6> Since nobody seems to have been paying any attention or have a memory, 9/11 was sadly the information about scenario two. It's not a bloody experiment anymore.

<comment><USER7> If you think any of the measures instituted after 9/11 could prevent another mass 9/11 style attack, you're in denial. Like people who want to ban semi- automatic rifles because of school shootings. The Bush administration ignored all the 9/11 warning signs.

[http://www.nytimes.com/2012/09/11/opinion/the-bush-white- hou...](http://www.nytimes.com/2012/09/11/opinion/the-bush-white-house-was- deaf-to-9-11-warnings.html?_r=0)

[http://www.theatlanticwire.com/politics/2012/09/bush-knew- mo...](http://www.theatlanticwire.com/politics/2012/09/bush-knew-more-about- bin-laden-plans-than-we-realized/56716/)

<comment><USER6> You got me; I'd also like to ban semi-automatic rifles. Give those deer a fighting chance.</comment></comment></comment></comment>


Market Data Sources for US Trading Venues - <AUTHOR> http://www.nanex.net/aqck2/4666.html

<comment><AUTHOR> I submitted this as a follow up to this post:

[https://news.ycombinator.com/item?id=9638748](https://news.ycombinator.com/item?id=9638748)

I think this, more than any other source, illustrates what is meant by latency arbitrage, or "what HFT firms do".

Long story short, In the chart, the red and black squares are "fast", while the blue squares are "slow".

When a trade happens on an exchange there is an opportunity for HFT firms to look for mispricings on the exchanges with blue squares due to the HFT firm knowing what happened even before the blue squared exchange does.

The reason the HFT firms have advance knowledge is that they build their own networks consisting of microwave or fibre lines that are faster than the SIP(blue square pricing source).

it's not always there and its certainly the type of trade that quickly converges into a winner take all event, but this is latency arbitrage in a nutshell.

What the diagram is missing is the 40 dark pools in the US, almost all of which use the SIP to some degree, which only exacerbates the problem.

TL/DR distributed systems are tough, even more so when the people controlling the money have a vested interest in making it so.</comment>


Show HN: CertAlert.Me Free SSL certificate expiration warnings - <AUTHOR> http://certalert.me

<comment><AUTHOR> At Stackify we use Windows Azure and were taken offline due to their SSL certificate expiring. A lot of us have had this problem before. Someone forgets to renew it and all hell breaks loose when it expires. So we searched for a simple solution to monitor them and couldn't find any. So 24 hours later we put together our own little free monitoring tool! Enjoy!</comment>


You Are in Charge of Your Future - <AUTHOR> http://softwarearchaeology.blogspot.com/2012/05/you-are-in-charge-of-your-future.html

<comment><USER2> Wow, so many commercial things being recommended! All of that can probably be done for free. All you need is just the desire to keep up to date and a web browser.

<comment><AUTHOR> That may be true, but your point is the same as the author's, that desire should be the motivating factor. Whether you chose the free or paid route is immaterial. And FWIW, there are plenty of reasons to pay for tools and learning resources, not the least of which is that some people prefer learning in the "guided mode" that these resources provide.

</comment></comment><comment><USER3> All true. One of the bigger issues is that some of these Dark Matter folks don't even know what's out there, and need some help getting there. They want to be part of things, but they haven't been for a while. Any encouraging words to developers who want to contribute to the community, but aren't yet doing so to the extent they could, are welcome.</comment>


Apple discontinues iPod Classic - <AUTHOR> http://www.apple.com/ca/ipod/

<comment><AUTHOR> The Verge has just published a story on this as well: [http://www.theverge.com/2014/9/9/4715274/ipod-classic- discon...](http://www.theverge.com/2014/9/9/4715274/ipod-classic-discontinued- a-visual-history)</comment>


More Mistakes Discovered In DHS's Domain Seizures - <AUTHOR> http://www.techdirt.com/articles/20101222/02112912376/more-bigger-mistakes-discovered-homeland-securitys-domain-seizures.shtml <comment><USER2> So basically zero repercussions for judges and law enforcement that swear and sign vastly incorrect orders that do drastic damage. Just like that article the other day where there are no repercussions for badly behaving prosecutors.

I guess at least they didn't kill anyone like a no-knock warrant on the wrong house for the wrong reason. Still, it's the general attitude that really should wake up people who have blind faith.

<comment><USER3> A better course of action may be prosecution of the RIAA under RICO statutes as they have caused damage of the property of others for claims which are false and which they ought to have known were false. They do offer 'protection' from these issues in exchange for 'licensing' fees. And it's clear that the record company execs have conspired to create such an organization.

This would create far more change than the prosecution of some low level bureaucrats, as RICO statues would allow the prosecution of the executives rather than lower level employees, as well as piercing the corporate veil to go after the record company execs rather than just RIAA execs.

The nice thing is that RICO allows for a civil claim where the evidentiary standards would be greatly relaxed, also a civil claim could not be quashed by reason of 'public interest'.

<comment><USER4> We can only dream. It'd be nice if everyone, corporations, politicians, and individuals, were held to account equally and were treated equally under the law. Unfortunately, that's not the world we live in.

</comment></comment></comment><comment><USER5> Mistaken arguments discovered in mistakes in seizures post.

 _In multiple cases, the blogger notes that he will not post links to too many tracks from an album, suggesting that the site is not at all focused on getting as much infringing material up as possible, as implied in the affidavit. If that was the goal, why would it specifically refuse to post links to more than just a few songs?_

Man in a barber's shop, and a kid walks in. "Hey", says the barber to the man, "see that kid? dumbest kid in the world. Look, I'll show you." and he goes over to the kid and holds out a dollar in one hand and two quarters in the other and asks the kid to choose. The kid takes the quarters and leaves. "See?" says the barber, "what did I tell you? Dumb as a box of rocks that one".

A bit later the man leaves the barber shop and sees the same kid outside an ice cream store, and asks him "why did you take the quarters instead of the dollar?".

"Because", replied the kid licking his icecream, "as soon as I take the dollar, the game is over".

<comment><USER6> While your joke is humorous, it's not particularly applicable to this situation. The affidavit only highlighted four "infringing" songs, and according to TechDirt, every single one was explicitly provided to the blog by the record label (or in one case, the unsigned artist) for promotional purposes.

The fact that they refused to post links to all but the permitted songs _does_ actually demonstrate a desire to comply with intellectual property laws.

</comment></comment><comment><USER7>
        Note that he says all were pre-release, but only three were copyrighted.

Argh! Copyright attaches to a work upon creation, not upon sale, or slapping (c) on it.

<comment><USER8> Unpublished words are not automatically copyrighted. If someone steals your unpublished work, and publishes it themselves, you will be out of luck unless you registered the work.

<comment><USER9> Actually, unpublished works are still copyrighted. The issue here is that you have to show that you created the work if you want to make a copyright claim, which is difficult if the work is unpublished and not registered.

<comment><USER10> Not so. While courts require registration before they'll enforce your rights, the process itself demands nothing more than an assertion - under penalty of perjury - that the work in question is yours. And that's all.

A lack of publication or registration is only a problem if you're challenging the legitimacy someone else's copyright. And yes, that's considerably harder to do - as well it should be.

Does this mean that it's easy to register the copyright for unregistered work that isn't yours? Yes it does. But actually doing so is insanely stupid, since getting caught means opening yourself up to both a civil lawsuit from the rightful owner, as well as Federal perjury charges. And since you're involving the courts themselves in your fraud, you can expect whichever judge you face to be especially unforgiving.

Unsurprisingly, knowingly falsified copyright registration is not a widespread problem.

</comment></comment></comment></comment><comment><USER11> The MPAA and RIAA get DHS to shut down a hip-hop blog under false pretenses -- and DHS botches the job. Is this the greatest country in the world or what?

<comment><USER12> This just goes to show you why we normally have due process. When you don't follow the process, you fuck things up badly.

<comment><USER13> They did follow due process. An industry body bought off some politicians who passed a law making attacks on their business model a matter of national security.

That's been standard procedure since at least 1776

</comment></comment></comment><comment><USER14> This is just insane to me. At what point is domain seizure increasing or defending homeland security? I cannot see where these seizures are at all part of DHS's stated goals when the department was created.

How is it that our government agencies continue to limitlessly aggrandize their power & reach with no end in sight and, apparently, no recourse or prevention? Perhaps we need to return to constitutional amendments protecting the People and the states from unfettered power grabs--such as an amendment that expressly prohibits a federal agency of the executive branch from increasing its reach without due congressional process & said increase being legislated and passed by both houses, like any other law.

I'd like to believe it's an idea that liberals, conservatives, independents, and anyone else can actually agree on. But ... we're talking about people here. And politics.

<comment><USER15> DHS was created by consolidating several existing agencies. One of them is ICE, which has traditionally had a role fighting counterfeit goods and copyright infringement. Yes, it's bad that they suck so badly at their job -- but this isn't a "power grab"

<comment><USER16> Uh,

I keep hearing the ICE-is-tasked-with-counterfeiting-so-this-isn't-a-power- grab argument.

Whatever the merits of the general argument, you need to find a different term for you say it isn't. Because it certainly _is_ a power grab by the normal use of the phrase.

We haven't seen mass domain seizures previously and this ability certainly is power. It's been done with dubious legality, dubious constitutionality and just dubiously, so it's effectively a grab.

If the Department of Agriculture started arresting people for using too many pesticides in their home gardens, it would be a power-grab even though the department sure-enough is tasked with regulating agriculture.

<comment><USER17> How about "The ICE is tasked with policing counterfeiting so this isn't overstepping the bounds of their jurisdiction?" Quibbling over the words "power grab" seems rather pointless.

<comment><USER16> The summary of an article can matter _a lot_ these days. If someone says "TL;DR - not a power grab", it may make someone who would otherwise react against it do nothing.

 _This is a significant increase in state power. I hardly oppose any summary which gives any other impression._

<comment><USER18> You meant _heartily._

<comment><USER16> Yes I did ;<

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Hm, the author seems to use "Occam's Razor" as "most charitable explanation".

<comment><USER20> Better put by Hanlon's razor, "Never attribute to malice that which is adequately explained by stupidity."</comment></comment>


How to Grow a Forest Fast - <AUTHOR> https://fellowsblog.ted.com/how-to-grow-a-forest-really-really-fast-d27df202ba09 <comment><USER2> This is from 2015.

It seems like they didn't get much far with the open source software they claim to be using/developing. On their website there is a link to a Dropbox folder where people can download some spreadsheets and documents to implement their method, but nothing more.

I am a little bit skeptical, because some of the claims are hard to believe. For example they cite noise reduction as a benefit, but no plantation, no matter how dense, provides any significant noise reduction.</comment>


Active vs Passive investing - <AUTHOR> http://avc.com/2016/07/active-vs-passive-investing <comment><AUTHOR> Tldr:

Investors must choose to be either active and concentrated or passive and diversified; big gains require investments of time, energy and intellect, in addition to capital; truly active investing limits the number of investments a person or firm can make; it's difficult to scale.</comment>


Porn will be age-blocked across the UK on July 15 - <AUTHOR> https://www.businessinsider.com/porn-age-verification-to-launch-in-uk-on-july-15-2019-4 <comment><USER2> This is an awesome experiment that will allow us to do AB testing.

The thing is that I'd rather see the UK tackling the serious drinking problems teen have rather than addressing porn.</comment>


Ask HN: Blogging is cool, but where does it lead? - <AUTHOR>

I'm currently setting up a coding blog (I know, I'm incredibly original) and while I'd love to just spend every waking minute making and sharing code for the world, I obviously need a job to sustain myself. Right now I'm exploring my options and figuring out a long-term plan to sustain this project.
My question: Is there any way to be financially self-sustaining when the products you create (text and code) are inherently free (blog posts and open source)?
I'm a hobbyist (read: unqualified) coder with a strong desire to work for myself, so I won't accept "get attention from employers" as an answer. "Make an app" also isn't acceptable. What I'm looking for is a way to turn "code blogging" into a viable, long-term financial platform.
Thank you for any and all advice. <comment><USER2> If you don't want to sell anything (an app), and you don't want people to pay you for your skills (a job), I see two possible routes: a) have very high quality content on your blog behind a paywall, b) have very high quality content on your blog along side some types of ads. In either of those scenarios, you are going to need a very large amount of traffic in order to sustain yourself long term.

</comment><comment><USER3> It's all about your goals - both short term and long term. Some people find that writing helps them understand the problem(s) better - that's a short term benefit. Others want to position themselves as an expert so that they can speak at conferences - that's more of a long term benefit.

So where does it lead? That's up to you - define your goals, and figure out whether blogging matters in the end towards reaching that goal. It might, and it might not. It's quite time consuming to put out high quality blog work so the payoff needs to be real.

</comment><comment><USER4> IF you are looking to turn a coding blog into direct monetization, my suggestion is to blog every single day and publish amazing content. Even then, it is a long game.

</comment><comment><USER5> Write content on your blog that shows you know what you are talking about and use that to promote yourself for freelance work.</comment>


Show HN: My weekend project. Quickly use different Vagrant setups - <AUTHOR> https://github.com/kapowjs/kapow

<comment><AUTHOR> This is a rough MVP of my weekend project of making it easier to use different vagrant setups without having to reconfigure everything yourself. You can create packages for others to use by sending them off to the packages repo, Then when someone uses kapow, they can use the same setup as you by specifying the package in their kapow.json file. It also hooks into pow.cx for quickly giving a yourproject.dev url for each kapow project you make.</comment>


# of days since the last alg=none JWT vulnerability - <AUTHOR> https://www.howmanydayssinceajwtalgnonevuln.com <comment><USER2> This exact vulnerability is something I've seen in a good number of open- source codebases or boilerplate repos in the Node ecosystem.

The library most people use for JWT stuff in Node is Auth0's. There are two methods for decoding a token payload: jwt.decode() and jwt.verify()

Both of them return the decoded payload, but one (if you don't read the documentation) sounds more immediately like the one you think you want to use.

jwt.decode() doesn't verify the token when decoding:

[https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken-- o...](https://github.com/auth0/node-jsonwebtoken#jwtdecodetoken--options)

If you dig through Node repos on Github searching for "jwt.decode()" or "this.jwtService.decode()" you'll see a shocking number of results.

The other big mistake I've seen is encoding personal data in the token, instead of just an ID that only has meaning inside of your database. It turns out not everyone is aware that JWT tokens are publicly decodable and that the only security is in the signing + verification. Many people I've spoke with think the token is like a hash.

<comment><USER3> I worked on some code signing code, and one of the internal customers, who had a lot of clout (but not as much as they thought) were adamant that I needed to provide them a way to pluck data out of the payload without verifying the signature first. I told them, in a variety of extremely diplomatic ways, to politely fuck off. In fact I did a sweep of the code to make extra sure that none of the data paths gave you anything before verification had finished (there were not barn doors but there were soft spots). When your dog is sniffing around, it's time to hide the treats.

The only reason you want to look at a payload is to make decisions about it, _before you can trust those decisions are rational_. What I did promise them is that I would continue to try to make the checks cheaper, which we did.

Ten years later, I still trust that I made the right call. Never expose a function from a security library that gives you the data without verifying it first. You are doing _violence_ to the user, the team, the company, possibly an entire industry.

<comment><USER4> In general I don't see any reason to look at any data in the payload before the signature is verified. If anything, a good reason is that increases attack surface by giving attacker ability to interact with my system without the signature.

I don't know what exactly you mean by improving performance by looking at the payload before the cost of signature verification. If you mean that for some reason you could discard large portion of messages without actually verifying the signature then this is generally false.

In a DoS situation the attacker might want to consume your resources without bothering to forge the signature but just as well he can forge the content so potentially easy fix to their fake content will cause you to pay for the signature verification anyway.

If, on the other hand, the application somehow relies on this to be viable then very likely this is a design fault. I can imagine for example that you might want to discard messages with outdated tokens but there are better ways to solve this (just don't send outdated tokens?)

<comment><USER3> In one case they were trying to categorize the content based on inspecting the manifest, shall we call it. If you start making decisions based on non- authoritative information, my experience is that you very quickly forget that it's non-authoritative. That slippery slope is universal, rather than particular to any examples in this thread. If it can happen, it will happen.

If you decide things without checking with a higher authority, then you are the Confused Deputy, and that typically ends badly. It's not Barney's fault he keeps getting locked in the jail cell. It's Andy's.

</comment></comment></comment></comment><comment><USER5> Slightly OT but why should I choose a JWT over creating some opaque token (random bytes) and storing that in a database mapping it to a user's ID?

It seems like people create short lived JWTs and then pass some opaque token to an auth endpoint to get a new JWT signed whenever the old one expires, or they store the JWTs in a database so that they can be revoked, making me question their usefulness.

<comment><USER6> > Slightly OT but why should I choose a JWT over creating some opaque token > (random bytes) and storing that in a database mapping it to a user's ID?

To avoid the database lookup. Often you might want to hold some state, without the latency.

JWT is about your server being able to be stateless, whilst the client is stateful, which can speed up some... Irritating... Places of performance problems.

<comment><USER7> But you then lose the ability to revoke a token on the backend, given that requires a DB lookup. Or you have very short lived token, meaning that you don't have real benefits versus an opaque token in DB.

IMHO JWTs only make sense in some constrained contexts, such as:

1\. You want a report, click on "generate"

2\. The processing starts, you receive a token to access the resource

3\. Once the file is created you get can access it by using the token previously received

In those kind of short term and limited use cases they can make things a bit nicer as the "report generation service" only need to check the token.

But in practice JWTs are often used used as a general authentication/authorization mechanism, and that makes little sense (and brings a lot of overhead).

</comment></comment></comment><comment><USER8> This appears to be just the start. There appears to be no longer list of prior vulnerabilities, but these will come, right?

<comment><USER9> A couple more from recent history:

[https://insomniasec.com/blog/auth0-jwt-validation- bypass](https://insomniasec.com/blog/auth0-jwt-validation-bypass) [https://auth0.com/blog/critical-vulnerabilities-in-json- web-...](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token- libraries/)

</comment></comment><comment><USER10> My thoughts on this: [https://twitter.com/mooreds/status/1300932665755856896](https://twitter.com/mooreds/status/1300932665755856896)

<comment><USER10> Okay, maybe I shouldn't have linked to a twitter thread :).

You shouldn't use alg none unless you have some other way of protecting the contents of your JWT (like, say, network isolation) and you have verified the performance impact of signing a JWT is worth the possible security impact.

Not too many folks are in this situation, so in general, sign your JWTs!

<comment><USER8> I don't quite get why it got down-voted. But if you are the author of the site, perhaps extend the list with more past vulnerabilities?

<comment><USER10> Ah, thanks. I'm not the author of the site, just someone with the same mindset.

</comment></comment></comment></comment><comment><USER11> The domain name isn't spelled in full. /s</comment>


Artificial Intelligence Has a 'Sea of Dudes' Problem - <AUTHOR> https://www.bloomberg.com/news/articles/2016-06-23/artificial-intelligence-has-a-sea-of-dudes-problem <comment><USER2> Hilarious. The nyt accused AI researchers of being white, which is preposterous. (Maybe they aren't black but many are Asian)

Now it is true they trend male. Particularly true if they are not white.

</comment><comment><USER3> The bias against men in this article is staggering.

<comment><USER4> There is a bias in AI systems that stems from them being written almost mostly by (white) men.

That just pointing this out, yields this knee-jerk reaction yours is very sad.

There is a an opportunity here to make a global society where computers can serve all of humanity in specific needs of everyone instead of just their creators. Let's not squander it.

<comment><USER5> It's not just pointing it out. "Sea of dudes"? How is that an appropriate and professional way to frame the data?

Swap that out with anything else and you can immediately see the problem. How does "Fashion has a sea of chicks problem" sound?

<comment><USER6> Fashion has a lot of men involved.

They're trying to be edgy. It's not like they said it's a sausage fest.

<comment><USER7> Give it some time, and the random adjective generator that keeps reposting this article will come up with it.

</comment></comment></comment></comment></comment><comment><USER6> Sorry to see these thin skinned boys preventing discussion of a legitimate problem.

There's nothing prejudicial about noting a deficiency or proposing a more fully rounded environment.

<comment><USER5> How about you start with not assuming everyone who disagrees with you is male. Then not call grown men "boys". It's super offensive and doesn't help the point you're trying to make.

</comment></comment><comment><USER8> The term 'dude' is unisex and can be used to refer to either of the two genders.

</comment><comment><USER9> moving my brilliant comment from dup thread: Really gets to the nature of what we mean by the term "intellgence". It's _gender_ specific. A lot of times in AI you'll hear people talk about a no gender robot thinking for itself. But we have no examples of genderless intellegent humans. intellgence implies gender.

<comment><USER9> and there was a great reply too: "Intelligence is the ability to extract meaning from a mass of input -- but yeah, what makes it meaningful? By definition, it has to be meaningful to a person in some way. While everyone wants good medical data and scientific breakthroughs...yeah, it seems like sooner or later you're going to reach a question which men and women view differently." how can I just move this thread over here?

</comment></comment><comment><USER10> I dont understand - what does a persons sex have to do with it?

I hadn't even noticed, probably because I'm not looking

</comment><comment><USER11> No words.

</comment><comment><USER12> This PC thing that keeps blaming White Men for everything is hilarious.

Maybe there are not data sets made by woman cause woman don't take their time to contribute to them? But of course that's men fault... white men fault as usual.

<comment><USER4> Why with the thin skin ? This particular problem isn't about "men's fault", it's primarily about bias.

To make a very blunt argument: If you were to write _an AI_ to reason about menstruation, and let a group of women train it then you would get a particularity different outcome than if a group of only men did it.

This argument extends to many other topics on different levels of subtlety.

... there are of course complex reasons why "women don't take their time to contribute", and to just dismiss that as "This PC thing" is a little short- sighted.

<comment><USER13> Isn't that an extremely sexist view?

Hitler used to talk a lot about "Jewish physics" vs "Aryan physics" as if there's a difference.

I'm just surprised to see extremist talk like that on HN.

<comment><USER4> Sure, why not? Using "You're just like HITLER!" always seems like a sound argument.

> I'm just surprised to see extremist talk like that on HN.

Except you are the extremist here. If your take-away from me saying that women and men have different experiences about life on this planet is that it's just like what HITLER! said, your argument lacks nuance.

</comment></comment></comment></comment><comment><USER14> I wonder if this woman thinks we have a "sea of chicks" problem in elementary education since mostly women are training our _actual_ intelligence.

</comment><comment><USER5> So the people who created the field are nothing more than "a sea of dudes". What an ignorant and sexist viewpoint. Bloomberg and Microsoft should be ashamed.

We need to stop being ok with racism and sexism against _anyone_. White males included.

<comment><USER4> And as part of that fight against racism and sexism we need to make sure that the AI's we create aren't biased from being created and trained mostly by one particular subset, the referenced "sea of dudes", because that's a pretty good way to perpetuate racism and sexism _by our software_.

I don't see what's so hard about that. And really, as a dude, to be offended because she said "sea of dudes" to mean that the field, which will probably impact the global society in a huge way, is dominated by men, and not as you imply diminish their contribution, is pretty thin skinned.

<comment><USER5> You can't fight sexism and racism by being sexist and racist. It's also not sexist or racist to use the data provided by participants.

<comment><USER4> Except there is no sexism or racism against white men (which I am assuming you mean, please correct me if I am wrong) to be found in this article.

Sexism or racism are societally useful concepts if you include the power dynamics. Without them all that's left is that someone wasn't very nice to you, which really as a grown up you should be able to deal with.

The power dynamic here is that the _software of future_ is created by a majority of white men, who, overall, were the first and last group who were and remain globally in charge.

So to say "uff so many men!" in an office 75% full of white men, is completely different than saying "uff so many black women!" in that same office. Not necessarily because of the numerical, but because of the powerbalance.

To point that out, does in no way mean that each individual man in that office is a terribly racist sexist! It just means that there are biases in the whole setup.

In the same vein it's not "sexist or racist to use the data provided by the participants",but if you're not careful and you let the biases in your reading of the data, that were shaped by your experience as a human on this planet, affect the way your AI is trained (and it's almost impossible to be unbiased in that sense), then the _outcome_ of what you're trying to do might well be.

<comment><USER15> You would never think to say "uff so many right-handed people!" because being right-handed doesn't makes you pre-judge them as flawed and less capable.</comment></comment></comment></comment></comment>


Show HN: Elastic.news – a HN client for people that love HN - <AUTHOR> https://elastic.news/ <comment><AUTHOR> This is the first/alpha release of a new HN reader where I'm trying to solve a lot of the issues I have when reading/following stories on HackerNews. This is a very small subset of the features that I'm working on - but I wanted to get something out to hear what people think.

It's called "Elastic" because I'm a big Elasticsearch fan and much of the backend will be powered by it. This version just uses the regular firebase datastore - but that is temporary.

Please let me know what you think. I'm sure there are many cross- browser/device issues - I only tested on chrome/ff on OSX for this.</comment>


Are we truly ready for cloud gaming? - <AUTHOR> https://medium.com/futuresin/are-we-truly-ready-for-cloud-gaming-462fc58e06d4 <comment><USER2> Not ready for paywalls.</comment>


Bundle Club – Curated essentials for your baby delivered monthly - <AUTHOR> http://bundleclub.net/#about

<comment><USER2> My wife and I just had two kids, about 14 months apart.

The essentials we missed out on must have been unknown unknowns for us. We bought almost all of our clothes second hand (there are thriving brick and mortar stores that sell second hand infant/toddler clothes). Outside of hospital costs the expensive part of having a baby isn't all that expensive, actually.

If I had a service that picked up the things I already paid for, I'd have to repurchase things when we had baby #2. That's not a selling point. (When clothes don't fit, or are incorrect gender, they can be used for credit at used clothes stores.)

<comment><USER3> Can not overemphasize the value of the secondary market. That is a huge cost savings for clothes and also large toys. Garage sales, etc. Why pay $100-200 for a fisher price car when you get a used one for $10?

The only exception I've found are good kiddie pools. Those things hold a surprising amount of value. There are a couple of products out there that are popular for dog baths, so kind of a funny market dynamic.

<comment><USER4> _" Can not overemphasize the value of the secondary market. That is a huge cost savings for clothes and also large toys. Garage sales, etc. Why pay $100-200 for a fisher price car when you get a used one for $10?"_

Wish I could upvote this more than once.

When the first child is on its way (or has arrived), new parents understandably want the best for their baby. Of course, in many cases this translates into "new". After all, unless your parents are pack rats or you've got older siblings who have recently passed through the early stages of child- rearing, who _keeps_ this stuff around?

If rent-to-own stores are the greatest rip-off in consumer America, I think baby stores may be a close second. We spent far more time, energy and money in 'Babies R Us' than I care to remember.

Now when baby #2 arrives, you're a little more seasoned. Jaded, even. Hand-me- downs are definitely an option, and you likely no longer have the budget to buy all-new again. Yard sales can be your friend, and you'll be surprised how many used items can be like-new or restored to like-new condition and still be safe and clean for use by the new arrival.

Edit: regarding Bundle Club -- the whole purpose of this thread -- I think that it _may_ be useful to first-time parents without an available support mechanism (family & friends) in their area. Existing parents are full of knowledge of what you need (usually due to an experience of not having it on hand), so if they aren't accessible perhaps a 'curated' experience _may_ be able to fill some of the gaps.

<comment><USER2> When we were about to have our first we went to Babies R Us, and had to sit through some "new parent" training nonsense with a few other couples for a 25% off coupon. I thought at the time "25% off, okay I can endure 15 minutes." It wasn't worth the time. What I learned from that experience was that they were desperately trying to sell us a bunch of expensive crap we didn't need.

I think if they didn't try so hard its likely we would've bought a lot of baby stuff from them. Because of that experience we went to second hand stores where the employees left us alone and answered questions when we had them.

</comment></comment></comment></comment><comment><USER5> If the owners are here, I would modify this sentence.

HELP US GET AHEAD IN THE WOMEN WHO TECH CHALLENGE

I would quote or italicize "Women Who Tech". It is a hard sentence to read without that.

</comment><comment><USER6> Bundle club - because babies aren't expensive enough without a middleman markup

<comment><USER7> I don't know man, I wouldn't knock it that hard.

This is like a Loot Crate (www.lootcrate.com) for your baby. No sillier than that idea, and you could buy yourself that nerdy stuff too.

I think the idea is great and something we might have done, or might sign up friends for as a gift.

I am especially happy with them collecting stuff back and refurb/donating it. That's a nice addition.

</comment></comment><comment><USER8> If I understand this correctly, it's a great idea. Can anyone comment if this is a new idea or are similar things available?

Someone has likened this to Loot Crate (a 'consumerism-as-a-service'/we send you things every month deal), but my impression is different: it's about RENTING the non-disposable items your child needs. Bottles, clothes, toys, car seats, age-appropriate toys, etc.

As I see it, you have you currently have two options:

1\. Purchase nice new things for baby and then dispose of them when you don't need them. Expensive. 2\. Trawl charity shops, eBay, etc. for second-hand bargains. Time consuming.

This provides a third option that will ideally be between the two price-wise, and add extra convenience and assurance (promises to quality-check and sterilise everything before sending it back out) over DIY second-hand. Is this about right?

Additional opportunities could include: * Up-selling consumables - they could deliver nappies/formula * Product testing - partner with manufacturers to get stock for free/cheap in return for evaluating their products. (Not sure how valuable or practical this is in practice.)

<comment><USER9> "As I see it, you have you currently have two options:"

My wife and I have a 2 year old and we did #1 till we were broke. We're having another in June and have used FreeCycle and friends this time around. We have far more useful items this time around and have spent nothing.

New parents are scared and research and buy everything. Smart parents borrow and inherit. We have gotten some amazingly (expensive) and useful items on FreeCycle (including all the baby room furniture. We'll be passing it along when we are done as well).

No offense to the creator. But as a parent of young kid(s), this makes me cringe. I think clutter-crate might be a better name.

<comment><USER8> So do you think you might have been a good target for this service? As a new parent, would it have allayed your concerns and been an acceptable alternative to new items? And as a smart parent would this be sufficiently more convenient than sourcing things yourself?

<comment><USER9> My wife spent a stupid amount of time researching everything and then finding the absolute best price (which is like saying you are a savvy lamborghini consumer). So as new parents, I doubt we'd consider it (tho my wife did do a trial of some curated eco-toys... we did not sign up and we did not find it useful).

So I would say no. We actually dread parties and holidays as it brings a huge influx in new toys that our daughter will likely never use or clothes she will outgrow in a few weeks and/or never wear.

</comment></comment></comment></comment><comment><USER10> Isn't "little known" and "necessity" contradictory? If both were true, then we'd have a lot of dead babies on our hands.

</comment><comment><USER11> Hooray for everything being "curated" these days.

<comment><USER12> Indeed. I'm going to propose CURATE as a synonym for SELECT in the next SQL standard.

</comment></comment><comment><USER13> I wish they had posted this to HN after it was available...I want it now! This project still appears to be in its infancy.

</comment><comment><USER14> I think you would need to be able to tailor the bundle to your specific baby's requirements? For example, our baby can't have antiseptic creams, so sudocrem (which is very common), would be useless for us.

</comment><comment><USER15> Pricing would be helpful.

<comment><USER16> Pricing AND country would be helpful. I guess it's probably US only- but it would be handy if it specifically stated _where_ it's available. UK?</comment></comment>


Anyone use a VR headset for dev work? - <AUTHOR> When it comes to development, for me, the more screen real estate, the better/more productive I am (to a point).
I was thinking, rather than a wall of monitors, some VR experience with a virtual desktop (with a screen as big as I want) would be the ultimate solution.
Does anything like this exist? Would it work?
I saw "Virtual Desktop" on Steam, but it just looks like a regular screen output within a VR "space". I suppose the limitation will be the maximum resolution your GPU can output. Has anyone tried/experimented with this? <comment><USER2> Yes - I have a health condition that means I struggle to stay in a sitting position for longer than 4 hours, so I use Oculus Rift and Virtual desktop on the bed, with a split keyboard.

It's "ok" and is quite fiddly to setup with the sensors etc, I'm thinking if replacing the whole thing with a projector,

The hardware is good, it's the software that's lacking, but it's very close!

Anyone with suggestions on alternative setups would be much appreciated!

</comment><comment><USER3> It's an interesting idea but I don't recommend it with current headset. I work on a VR startup but truthfully speaking the technology isn't ready for everyday use yet.

The current generation of the headset isn't ready for long term use yet, maybe when the next generation of headset come out. Reading text on the current headsets (Oculus/HTC) can give you some serious headaches and eye strain. I'd wait until next generation come out before trying.

Though one thing that VR is really good for is A/B testing designs and visualizing data.

</comment><comment><USER4> You'd be looking for BigScreen rather than Virtual Desktop for your use-case.

Having said that, echoing other commenters - the resolution isn't there yet. Maybe have a look at the just-announced 8k headset - [https://www.kickstarter.com/projects/pimax8kvr/pimax-the- wor...](https://www.kickstarter.com/projects/pimax8kvr/pimax-the-worlds- first-8k-vr-headset) \- which claims better text definition.

</comment><comment><USER5> A bit of a hack, but I came across this a while back:

[http://www.deepelement.com/article/gearvr-remote- desktop](http://www.deepelement.com/article/gearvr-remote-desktop)

</comment><comment><USER6> I tried, I couldn't see any text at all.

I used oculus dk2, the resolution is too low for any serious work.</comment>


Reddit bans more than 2k communities - <AUTHOR> https://www.theverge.com/2020/6/29/21304947/reddit-ban-subreddits-the-donald-chapo-trap-house-new-content-policy-rules <comment> tech-historian Current title: "Reddit bans r/The_Donald and r/ChapoTrapHouse as part of a major expansion of its rules"</comment>


Gmail gets IMAP - <AUTHOR> http://www.downloadsquad.com/2007/10/23/gmail-gets-imap/ <comment><USER2> I don't seem to have the setting enabled, but I'm guessing it's just a matter of time. This is going to be great. I wonder how much the iPhone had to do with this.

<comment><USER3> I noticed that the iPhone is the only mobile device listed on the support page.

OTOH, if Googlers are forced to use Gmail internally, I'm not sure how they lived this long without IMAP.</comment></comment>


Web Analytics 2.0? I am more worried about Web Analytics 3.0! - <AUTHOR> http://news.adversitement.nl/newsitems/index/category:popular/newsitem:62

<comment><USER2> This is a "I loved Country before Country was popular" feeling. Industries get a new buzzword every few years and if you don't adopt the buzzword you look out of date. I didn't really want to adopt "Web 2.0" for my product but I had to if I wanted to get free advertising on blogs. I don't care about "Web 2.0" other then it's marketing potencial.

I take whatever best ideas there are from a trend and implement them, but it is just part of a focus on incremental improvement (because there is no such thing as "done".)</comment>


Chris Sacca Asked for Advice on Twitter - <AUTHOR> https://www.entrepreneur.com/article/291040 <comment><USER2> How is this news?</comment>


Ask HN: What's missing in Porn sites? - <AUTHOR>

I'm regularly irritated by the consistent use of 90's era web design in porn sites.<p>What bothers everyone else? <comment><USER2> Because it's easy and it works.

I'm going to go out on a limb here and suggest that people don't go to porn sites to marvel at the design.

<comment><USER3> I think you're right. People probably go to read the dirty CSS.

</comment></comment><comment><USER4> Nobody else seems to be bothered by it.

I don't believe porn site owners really aspire to have cutting-edge designs on their sites.

</comment><comment><USER5> What bothers me? All male porn stars. Most female porn stars.</comment>


IBM: The 'next big thing' no longer exists (2006) - <AUTHOR> http://www.cnet.com/news/ibm-the-next-big-thing-no-longer-exists/ <comment><USER2> This post has a provocative headline, but I don't see anything of substance here. For example: "The fact is that innovation was a little different in the 20th century. It's not easy (now) to come up with greater and different things," IBM exec Nicholas Donofrio said.

Apple introduced the iPhone in 2007, one year later.</comment>


YSlow-er? New YSlow! - <AUTHOR> http://www.phpied.com/yslow-er/ <comment><USER2> Is it just me or does this page crash firefox whenever you open it?

<comment><USER3> works for me (ff2 on fedora)

</comment></comment><comment><USER2> well i had to use lynx to read the article, but this is a great step up for yslow. That and firebug are my two most essential web development extensions.</comment>


International Space Station Infected With USB Stick Malware - <AUTHOR> http://www.ibtimes.co.uk/articles/521246/20131111/international-space-station-infected-malware-russian-astronaut.htm <comment><USER2> ISS had a documented infection from W32.Gammima.AG worm in 2008 from the Russian segment, back when they were running Windows.

[http://www.extremetech.com/extreme/155392-international- spac...](http://www.extremetech.com/extreme/155392-international-space- station-switches-from-windows-to-linux-for-improved-reliability)

Kaspersky never specifically claims a recent or Stuxnet infection of the ISS, just of a power plant, so he's probably referring to the above as an example of air gap not being enough to prevent attacks.

The commercial laptops (originally running Win98, then NT, then XP, now moving to Debian 6) are used for normal computing and interfacing with segment control. The segment computers (60+) which actually run the station are heterogeneous and bespoke aerospace-heritage hardware and software. The Russian side and American side especially are very different and almost entirely independent. Pretty darn sure there's no Siemens systems running up there, so Stuxnet wouldn't be a problem.

The embedded systems are probably not all that hardened, but they are not widely-distributed (to say the least) and are hard to get to, so it would be awful hard to target them. Possible, but mostly through attacking the developers on the ground, I should think.

</comment><comment><USER3> As almost everyone reading this knows, software is going to "eat the world" \-- to quote Marc Andreessen.[1]

The corollary to that prediction: wherever one finds software, one will also find bugs and malware.

So, bugs and malware everywhere -- in our phones, TVs, ovens, vehicles, factories... and space stations.

\--

[1] [http://online.wsj.com/news/articles/SB1000142405311190348090...](http://online.wsj.com/news/articles/SB10001424053111903480904576512250915629460)

<comment><USER4> This is not unlike how where there's biological life, there's parasites and viruses.

<comment><USER5> Moreover, everything has evolved to the point where we can't live without some "parasites" \- see gut bacteria.

Perhaps some sort of a similar homeostasis will also be reached by software.

<comment><USER6> Sure, I can see a few ways of this happening:

1) A virus provides some additional benefit. For example, if a virus' first stage acts as a sort of installer and pulls in some additional libraries for use, at some point of public infection rate there's a pretty good chance those libraries are available to anyone targeting programming for those systems. This becomes more feasible if AV cleaned the infectious and malicious portion while leaving libraries. Imagine, every system has libpcap one it...

2) Viruses start opening previously locked down portions of the OS to achieve their goals, and developers start taking advantage of these opening to extract more value for what they provide (in fact, being somewhat malicious themselves). This is already the case to some small degree with browser exploits. Keygen utilities that install malware seem to fit this somewhat.

This all presupposes a much more computer integrated and yet less computer aware society, which is where I think we are heading. More and more items have integrated computers and operating systems, yet we are much less aware of when this is the case (of course certain groups, such HN regulars, are more likely to be a aware of these items).

Edit: Here's a sample scenario for you: You turn on your new computer and attempt to use it to watch videos on your favorite site, but it doesn't work. You try again tomorrow and it does. What happened is that between then and now, a virus has infected your system and installed a hacked divx codec and made some changes in your browser to redirect you to some specific sites often. The author gets information about your system far beyond what is normally allowed, and you get access to videos as you normally did (possibly illegally).

<comment><USER7> It seems illogical to discuss possible benefits of real malware.

I work as a malware and enterprise security analyst, and I can certainly see no current or future benefits to malware. I think the "cons" of them harvesting your email, banking, and social networking credentials, abusing your system resources to spam and DoS, and siphoning important information from your hard drive to a remote server certainly outweigh any incidental benefits that may occur.

<comment><USER6> Of course. I made no argument towards it being beneficial, just scenarios in which we could _possibly_ come to a homeostatic situation with malware, and as I note it assumes a fairly different software ecology than today. Imagine a world more in the vein of classic Neal Stephenson or Charles Stross as a prerequisite, if that helps.

Edit: s/Stephens/Stephenson/, + classic

</comment></comment></comment></comment></comment></comment><comment><USER8> Warning:

This link auto-plays a video with sound enabled for me (about Snowden, in the upper right corner, totally unrelated to the fine article about the ISS).

<comment><USER9> And the page also pops up a giant like button every few minutes.

<comment><USER10> [https://web.archive.org/web/20131111162541/http://www.ibtime...](https://web.archive.org/web/20131111162541/http://www.ibtimes.co.uk/articles/521246/20131111/international- space-station-infected-malware-russian-astronaut.htm)

This doesn't do either.

</comment></comment></comment><comment><USER11> "As these systems are based on Linux, they are open to infection."

Edit: This part seems to have been removed.

<comment><USER12> I don't see what the fuss is all about. They are open to infection. They're built on linux, rather than an entirely custom system. So they're vulnerable to existing malware floating around.

<comment><USER13> Custom systems would also be "open to infection". It just probably wouldn't be very likely.

It is very difficult to not read a strong implication into that line. If nothing else, then the line is useless and states nothing at all.

</comment></comment></comment><comment><USER14> Now that's an air gap.

<comment><USER15> Is it technically 'air' when it's that far out?

<comment><USER16> Well, there's still the atmosphere between us.

</comment></comment></comment><comment><USER17> <quote>Expensive

Kaspersky told the Press Club that creating malware like Stuxnet, Gauss, Flame and Red October is a highly complex process which would cost up to $10 million to develop.</quote>

really, 10mi to disable one strategic facility (or maybe N facilities) is expensive? that is probably the cost of a dozen smart bombs. And you can use the digital counterpart much more stealthily.

Sounds like a bargain.

</comment><comment><USER18> >Kaspersky revealed that Russian astronauts carried a removable device into space which infected systems on the space station. He did not elaborate on the impact of the infection on operations of the International Space Station (ISS).

>Kaspersky said he had been told that from time to time there were "virus epidemics" on the station.

Given the total lack of supporting evidence here, I'm going to stick a big ol' [citation needed] sticker on this.

<comment><USER19> It's not controversial. A tiny bit of web searching would have turned up reliable sources. here's one from a while ago. [http://www.zdnet.com/blog/security/malware-detected-at- the-i...](http://www.zdnet.com/blog/security/malware-detected-at-the- international-space-station/1806)

It's even been on HN before.

[https://news.ycombinator.com/item?id=5770145](https://news.ycombinator.com/item?id=5770145)

EDIT: Sorry! This is really grumpy.

<comment><USER18> Thanks for the references (and no worries on the "grumpiness" :) ) but I still don't think this qualifies as an "epidemic", to use Kaspersky's wording.

</comment></comment></comment><comment><USER20> s/'these systems are based on Linux'/'attackers have physical access'/g

</comment><comment><USER21> Hasn't this news already been released? I'm sure I recall seeing it somewhere before? Or has it happened yet again?

<comment><USER22> Yes, I was thinking perhaps this was trying to get the Kaspersky name out there in front of people when they are renewing their anti-virus packages. Since a lot of students end up with computers at Chrismtas time, it seems there is a renewal hump at the same time. It seems to correlate with people who make such systems trying to get into the press about how aware/good/active they are. It looks like a great example of a self organizing system :-)

</comment></comment><comment><USER23> [http://en.wikipedia.org/wiki/Stuxnet](http://en.wikipedia.org/wiki/Stuxnet) Seams to me that Stuxnet infects Windows and SCADA (wich i guees might be linux powered, not that it matters ).

<comment><USER24> scada controller (runs on windows as app) not the scada device (controlled by windows app)

<comment><USER25> What do you talk about? Stuxnet eventually deploys the native infected code for non-Windows PLC device, Windows is just a carrier not the final target:

[http://antivirus.about.com/od/virusdescriptions/p/Stuxnet- Wo...](http://antivirus.about.com/od/virusdescriptions/p/Stuxnet-Worm.htm)

"the Stuxnet worm incorporates several sophisticated means of propagation with the goal of eventually reaching and infecting STEP 7 project files used to program the PLC devices.

For initial propagation purposes, the worm targets computers running the Windows operating systems. However, the PLC itself is not a Windows-based system but rather a proprietary machine-language device."

</comment></comment></comment><comment><USER26> Lucky it wasn't the cryptolocker virus. Can't exactly connect to the net from up there to pay the people.

</comment><comment><USER27> Is this "news" being passed-off as a current event? This happened _at least_ 2 years ago.

</comment><comment><USER28> this is why on Galactica all of their computer systems were completely disconnected from each other.

</comment><comment><USER29> "As these systems are based on human creations, they are open to infection."

FTFY.

</comment><comment><USER30> interesting because a common suggestion for increasing the security of a sensitive system is to maintain an "air gap". they have an "off-the-planet gap" and they still got compromised.

<comment><USER31> They also had a constant radio connection with the station, which is the opposite of an "air gap".</comment></comment>


CI/CD: How to Build an Effective Initial Deployment Pipeline - <AUTHOR> https://www.toptal.com/devops/effective-ci-cd-deployment-pipeline <comment><AUTHOR> I hope this makes your MVP deploys faster!</comment>


AirHadoop – "AirBnb" for Hadoop Clusters - <AUTHOR> http://www.opendatascience.com/blog/airhadoop-airbnb-for-hadoop-clusters/ <comment><USER2> As a business owner, I have to question the reliability (who do I call if there are technical issues) and the potential for data leaks and privacy issues.</comment>


Seattle Is Dying - <AUTHOR> https://www.youtube.com/watch?v=bpAi70WWBlw <comment><USER2> There should be a healthy caveat attached to this one. This was produced and presented by Sinclair broadcast group[1]. Whose devotion to promulgating conservative interests is almost unparalleled. And while some valid points are mixed into this documentary, there is a whole lot of mitigating information left out[2] the better to create outrage.

[1] [https://en.wikipedia.org/wiki/Sinclair_Broadcast_Group](https://en.wikipedia.org/wiki/Sinclair_Broadcast_Group)

[2] [https://www.thestranger.com/slog/2019/03/18/39630856/komos-s...](https://www.thestranger.com/slog/2019/03/18/39630856/komos- seattle-is-dying-news-special-is-killing-me)</comment>


Creating art using only circles in CSS - <AUTHOR> http://www.youtube.com/watch?v=ztwSAZ7lJg8

<comment> codepo8-hn This is pretty cool, especially as he only used the developer tools. The final product is here: [http://afranoubarzadeh.se/cssart.html](http://afranoubarzadeh.se/cssart.html)</comment>


Why a great individual is better than a good team - <AUTHOR> http://blogs.hbr.org/cs/2011/06/why_a_great_individual_is_bett.html?cm_sp=most_widget-_-blog_posts-_-Why%20a%20Great%20Individual%20Is%20Better%20Than%20a%20Good%20Team

<comment><USER2> I made the decision to work in small, preferably very small, teams 20 years ago. Why? Because I noticed that the very small teams I worked with were far, far more productive than the bigger teams.

I also learned at that time, empirically, that "flying in" domain experts for certain problems was far, far more effective than having them hang around on the project. And this is how I've liked to work with my clients ever since.

Taking this a stage further, I decided to study individual effectiveness on teams by writing a thesis on it (for my Masters) by studying a small number of projects in quite a large company. (I am very grateful to that company, and a particular individual, whom I still know, for letting me run riot in their IT department for a summer to conduct this study.)

The result I obtained was absolutely clear that productivity is linked to individuals. I used function points as the basis for the study, and while I'm not wedded to them in any way, I've yet to find a better metric. I'm not active in that field any longer, so please enlighten me of progress.

The maxim "hire smart people and get out of their way" is the best way to be productive in IT. Better still, practice servant leadership alongside <http://en.wikipedia.org/wiki/Servant_leadership> and you are golden.

It's hellishly difficult getting businesses to adopt this practice, though. When you are all command and control this doesn't tickle your pseudo alpha genes. But when you want to get work done, it's the nuts.

</comment><comment><USER3> I'm never able to understand why businesses cannot accept this fact and incorporate it into project management. It seems that they'd rather throw 20 average engineers (using average technology) at a problem and just spend more money and time on all sorts of official-looking artifacts such as meetings and design documents. They often strike me as signalling devices to show that responsibility for the problem is being distributed among everyone in case something goes awry. They're certainly necessary, but they're almost always done to excess. Really, the heavy emphasis on 'collaboration' always seems hellbent on forcing ideas to fit some safe notion on how things should be done instead of just trusting individuals to figure it out for their own.

What's the motive here? Fear? If so, why do we allow people in charge to project this?

</comment><comment><USER4> I know they are talking about businesses and everything here, but let me throw a wrench into that entire theory.

2010 San Francisco Giants.

<comment><USER5> When teams gel and you get a synergistic effect, it's an awe-inspiring thing. Humility is often the key ingredient. Contrast the 2011 Mavs with the 2011 Heat. The individual team members must be humble else hubris and competing egos will drag them down.

Hubris leads to overreaching and taking uncalculated risks (<http://www.charlierose.com/view/interview/10565>), and I believe this is far more common when individuals are part of a team than whey they are working alone because teams provide a safety net and outlet for passing the buck. Individuals working alone don't have these outs, and this helps keep them in check.

Another aspect to this is if an individual has the freedom to flow in any direction and is not bound by constraints imposed by the group, then the individual has the freedom to tap into and include their best ideas in the project without having to pass them by a committee. This reduces context switches, allows them to flow faster and better maximize their potential.

In addition, when a corporation hires someone with a specific task in mind, they may only see a sliver of the individual's potential because the latent parts aren't relevant to the job description. Contrast this to an entrepreneur that puts his heart and soul and every fiber of his being into realizing his vision. This environment is maximizing his potential because he is summoning all his best parts. When all of that energy is harnessed and focused, the individual is much more valuable.

<comment><USER4> Another good example!

</comment></comment></comment><comment><USER6> As much as the hypothesis in the title appeals to me, I don't think there's anything in the article to substantiate it. The whole thing is a repetitive pattern of {cite some scientific finding}, {blindly assert that the same (or, at some point, the inverse!) applies to this unrelated subject}. Bleh.</comment>


Free Business Consulting Logo Designs - <AUTHOR> http://www.designimo.com/create-logo/business-consulting

<comment><AUTHOR> You can download vector files on the fly.</comment>


Is the Only Way to Make Housing Affordable by De-Commodifying It? - <AUTHOR> https://www.eastbayexpress.com/oakland/is-the-only-way-to-make-housing-affordable-by-de-commodifying-it/Content?oid=20312922 <comment><USER2> Why is it everyone thinks they are entitled to own a home or even live in a city of their choosing? I made the choice to move away from the Vancouver area so that I could have a roof over my head, but I don't resent high housing costs, I could have saved my money, not wasted it on cell phones vacations, fancy cars, eating out, going to movies and made many other lifestyle choices that would have allowed me to live in Vancouver and or own a home. I took public transit the other day and was shocked by the number of 500 dollar plus valued cell phones people were using, yet these same people whine about the cost of transit and the price of housing. If you don't like the costs move and they will come down, stuck in a city because of your job? Find a new one and if enough people do that guess what the costs will come down to match the demand.</comment>


T-Mobile Might Ditch 2-Year Contract Requirement, Others May Follow - <AUTHOR> http://denver.cbslocal.com/2013/03/04/t-mobile-might-ditch-2-year-contract-requirement-others-may-follow/

<comment><USER2> I hope so... With the Nexus 4 and the Walmart iPhone payment plans, you can do much better than locking yourself into 2 years and $1k extra in payments.</comment>


Elemental Haiku - <AUTHOR> http://vis.sciencemag.org/chemhaiku/ <comment><USER2> My Fav is Neon :

There's no shame in it. Advertising pays the bills. Stop looking so red.</comment>


Hajime: A follow-up - <AUTHOR> https://x86.re/blog/hajime-a-follow-up/ <comment><USER2> TFA included this interesting link, about the multiple backdoor passwords in Arris cable modems: [https://w00tsec.blogspot.com/2015/11/arris-cable-modem- has-b...](https://w00tsec.blogspot.com/2015/11/arris-cable-modem-has-backdoor- in.html)</comment>


Idea Buddy | Give one idea, get ten. - <AUTHOR> http://idea-buddy.com <comment><AUTHOR> Give 1 idea, get 10 back.

*Idea Buddy made it to the top 10 on product hunt last week. check it out at [https://www.producthunt.com/tech/idea-buddy](https://www.producthunt.com/tech/idea-buddy)

I was inspired by Seth Godin's Alternative MBA and the thousand or so ideas one of the teams came up with. The takeaway is that the execution is more important than the idea itself, so here's a public repository of ideas. Use it for inspiration, or testing your ideas on other people anonymously. See which of your ideas got the most love, or the most hate.

This is part of my attempt to launch 4 products in 4 weeks. This is the first!

</comment><comment><USER2> No Facebook. Can not use.

<comment><AUTHOR> sorry about that, I've heard that quite a bit, I will likely add a twitter option.</comment></comment>


Ask HN: What stories would you suggest a tech-editor write? - <AUTHOR>

We "bitch & moan" at the level of technical stories written but given the chance, what tech articles would you like to read? <comment><USER2> * Why Google Checkout has so much fraud/chargebacks yet no one says anything

* Why is Firefox 3 getting so much press when it is so buggy?</comment>