Getting Crazy with Windows Subsystem for Linux - <AUTHOR> https://brianketelsen.com/getting-crazy-with-windows-subsystem-for-linux/?utm=none-hn-bketelsen <comment><USER2> Going down a different containerized route, if you use Docker for this you won't even need a separate WSL installation for each project but you'll still get your own container based isolation with an "open terminal and start coding!" work flow.

WSL plays nicely with Docker for Windows[0].

At this point Windows running Docker connected through WSL offers me a more productive Linux development environment than running Linux natively (mainly because certain apps I depend on don't run on Linux).

I've been running this set up for months and it's super solid.

[0]: [https://nickjanetakis.com/blog/setting-up-docker-for- windows...](https://nickjanetakis.com/blog/setting-up-docker-for-windows-and- wsl-to-work-flawlessly)

<comment><AUTHOR> I really like your blog layout/theme. Clean and readable. Have you tried mounting code from WSL into a docker container and using vim/emacs in a shell in docker?

<comment><USER2> Thanks for the kind words about the blog layout.

I keep my source code outside of WSL's file system because I don't trust it yet.

It's then mounted into WSL and Docker for Windows. Docker volume mounts work fine with that set up.

I don't use vim/emacs but running them straight in WSL should be fine. I wouldn't think to run vim/emacs directly inside of the container (because I try to adhere to the "1 container, 1 process" best practice) but in theory it would work no problem.

In this WSL set up article[0] I go over installing Sublime Text within WSL and using MobaXterm as an X server. It runs lightning fast.

[0]: [https://nickjanetakis.com/blog/using-wsl-and-mobaxterm-to- cr...](https://nickjanetakis.com/blog/using-wsl-and-mobaxterm-to-create-a- linux-dev-environment-on-windows)

</comment></comment></comment><comment><USER3> Is it just me or should it have been named the other way around? This is a Linux Subsystem for Windows (just like there is/was a POSIX subsystem for Windows).

I thought this was an official WINE-like layer for Linux.

<comment><USER4> I see what you mean and understand the confusion. Though I think it is called what it is because it is a distinct _Windows subsystem_ , with various kernel drivers and modules, that are _for_ Linux processes. The substytem is still Windows (using Pico providers and processes), and so it is therefore not a "Linux Subsystem".

</comment></comment><comment><USER5> Has WSL gotten more stable? I found it unusable when it first came out.

<comment><AUTHOR> OP here (disclaimer, I work for Microsoft, but I'm a Linux and Mac guy on the Azure team). Yes, it really has. Originally many things didn't work, node, redis, others wouldn't even run. Now I can't find anything that won't run at all and my only complaint overall is that disk IO is a little slower than on the Windows side of things. Overall it's really nice. Zero changes to my Ubuntu dotfiles.

<comment><USER6> nmap doesn't work, as one example.

<comment><USER7> It's also quite special as it needs raw socket access (doesn't it work in connect() mode though?), it is on the backlog though as I understand.

Other things that won't work are fuse and VPN's and loading arbitrary kernel drivers (it's surprising how many people don't seem to get that it only implements userland compatibility)

</comment></comment></comment></comment><comment><USER8> I love WSL, but really want GPU passthrough support in the future.

<comment><USER9> The trouble is: it's not a VM, so what you are asking for is not _passthrough_ , but _driver_ support.</comment></comment>


Codes are machines, not poems! - <AUTHOR> http://www.avsaro.com/codes-are-machines-not-poems/

<comment><USER2> Design and copy are poetic. Code and data are scientific. Just my opinion...</comment>


Asthma inhalers' carbon footprint 'as big as eating meat' - <AUTHOR> https://www.bbc.com/news/health-50215011 <comment><USER2> While I don't agree with the "climate change isn't real" crowd I can sympathize with them when they point out that there's a constant inflow of contrary evidence. It's easy, and fair, to respond with "well last week you said emissions were made up of this, and now here's something completely and substantially different". Not sure how to fix it but it does seem to be a problem.

<comment><AUTHOR> I can't argue with your broader point, but as for "well last week you said": there are large amounts of various greenhouse gasses being added to the atmosphere; nobody has identified all all the sources but there is continual work on reducing the amount of "unknown". So it's not like this result discounts any other study or claim.

<comment><USER2> My point of aggravation is that there's no good way of measuring it, at least not right now. If there were more targeted, absolute actions could/should be taken.</comment></comment></comment>


Daylight saving time could end in California - <AUTHOR> http://www.sacbee.com/news/politics-government/capitol-alert/article62292437.html <comment><USER2> Good idea. I wouldn't mind it so much if it were only half the year, but now it's almost eight months long.

</comment><comment><USER3> This is a ridiculous concept because California, by practice and in keeping with national standards, has _already been in violation of its own Constitution for decades_ in this regard.

The Constitution defines DST as from the "last Sunday in April until last Sunday in September", which, if obeyed, would already put CA with different effective dates from the rest of North America.</comment>


Growth Hacking For Startups - <AUTHOR> http://www.slideshare.net/mattangriffel/growth-hacking

<comment><USER2> Nice guide.</comment>


Buffett Reminds His Top Managers: Reputation Is Everything - <AUTHOR> http://blogs.wsj.com/moneybeat/2014/12/19/buffett-reminds-his-top-managers-reputation-is-everything/ <comment><USER2> Note: this biennial letter follows, nearly word-for-word, the format of letters from previous years, with updates to the various statistics (for example, number of employees). Mr. Buffett included the 2010 letter in that year's annual Shareholder Letter: [http://www.berkshirehathaway.com/letters/2010ltr.pdf](http://www.berkshirehathaway.com/letters/2010ltr.pdf) (via: [http://www.berkshirehathaway.com/letters/letters.html](http://www.berkshirehathaway.com/letters/letters.html))

</comment><comment><USER2> Text of the memo:

Memo

To: Berkshire Hathaway Managers ("The All-Stars")

cc: Berkshire Directors

From: Warren E. Buffett

Date: December 19, 2014

This is my biennial letter to reemphasize Berkshire's top priority and to get your help on succession planning (yours, not mine!).

The top priority–trumping everything else, including profits–is that all of us continue to zealously guard Berkshire's reputation. We can't be perfect but we can try to be. As I've said in these memos for more than 25 years: "We can afford to lose money – even a lot of money. But we can't afford to lose reputation – even a shred of reputation." We _must_ continue to measure every act against not only what is legal but also what we would be happy to have written about on the front page of a national newspaper in an article written by an unfriendly but intelligent reporter.

Sometimes your associates will say "Everybody else is doing it." This rationale is almost always a bad one if it is the main justification for a business action. It is totally unacceptable when evaluating a moral decision. Whenever somebody offers that phrase as a rationale, in effect they are saying that they can't come up with a good reason. If anyone gives this explanation, tell them to try using it with a reporter or a judge and see how far it gets them.

If you see anything whose propriety or legality causes you to hesitate, be sure to give me a call. However, it's very likely that if a given course of action evokes such hesitation, it's too close to the line and should be abandoned. There's plenty of money to be made in the center of the court. If it's questionable whether some action is close to the line, just assume it is outside and forget it.

As a corollary, let me know promptly if there's any significant bad news. I can handle bad news but I don't like to deal with it after it has festered for awhile. A reluctance to face up immediately to bad news is what turned a problem at Salomon from one that could have easily been disposed of into one that almost caused the demise of a firm with 8,000 employees.

Somebody is doing something today at Berkshire that you and I would be unhappy about if we knew of it. That's inevitable: We now employ more than 330,000 people and the chances of that number getting through the day without any bad behavior occurring is nil. But we can have a huge effect in minimizing such activities by jumping on anything immediately when there is the slightest odor of impropriety. Your attitude on such matters, expressed by behavior as well as words, will be the most important factor in how the culture of your business develops. Culture, more than rule books, determines how an organization behaves.

In other respects, talk to me about what is going on as little or as much as you wish. Each of you does a first-class job of running your operation with your own individual style and you don't need me to help. The only items you need to clear with me are any changes in post-retirement benefits, acquisitions, and any unusually large capital expenditures. But I like to read, so send along anything that you think I may find interesting.

 __ __ __ __ __ __

I need your help in respect to the question of succession. I'm not looking for any of you to retire and I hope you all live to 100. (In Charlie's case, 110.) But just in case you don't, please send me a letter or email giving your recommendation as who should take over tomorrow if you should become incapacitated overnight. These letters will be seen by no one but me unless I'm no longer CEO, in which case my successor will need the information. Please summarize the strengths and weaknesses of your primary candidate as well as any possible alternates you may wish to include. Most of you have participated in this exercise in the past and others have offered your ideas verbally. However, it's important to me to get a periodic update, and now that we have added so many businesses, I need to have your thoughts in writing rather than trying to carry them around in my memory. Of course, there are a few operations that are run by two or more of you – such as the Blumkins, the Merschmans, the pair at Applied Underwriters, etc. – and in these cases, just forget about this item. Your note can be short, informal,handwritten, etc. Just mark it "Personal for Warren."

Thanks for your help on all of this. And thanks for the way you run your businesses. You make my job easy.

WEB/db

P.S. Another minor request: Please turn down all proposals for me to speak, make contributions, intercede with the Gates Foundation, etc. Sometimes these requests for you to act as intermediary will be accompanied by "It can't hurt to ask." It will be easier for both of us if you just say "no." As an added favor, don't suggest that they instead write or call me. Multiply 80 or so businesses by the periodic "I think he'll be interested in this one" and you can understand why it is better to say no firmly and immediately.

<comment><USER3> One interesting thing is WEB isn't interested in succession when "two or more" run a business.

Okay, lots of businesses have rules against multiple key employees traveling in the same plane. But what about the same car? What if they're in the same car and it gets hit by a truck? What if they're eating lunch together and someone "goes postal" in a cafe, like what just happened in Sydney?

I dunno. WEB probably knows 1000x as much about "risks" as I do. But this particular thing just seems a little odd to me.

</comment></comment><comment><USER4> People can point to WEB's investing track record and what a great idea it was to move BH from textiles to insurance to allow him a large pool of zero (or profitable) capital to invest.

At some point investing kind of poops out as the law of large numbers kicks in. However WEB is able to acquire companies that are not otherwise on the market because of his reputation as a manager and the very substantial credibility he has with his track record. Iscar is the latest that comes to mind.

</comment><comment><USER5> The letter mentions "the problem at Salomon" that almost caused the firm to close. Does anyone know what that was?

<comment><USER6> Berkshire Hathaway owned a significant stake of Salomon. A rogue trader at Salomon broke Treasury rules and the CEO didn't discipline him. The U.S. Government threatened to bar Salomon from buying U.S. Government bonds which would have destroyed the bank and maybe Berkshire Hathaway. Buffet stepped in and saved the day.</comment></comment>


How fast is AMP really? - <AUTHOR> https://timkadlec.com/remembers/2018-03-19-how-fast-is-amp-really/ <comment><AUTHOR> If you want to test how fast are AMP pages compared to full pages, check out the AMP Browser Extension: [https://chrome.google.com/webstore/detail/amp- browser-extens...](https://chrome.google.com/webstore/detail/amp-browser- extension/mccnchmofleakpdohkmljohfckgpdehb)

</comment><comment><USER2> You might not realise how much AMP you come across every day.

Your web browsing isn't it at all.

If you are on an Android phone go install NetGuard and take a look at the logs.

There are a few domains that come up for almost every app:

1\. graph.facebook.com

2\. graph.accountkit.com

3\. .crashlytics.com

4\. .ampproject.net

5\. .segment.io

AMP Project is up there. The majority of the apps on my phone now do their content via WebView + AMP.

In this AMP have found their niche.

</comment><comment><USER3> The most infuriating part of AMP for me is that I can't count the number of times I'd read an AMP version of an article, and graphics in it were just plain _missing_ without any heads up. Why newspapers and the like would gimp their own work like that is beyond me.

</comment><comment><USER4> So nowadays 61 requests per page load is considered an _" accelerated"_ page? Might not be so bad with http2 but still wow. Maybe publishers should start working on that number if they want actually faster web pages.

<comment><USER5> It depends on if you pack your data or not, really

With simple development on a moderate website you might have a couple of html resources, a few css files and some js files to fetch, not to mention all the media (images, videos and audio).

It's easily half that just by doing sane development where you split functionality into files and if your site is media rich it's not surprising at all.

</comment></comment><comment><USER6> Do you want to hack into your spouse's phone remotely without touching his or her phone You can hack into any devices to access facebook , whastapp , text mssg , call logs etc to know who they have been talking to and if they're cheating on you remotecyberhacker@ gmail com he's the fastest,reliable and cost-effective you can ever come across cos his name has never been SOILED , in shrot....he's the best working for me . text/call ; + 1 3 4 7 89 93 01 7 whatsapp ; +1 267 52 6 53 4 6

</comment><comment><USER7> i tried to turn these tables into graphs because charts of numbers weren't doing much for me. but i suck at spreadsheets, so i don't know how to label these: [https://docs.google.com/spreadsheets/d/1ZFWiqXesq8SlOZ3uW9Om...](https://docs.google.com/spreadsheets/d/1ZFWiqXesq8SlOZ3uW9OmRdEtPl1k4VG8dHoS47i3tQI/edit?usp=sharing)

(the bars are raw/cached/canonical, and the groups on the X axis are min/max/median/90th)

</comment><comment><USER8> Stopped using AMP.

Created a site in pure AMP. All competitors didn't use AMP then (1 yr ago). My site was the fastest, didn't have any ads, was the lightest, the most beautiful, had the best UX flow.

SEO-wise my site still doesn't list on the keywords which are in H1 and the page title but all the crappy, non-AMP, megabytes big slow-loading, ads-heavy competitor sites are still in the top ten SERP.

Guess that even Google stopped giving AMP sites any special rank power except they are news sites (then you will see them probably in the carousel but only if they are accepted with Google News).

<comment><USER9> Isn't it in Google's best interest to list the ad heavy sites first? They don't receive any commission sending users to your ad free site, but they'll earn 32% of AdSense profits from your competitors.

Now, I don't believe that is actually occurring, but it's one of the many ways that our interests and Google's interests do not align.

</comment></comment><comment><USER10> it's funny how so many people use to ridiculed ColdFusion and Asp.Net WebForms for "re-inventing" and "polluting" HTML with their custom tags and server components respectively. This is exactly what AMP is.

</comment><comment><USER11> The first point in the article is the dead killer of AMP for me. My mobile provider gives me very little monthly data, I've stopped using AMP because preloading the AMP results is eating through my cap, with images disabled.

Without preloading, AMP is slower than the non-AMP version of the same webpage with a simple script blocker. And usually causing more traffic too.

I hope Google refrains from bullying website owners into making the internet a worse experience for people without 1GB+ data plan.

<comment><AUTHOR> No. AMP is much faster even without preloading. Here is an example of a random article on CNN: [https://www.webpagetest.org/video/view.php?id=180402_4583919...](https://www.webpagetest.org/video/view.php?id=180402_4583919a10f9cadcd56a6aacb67e6033c904cd34&data=1)

<comment><USER11> This is not my experience. AMP is consistently slower than normal desktop pages or mobile pages when offered. I've measured this myself on my own phone countless times.

CNN is also probably one of the worst offenders, so the example is rather cherry picked nor does it represent my usual browsing in any way.

</comment></comment></comment><comment><USER12> Heh. This reminds me of a recent pet peeve and observation of mine: progressive web apps are not faster.

The Twitter Lite PWA, arguably the 'flagship' PWA ("developed in partnership with Google"), takes longer to display tweets for me than regular desktop Twitter.com, and the old 'static' mobile twitter site (which loads INSTANTLY[1] you can only get with user agent trickery)

[1] Just did some testing. According to Chrome Dev Tools, old Twitter Mobile displays tweets in 124ms. PWA Twitter takes greater than 1.4s (it stopped recording screenshots), 2s according to a screen recording [https://gfycat.com/PlushThornyIcefish](https://gfycat.com/PlushThornyIcefish)

<comment><USER13> PWAs aren't literally faster — caching aside, they load the same data and it takes the same amount of time over the same connection. But there is a percieved performance boost if the PWA uses caching and preloading intelligently. The first load might take a little longer, loading the first tweets will take just as long, but scrolling through the timeline should be faster and page transitions can be almost instantaneous.

<comment><USER12> Okay so this actually goes straight to the heart of everything that's wrong with the web development communities obsession with PWAs. The technologies behind PWAs are fine, but people need to learn how to properly assess these buzzwords and learn if their suitable for the particular use cases of their site.

The main use case of Twitter is to look at your timeline, yet Twitter Lite somehow screwed that up and made it slower, even on subsequent loads. Not only that, the particular implementation provides arguably a worse experience, doing things like showing three different 'loaders' on the path to the timeline (Twitter icon 'splash screen' (wtf, I thought this was all preached?), spinner for the whole 'app', and then spinner for the timeline).

Reminds me a lot of people's obsession with Webpack and code-splitting - I'm sure a huge majority of projects will find >75% of their JS bundle weight being their dependencies.

</comment></comment></comment><comment><USER14> Don't use AMP... Aweful for everyone involved, except Google.

</comment><comment><USER15> Is it really hard to use the whole of my screen? I'm well aware that modern websites have to scale to lots of different screen sizes. My laptop is a 17" job so why the blazes do I only get to see a block of text using the middle third of it? It looks shit. I'd probably have to peek under the lenses of my specs on a smaller screen. I spend far too much time using CTRL + these days.

<comment><USER16> See [http://bettermotherfuckingwebsite.com/](http://bettermotherfuckingwebsite.com/) for the reasoning behind this trend. Line width, namely the number of characters shown in one, is regarded as a prime factor in readability, which I personally agree with.

</comment></comment><comment><USER17> How fast could google.com be if they trimmed the JS fat?

<comment><AUTHOR> The non-JS version takes 1/3 loading time of the JS version: [http://www.webpagetest.org/result/180402_0J_6a3f29516e9a8bcf...](http://www.webpagetest.org/result/180402_0J_6a3f29516e9a8bcf06484a975136d3b7/) vs [http://www.webpagetest.org/result/180402_Z3_1bd3e53e1be2668c...](http://www.webpagetest.org/result/180402_Z3_1bd3e53e1be2668cb583ba24bdd54c3a/)

<comment><USER17> Thanks. And I have a feeling that it would be much worst (aka better) for a mail.google.com inbox page, even if you keep the useful Javascript. But their javascript is so obfuscated that it is not too easy to test. One time I extracted a simple feature for gmail's javascript... it was fun (probably would be easier for a programmer though)

<comment><USER18> gmail has a basic html mode that is lightning fast.

</comment></comment></comment></comment><comment><USER19> As someone with limited mobile data, not cool, Google. This after Google created a cell carrier for people who use less data (Project Fi) and want per- gb billing.

</comment><comment><USER20> Alternate answer : not as fast as Dan Luu website.

[https://danluu.com/](https://danluu.com/)

<comment><USER21> it's a pain to read it on desktop without reader mode. the width is just too wide.

<comment><USER22> I'd put the blame on crappy user-agents that can't present a readable view by default for a reasonable, semantically marked up document. Arguably that is their raison d'être, and they fail horribly at it.

</comment></comment></comment><comment><USER23> Worth noting that it would be insane to preload content that didn't pass a strict filter akin to that of AMP.

Each Google search would download dozens of MBs and produce a significant CPU workload, both resources being precious on mobile.

Perhaps it was a communication issue: AMP should have been named/marketed "preloadable pages" rather than "fast pages".

<comment><AUTHOR> AMP is not about preloading in the first place. It's about the fast CDN. Let's compare any NYT article in the AMP and standard HTML formats: [https://www.webpagetest.org/video/view.php?id=180402_16d7083...](https://www.webpagetest.org/video/view.php?id=180402_16d708376305a3bcdf0026043845ac4b232d0a17&data=1) \- AMP loads much much faster.

<comment><USER23> Not sure of what does webpagetest is showing evidence of. It could be anything... for one thing, AMP versions are much leaner so naturally they will load fast - even with no dedicated CDN at all.

Cloudflare and Fastly should be more than sufficient CDNs?

Admittedly, maybe the AMP CDN is an easier one to set up for the masses, but other than that I bet they all have about the same performance.

</comment></comment></comment><comment><USER24> Please stop saying "performant" when you mean "fast". If you just mean "fast", say "fast".

</comment><comment><USER25> Maybe just once tell the readers what AMP stands for.

<comment><AUTHOR> AMP stands for Accelerated Mobile Pages.

</comment></comment><comment><USER26> One detail which I feel must be mentioned: if you block `ampproject.org` by default -- directly or by blocking 3rd-party javascript by default, -- you will be "punished" with a 8-second delay before the page becomes visible.

This is an entirely artificial delay, implemented through an inlined style CSS animation in AMP-based pages:

        animation:-amp-start 8s steps(1,end) 0s 1 normal both}
        @keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}

I can't see any good reason for such delay. If you are not aware of this 8s delay, you might be misled into thinking the page is broken and that `ampproject.org` is really needed, while the page renders just fine without it, except for the delay.

Example: [https://ampbyexample.com/](https://ampbyexample.com/)

<comment><USER27> I'd assume that's probably done to prevent FOUC while it's waiting for the JS to load. What do you get if you override that style?

<comment><USER26> If using uBlock Origin, you can try the example page with that cosmetic filter:

        ampbyexample.com##body:style(animation: none !important;)

One thing for sure, the result is much more pleasant than having to wait 8 seconds if one does not want to un-block 3rd-party javascript from `ampproject.org`.

<comment><USER28> I suppose webmasters could add the inline css

       body{animation:none !important;}

On mobile so I haven't had the chance to test

<comment><USER26> I should have included this in my first comment: this is a requirement from AMP to include the animation[1]:

        AMP HTML documents must contain the following boilerplate in their head tag. [...]
        <style amp-boilerplate>body{-webkit-animation: ...

[1] [https://www.ampproject.org/docs/fundamentals/spec/amp- boiler...](https://www.ampproject.org/docs/fundamentals/spec/amp-boilerplate)

</comment></comment></comment></comment></comment><comment><USER29> I think the point of AMP is it gives Google a simple and reliable way to detect fast rendering pages that render well on mobile in a way that can't be easily gamed. When you allow unrestricted usage of JavaScript that's changing page content, loading styles etc. for example, detecting pages like this is more difficult.

You can write performant pages without AMP but how would Google reliably detect pages like this?

I'm not saying AMP is the best solution and I can see why some developers have objections against it but I think I understand what it's trying to do.

<comment><USER30> > I think I understand what it's trying to do.

It's appifying the WWW on Google's domain and allowing them to dictate how sites are monetized. On the most basic level, it isn't motivated by speed.

<comment><USER31> Fast page loads means a better UX on the web.

Better UX on the wide web means people enjoy using Google more. If I'm using Google, it means I want to find something. If Google has encouraged the entire web to be faster, I will find what I'm looking for faster.

People using Google and enjoying it is good for Google.

<comment><USER30> > Fast page loads means a better UX on the web.

Not necessarily. AMP has terrible usability. For people who block 3rd party JS from loading, AMP pages take 8 seconds to load.

AMP will hurt publishers in the long run:

\- giant back button to take users back to Google Search instead of deeper into your site

\- broken referrers

\- bad inbound links (that point to google.com)

\- someone else dictates your monetization strategy

\- someone else limits how you publish online

\- not faster than DIY optimization

\- etc. [https://www.google.com/search?num=100&q=amp+sucks](https://www.google.com/search?num=100&q=amp+sucks)

</comment></comment></comment></comment><comment><USER32> I built a simple bash/javascript to get the AMP URL for a given URL, did reduce my data usage by tons. Look here:

[https://developers.google.com/apis- explorer/?hl=en_US#p/acce...](https://developers.google.com/apis- explorer/?hl=en_US#p/acceleratedmobilepageurl/v1/acceleratedmobilepageurl.ampUrls.batchGet)

       curl -X POST -H "Content-Type: application/json"  -d "{urls: ['$1'] }"
       https://content-acceleratedmobilepageurl.googleapis.com
       /v1/ampUrls:batchGet?key=YOUR_AMP_API_KEY

For android app use:

           public static String GET(String url){
            String result = "";
            String ampString = "https://content-acceleratedmobilepageurl.googleapis.com/v1/ampUrls:batchGet?key=YOUR_AMP_API_KEY";
            HttpURLConnection conn = null;
            try {
                URL ampurl = new URL(ampString);
                conn = (HttpURLConnection) ampurl.openConnection();
                conn.setReadTimeout(10000);
                conn.setConnectTimeout(15000);
                conn.setRequestProperty("Content-Type", "application/json");
                conn.setRequestMethod("POST");
                conn.setDoInput(true);
                conn.setDoOutput(true);

                JSONObject jsonObject = new JSONObject();
                jsonObject.accumulate("urls", url);

                OutputStream os = conn.getOutputStream();
                os.write(jsonObject.toString().getBytes("UTF-8"));
                os.close();

                InputStream istream = null;
                istream = conn.getInputStream();
                InputStream in = new BufferedInputStream(istream);
                if(in != null){
                    result = convertInputStreamToString(in);
                }
            }
            catch (Exception e) {
                Log.d("News exception", result);
            }finally {
                // Close Stream TODO
                // and disconnect HTTPS connection.
                if (conn != null) {
                    conn.disconnect();
                }
            }

        private static String convertInputStreamToString(InputStream inputStream) throws IOException {
            BufferedReader bufferedReader = new BufferedReader( new InputStreamReader(inputStream));
            String line = "";
            String result = "";
            String id = "";
            String ampUrls = "";

            while((line = bufferedReader.readLine()) != null){
                result += line;
            }
            inputStream.close();
            try {
                JSONObject jsonObj = new JSONObject(result);
                // check if jsonObj has ampUrls string - how to do it?

                    if (!jsonObj.isNull("ampUrls")){
                        JSONArray contacts = jsonObj.getJSONArray("ampUrls");
                            for (int i = 0; i < contacts.length(); i++) {
                                JSONObject c = contacts.getJSONObject(i);
                                id = c.getString("cdnAmpUrl");
                                }
                        }

                } catch (JSONException e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
                }
            return id;

        } //end of convertInputStreamToString

<comment><AUTHOR> You can try the AMP Desktop Extension, which uses this API: [https://chrome.google.com/webstore/detail/amp-browser- extens...](https://chrome.google.com/webstore/detail/amp-browser- extension/mccnchmofleakpdohkmljohfckgpdehb)

</comment></comment><comment><USER33> A very low quality article. The _whole point_ of AMP is to define a restricted subset of HTML that is safe to prerender and still provide working analytics to the publisher. When you prerender, the advantage of AMP is substantial as it is impossible to beat a user experience of instant, which is why users prefer it and why publishers go through the trouble of implementing two web versions of their web pages (in addition to Facebook and Apple News non-web versions).

The point of the AMP cache is not for CDN speed, as the author mistakenly believed and measured, but for same-origin or CORS prerender, and Google is not the only implementer.

<comment><USER34> Publishers go through the trouble in order to get the boost in Google's rankings.

As an iOS user I find AMP to be quite buggy, and AMP versions of pages like reddit are borderline non-functional. I don't prefer it at all.

<comment><USER35> It's a trouble of writing template once though and it is not that much work. I worked on this at my previous employer and it was alright, little frustrating but once it was done, it was done until you redesign the pages.

Disc: Googler but nowhere close to AMP.

<comment><USER36> It is absolutely not that simple. We are a marketing company working with hundreds of publishers and this is a constant struggle.

It's splitting whatever little dev time they have on yet another format that adds nothing to the already universally accessible "web" version.

</comment></comment></comment></comment><comment><USER37> Answer: not as fast as the D lang forums.

[https://forum.dlang.org/](https://forum.dlang.org/)

<comment><USER38> Truly impressive is [https://www.gov.uk/](https://www.gov.uk/)

A government site, lightning fast, try the search! No bullshit design.

<comment><USER39> Yes, I'm always impressed when I have to deal with it. Truly amazing to find such competence in a gov site.

A lot of that is done in the open, too.

[https://alphagov.github.io/](https://alphagov.github.io/)

<comment><USER40> The uk gov website is a blessing, now leaving in the UK I can compare with the french ones and those are not playing in the same league.

</comment></comment></comment></comment><comment><USER41> A suggestion for the author: Please avoid commas (or dots) as thousands separators. My brain parses "4,604ms" as "about four milliseconds", which would be amazing, but is very much not what you mean.

ISO recommends half-width spaces as thousands separators to avoid this kind of confusion. Also, I think thousands separators can just be skipped if your numbers are only four or five digits wide.

<comment><USER42> >> Please avoid commas (or dots) as thousands separators.

You might as well say 'please ignore the standards of your country in favour of mine.'

Are you really not aware that this is the standard in Europe?

<comment><USER43> Parent is clearly a European (or denizen of another local that uses commas as decimal markers), as they interpreted 4,604ms as slightly over 4ms. Also, they advise using an ISO ( _International_ Standards Organization) standard, specifically to avoid misinterpretation while remaining locale-independent.

<comment><USER44> I think the confusion is more about secondes vs ms. Like 4.604s parses easier in my brain.

<comment><USER41> No it isn't. Your parent comment was correct.

</comment></comment></comment></comment></comment><comment><USER45> So basically Google could get 90% of what AMP provides without AMP itself, because the magic is in the caching and forcibly reducing the ad junk the page loads.

Does that about sum it up?

<comment><USER7> Yes, except how do you propose to implement caching and stripping out the ad junk without AMP?

<comment><USER46> HN is seemingly incapable of rationally discussing AMP.

AMP solves a very real problem, which is that our web stack is open to enormous abuse because it is sometimes too powerful for its own good. While we could make simple HTML that is as fast ( _of course_ we can), the reality is that we don't, and many don't often for tragedy of the commons reasons. And the counter-argument that search rankings should just favor this -- e.g. just promote speedy pages -- ignores that abuse would be absolutely rampant (and the other argument -- just run a layer of ad blockers -- completely misses the point). AMP isn't just an ideal, it's a strict set of enforced restrictions.

In previous discussions I've noted that we need an HTML lite to counter AMP, not just the same head-in-the-sand strawmen about how it serves no purpose. An HTML lite that is a mode in the browser, enforced on the DOM and JavaScript. The anti-AMP rhetoric makes it impossible to discuss rationally.

<comment><USER47> > many don't often for tragedy of the commons reasons.

Google are some of the major culprits driving the creation of an unpleasant web experience loaded with tracking and advertising cruft, and now they're pushing this alternative format to supposedly fix the damage they wrought. That's why people are salty about AMP.

It's an imperfect analogy, but imagine if some company had torn up the roads near your house by driving their heavy cargo trucks over it, and now you're irritated by the potholes, that same company says, "Great news! If you just buy our special tires and shocks and install them on your car, you'll have a smoother ride with fewer bumps from potholes!"

<comment><USER46> Google has pushed speed in virtually everything they've done since day one. Asynchronous, deferred scripts. Always outrageously fast loads. Simple, lightweight ads. They even built a browser to try to push speed.

I despise ads, but blaming Google for the situation that we're in is seriously missing the mark.

Google wants the web to succeed, for their own selfish reasons. They don't want it to become a wasteland of zombie scripts, cryptomining, pop-overs, and abuse (which tends to be even worse on mobile, as an aside, abusers knowing that mobile users often have fewer tools). They have been pushing pro-web policies since the early days. AMP, as cynical as people can be about it, is one of those.

<comment><USER47> Google monetized links. They were the ones who showed you could make serious money from tracking and marketing to people on the internet.

Your argument is "Google is more technically competent at doing all these crappy things than Google's imitators", but Google was the trailblazer who proved there was big money in ads and scripts that do more than blink a banner.

<comment><USER46> No, that isn't my argument, and given that you're busy taking swipes at absurd strawmen I think this conversation is done.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: How to get the most out of a programming conference? - <AUTHOR>

I just won tickets to RubyConf from Heroku. (Thanks again, guys!)
I graduated college in May, and I've never been to a conference like this before.
Do you guys have any tips for getting the most out of one of these events? What to expect? Thing to do / not to do? Any advice would be much appreciated! <comment><USER2> Most of the conferences I've gone to (i.e. DEFCON, BlackHat, etc) I've benefited from turning off the laptop, silencing my phone, and listening. There is no way you will grasp everything that is covered at a conference, and especially so if you aren't paying 100% attention to the presentations. A little dead-tree notebook and pencil/pen is enough. Learned that the hard way toting 10lbs of gadgets around my first year at DEFCON.

On a networking note, bring business cards of some sort. People forget your name, forget your face, but its hard to forget something physically given to you when you're genuinely interested in talking to the other person.

<comment><USER3> How are business cards done these days?

Besides email, do you list your twitter/linkedin or whatever social network account you use? Blog or website?

Any neat tweaks on business cards you've seen? (USB business cards? I remember the CD ones - people weren't going to use them as a CD anyways so I guess it's not such a great idea)

some bluetooth-enabled contact info from a cellphone app?

<comment><USER2> On mine I listed my email, urls to related sites or projects, twitter id, and my Google Voice account phone number. Most of all, if you can make your cards relevant to the event, do that! Much easier to remember where you got the card from that way, which leads to better ROI of sorts.

At DEFCON 17 I saw people use Bump on their phones to achieve this sort of thing without cards. At that same conference I actually came across a very cryptic card which ended up being a crazy puzzle game of sorts. That held my attention for a good 2 days.

</comment></comment></comment><comment><USER4> The talks will be fun and informative. Enjoy them, but don't get distracted taking notes.

Talk to everyone. Ask them about what they do, and what they're interested in. If you make any sort of connection, add people on Twitter, Facebook or whatever they prefer. Keep up with what they're doing, and help out if you can/want.

Go to the hackfests. Find different folks to eat with at every meal.

Notice how much I'm talking about people? Yeah, they're the most important part of a conference (and life in general).

<comment><USER5> Twitter work great at conferences, (actually, it's about the only time I use it), for getting/posting msgs like "I'm hacking on Z in room X."

</comment></comment><comment><USER5> Going way back, and in no particular order:

Have an offline copy of the schedule, and don't count on the wifi staying up.

If it's not already, make sure your dev environment is fully set up.

Review the schedule, downloading, and perhaps installing any software/libraries mentioned in talks you find interesting, (saves you missing 10 minutes of the talk)

Realize that for a lot of things, a simple note that X exists and what it's called is enough for future research.

Roomshare. You'll learn a lot, and meet people you wouldn't otherwise.

Go to the sprints if you can. Go out with people in the evening.

Have fun!

</comment><comment><USER6> Start your preparation _now_. You only have 6 days left.

Be well rested, mentally and physically prepared. Forget about drinking, drugs, coffee, soda, junk food, and late nights, starting now. When you get there, go to as much as possible, day and night, and take it all in. Get there early and stay late. Take advantage of related events and get-togethers (at night, especially). Minimize drinking, coffee, and junk food while you're there. Let your mind and body take your notes for you. Don't allow yourself to end up in crashing and missing anything. There will be plenty of time for that on November 14. Most of all, have fun. Don't wonder what could have been if you had planned properly.

<comment><USER7> I think I'm the opposite of edw519 - I'm going the conference to hang out, absorb as much as I can, and have fun. Nothing about edw519's advice appeals to me - makes it like work. A conference should be fun and yes, crashing is part of it. You can't absorb everything and if you go into a conference thinking that you must "prepare" or your will forever "wonder what could have been if you had planned properly", you will get depressed/upset when you find your brain has turned to mush at 4:15 on day three.

Have caffeine if you've found that it helps you stay alert or be perky/whatever. Eat junk food for the same reason. Lots of carbs and proteins both work for me.

I don't know - I guess I just don't think of a conference in the same way as a marathon (which is what edw519's advice would apply to).You should absorb what you can but you should meet lots of folks and hang out.

Brush your teeth and have good hygiene. No one enjoys smelling you from 10 feet away. Smile. Wear your nametag. Take pictures with people and connect afterwards.

Enjoy and congrats!</comment></comment>


Death in the Watermelon Patch - <AUTHOR> http://luckypeach.com/death-in-the-watermelon-patch/ <comment><USER2> Long and kinda fun submarinetupe article on the history of what people will do to defend their livelihood from thieves. I fell for it and might even buy some watermelon seeds.</comment>


Washington Marijuana Startups present interesting legal issues - <AUTHOR> http://marshall2law.com/2012/12/11/washington-marijuana-startups-present-interesting-legal-issues/ <comment><USER2> "Frank Schnarr, Frankie's Sports Bar & Grill Owner, Welcomes Pot Smoking In Bar"

[http://www.huffingtonpost.com/2012/12/10/washington-state- ba...](http://www.huffingtonpost.com/2012/12/10/washington-state-bar- owne_n_2270638.html)

This is in Olympia.</comment>


New Silicon Valley TV Show By Mike Judge Films in Palo Alto (Pictures) - <AUTHOR> http://valleyfringe.com/new-silicon-valley-tv-show-by-mike-judge-films-in-palo-alto

<comment><AUTHOR> Did anybody else get to check out the filming? They closed a few blocks of El Camino Real for awhile earlier in the day, but I was too busy to go over there and get photos.

If anybody else has any photos of the filming, post a link and I will update my blog with a link to your site.</comment>


I have failed twice. Business tips in hindsight. - <AUTHOR> http://engineactive.com/abstract/2009/10/i-have-failed-twice-10-business-tips-in-hindsight/

<comment><USER2> I think the post may appear general and commonsensical at first glance, but IMO it has excellent advice for someone starting their own business.

</comment><comment><USER3> I don't necessarily disagree with the author, but I would be more inclined to take his advice if I knew he had succeeded at least once.

</comment><comment><USER4> Lots of times the overnight success doesn't really understand why he succeeded and is tempted to toss out platitudes he's hears somewhere else.

Someone who has failed once has probably spent years analyzing why.and can save people faced with same decisions from making a fatal mistake.

</comment><comment><AUTHOR> Thanks for the great comments. I particularly love perpetuity's comment ;)

@rmason. Thank you. These are exactly my thoughts. I hesitated writing this post because I have not had that 'big success' yet.

</comment><comment><USER5> Only failed twice? The author obviously isn't working hard enough.</comment>


Build a WhatsApp Chatbot with Python, Flask and Twilio - <AUTHOR> https://www.twilio.com/blog/build-a-whatsapp-chatbot-with-python-flask-and-twilio <comment><USER2> I really didn't like the WhatsApp approach on this. Basically only partnering with few big vendors like twilio and then asking people to build apps via them (by basically paying for it).

Other apps like telegram allows anyone to directly interact with them

<comment><USER3> FB paid something like 20bn for Whatsapp almost 6 years ago. Something like 4bn was paid in cash. How do you make that money back if: a) users do not pay a subscription and b) ads are not printed in the app? You leverage the app's immense user base asking businesses to pay for API services so they can implement chat-bots, notifications, in-app tools, etc.

Why using res-sellers, like carriers use re-sellers to sell SMS integration? Distribution and fair-use control. First, companies like Twilio are the natural partners to sell one more channel to customers that already integrate to SMS. Second, partners will help enforce and control anti-spam efforts. If opening Whatsapp API turns it into a spam jungle like email or sms, it will certainly lose its appeal and users will start switching to the next new spam- free chat app.

<comment><USER4> They don't necessarily need to put ads in the app. They can simply transfer that personal information to their larger people profiles making their existing ad networks more valuable. It could additionally be simply a play to keep someone _else_ from getting said data. (I think your argument still makes sense, just another angle on that part).

<comment><USER5> The privacy law implications (GDPR, the new California law, etc.) would probably crush Facebook as a company if they started doing that.

They already paid over 100 million for just making false promises when they bought WhatsApp, now that the EU has sharpened their blades to take on big data farms like Google and Facebook, doing something like that would be suicide for FB. Any additional data farming would probably attract auditors and lawsuits that Facebook can't get out of so easily anymore.

Facebook would need to put a lot of work into following the GDPR (because someone using an Asian VPN is still protected, so IP based geoblocking won't work) to prevent a fine. It would be a very risky move.

I don't think Facebook is going to sell private WhatsApp information any time soon.

<comment><USER4> I'm mostly speculating but, they wouldn't be selling the data, they would be selling access to their ad network that has models built off that data used to match ads to people. If they have a high(er) conversion rate, they can charge quite the premium for this information. Similarly, if they could merely keep people in their platform (WhatsApp), nobody else has that information -- same effect.

(Also speculating) if that's more or less how it works, and an ads conglomerate like Google or Facebook is worth hundreds of billions, then even a fine of a billion dollars wouldn't be enough to deter them from this activity.

None of this is meant to stir up controversy or be negative or anything, I just think its an interesting mental exercise to consider this scenario and these motivations.

</comment></comment></comment></comment></comment><comment><USER6> This is nice but quite expensive. Up to 0.09$ per message inbound or outbound!

Pricing for Template messages

Outbound template messages to WhatsApp destinations have two different components:

Edit: Here's the price breakdown. [0] > Twilio charges a flat fee of $0.005 per message for all WhatsApp messaging. This applies to all incoming messages, outbound Template and Session messages. > WhatsApp also charges a per-message fee to send outbound Template messages. This fee may vary, depending on the destination country or region.

The second fee varies wildly up to 0.09$ in Germany! [1]

[0] [https://support.twilio.com/hc/en- us/articles/360037672734-Ho...](https://support.twilio.com/hc/en- us/articles/360037672734-How-Much-Does-it-Cost-to-Send-and-Receive-WhatsApp- Messages-with-Twilio-) [1] [https://developers.facebook.com/docs/whatsapp/pricing/](https://developers.facebook.com/docs/whatsapp/pricing/)

<comment><USER7> Feel beholden to cell phone carriers? Check out WhatsApp -- it uses the Internet to eliminate absurd and capricious regional fees.

</comment></comment><comment><USER8> Hey all, I'm the engineering manager for teams at Twilio responsible for WhatsApp integration, among other channels. We're more than happy to answer any technical or general questions -- fire away with replies. Will keep an eye on it today.

<comment><USER9> It seems there is no support for letting a user share their location over WhatsApp through the API at this moment - I was wondering why that is and if you're expecting that that will change soon? For the rest I've experimented with the system and it's been working quite well, thanks for the work!

<comment><USER8> Glad to hear it! Location support actually launched just last week! Check out [https://www.twilio.com/blog/new-rich-features-support- deeper...](https://www.twilio.com/blog/new-rich-features-support-deeper- customer-engagement-twilio-api-whatsapp) and [https://www.twilio.com/docs/sms/whatsapp/api#send-a- location...](https://www.twilio.com/docs/sms/whatsapp/api#send-a-location- message-with-whatsapp) for details

<comment><USER9> That's great to hear, thanks!

</comment></comment></comment></comment><comment><USER10> I'm about to release a bot for Whatsapp for NanaGram ([https://nanagram.co](https://nanagram.co)). Amped!

The user experience of SMS-first products is novel and fun. There's something magical about snapping a photo and just texting it to a unique NanaGram number powered by Twilio. It takes just a couple seconds. I'm excited to deliver the same experience through Whatsapp to customers around the globe and people on wifi.

Building NanaGram SMS-first has been a challenge. There have been all kinds of gotchas:

1) AT&T started blocking any number permanently across its network last January if it contains a hyperlink or email address, even if the customer interacts with the number. I had to create separate messages just for the 12.5% AT&T users.

2) Twilio only works when you have cell service. If you're indoors with wifi only, the text won't go through.

3) Images are downsized in an unpredictable way by the carriers. If you're sending 1 or a couple images, they're pretty good quality. If you send ~5+ photos, they get downsized pretty far and luckily they're still good enough for 4x6 photo printing. Certain carriers like cricket are super aggressive with downsizing.

4) When Apple users with iCloud enabled share more than 1 image, it generates a sharing album which has been a beast to support. Then there's the added challenge of Apple's recent move to HEIC/HEIF images.

5) Twilio doesn't support group threads (WhatsApp doesn't yet, either)

... I could go on and on.

Getting approval from Whatsapp took a while. I first applied about a year ago and didn't hear anything, then applied again and was approved a few weeks ago. I'm guessing the approval layer is to ensure only high-quality bots make the cut. They also have an approval layer for all of your messages sent outside a 24-hour window of the last user interaction. The approval for that took a few days.

Integration with WhatsApp has been surprisingly easy. I basically just had to change "+1{number}" to "whatsapp+1{number}"

<comment><USER11> > 1) AT&T started blocking any number permanently across its network last > January if it contains a hyperlink or email address, even if the customer > interacts with the number. I had to create separate messages just for the > 12.5% AT&T users.

I don't follow - they blocked any number which replied with a hyperlink or email?

Can users of AT&T not send them to each other?

<comment><USER12> I bet that AT&T can detect "non-real-user" phone numbers, so their hyperlink filter only acts on those numbers.

I have been using Google Voice as my secondary phone number for the past 5 years, and some services manage to detect that it isn't a real phone number and refuse to work with it. More specifically, it usually happens when I try to use 2FA over SMS (note: i know that 2FA over SMS is not considered secure, but some of the services I use only offer this as their 2FA, and it is better than me not using 2FA at all). It doesn't just fail to deliver the message, the service straight up tells me to enter a "real" phone number.

<comment><USER10> I've noticed this as well. Services like Twilio provide an endpoint to check the carrier. For my Google Voice number, they return "Google (Grand Central) BWI - Bandwidth.com - SVR."

</comment></comment></comment></comment><comment><USER13> Chatbots on Whatsapp are kind of hard from a UX point of view because the platform don't support rich elements like buttons or webviews (unlike Facebook messenger). I hope Whatsapp adds these kind of features soon, otherwise users will get frustrated when interacting with bots and never use it to talk to businesses again. And no, AI/NLP is not the answer to this because users are lazy and prefer to tap on buttons than to write 20 characters... I know this because I'm the creator of Botonic (a React-based conversational framework) and we've been building conversational apps on Whatsapp and other platforms for years. By the way, if anyone is interested in access to the Whatsapp Business API beta feel free to drop me a line at firstname.lastname@example.com

<comment><USER14> No thank you. I like whatsapp for its simplicity. If I wanted a copy of Messenger or Telegram I would use those instead.

<comment><USER13> Simplicity of features != UX Simplicity It's way more simple to tap on a button than to write complex sentences. We've studied this, when users have both options available (buttons and input text), 80% go for buttons.

<comment><USER14> What I also meant is that I don't want bots on whatsapp.

</comment></comment></comment></comment><comment><USER15> wow this is by Miguel Grinberg who is the author of some of the best Flask tutorials and books around. Nice to see Twilio is attracting such high quality writers for their blog

<comment><USER16> Miguel Grinberg was recently hired by Twilio

<comment><USER17> Yes, this is true. I will be involved with the Twilio blog as part of my duties, by writing original articles and also by working with other contributors to get their posts published.

<comment><USER15> oh nice! Long time fan of your work and I people get us confused sometimes because PacktPub chose the title 'Flask by Example' for a book I wrote with them which is too similar to your blog posts.

I nearly wrote an article for Twilio but didn't complete the process. But have written similar posts e.g. [0] and work with other writers who also do this form of instructional technical writing. Would love to chat sometime if you have time - contact info in my profile

[0] [https://www.codementor.io/garethdwyer/building-a-telegram- bo...](https://www.codementor.io/garethdwyer/building-a-telegram-bot-using- python-part-1-goi5fncay)

</comment></comment></comment></comment><comment><USER18> I am divided about this. In my home country WhatsApp is the Internet (along with Facebook and Twitter). Mobile service providers sell WhatsApp data bundles which are orders of magnitude more affordable than "normal" data bundles. So we all communicate via WhatsApp. We use WhatsApp groups and it works well. News, videos, pictures everything I get by WhatsApp from contacts. IMHO it works well because there is not advertising and no bots spamming us. Some of the groups are noisy but you can mute.

I am divided because I like WhatsApp as it is right now. But we are not paying for it and the money has to come from somewhere. Using third party providers like Twilio is probably one way to pay for it. I am divided because having to use Twilio is likely to freeze out developers from my home country. C'est la vie.

<comment><USER19> > we are not paying for it

"With location sharing data, 60 billion messages sent per day and access to users' entire contact lists, Facebook has access to a ton of personal information – all uploaded and saved on its servers."

[https://www.investopedia.com/articles/personal- finance/04091...](https://www.investopedia.com/articles/personal- finance/040915/how-whatsapp-makes-money.asp)

</comment></comment><comment><USER20> This is funny because just today I decided to join Telegram to develop a bot.

<comment><USER21> Telegram bot writing is silly easy. If you use the python module you can basically just write the whole thing as a set of functions in a file (with decorators that watch telegram for triggers) and one function that automatically polls and does all the responding at the end.

I managed to bang out a few when I had a day off a few months back. Very satisfying.

<comment><USER22> Writing a Telegram bot is easy yes but writing a good one isn't. There are some very tricky things involved which you basically can not know and wont find in the Documentation. It forces you to run into problems first and then look for solutions. Especially if your bot gets decent amount of traffic something in the range of 1msg/s and above.

The people at [https://t.me/BotDevelopment](https://t.me/BotDevelopment) (unofficial) are your best chance for support because Telegram (bot) support is a joke.

<comment><USER23> What are those tricky things?

</comment></comment></comment></comment><comment><USER24> The pricing model is:

Template Message: $0.0085 WhatsApp fee + $0.005 Twilio fee = $0.0135 [1].

WhatsApp Session Message, sent or received: $0.005. A session ends 24h after last user message [1].

Compared to just $0.0075 for sending/receiving SMS [2].

[1]: [https://www.twilio.com/whatsapp/pricing/us](https://www.twilio.com/whatsapp/pricing/us)

[2]: [https://www.twilio.com/sms/pricing/us](https://www.twilio.com/sms/pricing/us)

</comment><comment><USER25> In the 90's I built an IRC chatbot, at the time users were naive enough to think it was a real person, so I kept adding conversation lines. Over time it grew into thousands of lines and some people came back to the channel just to chat with it. My friends and I had some good laughs, good times heh.

</comment><comment><USER26> Do you have to pay for Twilio for something like this or does that only come in for SMS/MMS?</comment>


Compiler fuzzing, part 1 - <AUTHOR> http://www.vegardno.net/2018/06/compiler-fuzzing.html?m=1 <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=17387954](https://news.ycombinator.com/item?id=17387954).</comment>


Show HN: the first HTML5 avatar creator - <AUTHOR> http://www.mangatar.net/create-your-avatar.php

<comment><AUTHOR> Hello HN!

We are an italian startup and we are working on a social game in the manga universe. It will be ready in a couple of month, meantime on our website you can take a look to our avatar generator and the community.

The avatar generator is the first one completely HTML5! No flash...just canvas & javascript!

Tell me what you think about it from the technical and graphical point of view.

Any feedback will be appreciated...also about the community features.

Thanks ;)</comment>


Equifax Argentinian portal secured with admin/admin - <AUTHOR> https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/ <comment><USER2> I used to jokingly call my Matasano partner daveg "admin/admin", because he would unironically check for admin/admin before testing in earnest. You'd laugh, because in our field you're supposed to break in with a memory corruption exploit that you worked out remote and black-box. But there he is, every Nth test (for single-digit N's), with an admin login.

This stuff is a lot more common than we like to acknowledge.

Unrelated tale of interest: I did my first web pentest in 2005 (I've been doing security work since '94-95, but I was a developer for several years before 2005 and missed the start of web pesting). And, I shit you not, the very first input I tested --- a login form --- had a 'OR''=' SQL injection on a plaintext password lookup. It warped my expectations for what to expect on web pentests for years.

<comment><USER3> I don't work in security, but _most_ of the routers I that ever wanted to gain access to had some type of default credentials like admin/admin or admin/abc123 etc.

<comment><USER4> I've found the last few years they have generated, pretty difficult, passwords printed on the side now. At least, consumer routers...

</comment></comment></comment><comment><USER5> Given over a month to examine the breach in private, you'd think they would have checked and remediated this massive security flaw. It makes me wonder, did anyone working on the Argentina site know about the US breach? Did anyone try raising a flag saying, "Hey guys... maybe we should change this admin/admin login?"

And if so, what were they responded with?

There are just too many questions to ask, and I'd love for every single one of them to be answered with honesty, but my hope at this point is dwindling.

Everything in the news about Equifax just exclaims all the worst possible words one can use to describe a company.

<comment><USER6> It seems to me that the systematic incentives in place with EFX simply do not require good security.

Security is expensive. But fraud/breaches at a CC company hit the wallet directly and hence it is relatively cheaper to invest into securing their infrastructure. With EFX though, there is no direct loss of revenue; it is the CC companies that are hit. Until now there was no directly measurable effect of their security practices and so it didn't incentivize any investment. And lastly these are old organizations with old systems and a lot of momentum, and again without a correcting force.

If someone was starting up a new credit reporting agency today can you imagine the security/compliance/auditing gauntlet they would have to run through to even open the doors? Very interesting events indeed.

<comment><USER7>
        If someone was starting up a new credit reporting agency
        today can you imagine the security/compliance/auditing
        gauntlet they would have to run through to even open the
        doors? Very interesting events indeed.

Perhaps, but you'd be surprised to learn fintech / new insurance companies aren't compliance ready espeically at launch time when they are already serving customers (in fact, I doubt some of them were even licensed when they first started). As long as you can dodge the ball / ask for extension, you are fine. This is why you'd hire a skillful security compliance officer to negotiate with the auditors. Or, you can choose to run your startup in stealth mode first, and then slowly deal with the laws.

My experience with compliance is not in the fin/banking industry, and perhaps doesn't apply to anybody at all. When I had to deal with SOX compliance, I just had to make sure audit logs were in place and they were exported to a safe and auditable log, along with clear documentation about where things were, roles and privileges of different user groups, how accounts are created/terminated/updated etc, rather we have backups or not.

If you say developers must have access to this production S3 bucket, totally cool, for as long as the manager responsible for this system is aware (if written somewhere will be even better). The auditors don't care the actual implementation. If your internal site superuser login is admin/admin, they don't care. If you allow public access to a secret portal, they don't care. Your boss signs off the risk, auditor is happy to move on to the next item. Auditors don't care how many times you backup a day, or which copy is retained for 7 years as per SOX; as long as you did everything SOX requires, you are good.

YOU DO NOT tell auditors how your system actually work because that's digging a grave for yourself. You sell your system to auditor like speaking to a customer, with as little information about the backend as possible. This is called minimize impact zone. If your system runs on five different DBs, have ten micro-services, a couple monitoring and alerting tools, and a dozen other stuff, well, please do not tell them all of the above. Choose what you can present and what you can defend. Limit what you show.

The auditor just wanted to see if there were logs and whether management had any clues what was going on. Don't spill the secrets so they won't question (e.g. do not tell them there is a publicly accessible secret portal). Communicating with auditor is a very mindful skill, not something to be taken lightly. If you encounter a very technical auditor, yes, you'd face a tougher interview, but they are not there to judge your incompetence, just going to keep asking questions till you spill secrets, then HAHA, they now have something to write.

For an institution like Equifax, there are too many holes to cover up at once, so they will limit exposure as much as possible. I'd say being a credit agency they also have leverage, although that's just my conspiracy: all four agencies work with each other to make sure no one's credit is affected by compliance report... No one wants to piss off a credit agency.

<comment><USER8> I work with auditors regularly, can confirm. Naively believed in my first year of employment that this was a cooperative relationship with them there to help us understand our security weaknesses. Boy was I corrected on that quickly!

</comment></comment></comment></comment><comment><USER9> Very thankful for the security community keeping up the diligence on this.

If this can manage to stay in the news cycle for several more days, something may actually be done. Otherwise, (and this seems far more likely) the world will move on, Equifax will rebrand, and the cycle will continue...

<comment><USER10> I hope more public security shaming like this happens, consequences and lawsuits be damned. This is getting too tiresome, we've been tolerating incompetence and bad management for too long.

<comment><USER11> Yes, this is incompetence. Gross, egregious, horrible incompetence.

Problem is, though, it only takes one incompetent person - or even one person making a mistake one time - to open the door for a massive breach. Requiring perfection of humans in order to maintain security... that's not a workable approach.

Yes, this was inexcusable. But also, our current approach to security is fatally flawed.

<comment><USER12> So what approach do you recommend?

<comment><USER13> Criminal charges against the company for security negligence. Seize their assets and close them down.

Back in the 90's hackers used to get criminal charges for getting into secure systems. Now tech companies are a little more intelligent about it and they pay bounties to hackers. It should go all the way in the other direction though, the responsibility for getting hacked should fall on the company that gets hacked for their shit security.

</comment></comment></comment></comment></comment><comment><USER14> What legal protections do "security researchers" have to conduct this kind of investigation? After getting into the panel by using the admin/admin default, they continued to click around, clicked into user accounts, exposed passwords, etc. I understand the value of what they're doing (and their own internal policies to not release said data), but as far as I'm aware, there is no law that would protect them if Equifax decided to attempt to get them prosecuted under the Fraud/Abuse Act.

Every time there's a big-name company in the news, all the various security firms seem to go to town seeing who can break into the rest of their systems first. Regardless of intention, it still seems potentially criminal.

</comment><comment><USER15> If it's not, this level of negligence should be criminal. There is no security ignorance left to claim on this day and age. I hope we learn the details of the US Equifax breach, and I hope for them it's nothing like this one.

<comment><USER16> I wonder if people do this on purpose when they really hate their client.

I know I've considered it.

</comment></comment><comment><USER17> I suppose at this point nothing about Equifax's security should surprise us, but this... this is just... wow.

</comment><comment><USER18> Yes, this is stupid. One thing to note thou, DNI is not supposed to be secret or used as a secret in practice.

<comment><USER19> Right: when americans mention that SSN should not be used as a secret, I have to remind myself that it actually is. DNI's are as good as public, it really doesnt matter.

</comment></comment><comment><USER19> admin/admin is jokingly terrible, but i can find sympathy: its probably lazyness that got it there. But storing plain text passwords on a data- sensitive site? Or plaint text passwords at ANY point.

Veraz is a piece of shit also (I'm argentinian), much like the us counterparts.

<comment><USER4> Do you know if the web portal behind TLS?

</comment></comment><comment><USER20> The Argentinean site was created by an Equifax-acquired company that was called Veraz (that's why the site is called Veraz).

Most of the Equifax subsidiaries used to be different companies, and when I worked there they all had different technology stacks.

It's even worse than in the U.S. in some cases - in Uruguay, the ONLY credit bureau was acquired by Equifax, so if it goes down, so does the financial industry.

On the other side, SSN equivalents (DNI - National Identity Document in Argentina and CI - Identity Card) in Uruguay and Argentina are NOT treated as a secret in the same way as they are in the U.S. - most every company has access to them, and you can even request access to an API to call them (as noted by other commenters - [https://news.ycombinator.com/item?id=15234806](https://news.ycombinator.com/item?id=15234806) ).

Uruguayan cards now have chips and biometric facilities too.

Still, more gross negligence on Equifax's part. The Uruguayan operation was run pretty tightly, I was really surprised to learn that in the U.S. and Argentina they were not.

</comment><comment><USER21> Needs to be sued out of existence. Send a message to corporate America: Protect Sensitive Data.

<comment><USER22> I'm sure Equifax has far more sway with the regulators than consumers. Nothing is going to change and Equifax isn't going to suffer more than a few million dollars in symbolic fines.

</comment></comment><comment><USER23> For a company that is supposed to be responsible for a lot of private data, they aren't very good at security. Makes me wonder how much better or worse the other credit bureaus are.

<comment><USER24> Hope for the best but expect the worst.

</comment></comment><comment><USER25> a play, in two parts:

[https://imgur.com/a/krXIz](https://imgur.com/a/krXIz)

additionally, the twitter account claiming responsibility (@real_1x0123, on friday, sep 08) for the webshell/compromise just protected their tweets. this will turn out to be much more interesting than it has been thus far.

<comment><USER13> Some of those are down already. Here's their salesforce login though: [https://help.equifax.com/login](https://help.equifax.com/login)

Here's the login for their finance blog: [https://blog.equifax.com/wp- login.php](https://blog.equifax.com/wp-login.php)

admin/password and admin/admin doesn't work on that one. It lets you keep trying passwords for a pretty long time, maybe possible to brute force.

I haven't been able to get through any of the others with admin/admin as well. Maybe someone is on the job.

I can't help thinking of how on-the-ball companies like yahoo, github and dreamhost are about security breaches for much lower-stakes information. This whole story is so pathetic. Makes me think the company is being run by people like my dad, who is barely capable of using a computer for Youtube and the news, and is constantly fearful and paranoid of "cyber" threats, but won't take the most basic steps to educate himself or take precautions.

<comment><USER25> Sure was up last Thursday. Cached results are being scrubbed from Google. The point I'm attempting to illustrate here is that someone appears to have had a PHP web shell on a force.com endpoint.

<comment><USER13> Yeah, I was just poking through the others to see if I could score any more easy wins :)

</comment></comment></comment></comment><comment><USER26> This is a business extinction event for Equifax, right?

<comment><USER27> Not a chance. Though they might change their name to Equifix.

</comment></comment><comment><USER28> gross/negligence</comment>


The World's Oldest Forest Has 385M-Year-Old Tree Roots - <AUTHOR> https://www.smithsonianmag.com/science-nature/385-million-year-old-fossils-reveal-worlds-oldest-forest-had-modern-tree-roots-180973810/ <comment><USER2> Fossilized, 385M year old tree roots.

Which is very cool, but not nearly as bizarre/profound as the headline suggests. Phrasing.

<comment><USER3> I agree, I was also disappointed.

Meanwhile the oldest known living tree is a still astonishing 4,800 years old

[https://en.m.wikipedia.org/wiki/Methuselah_(tree)](https://en.m.wikipedia.org/wiki/Methuselah_\(tree\))

<comment><USER4> When I went there I asked a ranger if there was something special about bristlecone pines that allows them to live for so long. She first told me what it means for a tree to be alive. Apparently, as long as there is a connection from root, through bark, to leaves, it's still alive. So a lot of bark could be missing, but if there is a path it's good.

For the longevity, it's just the perfect environment in the White Mountains. Trees don't die of old age. Pests, disease, and erosion are what kill them. That area, being California high desert, there just aren't really any pests or disease. Erosion and weather are the biggest threat to the trees.

That place is totally cool, in that I really like it but don't think anyone I'd drag up there would enjoy it as much, ha.

<comment><USER5> If you like Bristlecone Pines, I highly, highly recommend checking out Great Basin National Park and hiking up to the Bristlecone Pine Grove. It's a lovely day hike - I did it over Thanksgiving weekend and used those little snowtrax grippers over my hiking shoes.

[https://www.atlasobscura.com/places/the-bristlecone-pines- of...](https://www.atlasobscura.com/places/the-bristlecone-pines-of-the-great- basin-baker-nevada)

Could be done around now-ish in snowshoes as well.

One of the least visited and most beautiful national parks in the US! Sparkling stars and dark skies make for great meteor viewing, and the bristlecone pine trail has a loop through all the interesting trees with little signs and "biographies" about each tree.

One of the largest is Prometheus: [https://www.nps.gov/grba/learn/historyculture/the- prometheus...](https://www.nps.gov/grba/learn/historyculture/the-prometheus- story.htm)

</comment></comment></comment></comment><comment><USER6> Cool article, but the headline should read "385M-Year-Old Fossilized Tree Roots"

</comment><comment><USER7> This really implies that the same tree-root architecure evolved independently in different lineages of plants.</comment>


Show HN: Practicing Rails: Learn Rails without being overwhelmed - <AUTHOR> https://www.justinweiss.com/book/

<comment><AUTHOR> I just opened up beta book sales today! If you'd like to learn more about the reason behind the book, you can read more here: [http://www.justinweiss.com/blog/2014/10/21/learn-rails- witho...](http://www.justinweiss.com/blog/2014/10/21/learn-rails-without- being-overwhelmed/)

And I'd be happy to do my best to answer any questions you have!

<comment><USER2> I know I'm asking too much, but is it possible to get a hand on the chapter on testing only? I have been reading on tests, but most of the time I feel quiet lost. I'm afraid it might be the same here too.

<comment><AUTHOR> Hey! I actually posted a short snippet from the testing chapter to the blog yesterday: [http://www.justinweiss.com/blog/2014/10/20/writing-better- te...](http://www.justinweiss.com/blog/2014/10/20/writing-better-tests-with- the-three-phase-pattern/)

That snippet is just a page or two, but should be a good representation of the kind of information in that chapter.

<comment><USER2> Awesome! Thanks!

</comment></comment></comment></comment><comment><USER3> The site is dead!

<comment><AUTHOR> Which browser? I wonder if it's related to the poodle fix.</comment></comment>


China's Belt and Road Infrastructure Plans Are Heavily Net Carbon Positive - <AUTHOR> https://nationalinterest.org/blog/buzz/chinas-belt-and-road-global-infrastructure-plans-are-dooming-planet-78326 <comment><USER2> The way it's built must reflect the fact that the countries passed through by the belt are receiving help from China. Which of course is a good thing, but that's the first goal, other considerations are secondary. If a country says no to the help, they will wait until it's a yes.</comment>


Blood, Bullets, Bombs, and Bandwidth - <AUTHOR> http://rezendi.com/travels/bbbb.html <comment><AUTHOR> This is the unabridged version of a piece that appeared in Wired a while ago.</comment>


Live stream: Microsoft releases official SDK for Kinect - <AUTHOR> http://channel9.msdn.com/live?kinnect=yes

<comment><AUTHOR> Here's the download site: [http://research.microsoft.com/en- us/um/redmond/projects/kine...](http://research.microsoft.com/en- us/um/redmond/projects/kinectsdk/)</comment>


'US-Russian relations above Snowden case' – Putin - <AUTHOR> http://rt.com/news/putin-snowden-us-relations-196/

<comment><USER2> This unusually respectful rhetoric from both sides hints on that they already agreed on the case. Russia keeps Snowden quiet, the US doesn't bug them with extradition. A win-win for both presidents. Putin saved a poor NSA contractor from the evil Empire. Obama shut down the leak and as a bonus got a "traitor" who fled to the "Soviets".

<comment><USER3> I feel like you're right, but there has to be more in it for Russia. Obama gets "good" PR and silences Snowden - the best possible outcome. I don't see Putin settling for just good publicity. If Putin played hardball here he would still gain massively with South America and still get the benefits you mentioned

<comment><USER2> Putin can't afford to play hardball. Despite his macho exterior in the media, he knows that the US has leverage economically and elsewhere.

</comment></comment></comment><comment><USER4> It's almost as if Putin makes a facepalm and says "Dude, Edward, what the hell? Why would you do this?". And Putin, mind you, is very aware of the balances of power and the GAME. I think he sees very clearly how all this plays out: public at large won't give a shit over time, Snowden is forgotten, governments keep on doing what they've been doing for a long time: farming and milking their citizens.

<comment><USER5> I would say he's just been waiting for Russian public support for Snowden to cool down a bit, but then I forget that it seems from the outside that he pretty much doesn't need to consider Russian public opinion.

</comment></comment><comment><USER6> _In the meantime, Snowden may be transferred to a refugee center._

These "refugee centres" are known as Temporary Accomodation Centres (TACs), about which Refugee Legal aid [1] states:

 _Temporary Accommodation Centres: TACs are located throughout the Russian Federation and at great distances from metropolitan areas. Transportation to and from a TAC and nearest metropolitan area is often costly and dangerous._

I can't imagine that would be a very safe secure environment from Snowden's perspective...

[1] [http://www.refugeelegalaidinformation.org/russian- federation...](http://www.refugeelegalaidinformation.org/russian-federation- coi#sthash.DoSA6YRq.dpuf)

</comment><comment><USER7> I hope so. I married (literally) into US-Russian relations and have family / own property in both nations.

Maybe it's time to find a neutral 3rd country?

</comment><comment><USER8> Sure, we spy on our people and your people, and so do you. Our relationship is just fine.</comment>


Show HN: A Tic Tac Toe "AI" Built with Only HTML and CSS - <AUTHOR> https://css-ttt.netlify.com/ <comment><USER2> there's a bug where it claims i lost when i didn't. bottom left, top right, bottom right, middle right. it will then say green wins.

<comment><AUTHOR> Hiya, I pushed a fix last night when someone reported something similar.

I tried your sequence and it looks like it loses now so I think that might be fixed.

<comment><USER3> Still bugged for me - the green and red turns take place on the same "turn" so I end up with green and red winning and it staying green wins - even though red went first.

This is what it looks like: [https://vgy.me/wXP18k.gif](https://vgy.me/wXP18k.gif)

<comment><AUTHOR> Oh! Apologies. You are completely right. No idea how I missed that.

Pushed a fix. Thanks for reporting!</comment></comment></comment></comment>


Why Human-Sized  Vehicles Will Conquer the City - <AUTHOR> https://www.citylab.com/transportation/2018/06/welcome-to-the-tiny-vehicle-age/563342/ <comment><USER2> This article looks so "old" if you compare it to Amsterdam: Lots of little vehicles here. We call them bikes. It already conquered the city long time back. Lots of areas in the city are no-car zones:

[https://firstname.lastname@example.com,4.9006449,3a,75y,196....](https://firstname.lastname@example.com,4.9006449,3a,75y,196.97h,73.68t/data=!3m6!1e1!3m4!1sS5AXcAhOvMtdfR7P_IJCYg!2e0!7i13312!8i6656)

<comment><USER3> ... and Amsterdam is probably among the least bike-friendly big cities of the Netherlands (which is not a dig against Amsterdam).

It probably helps if provinces, counties and cities are all competitive about being the most bike-friendly place of the Netherlands. For example, there is a yearly "bike city/county of the year" competition and from what I can tell city councils are really, _really_ keen on winning it, proudly naming their victory on the town signs. Apparently Houten is the bike city of 2018, and it's their second time[1]. My home-town of Groningen will have to step up it's game..

[0] [https://www.fietsersbond.nl/nieuws/zuid-holland-als- eerste-p...](https://www.fietsersbond.nl/nieuws/zuid-holland-als-eerste- provincie-fietsvriendelijke-werkgever/) \- _Too Dutch, Couldn 't Read:_ The province of Zuid Holland first to encourage bureaucrats, etc to use bike as mode of transportation.

[1] [https://www.fietsersbond.nl/fietsstadverkiezing-2018/](https://www.fietsersbond.nl/fietsstadverkiezing-2018/)

</comment></comment><comment><USER4> Little vehicles are a great concept for cities and perhaps will (and should) take over the city. What this article fails to mention are the risks involved. As a New Yorker, I absolutely cringe when I see a family of tourists riding down a busy street on their bikes, oblivious to the world. It is extremely dangerous to ride a bike on the side of a busy road. Many streets are entirely without bikelanes and taxis , buses and trucks are constantly barreling around corners and driving in out out of the shoulder. Little vehicles will be great in a city with roads and pathways designed for them, but they remain a very risky proposition as long as the roads are designed for (and crowded with) much larger vehicles.

</comment><comment><USER5> China is leading the way here. Although, I would personally estimate from observation that in Shenzhen the amount of monowheels visible on the streets perhaps peaked last year and is now dropping. They have been largely supplanted by the stand-on two-footpad type (very popular with kids) and the scooter (adults).</comment>


VS Code Development Using Docker Containers on Remote Host - <AUTHOR> https://leimao.github.io/blog/VS-Code-Development-Remote-Host-Docker/ <comment><USER2> I've gotten close to getting this to work. I do remote development on an SSH box using remote SSH, and I want intellisense to use containers running on that host while I edit files on the host.

I've done everything in this blog post, but the problem is "open folder in docker container" is only an option from my local workspace. I cannot do it from the SSH workspace. So the code that gets mounted is the code from my local machine, not the remote machine.

<comment><USER3> Do you also do all of your dev in Remote - SSH? I haven't found anyone that does that besides me.

<comment><USER4> [https://tilt.dev/](https://tilt.dev/)

We recently got this setup running company wide. It is a headache to iron out all the kinks, but the reproducibility is great.

Essentially each developer has their own Kubernetes cluster in the cloud. As you develop your code is r-sync'd across to the pod running the relevant compiler/server/etc.

Again, a bit of a pain to get running but really powerful once its setup. We now have near carbon-copy deployments across prod, dev, local development, and (soon) even the CI.

(I don't work for Tilt, just a fan of their product and vision)</comment></comment></comment>


Ask HN: How to Disrupt Booking.com / Expedia? - <AUTHOR> Hi HN,
We are 2 engineers working full-time on a hotel booking solution with no commission, instead of 18% practiced by sites such as Booking.com / Expedia. Hotels hate this commission, but they keep paying since Booking / Expedia bring customers.
Tourists know about these brands and go there to book hotels, even though there are hundreds of other booking & meta-search solutions. Note that they won't find better prices, since hotels aren't allowed by Booking/Expedia to post better prices online. So a site with a smaller commission can't post cheaper prices. Booking/Expedia also 'price match', just in case a tourist manages to find a better price. There's an exception with https://bidroom.com/ , which shows better prices after registration, so not 'publicly'.
Tourists also prefer Booking / Expedia since their booking is guaranteed and payment is safe with these known brands.
Would you have any out-of-the-box ideas on how one could disrupt these booking sites? Obviously, if there would be any straightforward steps, you'd do it yourself. However, if you don't have the time to work on it, but have interesting suggestions, would you please share for others to consider?
Thanks! <comment><USER2> Heya :) I work in this exact area it's tough but not impossible (based on over 20 years industry experience). You are right that hotels hate the commission, actually even more they hate the way they are treated by the big agencies and they are held basically hostage by the massive advertising spends of the big players.

It's an uphill battle, and a slow one, but chances are now things might actually take a turn for the better because the OTAs have suffered under the crisis too. There's a lot of similar projects out there as yours, but it's also a huge market. It takes a lot of work on the consulting side, because hotels are an industry that's ages behind other digitally-capable businesses. So you should look more to changing their mind than looking at the guest side, trust me on this.

I'd be happy to talk and share what I know, we need every hand we can get to turn the situation around. I also work directly with Google Hotel Ads and can share some insights there. Ping me on the email that's in my profile, there's a lot to explain and it would take a book haha.

</comment><comment><USER3> Might be helpful to state:

\- what your current business model is;

\- business models you attempted, but abandoned;

\- reasoning of why the current model is broken besides an existing company having a monopoly;

\- what you're break even profit needs are

\- what jurisdiction you're in and plan to target;

\- prior experience in the hospitality industry.

——

Lastly, (1) do you have any proof of "hotels hate this commission" other than your assumption that no one likes spending more money on a transaction than needed? Ask because unless you have researched this, the reasoning for why hotels use booking services might be that it's cheaper than marketing their inventory themselves. (2) My understanding is the largest player in this space is now Google, how do you intent to deal with Google?

<comment><AUTHOR> Thanks! We are exploring business models. If there's traction with low operating&marketing costs, we can afford not to charge a commission, but instead charge later for optional premium services/functionality. bidroom.com charges tourists instead.

Prior experience in the hospitality industry: none. Just started a few months ago.

(1) That's a good point. Didn't consider the marketing costs for the hotel direct bookings.

(2) Do you refer to [https://www.google.com/travel/](https://www.google.com/travel/) and [https://ads.google.com/hotels/](https://ads.google.com/hotels/) ?

We looked at these. Since hotels aren't allowed to post best prices for direct bookings, a tourist will see in the booking list:

Expedia $100; Booking $100; Direct (or hotel name) $100

Without a better price, they'll choose one of the known brands.

Any suggestions on how to tackle Google Hotel Ads?

<comment><USER3> Honestly, unless you're able to find a way to exploit the downturn related to the global pandemic, in a way that you're able to maintain growth post pandemic, my advice would be to pick a new industry, since this is one of the industries that is in my opinion well know for killing countless startups.

If I had to give a singular piece of advice, I would suggest contacting large enterprises that still book hotel rooms, find the person who has the most control over bookings, and ask them, as it relates to the pandemic, if there's service they feel is missing. B2B business has a much longer time to revenue, but the revenue is much more predictable. This would also solve the issue of Google, since they're focusing to my knowledge on consumer market.

Lastly, this is a very regulated industries, I would suggest getting off the record advice from attorneys on potential legal issues based on any model you do find a product market fit for.

<comment><AUTHOR> Appreciate your insight! Will seriously consider that.

</comment></comment></comment></comment><comment><USER4> I've seen this a million times. No one accounts for the marketing spend, and they all fail.</comment>


Sudoku, Linear Optimization, and the Ten Cent Diet - <AUTHOR> http://googleresearch.blogspot.com/2014/09/sudoku-linear-optimization-and-ten-cent.html

<comment><USER2> This struck me as almost a perfect example for good content on a company blog (outside of the required press-release style posts). Ties into their software, light-hearted, polished and well put together.

</comment><comment><USER3> One interesting use for Linear Optimization is to do constraint-based UI layout - [http://en.wikipedia.org/wiki/Cassowary_%28software%29](http://en.wikipedia.org/wiki/Cassowary_%28software%29) . I wonder how Glop would compare to Cassowary?

EDIT Unfortunately the documentation for the Google OR suite is pretty sparse.

</comment><comment><USER4> If anyone is interested in exactly how to solve Sudoku via integer programming see the following: [http://www.mathworks.com.au/help/optim/ug/solve-sudoku- puzzl...](http://www.mathworks.com.au/help/optim/ug/solve-sudoku-puzzles-via- integer-programming.html)

It's a very elegant solution.

<comment><USER5> Mixed-integer and 0-1 integer programming problems are NP-complete in the general case. You might as well use the backtracking approach which in my opinion is much more elegant.

</comment></comment><comment><USER6> I actually just wrote an add-on for Google Sheets (It allows you to run neural networks in a spreadsheet). While I resented being forced to use Google's Apps Script Editor, I was impressed with the quality of the documentation and reference materials. They've done a pretty good job.</comment>