Soldering is easy - 7 page comic book about how to solder - <AUTHOR> http://log.andie.se/post/4529161438/soldering-is-easy-the-comic-book <comment><USER2> Hah. That's great. Soldering _is_ easy. And, a soldering iron is almost as versatile as a Swiss Army knife[1]. You can use it for soldering, wood burning, spot retouching a hot-glue job, boiling water, opening those pesky Costco clamshell packages without slicing an artery, shaping open or closed- cell foam, giving toy soldiers horrific battle wounds, rosin-based aromatherapy, a(u)nt punishment, and general hole-melting. It's the lightsaber of our millennium.

And finally, to make this comment more useful, so I don't hemorrhage my 33 points of karma: If you've ever wanted to gracefully rework SOICs, QFPs, etc., invest in a good hot air system with appropriately-shaped spreading tips. Amazon has a basic kit for $139: [http://www.amazon.com/X-TRONIC-Digital- Rework-Soldering-Stat...](http://www.amazon.com/X-TRONIC-Digital-Rework- Soldering-Station/dp/B003TC8EQS/)

Do _not_ use ChipQuik. It's expensive, unnecessary, and messy.

[1] Metcal enthusiasts, before you have a heart attack, recall that Radio Shack sells disposable lightsabers for $7.99.

<comment><USER3> Well the Metcal tips only slightly more expensive than the Radio Shack sabers and are easily replaced, although I wonder what they'd say if someone called them and asked which tip would be appropriate for boiling water or aromatherapy. :)

</comment></comment><comment><USER4> Issues:

1) The solder should always be convex, not concave. It's not that way in the illustrations. A concave ball, as sometimes shown, may be a good connection to the pad, but a cold joint to the wire. It'll work, for a bit, but may eventually fail.

2) Always, always, always keep the tip tinned (covered with a thin layer of solder). The solder acts as a thermal conductor between the iron and the joint, which lets the joint heat up much more quickly. It also prevents the iron from oxidizing. If you don't do this, the iron will oxidize, and you will no longer be able to tin it.

3) Feed the solder into the joint, not into the iron. That tells you the joint is hot enough.

4) Temperature controlled iron makes a huge difference. Weller WES51 is the minimum you should use ($90 or so). More expensive irons in the Weller line don't make a big difference. Metcals are nicer, but wicked expensive.

</comment><comment><USER5> Although not quite a comic, Forrest Mims' _Getting Started in Electronics_ is considered a classic.

[http://mightyohm.com/blog/2008/12/the-greatest- electronics-b...](http://mightyohm.com/blog/2008/12/the-greatest-electronics- book-ever-written/)

 _Citizen Engineer_ is a comic book / zine / electronics kit. Unfortunately, they haven't released a volume 2 yet.

<http://www.citizenengineer.com/>

</comment><comment><USER6> There's no mention of using desoldering braid (or even the suction bulbs) to fix bad joints? Sorry, but I don't like the "whack the circuit board on the table" method.

Once you get used to doing it right, desoldering braid is awesome. I never did get the hang of those squeeze bulbs, though. The braid was always so much easier to use.

<comment><USER7> They're keeping it simple. No mention of microscopes, dental tools, hot air guns, flux pens, or solder paste either. But yeah, I'm not sure I'd try his desoldering method either.

<comment><USER6> I wouldn't complain if they didn't mention desoldering at all. But they do mention it and they only give one method for it, as if that's the only way to do it!

I've actually done more desoldering than soldering and I would have gone crazy if I had tried to do it that way. I find braid to be the easiest method by far, but that's just personal preference. I'm sure there are people other than me who can get the suction devices to work well and who don't have to buy braid all the time.

</comment></comment></comment><comment><USER8> Great little guide.

One thing that's rarely mentioned in soldering tutorials is temperature. With good temperature-controlled soldering stations like the Weller WES51 available for <$100, I'd be hard-pressed to recommend skimping on a cheap pencil iron. Trouble is, I've seen very little discussion about what temperatures to use for particular types of solder.

I put this question to one of the EE lab instructors at my university. Their choice is 700-750F for standard 60/40 solder. I use 750F at home with good results.

You need higher temperatures for lead-free solders, which is one of the reasons I avoid them.

</comment><comment><USER9> Hurray, it's the Manga Guide to Soldering. Good stuff, I love these things.

One of the amazing side effects of technical comic guides are that small children, who are not really the target audience, end up picking these up and learning things like Physics, Database Design, and now Soldering.

<comment><USER10> When I was working a booth at Wondercon, an 11-year-old girl picked up a copy of the Manga Guide to Electricity and told me, "Reading this book was fun!" Made my day. (I edit the series.)

</comment></comment><comment><USER11> Neat comic.

My opinion differs on soldering irons. I find that cheap electric soldering pens tend to give me poor results. For someone starting out I think this could be discouraging. Radio shack has a cheap butane pen that works much better for me. It does cost slightly more, but I find it is usable on a wider range of projects and can even heat shrink tube in a pinch.

<comment><USER12> I would recommend buying an Aoyue temperature controlled soldering station ([http://www.amazon.com/Aoyue-936-AOYUE-Soldering- Station/dp/B...](http://www.amazon.com/Aoyue-936-AOYUE-Soldering- Station/dp/B000VINMRO/ref=sr_1_9?ie=UTF8&qid=1302632135&sr=8-9) $39.99)

It doesn't cost much to get a great iron.

<comment><USER13> Having used the Aoyue I found that it is not nearly as nice and does not keep temperature nearly as well as a nice Hakko soldering iron. The Hakko FX-888[1] (replacement for the Hakko 936) is absolutely fantastic. I used to own a Hakko 936 until it got stolen and it was by far the best soldering station I have ever owned.

[1]: [http://www.hakkousa.com/detail.asp?CID=49&PID=4800&P...](http://www.hakkousa.com/detail.asp?CID=49&PID=4800&Page=1)

</comment></comment></comment><comment><USER14> Interesting comic. I was thinking about giving it to my kids, but it gets a bit too complicated starting on page 4. And there are no simple examples. It would be nicer as a longer series that explained how to make some simple circuits in the same down to earth tone.

</comment><comment><USER15> I prefer to cut the leads before I solder them - this way there's no risk of unsettling the contact while you cut the soldered lead, so this gives you nice solid reliable contacts. This requires you to hold the component with one finger while you're soldering it (otherwise it may fall off), which may get tricky as the component becomes pretty hot, but with enough kung-fu you'll be able to do it easily (e.g., hold it with the fingernail). I soldered thousands of components this way.

Another tip: when in doubt, put a little rosin on the pad and lead before soldering them, even though the alloy is supposed to contain rosin already. Again, this reduces the risk of a poor contact.

Never use cheap unstabilized soldering irons - those are only for rough jobs like soldering the lid on a tin can, and then just use the biggest iron you can find. For electronics, only use stabilized (regulated) irons (soldering stations), that allow you to finely tweak the temperature. Working at the right temperature is crucial; too hot and you burn components and oxidize pads before they get soldered; too low and again you may burn components because you're fiddling with the iron too long; or you make weak unreliable contacts. You'll figure it out with experience.

I actually prefer to use a soldering gun instead of an iron for anything except very sensitive multi-pin components that don't like EM pulses. Again, it's a bit of kung-fu to know when to push the trigger and when to release it; essentially, your brain becomes the thermal stabilizer. :) You need to "wax on, wax off" many hours before you obtain the skills, but then it's awesome. The gun allows you to do neat tricks like transport large drops of solid rosin, because you heat it up or cool it down instantly, as needed; a station, OTOH, is always at the same temperature.

Heating up both lead and pad at the same time is crucial. It bears repeating - crucial. Push the iron or gun against both parts. Don't push too hard, but make sure the thermal contact is good and firm.

Whether you wait 1 second before touching the heated pad+lead with the alloy, or you don't wait, depends on the technique. Whether you wait 1 more second before you retract the iron, or you don't wait, again depends on the technique. But once the liquid alloy has spread out, pull the iron at once, don't tarry. Then blow air over the hot area.

Nail clippers work just fine for cutting leads.

Sometimes you don't want to solder components too close to the PCB. This is true for those resistors, transistors, etc. that dissipate a lot of heat while working. Give them some breathing room. In general, don't push 3-pin components (such as transistors) too close to the PCB; when they begin to resist, you need to stop pushing. But soldering them might be tricky if they're not sitting stable in that position.

All that stuff about toxic metals and rosin fumes - I should probably be a brain dead zombie by now, I never washed my hands afterwards. Rosin smells kind of nice actually, similar to incense, but breathing the smoke directly is not pleasant; I doubt the smoke is more toxic than any other kind of smoke.

Finally: 2 hands are sometimes not enough. It helps if you're an octopus.

<comment><USER13> Don't inhale solder and flux fumes ... you end up coughing up a lung or two, and if you do inhale enough of it (i've got some stupid friends) then your poop may turn black for a day or two.

In other words, make sure you have some way of moving the fumes out of your workspace, preferably having a wide open area, and or a fume extractor (Weller makes a great one).

<comment><USER15> Not sure what flux is that. I use pure rosin (colophony, Greek pitch - it's just solid pine sap) exclusively, never used anything else, and it's not nearly as bad. It's no different from incense in any way. One reason to stick to colophony is that I kind of like the smell. Incense-smelling clothes and hair were a staple of my teen years. :)

With proper technique, rosin is highly effective as flux.

Once I did a trial with aspirin instead, out of curiosity, but that stuff is devil's brainchild. It's very effective, it allows you to solder stuff on oxidized surfaces without problems, but the fumes will burn your nose, throat and windpipe - and maybe lungs too if you breathe deeply, which is pretty hard because you start coughing immediately. It's acid smoke, very corrosive. I tried it, then refused to use it again.

<comment><USER13> I don't know exactly what the stuff was, we had it at uni. You inhaled the smoke and you instantly started coughing, it was bad...

<comment><USER16> I've found that the newer no-clean and water-based fluxes give off some fairly nasty fumes. Rosin flux unless it's a very heavily activated type doesn't really bother me, although if I had a job that exposed me to it regularly I might start to worry about long term issues.

<comment><USER17> everything in excess damages you somehow.

</comment></comment></comment></comment></comment></comment><comment><USER18> I feel really stupid about a mistake I made recently while soldering, and this is extremely obvious: don't get cocky about where you're soldering.

I've been soldering for years, and just once I thought "you know, I'll just solder right here on the carpet. I'll be careful not to knock the iron over," instead of moving to my work desk. I melted a hole in the carpet.

</comment><comment><USER19> It's a fun guide, but a couple of things irk me. Bending the leads out is a serious no-no - makes it very hard to desolder the component. if there are a lot of components, it' better to solder them in by height, so you can allow tricky parts like diodes, resistors and inductors to rest face down on the table/workstation pad. I think that the things sticking out of ics and semiconductors are usually "pins" not leads. Banging a board on the table can chip the board or get you burned by molten metal... it's better for the entire job to clean the pads of solder with a vacuum tool or desolder braid. Holding your hand over the excess while side cutting is going to hurt and having slivers of tin, copper, nickel and lead in your palm ain't worth it. They should have also had a little aside about wattage as starting with a 45 watt pencil iron is going to suck.

</comment><comment><USER20> A couple other pointers.

1) Always tin the tip before soldering and tin it again before you put the soldering iron in the stand. This prevents oxidation of the tip.

2) Put some flux on the joint before soldering or desoldering. Always use a flux made for electronics, not the kind used for plumbing.

3) If the tip of the iron gets too much oxidation on it, you can generally restore the tip (do this when the tip is cold) by putting a bit of ammonia- based brass or silver polish on it and scrubbing it a bit with some steel wool and then wiping with a clean rag.

4) Whenever working with wire leads, tin the wires first before setting up the joint.

</comment><comment><USER21> Too bad they don't have a link to an mailing list for the _How to Make Cool Things with Microcontrollers (For People Who Know Nothing)_ , I definitely would like to be notified when that is available.

<comment><USER22> They do today: [http://mightyohm.com/blog/2011/04/sign-up-to-be-notified- whe...](http://mightyohm.com/blog/2011/04/sign-up-to-be-notified-when-my-book- is-published/)

</comment></comment><comment><USER23> Soldering through hole components is really easy (SMDs are another story, altogether). Like everything else in life, the best way to learn it is to practice. Just get a cheap vero board and a bunch of DIP sockets and solder em all. Then, try to desolder them with a desoldering wick. Also, get a PCB vice. With a vice holding the PCB firmly in place, two hands are all you need.

</comment><comment><USER24> I have spent a fair amount of time over the past 15 years both removing and installing different IC and discrete bits within hardware lab environments. I am not an expert solderer, and I would not want to work in a production environment, but I consider myself an exceptional solderer in the everyday (adverse) conditions you might find in a typical HW Engineering environment.

I don't know that it'll be all that useful, but I'll share some of what I've learned.

The key goals in an engineering environment are:

1.) You don't damage boards. No lifted pads, no torn barrels, etc. Ever. Unless you mean to (and sometimes you do, to make salvaging a pristine part easier.)

2.) You don't damage components while removing them unless you mean to (and you often will, to protect the board.)

3.) Your soldering is functional. When you are doing quick iterations, and noting the effects of whatever rework you've just performed, you need certainty that your circuit is actually what you intended.

Tools:

With a Metcal (or equivalent) and one fine tip, one broad tip -- you can remove or install pretty much any surface mount leaded component -- from a 0402 resistor to a large fine pitch TQFP. This sort of thing is common. You can also remove and or install pretty much any through hole component, up to large connectors. I'm going to talk mainly about removal, because it's not talked about as much (as it should be) and it's the more difficult side of things.

Removing things:

1.) small 2 lead discretes -- easiest with tweez pencil, grab it, solder flows on both ends, pick up, easy. generally you'll want to keep the part handy as you may go back to it, often just solder the resistor or cap to some other pad nearby, tombstoned. If you have only one iron, and say you're removing a 0402 -- easiest is to add solder to both ends of it and dance the iron back and forth rapidly to the leads. If the thermal reliefs are decent (as they should be for a 0402) it will tombstone itself and come right up.

2.) soic -- easiest with two irons (perform the below at the same time on both sides), but if you've only one, no problem. Take a SOIC16, 8 pins a side. Flow much solder down one side, bridging all pins. With any tip you'll be able to slide back and forth, causing all 8 leads to become molten. You want to use enough solder to bridge REALLY well. Insert tip of tweezer or dental pick under body near molten side and lift slightly. DO THIS VERY GENTLY. If all of pins aren't actually molten, and you pry on it, you will lift pads. It takes very, very little pressure. Once one side has lifted slightly, go to the other side and do the same thing. Now your SOIC is sitting above the board on both sides, sitting on solder piling. Take some solder braid and wick the solder from underneath the pins. Your SOIC will come loose, and you can clean it and the pads up with wick. SOIC is good for reuse, no lifted pads. If you did this with one iron and had to slightly lever the part, reform the leads slightly using tweezers.

3.) TQFP fine pitch -- It's always best to have all the right tools, my guide is how to do it when you don't have the right tools -- but need to do it anyway, and still pull it off. These are tricky.

With 4 irons (2 people) I've performed the solder bridge method, works well. Just flow all pins and remove part. With 1 guy, one iron, it can be done but you'll have to reform some leads when you're done. What you want to do is use fine tweezers or dental pick, and you're going to heat up one pin at a time and use the tip of the tweezer or pick to pluck the pin forward, lifting it up. You want to really heat up the pad, make sure solder is fully molten. Adding some flux is a good idea. Fine pitch pads with tiny traces are notoriously difficult to rework without lifting pads -- because people don't heat enough before yanking. You will probably lose some no connect pads using this method, tough not too.

You want to use this method on as few of the pins as possible, as its the most dangerous method. I cant stress enough, HEAT before applying any upward pressure. You want to work yourself into position to use the solder bridge method.

Do the above on two opposing sides (sides A and C). Just work your way down and do all the pins on both sides. Make sure all pins you think are free really are -- go through with wick and suck up the solder under the leads you've lifted. With two sides lifted you're back to a SOIC essentially..use the solder bridge method to lift sides B and D.

I've done many dozens of large TQFPs this way, with one iron, with no lifted pads. If can be done, just be very careful and take your time.

4.) Large through hole things with many pins (connectors, power bricks, etc) --

discretion is the better part of valor. If you are dealing with something with many through hole pads that touch heavy ground or power planes on multiple pins -- your best bet is to destroy the part. Trying to solder suck or wick out power and ground pins with a single iron is sometimes just impossible to do -- you will be at it for a long time, until the pads finally falls apart and you lose the annular ring, and your board is damaged.

If you only have one or two pins connected to a plane -- and all the rest are signals pins -- then clear the signal pins using wick/sucker, and then try to heat the reaminder of your plane pins at once. If you can get them all to flow, you can just yank the part out -- and THEN clear those plane connected pins.

If your part doesn't lend itself to this -- get out the dremel tool or the cutters and go to work on the part, systematically chopping or cutting it down until you are left with nothing but the pins in the holes....then simply heat the pad and pull out the pins with tweezers. THEN clear the hole. It is almost always the right choice, I've seen more boards destroyed by people trying to remove large through hole connectors and power bricks, when preserving the part was not a necessity. Know the goal -- if the part can go, then chop it out in little chunks. Not only the right thing, but kind of fun, too.

OK, that's all I can type for now -- I'm sure everyone has their pet methods and whatnot, and there are always caveats. I think its good to have the tool bag to perform "down and dirty". Honestly most places I've been, that's all there is or is time for.

<comment><USER25> I wish I had read this a few days ago...

I was trying to desolder a damaged mini usb port on my wifes mp3 player. heat, wiggle, heat, wiggle, pull... broke the traces. I should have cut the offending part down first to avoid damaging the board.</comment></comment>


Reasons Not To Take VC Money  - <AUTHOR> http://www.siliconvalleywatcher.com/mt/archives/2009/05/7_great_reasons.php

<comment><USER2> "What if you end up with a very profitable, modest sized business that you want to just run? That is no longer an option once you raise VC money."

Why hasn't the market produced a VC variant that's content with this, and willing to earn back its investment over the course of long term dividends? My guess is, the numbers just plain don't work out. If VC's are 10% successful, each successful startup has to pay for 9 failures. A VC might be 25% successful choosing successful dividends-bearing companies, but (a) those won't make up for the remaining 65% of failures and (b) the amount of dividends needed would dilute profits, so the founders wouldn't be any better off than if they didn't take the VC money in the first place.

<comment><USER3> Mainly because venture investors need to get their capital back, so they can invest it in new startups.

But another problem with dividends is that they'd be so easy to spoof. It would be easy to claim that a business was making no money while finding ways to funnel it to oneself. That's what record labels have traditionally done to musicians: they give them a percentage of the net, then arrange that the net is near zero.

<comment><USER4> _Mainly because venture investors need to get their capital back, so they can invest it in new startups._

The most common investors in the venture capital asset class are pension funds and university endowments. They have the least need for liquidity of any investors in the economy. They should be indifferent between selling the stock at market price and holding the stock forever. And they should be able to fund new rounds of startups from the cash flow of their overall portfolio.

 _It would be easy to claim that a business was making no money while finding ways to funnel it to oneself._

If investors of any company cannot prevent management from looting then there is a major problem. But investors can fire the management. Musicians have no such leverage.

</comment></comment></comment><comment><USER5> I'm sure there's just as many reasons to take VC money. It totally depends on your business plan.</comment>


Fractals in Clojure: Buddhabrot Fractal - <AUTHOR> http://nakkaya.com/2009/10/04/fractals-in-clojure-buddhabrot-fractal/ <comment><USER2> If I recall correctly (it's been a while), the normal Mandelbrot works by treating each pixel as a complex number and seeing if it escapes to infinity or not when iterated through some formula... the Buddhabrot however plots which values are landed on as numbers are iterated...

An interesting alternative I tried some years ago is to draw lines for each iteration instead, between where it started and where it ends, leading to the following result:

<http://img40.imageshack.us/img40/583/pathsoftravel5.png>

(I have some C code lying around if anyone's interested.)

<comment><USER3> Very interesting. Are you into chaos theory? Some day I would like to investigate if behavior on HN, say average score on the front page over time, lies on a strange attractor or not.

</comment></comment><comment><USER4> Haha... best thing is the name.. "Buddhabrot".. Still laughing!

To explain: "Butterbrot" is german for a slice of bread with butter.. spelling is nearly the same as "buddhabrot"

<comment><USER5> I think you mean the pronunciation; it is basically the same as how some Germans say it (or sometimes? actually I don't know whether it's regionally or what, as I'm from Switzerland where you don't hear it pronounced that way).

<comment><USER4> Uhm, yes, pronounciation of course

</comment></comment></comment><comment><USER6> Is anyone else seeing an image of fractal on that page? I don't see one.

</comment><comment><USER7> No matter how many times I see fractals visualized, they never cease to amaze me.

<comment><USER8> Jonathan Coulton said it best: "Infinite complexity can be described by simple rules."</comment></comment>


Show HN: Timeline.com - <AUTHOR> http://timeline.com/ <comment><USER2> Wow. Excellent execution of an awesome idea. Seriously, I've always lamented the fact that news is never presented with enough background, and the fact that these articles allow the user to either get an overview or an in-depth history is really exciting. I currently use Yahoo News Digest for quick updates about the day's events, but this complements that form of news consumption very nicely and I could see myself using it often.

Minor point, the UI is a bit glitchy and sometimes the header bar shakes back and forth. Also, navigation from within stories is unclear - I couldn't figure out how to get back to the front page section. I'm not sure if the functionality isn't there or just wasn't working, but a swipe left to go back would be much more user friendly.

Well done, and congrats on launching!

</comment><comment><AUTHOR> Wow. Thank you so much for the positive outpour of support, we are near the point of tears of joy with today's launch!

I'd like to take a minute and get back to all your questions and comments:

* Bugs and glitches: please keep the feedback coming! This is a version 1.0 product, so we're standing ready to fix issues ASAP as they come up.

* Technology choice: the iOS app is entirely native, written in Swift. The API is written in GO, and the web app is Angular.JS. Very shiny new tech all-around!

* Native vs. Web: We have a native iOS app on the AppStore right now, all other platforms can access full functionality via our web app [http://m.timeline.com](http://m.timeline.com)

* Maps and geographical exploration: Can't say much except "coming soon". If you have an interest, experience, or actual technology in this area we'd love to work with you.

* Contributing: We'd love to hear from you, and we'd love your help. Shoot us an email: email@example.com

<comment><USER3> Regarding maps and geographical exploration, I agree with you that should be at lower priority. I think start from events happening now such as news is a much better and more efficient way to foster the positive feedback loop. When the timeline module is more polished and with more resources, it could be a good time to explore the module for map layer. Eventually, combining both layers to have a tool that I dream of. I'm just someone interested in this because of how powerful I think it could be. At this moment, I don't have enough skills to bring it to life. Nice work.

</comment></comment><comment><USER4> I think this is great execution but I'm not sure I would use it over Wikipedia. If I want to know the timeline of Boko Haram, I think I would get more objective and comprehensive timeline information, with sources, from Wikipedia's page on Boko Haram* than the Timeline.com page __.

1 [http://en.wikipedia.org/wiki/Boko_Haram#2009](http://en.wikipedia.org/wiki/Boko_Haram#2009)

2 [https://m.timeline.com/#!/stories/boko-haram-nigeria- history](https://m.timeline.com/#!/stories/boko-haram-nigeria-history)

<comment><USER5> Wikipedia is an encyclopedia, Timeline is a news app that appears to publish articles with historical context and an innovative UI.

Why would you compare them? Apples and oranges, imho.

</comment></comment><comment><USER6> That would not have been a cheap domain name to acquire, especially after Facebook rebranding 'the wall' as 'the timeline'.

<comment><USER7> Just did a quick site price estimator, probably not super accurate but it said about 18k. [http://www.siteprice.org/website- worth/www.timeline.com](http://www.siteprice.org/website- worth/www.timeline.com)

<comment><USER8> I'm not sure how reliable that site is considering it's estimating the domain thehungergames.wikia.com to be worth $30.1M [http://www.siteprice.org/website- worth/www.thehungergames.wi...](http://www.siteprice.org/website- worth/www.thehungergames.wikia.com)

<comment><USER9> Also, insurance.com, which was sold for $35.6 million[0], was estimated to be worth <$29k[1].

[0] [http://en.wikipedia.org/wiki/List_of_most_expensive_domain_n...](http://en.wikipedia.org/wiki/List_of_most_expensive_domain_names)

[1] [http://www.siteprice.org/website- worth/www.insurance.com](http://www.siteprice.org/website- worth/www.insurance.com)

</comment></comment></comment></comment><comment><USER10> Very, very cool. I'm skeptical about your chances of success (I feel like news startups are just behind music startups in terms of mortality rate), but I've been wanting something that looks like this for a good long while. I think the lack of this sort of resource has done a grave disservice to our understanding of world events. So, thanks a lot for agreeing with me, and acting on it :)

(n.b. I'm a mobile engineer at NBC News, and arguably in direct competition with these folks.)

</comment><comment><USER11> I like the thought that has gone into expressing the app's motivations. As a curated app, I was interested in learning about the people behind it. Your About, FAQ/Editorial and Licenses section under timeline.com/about was fun to read. Too bad it was hidden away on the homepage. But, maybe you did this intentionally.

I'm in the process of working on a timeline-like design, non news related, so this piqued my interest.

</comment><comment><USER12> I like the idea of presenting news with related articles for historical context. I don't think I'd download an app. But if it were a website, I'd go there to learn more about a current news topic.

<comment><USER13> Yeah I would love this to be a website. I tend to read news at work (!) on my lunchbreak, on my desktop, so would love this to be a website.

</comment></comment><comment><USER3> I planned a tool to combine both timeline and map to be a tool for history exploration. With geography layer and time together, history can be shown in a clearer and impressive way. If one set of those by one user can be called a set. When grouping multiple related sets from different users, it must be amazing. It could be a game changer tool for history research and education. Moving those "meta" data to layers we can easily understand is a dream. Hopefully, I'm able to see it happens soon:)

</comment><comment><USER14> This is great. Will definitely be my go-to app to kill some time and catch up on things.

I noticed an odd sentence structure in an article though. Not sure whether this text was generated, wasn't copy-edited or I'm just not reading it correctly:

> Gadhafi's compound in Tripoli was connected to a web of secret tunnels. But > they did not save him: the tunnels where Gadhafi was captured in a tunnel > while trying to escape Sirte, his hometown, in a golf cart.

<comment><USER15> yep, 'the tunnels where' in the last sentence seems like a typo

</comment></comment><comment><USER16> This is beautiful. It really shows that a lot of thought has been put into it. Have you guys thought about using CartoDB's Oddysey.js[0] to integrate maps in your timelines? It seems both projects are very related to each other.

(Full disclosure, I'm a CartoDB employee, although not involved in Oddysey's development)

[0] [http://cartodb.github.io/odyssey.js/](http://cartodb.github.io/odyssey.js/)

</comment><comment><USER17> Why can't that be a website ?

Why do you have to make console-exclusives ?

<comment><USER18> [https://m.timeline.com/](https://m.timeline.com/)

<comment><USER19> [https://m.timeline.com/bower_components/angular- facebook/lib...](https://m.timeline.com/bower_components/angular- facebook/lib/angular-facebook.js) Failed to load resource: net::ERR_BLOCKED_BY_CLIENT [https://www.google- analytics.com/analytics.js](https://www.google-analytics.com/analytics.js) Failed to load resource: net::ERR_BLOCKED_BY_CLIENT app.js:4 Uncaught Error: [$injector:modulerr] Failed to instantiate module timeline due to: Error: [$injector:modulerr] Failed to instantiate module facebook due to: Error: [$injector:nomod] Module 'facebook' is not available! You either misspelled the module name or forgot to load it. If registering a module ensure that you specify the dependencies as the second argument.

Chrome/Linux Version 39.0.2171.95 (64-bit)

<comment><USER20> It's your ad/privacy blocker, FYI.

<comment><USER21> Not working for me on a fresh install of IE10. I.e. (no pun intended) not due to any sort of ad/privacy blocker.

<comment><USER22> Yup, this is an error on our end. We've got a fix for it in the next build. Thanks guys!

</comment></comment></comment></comment></comment></comment><comment><USER23> I've been dreaming about a site like this for years. Casual newsreaders need context given to them in a friendly way so they can properly engage with the content. Vox.com explainers are one thing but this is even better. Kudos on launching!!

</comment><comment><USER24> I LOVE anything that will add the needed context to news stories.

The article on Boko Haram is good. I like video and income map. The actual timeline functionality on the web view still needs some work. With a good timeline you can "feel" the differences in timespan.

Overall, I like the idea and the content. More please!

</comment><comment><USER25> I think the servers must be getting killed because the mobile web version loads incredibly slowly or not at all.

Also @rohamg I think there are some compatibility issues. In Firefox for Android I see only the site logo on a gray background. Chrome for Android loads ... eventually.

</comment><comment><USER26> Oh, Oh! ... dammit. I've been think about something like this for a while now. Nicely done.

</comment><comment><USER27> _Absolutely_ love the insight of news being "the short tail of a very long string of events". Along with the promising execution this could well be one of those tremendously successful ideas that look trivially logical in hindsight.

</comment><comment><USER28> No IOS device here. Trying to use the "mobile-web" app but all I get is an empty page with your logo then eventually Chrome asks me if I want to kill the page(on my PC) or nothing happening at all on my Moto G.

</comment><comment><USER29> I don't have a mobile device, so I can't really tell what's going on. Can someone give a brief overview of what this is about? It's supposed to be a new way of browsing news, right?

<comment><USER30> The mobile web app works great on desktop as well: [https://m.timeline.com](https://m.timeline.com)

</comment></comment><comment><USER31> Can I ask, was this at all inspired by reading my blog post that I posted here last year?

Looks awesome!

[http://jamie.st/blog/news-timeline-v2/](http://jamie.st/blog/news- timeline-v2/)

</comment><comment><USER32> Looks like this has been developed using the famo.us framework? I only say this because the parallax effect in the video is very reminiscent of a famo.us demo that was there yesterday but gone today.

<comment><USER33> Their about page lists the licenses for several native iOS libraries (AFNetworking, etc) which suggests it is mostly native.

<comment><USER34> Dev here. It's all native. Our iOS team says, "some of the third party libraries we have are Objective-C, but we've only written Swift code."

</comment></comment></comment><comment><USER35> With your servers seemingly being hit kind of hard, I'd recommend a refactor pass to using ng-bind over {{ }} syntax. Seeing unparsed expressions all over the place on your web app.

<comment><USER22> Hi grumblestumble, we're on it now. Thanks for the heads up!

</comment></comment><comment><USER36> Very small thing, but there is a space missing after the period in the tagline:

"..string of events.Timeline weaves those.."

Otherwise looks awesome!

<comment><USER37> Great eye, and thanks for the feedback! We'll fix pronto.

</comment></comment><comment><USER38> I love the tagline. It's short, sweet, and immediately gets the point across. Great job!

</comment><comment><USER39> The only way to understand what does it do is by watching a video?

</comment><comment><USER40> Pretty awesome idea. I'm willing to contribute.

</comment><comment><USER41> Thats one premium domain...

<comment><USER42> It's gotta be part of the business strategy. If the business itself flops, they've always got the increasingly popular domain name to sell to the highest bidder.

</comment></comment><comment><USER43> pretty good domain name

<comment><USER44> just "pretty good"? When i heard of Timeline now, I think of Facebook. This domain worths quite a lot i think.

</comment></comment><comment><USER45> Great idea! Congrats

</comment><comment><USER46> good idea, congratulations!</comment>


Show HN: Kronikl … Share what you want and keep the rest - <AUTHOR> https://www.kronikl.me

<comment><AUTHOR> Kronikl is a project we've been working on for the past year. It's deigned as a personal Facebook; a private experience where you can save and preserve the things that are important to you and build an archive of your storyline. You can share posts with friends from your Line, you can build a Line together with your friends or you can keep all of your content to yourself. Our video is here [https://www.youtube.com/watch?v=Y_gTUVF1kNI](https://www.youtube.com/watch?v=Y_gTUVF1kNI). You can see the project at [https://www.kronikl.me](https://www.kronikl.me). Feel free to offer any feedback.</comment>


"Dia" - sandbox an application or block of ruby code on Mac OSX - <AUTHOR> http://github.com/robgleeson/Dia

<comment><USER2> Thanks for the coverage "there" :-)

Rob</comment>


Dutch Rail: Where will the train stop? Where can I find an empty seat? - chestnut-tree https://www.youtube.com/watch?v=xZKA02SHV2Y

<comment><AUTHOR> How are they measuring the number of people in each car? I suppose it could be done as the conductor checks tickets, which would probably only require a software update.</comment>


Why Microservices? - <AUTHOR> http://dev.otto.de/2016/03/20/why-microservices/ <comment><USER2> Monoliths used to have specalists, people who know intricacies of cloud deployment, experts in db query tuning ect.

What happens to these people when ppl move to mircoservices. Now we have bunch of devs who are expected to be jack of all trades doing everything sub optimally .

I've seen some places move all database experts to 'db as service' team, but this arrangement is awkward at best and have strange organizational and management issues that were not present in monolith style development

<comment><USER3> In the beginning, every team that is able to build a monolith should also be able to build multiple microservices. Think of microservices being highly cohesive and loosely coupled components...

But this will not scale with respect to the number of dev/ops/qa people or with respect to the number of microservices. We did it differently from the beginning by starting with four instead of a single team.

Today, we have ~12 "feature teams" and a few teams for "cross cutting concerns": A team that is responsible for loadtests (ensuring scalability), one for (ensuring) security, one for "platform engineering".

The feature teams are responsible for one or few "bounded contexts" (->Domain Driven Design) like "ShoppingCart", "Search", "Navigation". Every BC is implemented by one or more microservices.

Teams have developers, testers, and everything else, that they need to develop and operate their services. Splitting teams by skill (DB, Frontend, ...) instead of splitting by business domain (shopping cart, ...) would only have the effect, that multiple teams heavily depend on each other, all the time. IMHO not a good idea. I would strongly recommend to build mostly independent, autonomous, cross-functional teams. DevOps teams.

\--Guido

<comment><USER4> Actually what you describe here is mostly why I think that it was stupid to rebuilt otto.de from scratch. microservices are a improvment over a monolith inside a bigger Application with a big team. Microservices are happening caused by team sizes and management overhead, it had nothing to do that a monolith is bad at all. And that's why I dislike all the fancy posts about them, nothing stops you from doing all the same things with a monolith, especially when you have a small team. As your team grows you mostly change to a service oriented architecture and evolve from there. it mostly isn't a good practice to start with a microservice architecture without having a monolith that you need to split (I know there are some but stil.. it's hard to say that the overhead it produces with a "few" people is valueable). Actually a lot inside this article explains what parts were easy, however the hard parts about such systems are mostly not written anywhere near, which is most managing logs, faulty systems, automatic routing, versioning, database migrations if the system has a database, updating servers, service discovery, service load-balancing, service monitoring, edge service router and that are prolly just a few of the dozen things which makes such systems harder.

<comment><USER3> We did not rebuild otto.de from scratch because we wanted a microservice architecture. We had to rebuild otto.de, because the old monolithic shop was not meeting non-functional (and a single functional) requirements anymore. And we had to rebuild it, because the old shop was based on a standard product, so we were unable to simply refactor it. When we started the development, we were looking for an architecture that is meeting our requirements - and we did not chose microservices in the beginning, but self-contained systems ([http://scs- architecture.org](http://scs-architecture.org), [https://en.wikipedia.org/wiki/Self- contained_Systems](https://en.wikipedia.org/wiki/Self-contained_Systems)). Microservices were introduced later, when the first SCS became too large again. I think, you should not use microservices, because they are interesting. You should use microservices, when you have problems that are addressed by this architectural style.

I totally agree, that microservice architectures (just like any other kind of distributed system) have a lot of challenges. It is hard to solve the problems, that you mentioned. My article was about the good parts - but I could very well imagine to write a follow-up about all the challenges :-)

\--Guido

</comment></comment></comment></comment><comment><USER5> > We are currently deploying multiple times a day, up to 250 times a week > (continuously increasing).

That is such a huge win. Time spent deploying and monitoring is wasteful; especially when you have a large application running on hundreds of machines.

<comment><USER3> Not only deploying and monitoring: managing bugs instead of fixing them. managing releases instead of releasing. And by the way: developing small microservices instead of trying to understand how to extend a single big, tangled monolith. \--Guido

</comment></comment><comment><USER6> i really miss the days when otto shipped games on their free cds ... what was the name of the logistic/world trade game again .. back in the DOS days (win95?)</comment>


The CPU Cost of Networking on a Linux Host - <AUTHOR> https://people.kernel.org/dsahern/the-cpu-cost-of-networking-on-a-host <comment><USER2> For many years, the most popular routing platforms (i.e., boxes built by Cisco) performed IP packet forwarding and management functions on the same processor (often a RISC architecture). In cases where packet rate was high, it was possible for devices to become unresponsive or lose critical protocols responsible for sharing routing information.

In the last 15 years there has been a hard move away from these architectures. Almost no packets are forwarded by the same processors running management and control plane functions anymore. This is mainly because the required traffic rates today need dedicated silicon purpose built for the task (the Broadcom Tomahawk3 can do 12.8 Terabits/sec above a relatively small packet size).

I don't know how things will shake out for the Linux world and x86 packet forwarding given the trend and lack of real performance in the kernel. Right now, your best bet when it comes to Linux and high network throughput/packet processing requirements is to just bypass the kernel entirely with DPDK, a "smart" NIC, or XDP.

<comment><USER3> I wonder if there's an economic argument, at useful scales, to using FPGA's in general purpose servers to accelerate network performance. The purpose-built ASICs would win on cost-per-unit every time, but the FPGA would have some adaptability to new protocols or algorithms that the ASIC wouldn't.

<comment><USER4> There's some cool tech going on at barefoot ([https://barefootnetworks.com/](https://barefootnetworks.com/))

I don't know much about the technical details, but the pitch I've heard is that it gives you ASIC level performance with more flexibility to reprogram the chip (not full FPGA).

<comment><USER2> Yeah, it's an interesting approach. They're basically allowing you to define packet processing with P4 on their Tofino family of chipsets: [https://p4.org/](https://p4.org/)

That said, there's only so much you can do in a chip before considerable tradeoffs are going to be made. They're not going to offer the same level of flexibility you get out of a general purpose CPU, but may not have same the restrictions of most fixed pipeline chips - their product sits somewhere in the middle. Also, P4 seems to sit in a space complex enough to make it unreasonable for most network shops - it's not for your average enterprise or service provider network.

</comment></comment></comment></comment><comment><USER5> This is one of the reasons I have a strong aversion to "cloud" technologies like docker and kubernetes. You take networking, something with decades of development and hardware support, and you put it all in the CPU.

To be clear, Linux has a very robust networking stack. But it will never come close to the natting and routing performance of an actual router.

And so we develop things like DPDK to spend _even more_ CPU just to keep things usable, but it still feels like a big step backwards.

A typical k8s deployment runs in containers that are in VMs. So each packet you want to send to or from a container needs to touch a cpu and traverse a networking stack _six times_. That's dumb.

<comment><USER6> > That's dumb.

Is it? It's certainly inefficient compared to dedicated hardware. But so is anything relying on a CPU - we could just use ASICs for everything. But then every logical change requires weeks/months/years of development and manufacturing.

The goal of k8s, VMs, etc is flexibility. I can set up a 100-node k8s cluster with less-than-perfectly-efficient networking stack in mere minutes. Good luck matching that with dedicated hardware.

<comment><USER5> > But so is anything relying on a CPU - we could just use ASICs for > everything. But then every logical change requires weeks/months/years of > development and manufacturing.

Right, except the asics already exist and you're actively choosing the less efficient, more expensive option.

> The goal of k8s, VMs, etc is flexibility.

I don't think this is necessarily bad, as long as you understand the tradeoff. You're choosing a fundamentally slower architecture to make management easier. It's a choice of prioritizing the developer experience over the user experience.

<comment><USER7> In this case it's not even user experience vs. developer experience as you can have both; it's just the cost for performance gets higher as the efficiency decreases.

On the other hand: the cost for development goes down if you don't need to pay for extra steps taken by an extra person. If you take a 10-step process that is run by 5 people and reduce it to a 5-step process run by 3, you have 2 more people to do other stuff, or roles that you don't have to create/fill in the first place.

</comment></comment></comment></comment><comment><USER8> Good short article. CPU power saving has an effect on interrupt handling and becomes a factor at high packet rates. Turning off p-states will improve performance.

</comment><comment><USER9> What happens when you "netperf TCP_STREAM from 2 sources"?</comment>


3D dual n-back Speed Run - <AUTHOR> http://cognitivefun.net/test/22 <comment><USER2> Great stuff... but on this test, instructions are a little unclear. It took me a while to understand that the 8 possible positions of the 'door' were the 'image' I was back-matching, and not the pattern of markings on the tunnel sides.

Also, as with other tests, the lack of a clear end (or even break) point is distracting, and makes it hard to compare runs, or even cleanly end a run at a standard length.

Not that whacked_new asked, but my overall estimation of cognitivefun: wow, you're generating a lot of games... but the overall comprehensibility of the site lags a bit. It's almost too much to absorb: where do I start? where do I stand? where do I go next? I suggest spending a little more time (or enlisting some help) with web design/copywriting/info-architecture.

<comment><USER3> Thanks for the feedback (and the mail as well), and you're right about everything. I'm going to add some fixes this week, which would hopefully solve the "lack of clear end" you talk about; don't know about the CSS fixes yet (shudders).

As for this test, I've battled with the design a bit (and know that it is nevertheless unintuitive). I suppose even after the demonstration it wasn't clear?

Finally, as you pointed out, one of the biggest problems is the clutter now. This has been an issue for a while already, although I still don't know how to best address it. I'm not sure if it is good to give a "start here, then here" guide; I just want users to be able to do whatever they find interesting within a few mouseclicks. But I'm all ears to suggestions regarding front page changes.

Thanks again.

</comment></comment><comment><USER4> HN user whacked_new builds these things, and doesn't get the credit he deserves IMO. Fantastic work.

<comment><AUTHOR> Agree. He has build the funfair of brain fitness!

</comment></comment><comment><USER3> Thanks for the submission and feedback!

</comment><comment><USER5> w_n! This new one looks great! Going to try it out today for sure.

The best part of the site is the tagline: "cognitive neuroscience for everyone"</comment>


What Is Posix? Richard Stallman Explains - <AUTHOR> https://opensource.com/article/19/7/what-posix-richard-stallman-explains <comment><USER2> RMS agrees to explain something for a site called "opensource.com". What a time.

</comment><comment><USER3> Who hurt Stallman to make him this way?

<comment><USER4> You can actually read all about it.

[https://www.gnu.org/gnu/rms-lisp.html](https://www.gnu.org/gnu/rms-lisp.html)</comment></comment>


Let the hackers raise the bar - <AUTHOR> http://www.64notes.com/let-them-raise-the-bar <comment><USER2> Hackers doesn't really leave that much of an impression to me. They are, after all, oftentimes referred as computer criminals.

<comment><AUTHOR> Then you have no idea who Hackers are.

</comment></comment><comment><USER3> Hackers are after all the sanest and most helpful people around!

<comment><AUTHOR> I know, right. I love haging out at HN. It's amazing what people around here keep doing - they keep raising the bar and make me better. :)</comment></comment>


Twistori -- an experiment: discovering the feelings of our global consciousness (using twitter) - <AUTHOR> http://twistori.com/

<comment><USER2> Twistori is an excellent example of blending art with human experience with a bit of technological black magic. I saw Eric Kastner give a talk at this year's RailsConf. It was a very _intriguing_ session on microapps. Amy Hoy was in the audience but participated in the talk too.

Twistori was a micro-app, as was Spell with Flickr.

A micro-app is loosely designed as an application you design and build in one continuous period e.g. day (in Amy's case, she woke up one morning with this idea and worked with her husband all through the day and launched Twistori at the end of the day).

Twistori doesn't use Ruby on Rails. It's very lightweight on the backend (once every hour a cron job scrapes the latest Twitter chats containing those human emotives via Summize and a bit of clever javascript). Amy said that the colors were very deliberately chosen. The design was very deliberate - the thoughts that scroll off at the top of the screen - you can't scroll them back - they're ephemeral...

TwitterVision, another favorite of mine (coded in 4 hours by Ruby on Rails ninja David Troy), was just featured in the MOMA! ([http://davetroy.blogspot.com/2007/10/moma-ny-selects- twitter...](http://davetroy.blogspot.com/2007/10/moma-ny-selects- twittervision.html))</comment>


WHO: "situation in Guinea has improved significantly over the last few weeks" - <AUTHOR> http://www.afro.who.int/en/clusters-a-programmes/dpc/epidemic-a-pandemic-alert-and-response/outbreak-news/4121-ebola-virus-disease-west-africa-25-april-2014.html

<comment><AUTHOR> Potentially of interest to those watching the Ebola outbreak in West Africa - several sites in Guinea have passed the typical Ebola incubation period without reporting new cases.</comment>


Show HN: Unstyle – App that removes styles, scripts, ads from websites - <AUTHOR> https://unstyleapp.com/ <comment><USER2> Definitely something I didn't know I wanted! Haven't tried it but it looks great. I think you should explicitly say in the description that users will save on cellular data/roaming fees as a main use case.

</comment><comment><USER3> Brilliant idea. I had this idea myself but I love your execution. It's awesome! My idea was to 'provide a service that makes websites as light as possible (while still user friendly)'

</comment><comment><USER4> Brilliant idea. Can you package it as a Firefox plugin?

<comment><USER5> Use Ghostery, NoScript, or uBlock to disable Javascript/downloading certain files. Then add a rule for "*.css" to block any CSS being applied.

Optionally, without using any addons, disable Javascript under your Firefox settings. Then press press Alt to bring up your Menu Bar and under "View" go to "Page Style" and select "No Style". (Or "LeftAlt, Shift+V, Shift+Y, Shift+N")

You may be interested in Readability: [https://www.readability.com/addons](https://www.readability.com/addons)

<comment><USER4> Sure, that's pretty much what I do already. I just thought it'd be nice to have the one-stop package offered here.</comment></comment></comment>


TestFlight Beta Testing - <AUTHOR> https://developer.apple.com/app-store/testflight/

<comment><USER2> I'm using both Apple TestFlight and the original TestFlight, and the original is just such a smoother experience, even with having to add UDID's to provisioning profiles.

Things that are annoying about Apple TestFlight compared to the original:

\- itunesconnect, while better than before, pales in comparison to the simplicity of testflightapp

\- builds submitted to Apple "take a while" before they're available, testflightapp is instant once you've uploaded.

\- managing users in groups seems to be absent

<comment><USER3> Last week I tested 7 builds with my team in the span of an hour. This all worked great because I was using original TestFlight which allows me to distribute immediately.

Waiting on Apple for each one of those builds? No, thank you.

</comment></comment><comment><USER4> Does anyone have experience yet with the timeline for the beta app review required for external testers? This is significant because I feel like I would just have internal users bring their device over, or install it themselves from Xcode. Its the external users that seem the most important with this.

My regular submissions have ranged from 7 days to 20 hours, but I would hope they will keep the beta review to the shorter end of that.

<comment><USER5> I'm very curious too! If it takes anything more than a day to get an app review, this tool is going to be pretty useless for us. :(

I've submitted an update to our app to external app review, so hopefully I'll have more information soon. [Update: Now "In Review", for what that's worth.]

<comment><USER5> And we just got approved! Took ~2 hours.

<comment><USER6> Took about half a day for me. The waiting time is well worth the 900 extra beta testers you can add. At least for us.

</comment></comment></comment></comment><comment><USER7> > Apps made available to external testers require a Beta App Review and must > comply with the full App Store Review Guidelines before testing can begin. A > review is required for new versions of your app that contain significant > changes. Up to 10 apps can be tested at a time, internally or externally.

Eww. Still doesn't hold a candle to an APK.

<comment><USER8> Or using an enterprise certificate.

<comment><USER9> > Or using an enterprise certificate.

Be careful with this!

I see a lot of companies using this as a way to avoid the pains of obtaining UUIDs (for testing) or of distribution on the App Store, if their production product is not intended for public use.

But if you read the fine print for enterprise certificates on iOS, they're not actually supposed to be used for distributing applications for test-use on- site, or non-test use off-site ("site" in this case referring to your physical office), or for use by non-employees (this _includes contractors_!).

It's completely ridiculous, and I was shocked to discover this, but as far as I can tell, it's true (I even had a phone call with an Apple rep who explained the various certificates to me).

Of course, if you're operating on a small scale they're unlikely to find out if you're using the enterprise certs in this way. But it's still a risk to be aware of.

<comment><USER10> One of my prior employers was using an enterprise certificate to deploy an application to clients, themselves in an enterprise environment. Our Apple rep told us, in no uncertain terms, that we were fine. So maybe not everybody's on the same page...?

<comment><USER11> I think the rule of thumb here is common sense. I know for certain a large number of med comms agencies in the pharmaceutical industry use enterprise certs for "internal" app distribution (think one off events, internal meetings etc. maybe needing to be run on 500 devices for 1 day only), where content may not be legally signed off/approved until 2am for an 8am start the next day. There's simply no way (other than jailbreaking) to get around this at the moment.

If Apple were to start enforcing this with an iron fist, a lot of this industry (which is, believe it or not, responsible for a lot of device sales) would quickly migrate over to Android, now the devices look and function as well as their iOS counterparts.

This doesn't hurt Apple's ecosystem - everyone is running Macbooks, iPads, iPhones, paying enterprise fees, etc. Most of these apps have no place clogging up the Appstore or consuming Apple reviewers time.

They just don't want you buying an enterprise cert to push out your emulator bundled with illegal ROMs or illegal movie streaming app, easily downloaded by all & sundry off a public web server.

This is why they put up the barriers of DUNS numbers, brief phone interviews, etc., before they will issue you an enterprise account.

<comment><USER10> Ha, yeah--we were making medical dictation software. Our software was definitely part of keeping iPhone and iPod Touch devices in doctors' hands.

</comment></comment></comment></comment></comment></comment><comment><USER12> It's disappointing seeing how TestFlight has been integrated into iTunes Connect. What mostly upsets me is the seemingly arbitrary review before the app is released to testers. It's exactly this kind of a delay ("several hours") that keeps me from using Google Play for Android app beta & alpha testing.

I end up with tight deadlines and my testers include clients & superiors. I can't afford a variable chunk of time between app compilation and release to testers. I've had really good experiences with Crashlytics and have heard good things about Hockeyapp. I'll stick with 3rd party distribution for the forseeable future.

</comment><comment><USER13> Tester? Seeking tester? I'm running a list to connect developers to people who want to test their apps.

All feedback appreciated.

[http://sealedabstract.com/betalist](http://sealedabstract.com/betalist)

<comment><USER4> >This list connects people who want testers, with people who need them.

I get what you mean, but this doesn't quite make sense.

<comment><USER13> Good point. Better now?

</comment></comment></comment><comment><USER14> It's about time! It's been such a hassle always needing the device id, creating the provisioning profiles, having to recreate the profiles and rebuild the project for every user you add. And also being limited to only 100 devices.

<comment><USER15> Testflight has been around for a while. was using them for beta tests a couple years ago. looks like apple acquired them and made it official.

<comment><USER16> Yeah I think it was apparent that was the plan when they acquired them. It just took them soo long to get it integrated. Using testflight as it was, was good but it was a little painful. This in comparison should be a lot more simplified and smooth.

</comment></comment></comment><comment><USER17> I'm going to do a bit of shameless self-promotion for my CLI tool for ad-hoc deployments, hawk:

[https://github.com/mtrudel/hawk](https://github.com/mtrudel/hawk)

Using a bit of XML glue, it uses simple building blocks of xcodebuild, S3, and email to give you one command building and distribution of your app, all driven by a plaintext Hawkfile. I (and a few colleagues) have been using it for a couple of years now, and it's been a real boon. Would love feedback.

</comment><comment><USER18> Sorry to see that the older TestFlight seems to be losing functionality. Sessions show up as anonymous and remote logging doesn't work for me anymore. I'm thinking of switching to [http://hockeyapp.net/](http://hockeyapp.net/)

</comment><comment><USER6> I read that the beta app review only applies for the 1.0 version, or if you make significant changes. Not sure about the time frame though.

</comment><comment><USER19> Kudo's to them on branding. The name was so good even Apple decided to keep it!

</comment><comment><USER20> Is it only for ios8?

<comment><USER5> Yep.</comment></comment>


A Tesla S owner's winter road trip experience - <AUTHOR> http://andwediditourway.blogspot.com/2013/02/the-not-so-ev-life.html

<comment><USER2> Why do people insist on taking long winter road trips in cars that common sense suggests are for city / daily commuting duties?</comment>


Those 500K Bitcoins that caused the flash crash weren't real - <AUTHOR> https://mtgox.com/press_release_20110630.html

<comment><USER2> If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so _right now_. When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know that I could still withdraw my money because they have enough cash on hand for me to do so.

Mtgox has neither of those assurances.

They have absolutely no credibility on the security front. They were using MD5 with no salts at one point in time. They then moved to MD5 with salts. Now they are at "SHA-512 multi-iteration, triple salted." That seems more like they're trying to say "Oooohh! Look at us! See?! We're being secure!" Triple salted means what, exactly? (Other than the fact that it makes it clear these are people who read about salting online and then though "more is better.")

Next: "we have actively been patching holes." Oh no. You mean, you're just going through the code and looking for bugs and hoping you get them all? That might work for normal programs just fine, but even ONE vulnerability is enough to take an _entire_ database. A database hosting just passwords may not be all that bad (it usually is, but it doesn't have to be). A database which hosts thousands and thousands of dollars? Now that is something to worry about. It truly does look like they got lucky on this attack.

As for the guarantee that banks give -- that if they get broken in to, I will still have my money -- there is no way mtgox provides this. Anyone who still has money on mtgox is asking for trouble.

<comment><USER3> The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet.

Would you store your funds at the Bank of Wordpress?

<comment><USER4> Is a site inherently safer if you use Java?

<comment><USER5> Then if you use Wordpress? Yes.

<comment><USER4> I meant than PHP. The implication seemed to be "WordPress is made with PHP, and WordPress isn't bank-quality software, so would you want to trust your money to something made with PHP?" I would trust the credentials of the people behind the site before I'd even give a second's thought to the programming language. (Of course, that doesn't help Mt Gox much either.)

</comment></comment></comment></comment></comment><comment><USER6> What bothers me most is the bullshit explanations that were given initially. Claims of a DB dump being stolen from a financial auditor's laptop, assertions that no SQLi vulnerabilities were reported and couldn't have been responsible, etc. If it weren't for the full-disclosure post about various vulnerabilities in the site, would they have ever admitted any of this?

I for one won't be returning to mtgox.

Edit: Full-disclosure post <http://seclists.org/fulldisclosure/2011/Jun/417> and relevant Bitcoin forum discussion <http://forum.bitcoin.org/index.php?topic=20437.0>

<comment><USER7> If I were the guy MagicalTux outright accused of being the hacker and threatened with FBI action, I'd be demanding a public apology right about now. He'll probably never get one.

</comment></comment><comment><USER8> "The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing"

Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own?

AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

<comment><USER9> What is the benefit of bcrypt over several million rounds of SHA-512? It seems to me that repeating the hash function is the adjustable work factor that bcrypt seeks to allow and SHA-2 is already in most languages without an additional library.

<comment><USER10> When talking about DIY crypto, the question should be turned around - what's the benefit of this over just using bcrypt?

<comment><USER11> Well, one example might be if you were implementing your crypto in a language that doesn't have bcrypt bindings.

So you would either have to port bcrypt or use existing crypto code to approximate bcrypt-level security.

<comment><USER12> False choice. Why roll your own when either porting bindings to bcrypt or porting the bcrypt implementation to your language is easier and safer?

</comment></comment></comment></comment></comment><comment><USER13> A reminder that MTGOX originally stood for "Magic The Gathering Online eXchange". When a site designed for trading cards online turns into the world's biggest Bitcoin exchange you better believe there's not going to be an appropriate level of security underneath it.

<comment><USER14> A reminder that people who make sweeping generalizations about subcultures they like to make fun of aren't worth listening to.

(also: <http://news.ycombinator.com/item?id=2697975>)

<comment><USER15> It doesn't really seem like a dig at the MtG subculture, IMO. It's just natural that a trading card site probably would focus less on security than a financial institution. This has nothing to do with the people or the hobby involved, and more to do with the fact that pretty much nothing needs as much attention to safety as a bank/currency storage.

</comment></comment></comment><comment><USER16> What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets.

They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no one to know the difference.

<comment><USER6> By using floating point values for a user's balances (per-currency) in the DB, they effectively _did_ make themselves a fractional reserve bank, even if the spread was likely small. Most every transaction would've added a tiny bit of an error value -- given enough time, this would've added up pretty considerably.

<comment><USER17> Due to how round-off is specified, cumulative errors in floating point calculations should average to 0 for typical workloads.

<comment><USER12> No. If you were to repeat an experiment a million times, the standard deviation should (quickly) limit to zero. That does not mean that the value compued is correct, however. Due to how round-off is specified, the estimated error will increase with every floating point operation.

</comment></comment></comment></comment><comment><AUTHOR> Previous discussion: <http://news.ycombinator.com/item?id=2676263>

Congratulations to those who guessed correctly: <http://news.ycombinator.com/item?id=2676467> <http://news.ycombinator.com/item?id=2676986> <http://news.ycombinator.com/item?id=2676612>

</comment><comment><USER18> That's fine, but it doesn't change the fact that Mt. Gox is sitting on untold amounts of users' funds, in both hard currency and bitcoins.

I've got 70 bitcoins in their system, and they have not responded to any attempts to contact them for two weeks now.

I've even gone so far as to contact Mark Karpeles directly through LinkedIn, and nothing.

They have lost all credibility. Aside from the fact that no one will ever trade with them again, the most likely next scenario is a flood of lawsuits from Mt. Gox members who have lost their money.

</comment><comment><USER19> I really hope somebody is giving out the best clusterfuck of the year awards soon, because this just nailed it.

<comment><USER20> What about Citibank, where you could read other people's accounts just by adding the account number to the request parameters (I think it was the account number)?

</comment></comment><comment><USER11> _We can attempt to blame the owner of the compromised account for the recent events but at the end of the day the responsibility to secure the site and protect our users rests with us. The admin account responsible had more permissions than necessary, and our security triggers were not as tight as they could have been._

Those are good words to read. +1.

</comment><comment><USER21> If Mt. Gox did find the hacker, what could be done? I feel like this would be opening up a can of worms between Gox and the Gov. Although Gox and its users (myself included) are the victims in the recent compromise, it may be possible that instead of sympathy (or justice) being served, it would be Gox on the losing end again. I can see the House Sub-committee having a field day on Gox.

Maybe, maybe not. But this hack may be one without recourse.

</comment><comment><USER22> I'm wondering why they don't offer users the option of using two-factor security, like Google recently made available to Gmail/Google App users. Being able to tie my gmail login to a secure passcode generated on my phone makes me feel a good deal safe, and I don't even have any really important information in my Gmail inbox.

</comment><comment><USER23> I was searching for the word "sorry" in the whole thing. Couldn't find one!

<comment><USER24> It's in the heading of section VI of the article. They just spelled it "Apology", but that's what "sorry" is.

</comment></comment><comment><USER25> why don't people use a private salts to beef up security? for example record the per-password salt in the db along with the hashed password but when calculating the hash concatenate the per-password salt with a salt stored in the program.

i realise it is kind of security through obscurity but in this instance the SQL injection wouldn't have compromised the private salt and it would have been much harder to recover the passwords. presumably, you would have to use a known pass/hash combo to brute force the private salt which would take a lot more computation time than recovering simple passwords.

</comment><comment><USER26> That 2000BTC the thieves made off with is worth about $32,000 at the moment.

<comment><USER27> It wasn't thieves, was it? It was just a guy who bought bitcoins during the crash and withdrew some. That's perfectly legal, from where I'm standing.

EDIT: It looks like the guy I'm talking about only withdrew 640ish coins, so this must be someone else.

<comment><USER28> No, MtGox said that _the thief was able to make a larger withdrawal (approximately 2000 BTC) before our security measures stopped further action._

<comment><USER29> I wonder if they don't really mean, "2000 of the coins created by the thief and then sold to buyers were withdrawn before we could shut things down"

<comment><USER28> "withdrawing the coins" in this case means moving them out of the BitCoin wallet owned by MtGox and moving them back into the BitCoin P2P block chain (as far as I know). There is no way to magically print more BitCoins like this (preventing this is one of the core design goals of BitCoin). This BitCoins had to come from somewhere. MtGox have admitted this and will have to buy/trade/get/acquire replacement BitCoins: _"the 2000 BTC withdrawn did have real wallet backing and they will be replaced at Mt. Gox's expense"_

</comment></comment></comment></comment></comment><comment><USER30> Dear Mt Gox, Please add margin-right - the 'Support' tab keeps blocking text as I scroll.

Thank you.

<comment><USER31> Not sure why this is getting down voted. That 'support' button showed to me in many websites, and was really upsetting.

<comment><USER32> Probably because it adds nothing to the discussion of the article at hand.

<comment><USER33> Yeah but its not like there's a discussion thread anywhere to critique the UI of MtGox's website, and these complaints have to be made so that these problems can be fixed.

(I had this same problem)

<comment><USER4> There's a contact link at the bottom of Mt Gox's site. That would be the best place to address your "Dear Mt Gox" messages.

</comment></comment></comment></comment></comment><comment><USER34> Everybody should give the people behind Mt. Gox a break. These guys make real banks look good - no small feat!

<comment><USER35> Something here is still real fishy:

 _March, 2011 – MtGox.com (Mt. Gox), now the world's leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions. In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account's credentials were obtained.March, 2011 – MtGox.com (Mt. Gox), now the world's leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions. In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account's credentials were obtained._

A quick search of Google for Tibanne Co Ltd leads to Tibanne.com:

 _DOMAIN: TIBANNE.COM

RSP: KalyHost

URL: <http://www.kalyhost.com/>

created-date: 2009-10-02 05:43:17

updated-date: 2011-05-25 15:15:09

registration-expiration-date: 2012-10-02 05:43:17

owner-organization:

owner-name: Mark Karpeles_

Does this mean Mark sold Mt. Gox to himself and in the process created a superuser account so he could manipulate the exchange to his benefit? Sounds like he could be taking a page out of the Ultimate Bet / Absolute Poker playbook.

Probably would be willing to take him at his word if the explanation of the flash crash didn't change every few hours. And/or if he and others didn't mobb the guy who put in the low bid during the crash.

<comment><USER36> Not to himself. MtGox was originally created by a guy named Jed, who sold it to Tibanne.

</comment></comment></comment><comment><USER37> So some Bitcoins are 'real'. Huh. And the rest are 'imaginary' I guess. From where I sit, they all look imaginary.

I haven't seen a 'real' stock certificate in 20 years either. But stocks are actually backed by something, somebody.

Bitcoins are backed by ... a sysadmin? An algorithm?

I'm reminded of when bond trading changed - folks stopped buying the bond, and instead just bought a 'coupon' representing the interest on the bond. Whaa? Kind of like betting on the horse, instead of owning the horse I guess.

So, bet on Bitcoins all you like. But when you get burned, its not very ingenious to complain about it.

<comment><AUTHOR> I don't think the analogies are helping you here. Real Bitcoins exist in the block chain, and fake ones don't.

<comment><USER37> Sure, and 'real' stock certificates exist in a database too. But they are backed by something. Currencies are backed by governments. Bonds are backed by the issuing entity which has assets.

Bitcoins are as real as grocery store coupons I guess. No, wait, grocery stores have inventory and bricks-and-mortar, so no, not that real.

Its misleading to call something as soft as a Bitcoin a 'currency'. There, no analogies at all.</comment></comment></comment>


Drupal for Firebug extension - <AUTHOR> http://drupalforfirebug.chapterthree.com/

<comment><USER2> Would love to see something like this for Django. Hmmm...new weekend project!</comment>


Building My Perfect Router - <AUTHOR> https://blog.tjll.net/building-my-perfect-router/ <comment><USER2> I did a similar thing in order to implement network segregation via VLANs and VPN routing.

Personally I think Alpine Linux is one of the better distributions to use for routers because it uses musl which is ultra small. [https://www.etalabs.net/compare_libcs.html](https://www.etalabs.net/compare_libcs.html)

I have separate VLANs:

• VLAN 1: Management (no tag, null route)

• VLAN 2: Untrusted (routes direct to ISP via ppp0)

• VLAN 3: Trusted (routes direct to ISP via ppp0)

• VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc)

• VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc.

(Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1]

[0] [https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...](https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_\(IPv6\))

[1] [https://alpinelinux.org/downloads/](https://alpinelinux.org/downloads/)

The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network.

<comment><AUTHOR> Can you explain a bit more on your VPN setup? Did you create it on the same machine as the router itself?

<comment><USER2> > Can you explain a bit more on your VPN setup? Did you create it on the same > machine as the router itself?

Yes.

Essentially it operates as a mult-home router.

Traffic on VLAN2 goes directly out to the ISP. This is useful for low latency needs such as online gaming. It is useful when you need your real IP address and do not want to trip security systems such as a online banking site might have.

VLAN 3 is used for everything else, downloading packages (apt, pacman etc, and all my web browsing). The router will send all traffic through the VPN ie tun0.

In addition I can be on VLAN3, and have "exceptions" such as to my mailserver even when on VLAN3 (my VPN VLAN).

I used CONNMARK, for this. In these circumstances the connections from VLAN3 are normally marked with a connection mark[0].

[0]: [https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...](https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Advanced_IPtables_rules_that_allow_us_to_route_into_our_two_routing_tables)

I am at the moment finishing up the configs as Jinja templates, so that one may just input their configuration into the JSON configuration files and it will populate all the configs with envtpl [https://github.com/andreasjansson/envtpl](https://github.com/andreasjansson/envtpl) it would be trivial for one to extend this into an implementation orchestrated by something like Ansible.

I use that on combination with Yadm [https://yadm.io](https://yadm.io) and store it in my dotfiles.

</comment></comment></comment><comment><USER3> I update the router about once a month, just to ensure all the relevant packages are kept current with upstream. So far the only breakages have been in kernel incompatibilities with the ipt-netflow module, but I think that's only happened once so far - any Arch updates to shorewall, dnsmasq, etc. have been stable.</comment>


Robert Louis Stevenson Was a Sickly Man with a Robust Imagination - <AUTHOR> http://www.neh.gov/humanities/2015/julyaugust/feature/treasure-island-author-robert-louis-stevenson-was-sickly-man-robu

<comment><USER2> If you want some insights into the engineering dynasty that was the Stevenson family then "The Lighthouse Stevensons" by Bella Bathurst is a good read.

[http://www.amazon.com/The-Lighthouse-Stevensons-Bella- Bathur...](http://www.amazon.com/The-Lighthouse-Stevensons-Bella- Bathurst/dp/0060932260)

</comment><comment><USER3> At last, across the weary faem,

Frae far, outlandish pairts I came.

On ilka side o' me I fand

Fresh tokens o' my native land.

Wi' whatna joy I hailed them a' -

The hilltaps standin' raw by raw,

The public house, the Hielan' birks,

And a' the bonny U.P. kirks!

But maistly thee, the bluid o' Scots,

Frae Maidenkirk to John o' Grots,

The king o' drinks, as I conceive it,

Talisker, Isla, or Glenlivet!

</comment><comment><USER4> I've always wanted to read Treasure Island but just never quite got the time to do it. Approaching my 30s and working on side projects, I spend most of my reading time on startup books and articles now. It's highly informative and sometimes entertaining, but it feels I am missing out on other things.

Maybe I need a little fiction to broaden my horizons...

<comment><USER5> Reading apps on my phone have completely rejuvenated my fervor for reading again. There's tons of free books out there, and there's several services that let you pay a monthly fee and then read all of the books you want. I also know that my library checks out digital books as well.

Having a book on my phone means I can snatch some reading time whenever, wherever- waiting at the dr's office, at lunch, while on public transit, whenever. It's awesome.</comment></comment>


Writing Skills - <AUTHOR> http://xkcd.com/1414/

<comment><USER2> The problem is that much like with Joyce, we'll end up with _Finnegans Wake_.</comment>


Ask HN: Why are languages seen as tools but DBs aren't? - <AUTHOR>

There's a lot of commotion going on about different database technologies other than the good ol' relational model. This typically ends up with people taking extreme positions either on a pro-SQL or a anti-SQL side.
To me this is just like the old programming language wars. But, there's a lot of wisdom to be found that languages are tools and one should ideally pick the best one for each job.
Why can't we come to a similar conclusion about database models?
[edit: This is an honest question. Is there's some critical difference that I'm missing?] <comment><USER2> You _shouldn't_ necessarily pick the _best_ one for each job, depending on the size of the job and a lot of other factors.

[http://journal.dedasys.com/2007/12/12/programming- languages-...](http://journal.dedasys.com/2007/12/12/programming-languages- are-not-like-hand-tools)

<comment><AUTHOR> Granted the "best" one for a particular task need not be defined exclusively by considerations about the language itself.

The (apparent) lack of this exact reasoning when choosing databases for projects is what surprises me.

There seem to be two bands: 1\. One who equates database to relational database and disregards everything else. 2\. One who decries the relational database and proposes <insert alternate model> as a the end-all of database models.</comment></comment>


Lala heralds MP3-killing iPhone app - <AUTHOR> http://tech.yahoo.com/news/ap/20091027/ap_on_hi_te/us_tec_techbit_lala_iphone

<comment><USER2> People don't like DRM because it means they don't really own the music. This is even worse. Why pay to have access to something if the service happens to be available and stick around for years?

Finally, I know this concept escapes tech reporters, but _not everyone has an iPhone_.

And PLEASE stop announcing the death of things that are clearly in no risk of dying. If your article sucks, admit it. Don't stick a sensationalist title on it to make it sound more exciting.

</comment><comment><USER3> I've been dreaming about this since the first time I tried Lala more than a year ago. Yes, the article is very overly sensationalist, but the idea of really cheap music streaming in the cloud is a good one for me.</comment>


How Healthy Is Your Office? - <AUTHOR> http://blog.boundless.com/post/27568122377/how-healthy-is-your-office

<comment><USER2> "10. Allow Pets in the Office"

Wouldn't having dogs/cats/miscellaneous animals roaming the cube farms be in breach of health and safety regulations? Think of all the lovely 'surprises' people would find on the carpets.

Although, how about training all the dogs to bark whenever upper management start talking?

</comment><comment><USER3> "2. Seek Natural Light"

I wish! The people I work with like to turn the lights off and work in the dark. Depressing.

<comment><USER4> On the opposite, I work in an office with enormous windows, and people always turn the light on even if the sun is bright and shinning outside. SO DEPRESSING.

<comment><USER2> In my office they pull the blinds up fully which causes a huge glare on the computer monitors!</comment></comment></comment>


Security warning for Thunderbird users and Enigmail users - <AUTHOR> https://posteo.de/en/blog/security-warning-for-thunderbird-users-and-enigmail-users-vulnerabilities-threaten-confidentiality-of-communication <comment><USER2> _The add-on architecture of Thunderbird allows an attacker to obtain your email communication through compromised add-ons. The add-ons are insufficiently separated and have access to the content in Thunderbird._

IMHO that's a _feature_ , not a bug, and the reason why add-ons are so useful. One only has to look at the situation around the capabilities (or lack thereof) of the new Firefox extensions model to see why.

There's a memorable saying which I get reminded of every time I read things like this: "the security people will not be satisfied until everyone has been put into prison."

</comment><comment><USER3> This write-up takes a while to get to the point for Thunderbird users, which is:

* Thunderbird add-ons aren't well-sandboxed, so a vulnerable or malicious add-on can access your mail and even private keys

* an as-yet-fully-specified bug in Thunderbird RSS feed handling allows RSS feeds to access "communications and other sensitive data"

I'm not sure how many Thunderbird users are dependent on add-ons – so simply disabling most/all add-ons may be an acceptable mitigation for the 1st matter.

But for the vaguely-described RSS bug, their only suggestion is: "Do not use RSS feeds in Thunderbird for now. There are critical security problems, threatening your entire communication."

<comment><USER4> >But for the vaguely-described RSS bug, their only suggestion is: "Do not use RSS feeds in Thunderbird for now. There are critical security problems, threatening your entire communication."

yeah, does any one know what this bug is about? I'd like to keep reading my feeds while I am waiting for a fix. Based on their vague description I can't deduce the likelihood that this bug is going to harm me.

</comment></comment><comment><USER5> Maybe I'm strange, but I've always regarded browser or email add- ons/extensions as likely to have the same level of system access as the program they're running in. You're running a program in a scriptable environment, it's no different than complaining that shell scripts can do terrible things to your system.

I applaud them for finding the actual bugs though, and hopefully those will be addressed promptly.

That said, what decent mail clients still exist? It seems like it's all webmail, phones, Outlook, or Thunderbird (which has had its own spate of "does it have a future").

<comment><USER6> There's always Mutt, of course. Easily beats the ones you listed, especially when handling larger volumes of mail. Development picked up some steam again in recent years, with forks like mutt-kz[1] (now deprecated and folded into neomutt[2]) integrating awesome search functionality.

Claws Mail has some fans, too, and might be more accessible to Thunderbird users.

[1] [https://github.com/karelzak/mutt-kz](https://github.com/karelzak/mutt-kz) [2] [https://www.neomutt.org](https://www.neomutt.org)</comment></comment>


What's your take on the save mysql? - <AUTHOR> http://www.helpmysql.org

<comment><USER2> It's duplicitous and wrong. He sold the product, and now he is actively undermining the product that he sold with the potential of costing Sun/Oracle considerable sums of money to defend against his clearly self-serving claims.

Even if Monty does not succeed, he has the ability to do significant damage to Oracle, Sun, and even industry perceptions of not only the GPL, but of open source in general.

<comment><USER3> > he is actively undermining the product

I wonder when some Sun/Oracle lawyer is going to give him a call and let him know about the legal trouble he could be in for this. I mean, wouldn't this type of behavior have been dealt with in the original MySQL purchase agreement?

<comment><USER4> He's urging public bodies to block the merger. I doubt they can have an effective agreement that involves anything more than firing him. And he doesn't work there anymore.

</comment></comment></comment><comment><USER5> If you sold something for a billion dollars, and you had a 1% chance of getting it back just by writing some letters and blog posts, so that you could sell it again for another billion dollars, would you do it? If you had a much- higher-than-1% chance of getting Sun/Oracle to pay you many millions of dollars just to STFU, would you do it?

Some of us would say "no," others "yes." Monty is definitely a "yes" man.

<comment><USER6> If I managed to sell something for a billion dollars, I'd be off doing something more interesting than trying to make more money for the sake of it. I guess that makes me a "no" man.

</comment></comment><comment><USER7> I think it's easy, if you sell it you lose it.

If Monty wants to continue working on MySQL he should simply fork the project and get it over with. Announce the new name, if he manages to assemble a good enough team then I'm sure he will gain some traction.

It's not like he couldn't hire a few talented people.

In fact, using some of the money he made from the SUN deal in order to do this would probably be one of the best ways to make use of it, provided his contracts do not stop him from doing that.

<comment><USER8> I think the problem is that he would have to fork from the GPL'd version, which means he can't sell a proprietary fork.

(Someone please correct me as I am most probably wrong)

<comment><USER4> The issue is that you can't write non-open source programs on it anymore. You have to write JUST GPL programs with it.

It doesn't have a linking exception like Linux does [which allows you to write non-GPL programs to run on it].

Basically, the dude used pure GPL [a bad idea in my book] with no linking exceptions. He did this to make $$$$ off of the dual licensing scam that MySql AB [The company] was doing. He then sold the company, and got bit in the ass, because you can't make a useful fork of the application due to the overly restrictive license [which pure GPL is for a library, such as MySQL].

Basically, if you wrote a proprietary app that uses MySQL, you're hosed if regulators don't block this.

<comment><USER3> You're only hosed if you use the C library. If you use a Free/Open source licensed language (Python,PHP,etc...), you're in the clear. MySQL has a FOSS licensing exception (and always has). So the clients for these languages aren't GPL-viral.

Now the C-library is a different story. If you want to use it, then you're looking either GPL or one of their supported FOSS licenses. So, it isn't quite as bad as you're making it sound.

What really needs to happen is to have someone write an LGPL or BSD MySQL client library. That would pretty much put up a licensing firewall. This might even be the case with something like DBSlayer. It would be even more clear if the middleware supported multiple DB backends.

MySQL has always straddled this GPL/FOSS/proprietary fence, and never made it very clear if you really needed a commercial license. I could be 'misremembering', but I thought that at one time they even explicitly said that if you used Python/Perl/PHP/etc you could write proprietary software w/o a commercial license. However, they also said that if your program "required MySQL features" that you had to have a commercial license. They made all of their money off of this confusion. But I think that if a third-party BSD client library spoke the correct binary protocol to the server, that you'd be in the clear. Then again, I'm not a lawyer...

<http://www.mysql.com/about/legal/licensing/foss-exception/>

<comment><USER9> I read somewhere recently (here or proggit?) about libdrizzle, which is a BSD- licensed client library that is compatible with the MySQL network protocol. The developers are quite clear that you can use it with their own GPL 2 database server: <https://answers.launchpad.net/drizzle/+faq/134>

</comment></comment></comment></comment></comment><comment><USER4> I've always thought the Oracle acquisition a bad bad thing.

Then again, I always thought using GPL for a database is ALSO a bad bad thing. It probably should have been LGPL at the most, probably something like apache/MIT/BSD instead.

To my opinion, this is MySQL AB's old owners getting bitten in the ass for their greedy dual licensing model. They should have licensed it with a more permissive license.

</comment><comment><USER10> My take is if mysql is important to you as a resource, get together with similar people and settle on a fork, then move on.

As for trying to influence the status of any IP owned by Sun and acquired by Oracle ... good luck with that.

<comment><USER4> Europe's merger approval body is already concerned, I think there is a real chance the merger may at least block for awhile unless they address something along this angle.

The issue with MySQL is there is a lot of stuff built on it MySQL AB said is "okay" that isn't specifically allowed in the license. That damages hundreds if not thousands of other projects that are in that gray area. Oracle has a huge incentive to enforce the actual license on these companies....so now you see the issue.

</comment></comment><comment><USER11> I'm concerned about having a leading (by usership) free SQL database under the control of the leading (by revenue) proprietary SQL database vendor.

And, I believe it would ultimately be better for MySQL users for it to be under a more permissive, non-copyleft license. It allows for a broader commercial ecosystem.

But, I'm uncomfortable with regulators telling companies what to do with their lawfully acquired property/rights based on speculation about potential abuses that haven't even occurred yet.

And, I'm uncomfortable with someone who chose for their own benefit one doctrinaire set of rules -- the GPL -- now asking for the rules to be rewritten, against the wishes of the people to whom he sold his package of rights.

So I can't support the campaign, even though I'd like one of its sought end states (non-copyleft MySQL).

Maybe if someone other then Widenius led a purely-antitrust-based case for divesting or relicensing MySQL. As an advocate, he's tainted.

</comment><comment><USER12> My personal opinion is that it's time to let SQL and RDMS go. Free the world from the shackles of schema.

<comment><USER4> I don't know why you're getting downvoted.

If the oracle approach is voted through without forcing an licencing exception change, I will be pushing people VERY strongly to NoSql solutions who need any scalability. MySQL was pretty much the best solution for many projects, and being used as a base with it in the hands of Oracle is a questionable thing to advise from a business risk perspective.</comment></comment>