Ask HN: Online Security Tips for Newbie Freedom Activists? - <AUTHOR> I'm becoming active in a local group of citizens (constituents of one electoral district here in the United States) who are trying to promote protection of civil liberties. Many are quite new to any kind of political activism and quite a few are very new to participation in online networks. What are your recommendations for sources of advice on best online security practices, easy for beginners to understand? The local group includes some technology professionals familiar with online security and administration of websites and mailing lists. The group plans to build a public-facing website, an internal use website, a mailing list for group participants, and other online channels of communication. It already operates a Twitter account and Facebook group (which is becoming quite active) and hosts in-person meetings. I would appreciate tips to pass on to new members about personal Internet security best practices and resources for nonprofit organizations or political action organizations to maintain secure communications in a possibly hostile environment.<p>Thanks for any suggestions you have. <comment><USER2> These answers are unlikely to make much of HN happy, but they are the correct answers.

1\. Get an iPhone and use it in preference to your computer.

2\. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP").

3\. Disable SMS 2FA on any account wherever you're using real 2FA.

4\. Switch to Google Chrome, which is significantly more resilient against vulnerabilities than either Safari, Firefox, or IE.

5\. Don't use Dropbox.

6\. Enable your OS's built-in full-disk encryption (this is FileVault on a Mac, BitLocker on Windows).

7\. Disable cloud-based keychain backups (OS X will ask you to opt-in when you configure your phone or laptop the first time; Windows will make you go out of your way to do it).

8\. Install Signal and either WhatsApp or Wire on your iPhone. Use Signal when you can, and fall back to the less strict alternative app when you can't.

9\. Don't use email to send sensitive information, full stop.

10\. Install a password management application that doesn't store your secrets in the cloud. I recommend 1Password. Better though to rely on 2FA than on a password manager.

11\. Do not use antivirus software, other than Microsoft's own antivirus software on Windows.

12\. Turn off cloud photo backups and location sharing for your camera.

13\. Don't accept or click on email attachments, or allow your peers to send email attachments.

<comment><USER3> > Get an iPhone and use it in preference to your computer.

When connecting to a computer or charging, never ever tap on "trust this computer". If I understand it right "trusting this computer" involves some irrevocable certificate exchange, in effect granting the computer elevated permissions.

Can someone correct me? What precisely "trusting" on iphone means except from the ability to decrypt backups?

Also:

Don't use icloud or any other cloud sync.

<comment><USER4> It's revocable:

[https://support.apple.com/en-us/HT202778](https://support.apple.com/en- us/HT202778)

It's anyway not a great idea to plug anything into strange USB ports.

<comment><USER5> USB condoms - [http://www.portablepowersupplies.co.uk/portapow-fast- charge-...](http://www.portablepowersupplies.co.uk/portapow-fast-charge-data- block-usb-adaptor/)

</comment></comment></comment></comment><comment><USER6> Beware of the guy that has too much free time, too many contacts and want to scale up the protest to more violent methods. He is probably an FBI informant. It was common during the previous administration, I don't expect it to have finished.

I'm too pessimistic about the security situation since a long time ago. Just email your Gmail/Hotmail/Facebook/Tweeter password to the NSA/CIA/FBI chief, so you don't get a false sensation of privacy.

Perhaps someone can try to keep some conversation private, like a journalist- whistleblower conversation, but it's too difficult to scale it up to bigger groups.

<comment><USER7> Very much the first two sentences, here: if anyone starts saying that they know where they can get instructions to make a bomb, they are probably an agent trying to provoke you. Kick them out.

What they won't do, and you should: learn your rights. Get a friendly lawyer to advise you and agree to represent you, should anybody get arrested.

<comment><USER8> If anyone says they know where they can get instructions to make a bomb you should kick them out regardless, doesn't matter if they're probably an agent or not.

That actually reminds me of the time when the FBI sent undercover agents to mosques to try and entrap some Muslims by pretending to be jihadists, and the people at the mosque reported the agents to the FBI.

</comment></comment></comment><comment><USER9> I like these guides by AP journalist Jonathan Stray:

[https://source.opennews.org/en-US/learning/security- journali...](https://source.opennews.org/en-US/learning/security-journalists- part-one-basics/)

[https://source.opennews.org/en-US/learning/security- journali...](https://source.opennews.org/en-US/learning/security-journalists- part-two-threat-modeling/)

In general, I think the two things that activists and journalists need to do that they often don't do, yet is a very common attack vector:

1\. Enable two-factor auth on all accounts, especially their email.

2\. Care about proper access control.

#2 is something I see violated quite frequently by tech novices, as it is a fairly mundane detail. Such as giving everyone admin level access to the org's Wordpress installation, and someone inevitably gets phished. And then there's the even more common problem of not revoking access when a member leaves.

And of course, phishing seems by far the most common way that groups get hacked. The recent U.S. election is the new canonical example, but I believe it's been the downfall of many other high profile orgs, such as the Associated Press and HBGary.

<comment><USER2> I have some quibbles with this (the first, practical, checkbox guide post; not so much the longer, abstract policy one).

* At-risk users should disable SMS 2FA, and favor code-generating applications instead. It takes some effort to disable SMS, but that effort is worthwhile, because SMS is quite insecure.

* The guide correctly notes that attachment are dangerous, but isn't very pragmatic about how to handle that danger. I think the right answer is: establish a rule that you won't be using email attachments to transmit documents. If you can be sure of the provenance of a file, you don't need an error-prone dance to pre-screen it before opening it on your desktop.

* The guide wildly overstates the value of full disk encryption. FDE handles almost exclusively a single threat: the physical threat of your unattended computer. Alter any of those words, and FDE does essentially nothing. You should, of course, enable FDE. You should not have high expectations about what it accomplishes.

<comment><USER9> I think the risk of your unattended computer being compromised is quite low for the average journalist, but don't activists in the field face increased danger of having their laptops/property seized during an arrest? It could be an activist participating in a march who happens to bring their laptop bag with them. Yes, ideally, people would have a policy not to engage in a protest while carrying laptops, but I could see activists who do the mobile-multimedia thing (shoot, process video/photos in the field) just being used to having their laptops out at all times.

I think the option of FDE is important to mention because I'm thinking the average non-techie thinks that having a password on their laptop prevents the (easy) reading of files when the laptop is confiscated.

<comment><USER2> The unattended compromise scenario is that your laptop is grabbed out of your house or car in a breakin, or left in your backpack in a bar or a cab, which happens all the time even to savvy people. Full disk encryption contains that catastrophe so that all you lose is your data and not your privacy.

It doesn't really protect you in any other scenario. In particular: if you can use your computer without a password, it is not at that moment protected by FDE.

</comment></comment></comment></comment><comment><USER10> the eff guide is really solid for most people [0] but i think its a little laymen for most people. Especially when you get into the activism side of things. Here are the rules i follow.

Rule #1. No phones. If this can't be avoided. burner phones without linked accounts. they cost $30-50, plus some for minutes/sms/basic data. This is good for using maps and visiting forums etc. Burner phones should be able to remove batteries. keep them fully powered down anytime you are near home or in your neighborhood. Major companies and governments are incredibly good at connecting profiles based on ancillary meta-data that you don't even think about.

Rule #2. see rule #1. Your phone isn't secure, get used to it.

rule #3. encrypt everything, use tails and TOR.

[0] [https://ssd.eff.org/en](https://ssd.eff.org/en)

<comment><USER11> What if someone needs to call or message you at home?

I have thought about taking some of these more "paranoid" measures as a precaution against an unpredictable political future. But doing this would cut me off from nearly every friend and family member.

How do you meet an average person and keep in contact with them (I.e. start a friendship or relationship) when doing something like this sounds insane?

<comment><USER12> You should compartmentalize different relationships you have. You wouldn't contact a friend or family member from your burner phone. Inversely, you shouldn't give a member of your activist group your home phone number.

You can maintain both types of relationships, as long as you use the appropriate tools for each one, and maintain strong separation.

</comment></comment></comment><comment><AUTHOR> Thank you very much to all for the detailed comments. I appreciate you keeping advice simple enough for someone like me, who decades ago counted as a "power user" of PCs, but who has no particular technical training or computer-related work experience. I will have to digest some of this advice for women (they are mostly women in the local group) who are barely comfortable using Facebook. And I'll pass on other tips to the women and men who have actual technical backgrounds and will be implementing the different online projects of the local group.

Advice that especially fits our situation is having an appropriate level of security for an intentionally PUBLIC organization whose members will be identifiable by multiple in-person activities in public places over the next few years. We are not afraid to be known as people who support the cause that we support. We are resolutely sticking to peaceful, legal means to reach our goals. Many group members are VERY wary of new group members--plenty of them are wary of me--so we will have to build mutual trust as we build mutual communication and public-facing communication. I like mz's advice to remind members that anything they say in an online group--even in our internal online groups for members only--might show up in mass media or in propaganda spread by opponents, so I try to model careful speaking and writing.

I'll link here to a document about the bad-case scenario of living under an actual dictatorship with a secret police force that kills political opponents. That's something I've actually done (in Taiwan, in the 1980s). The good news is that nonviolent popular movements can even overthrow dictators and establish democratic republics with full protection of civil liberties. That takes mental toughness, but it can be done. I've seen it done. You may be inspired by the document linked here and the other documents (in numerous languages) posted at the same website.

[http://www.aeinstein.org/wp- content/uploads/2013/09/FDTD.pdf](http://www.aeinstein.org/wp- content/uploads/2013/09/FDTD.pdf)

<comment><USER13> Since you have a lot of women, I will suggest that you explicitly instruct them to be careful about talking about other people in their lives in identifiable terms. Men tend to invest their identity in their work. Women tend to invest their identity in their relationships. Telling anecdotes about "My sister/boss/mother/daughter/son/husband" is potentially putting those people at risk. Encourage them to use vaguer terminology such as 'someone I know'; 'a relative'; 'an acquaintance'; 'a friend of a friend.'

Women are incredibly prone to talking about other people in terms that they don't think is problematic and in terms that they think is anonymous enough for the internet, but really is not ("my sister" instead of "sister's name" \-- but it is possible to identify your sister). This is a habit they need to break if they value the welfare of these other people.

Edit: Since this is getting down votes, I will add that if you think they won't listen to a man saying this, I will be happy to blog about it and you can give them the link. Perhaps it will be more palatable coming from a woman.

<comment><AUTHOR> Maybe some of the onlookers don't know that you have long identified yourself as a woman here. As I recall, we (you and I) eventually figured out that we first "met" on an online community before Hacker News was founded.

<comment><USER13> As promised: [http://micheleincalifornia.blogspot.com/2017/01/infosec-1-in...](http://micheleincalifornia.blogspot.com/2017/01/infosec-1-information- security-for.html)

You are free to use it, or not, to help your group get oriented.

</comment></comment></comment></comment><comment><USER14> The new social activists are shockingly ignorant of security. Most that I know of are organizing over Facebook. When someone mentions security to them, the activists say that there is no risk to them.

Education is even more urgently needed than tools.

</comment><comment><USER15> I would absolutely start by running a threat modeling exercise, as that will help you focus on the important things and tune out unnecessary FUD (e.g. do you really need to PGP-encrypt everything and run TAILS if you're not being targeted by the NSA?).

Once you have an understanding of what you need to protect and who your main adversaries are, choosing the right tools should become more straightforward.

My favorite guide to threat modeling for activists comes from WITNESS: [https://blog.witness.org/2016/11/getting-started-digital- sec...](https://blog.witness.org/2016/11/getting-started-digital-security/)

EFF Surveillance Self-Defense (mentioned elsewhere in this thread) also has a guide to threat modeling, as well as a lot of good resources around how to use various tools.

But my advice: don't choose the tools first, or the non-techies won't understand why they have to use them and may become discouraged by the friction and poor usability they encounter.

<comment><USER2> Ross Ulbricht was crushed by a mountain of evidence generated by the FBI simply by snatching his laptop from him when he was arrested and not allowing FDE to kick in. Had he compartmentalized and separately encrypted his files, much of that evidence might not have been available to the court. That might have been the difference between a few years in prison and the rest of his natural life.

So, the idea that people should be blasé about encryption is worth questioning. If your threat model includes "law enforcement", then there's not much difference between "ostensibly NSA proof"† and "protected from police".

† _Security people have a bit about this, which you can find by searching for "you're gonna get Mossaded"._

<comment><USER16> could you please provide links? googling this phrase is unhelpfully returning this precise thread and not much else that appears useful.

<comment><USER17> Probably this gem: [https://www.usenix.org/system/files/1401_08-12_mickens.pdf](https://www.usenix.org/system/files/1401_08-12_mickens.pdf)

> In the real world, threat models are much simpler (see Figure 1). Basically, > you're either dealing with Mossad or not-Mossad. If your adversary is not- > Mossad, then you'll probably be fine if you pick a good password and don't > respond to emails from firstname.lastname@example.com. If your > adversary is the Mossad, YOU'RE GONNA DIE AND THERE'S NOTHING THAT YOU CAN > DO ABOUT IT. The Mossad is not intimidated by the fact that you employ > [https://](https://). If the Mossad wants your data, they're going to use a > drone to replace your cellphone with a piece of uranium that's shaped like a > cellphone, and when you die of tumors filled with tumors, they're going to > hold a press conference and say "It wasn't us" as they wear t-shirts that > say "IT WAS DEFINITELY US"

> _Threat_ : Organized criminals breaking into your email account and sending > spam using your identity

 _Solution_ :

Strong passwords + common sense (don't click on unsolicited herbal Viagra ads that result in keyloggers and sorrow)

> _Threat_ : The Mossad doing Mossad things with your email account

 _Solution_

* Magical amulets?

* Fake your own death, move into a submarine?

* YOU'RE STILL GONNA BE MOSSAD'ED UPON

</comment></comment></comment></comment><comment><USER13> Years ago on an email list, we were advised to not say anything on list that we wouldn't want posted to the front page of the local newspaper. I still find this to be a good rule of thumb.

Humans are incredibly, horribly bad about writing stuff online like it is confidential, just between you and me -- even when it is a public forum that anyone can read, like Hacker News. Thinking of it in terms of published to the front page of the local paper can help people keep some of their worst, stupidest impulses down to a dull roar.

<comment><USER2> Yes. Email in general is an opsec nightmare, no matter what rules you come up with or what tools you use to protect it. It's the worst case scenario, a system that goes out of its way to make sure everyone has copies of everything.

Above all else: _do not create mailing lists for at-risk projects_.

<comment><USER13> We may be talking at cross purposes, but for clarity's sake: I was not recommending email. I was only recommending that noobs be told to think of any written communication in terms of "like it is being published to the front page of your local paper, where your husband, mother in law, and any personal enemy might see it" and, in this case, where any officials might see it as well.

The list in question was mostly full time mothers. I was a full time mother, but also a military wife. I was more familiar with general information security practices than most of them. So this is the most noobie friendly line I know that seems helpful in trying to get inexperienced people to think before they speak/type.

I also got annual InfoSec training while working for an insurance company for more than five years. Getting human beings to take InfoSec seriously is incredibly challenging. If you can't get that to happen, no amount of good tech will save you.

<comment><USER18> > Getting human beings to take InfoSec seriously is incredibly challenging. If > you can't get that to happen, no amount of good tech will save you.

I personally know one case when an assistant for a medical study forwarded a email list of participants to everyone when it was specifically complied that it was confidential. You would think that the person was fired because of this but no they literally couldn't find another employee that would take the job for such a low pay, so he kept his job and security didn't improve...

</comment></comment></comment></comment><comment><USER19> If you are seriously concerned about your security and safety, I would avoid electronic communication completely.

<comment><USER2> That concedes an enormous amount of ground to your opposition, who then has the privilege of using efficient communication while you don't. It's worth building up a gradient of security so that people who are simply exercising their rights can do so effectively without electronic harassment.

</comment></comment><comment><USER20> In addition to the EFF Security Self Defense ([https://ssd.eff.org/](https://ssd.eff.org/) ) I've also seen this circulated: [https://securityinabox.org/en/](https://securityinabox.org/en/)

Personally I don't think these resources go far enough, and some of the methods recommended have obvious exploits, or are too complicated for the less tech literate. Lot's of work to be done in this area for sure

</comment><comment><USER21> My one tip is this: get to know each other in real life, and make sure you know how to find and contact each other if Facebook, Twitter, Google or whatever big left-wing internet service decides to silence, shadow-ban, or delete your account.

</comment><comment><USER4> They should think long and hard about the downsides to each presence that they establish and not establish anything until they think they have a really good understanding of those downsides.

This may involve drastic steps like not using email.

</comment><comment><USER22> [https://ssd.eff.org/](https://ssd.eff.org/)

</comment><comment><USER23> Twitter Personality @SwiftOnSecurity has a guide [https://decentsecurity.com/](https://decentsecurity.com/) that is reasonable for non-techies to understand and follow.

<comment><USER14> But is it accurate?

</comment></comment><comment><USER24> I'm an active German antifascist. Here's something I do:

0) Get a lawyer. If you're arrested and you don't know a lawyer, you're screwed. And learn your rights: what do you have to tell the cops, and what you can refuse to tell them. Always carry a valid ID card with you.

1) When publishing pictures, especially on Twitter: place stickers over people's faces, or better: pixelate using ObscuraCam. The best thing is of course to not take pictures or video at all.

2) Get a "burner dumbphone", best are used, old Nokias and a burner sim-card when going to demonstrations. Do not activate or use the phone at your home or at meeting points.

3) If you insist on carrying a smartphone, get a recent Android phone with support for FDE and an exchangeable battery. Enable FDE, also on your SD card, and in case you're about to get arrested, take out the battery or drop the phone to the ground so that the battery falls out and the cops cannot use imaging devices. Use a strong passphrase. iOS devices may be secure, too, but they have the disadvantage that you can't pull out their battery or switch them off in a hurry. If you care about your device, get an IP68-proof/rugged device - cops don't care if they damage your property when pushing you around, and it's easy to e.g. fall on your phone when you're pushed to the ground. Android: disable USB debugging, or if possible with your model, the entire USB stack. On a rooted Android phone, you can do so via an adb shell command.

4) When browsing around the web researching political stuff, use TOR. Do not download unneccessary stuff onto your computer.

5) Securely encrypt your computers and all external media devices (USB sticks). OS X can use Filevault, Windows can use Bitlocker. USB sticks are best protected by VeraCrypt (as it is a cross-platform solution). If you have a NAS that doesn't support encryption, ditch it and buy one that does.

5) If you receive sensitive information, delete it as soon as in any way possible. Insist on communicating via GPG-secured emails, and password-protect your key. Written information should be shredded to as tiny pieces as possible - don't burn the paper, ash flakes or incompletely burned paper can be restored (as evidenced after 9/11).

6) Enable 2FA, preferrably via a token generator app on your phone, on any service that supports it. Store the backup keys (you will need them e.g. if your phone gets damaged!) somewhere safe that is NOT your home (e.g. at your parents' house). Do not label the sheets with a cleartext name of the service/account associated with them. SMS 2FA is the "last measure" as you'll be vulnerable to government attacks, but better SMS 2FA than simple password protection.

7) Handle sensitive information on a strict need-to-know basis. And for heaven's sake, don't talk about planned actions in public. Or brag about things you/your friends did or plan to do - while bars etc. usually aren't crowded with agents, someone may decide to rat you out to the cops.

8) Before going to any demonstration, write down the name and phone number of your attorney with waterproof ink on your arm. That way you don't have to rely on the cops finding your attorney or delaying calling him by taking their sweet time to do the search.

9) Inform close relatives/roommates that you're away, especially if you have pets, children etc. that need to be taken care of. Have enough cash on your bank account (or have a relative) to pay rent if you end up arrested.

10) don't ditch fares, or if you have a car, always take care that it's up to code, legally registered, and taxes/insurance are paid. Nothing sucks more than getting arrested for petty stuff, and pulling people over for broken lights is a common excuse of cops to search the vehicle. Do not carry huge amounts of cash in your vehicle (google for "asset forfeiture", it's really gross what cops can legally do).

11) don't ever go drunk, intoxicated or not well-rested to any political event. Do not take drugs of any kind with you, except medicine that you need (and for these, best take the original prescription or a copy with you, so the cops can't bother you with drug charges). Preferrably use plastic glasses (glass lenses can cause grave eye injury when damaged), contact lenses and cosmetics of any kind tend to aggregate nasty stuff like pepper spray.

12) Always take sufficient supplies of water, food and a small pack of glucose tablets (in Germany, we know them as Dextro Energy) with you. If you can, take a couple small adhesive bandages with you, and go to a First Responder education (this is useful anyway, even if you're not "actionist" \- you can save lives!)

13) Connect with other political groups both in your area and state/nationwide: ACLU, antifa groups, civil rights movements. Political parties (liberals, greens) may also be of interest to you, depending on your focus.

14) Beware of snitches or agents provocateurs that try to incite you to violence. When you want to go the "actionist" route, be aware of the potential consequences if you get caught and don't do anything you're not comfortable with.

15) Do NOT go on political demonstrations with firearms, knives or other weaponry. In most jurisdictions it's illegal, and even if it's legal to assemble with arms, it's not sane to do so. When you see armed protestors, or a demonstration turns violent, GTFO as fast as you can.

<comment><AUTHOR> Thanks especially for items 8 through 15, which some people forget. Part of what I hope happens where I live is that 13 happens in a big way, and the overall inclusive movement becomes broader and broader as different specialized local groups network with one another and with a variety of national groups.

<comment><USER24> You're welcome. I wish you all the best!

</comment></comment></comment><comment><USER25> I'd like to suggest taking some time to read through some off the EFF's collection on this.

[https://ssd.eff.org/](https://ssd.eff.org/)

If you are worried about more national level threats

While it is more dense PrivacyTools.io has pretty good material.

[https://www.privacytools.io/](https://www.privacytools.io/)

</comment><comment><USER26> This is the EFF's turf.

[https://www.eff.org/](https://www.eff.org/)

</comment><comment> joatmon-snoo Since this is coming up: I've seen recommendations for encrypted file drops when similar topics have come up before, but for some reason I can't find any of the mentions that I've seen on HN before. Anyone have services they plug?

</comment><comment><USER26> The "get an iPhone" comments remind me of Steve Martin's advice on how get rich... "First... Get a million dollars" Unless, theoretical bs.

</comment><comment><USER27> privacytools.io - plain and simple

</comment><comment><USER28> It's already too late, if you have an active Facebook group where you're discussing this stuff then you're already all tagged and profiled.

<comment><USER29> And there's no reason to suppose that YCombinator and HackerNews is not compromised and that there is no profiling going on by some entity.

<comment><USER30> It doesn't even need to be compromised. A lot of the HN data is available through the HN API. Plenty of data there without requiring any additional access to the HN hardware.

</comment></comment></comment><comment><USER31> Exactly what prevents the hostile actors you are ostensibly protecting against from joining your group?

Privacy is the antithesis of public advocacy.</comment>


Show HN: AppKeywordTool – Keyword Research Tool for iOS Apps - <AUTHOR> https://www.appkeywordtool.com/ <comment><USER2> The dataset looks great but what I most want is to be able to search out from a keyword I know to keywords I should be using. Your related keywords took looks to be just finding other keywords that contain the search term (eg. It gives me plurals when I provide the singular) but what I want to know are what are the other words that are more common among apps with my search term than among the general population of apps.

<comment><AUTHOR> Thanks Yodon for trying it out! Unfortunately it's not implemented at the moment. Currently, on the keyword pages you can check which apps use a particular word, then check the keyword analysis of the apps, but of course it's not the best. If I will see that some people utilize this version, I will add more features.</comment></comment>


Ask HN: What do you listen to while coding (and how)? - <AUTHOR> Personally I like to listen to electronic music (vocal trance, chillstep, etc) or chillout. However, I haven't been able to find a site that gives a continuous stream of good music. So I usually browse mixes on Youtube or mixcloud.com. It gets quite annoying having to manage music every hour or so though.
I've never been happy with Pandora or Spotify, their recommendation algorithms bring up the same music (and artists) over and over again.
Any recommendations (also open to other types of music)? <comment><USER2> Soma.fm for ambient, drone, chillout, lush, and a few other channels. Otherwise Spotify for streaming most of my music or what I have locally (which I usually play in an old winamp version). Lots and lots of youtube related videos for image-only song videos on youtube.

As far as music content, it's usually metal, psybient, folk metal, chillout, drone, and classic rock.

</comment><comment><USER3> [http://news.ycombinator.com/item?id=716219](http://news.ycombinator.com/item?id=716219) [http://news.ycombinator.com/item?id=167076](http://news.ycombinator.com/item?id=167076) [http://news.ycombinator.com/item?id=132026](http://news.ycombinator.com/item?id=132026) [http://news.ycombinator.com/item?id=61831](http://news.ycombinator.com/item?id=61831) [http://news.ycombinator.com/item?id=769769](http://news.ycombinator.com/item?id=769769) [http://news.ycombinator.com/item?id=668138](http://news.ycombinator.com/item?id=668138) [http://news.ycombinator.com/item?id=1209378](http://news.ycombinator.com/item?id=1209378)

</comment><comment><USER4> I like listening to Electronic Dance Music because it gets me pumped and I can code for longer hours at a time. A good source of the latest EDM is Spinnin' Sessions on Youtube. They roll out 1 hour sessions every Thursday. [http://bit.ly/1gX4ge6](http://bit.ly/1gX4ge6)

</comment><comment><USER5> It takes time to "train" Pandora but I've been at it for 3-4 years now seeding with all the tracks that are great for coding and thumbing up when I hear something that promotes going in to zen mode. The results are great and now this is my favorite music source in _everything else_ I've tried out: [http://www.pandora.com/station/play/164715539305919382](http://www.pandora.com/station/play/164715539305919382). The status features mostly vocal-free distraction less music with rhythmic beats that puts you in the zone and occasional uplifting tracks that keeps you going.

I've also found this music station to be very anti-procrastinating. If you feel like procrastating, just press the play button and suddenly you would want to get back to coding :).

</comment><comment><USER6> If it's complex / thought intensive, brown noise on [http://www.noisli.com/](http://www.noisli.com/)

If it's something I can just crank out, and I've thought about the overall design, I keep a list of soundcloud favorites ([https://soundcloud.com/basik/likes](https://soundcloud.com/basik/likes) and [http://thudsandrumbles.com/](http://thudsandrumbles.com/)). I always look for new things, though. Today, I listened to Christopher O'Riley cover Radiohead.

</comment><comment><USER7> EDM on [http://8tracks.com](http://8tracks.com) most of the time. If not EDM, then alternative but it's always on 8tracks. I love that site.

<comment><USER8> Trying this site out now; so far really dope tracks. Great recommendation.

</comment></comment><comment><USER9> I listen to Vedic chanting. Even though I understand nothing (I know very little of Sanskrit language), the music itself is very relaxing and helps concentrate.

</comment><comment><USER10> Surprised no one has mentioned Focus at Will ([https://www.focusatwill.com/](https://www.focusatwill.com/)). I've had huge productivity boosts while listening, whether it's programming or writing emails. The free version is nice, but the paid version is really worthwhile since you get a much wider variety of music (it adds an "intensity" option to each genre).

</comment><comment><USER11> I'm a big fan of quiet. I find that music determines my mental rhythm, and what I'm thinking about or constructing doesn't have a regular rhythm. For me personally, music interferes with thinking about something specific, so I only listen to music when what I'm doing is Listening To Music, or if I'm OK with letting my thinking wander.

I realize I'm unusual in this.

</comment><comment><USER8> Classical on Pandora. I used to listen to EDM, but I couldn't concentrate on my work. I guess I subconsciously associate EDM with going out, having fun, etc so my mind just wanders.

The Classical station on Pandora (at least my station) isn't just the "stuffy" Beethoven pieces, but also incorporates really cool string or piano covers for famous songs. Try it out.

</comment><comment><USER12> Albums that I've listened to a lot. I prefer fast-singing rock bands (Icon For Hire, Flyleaf), anything 'quick' and with a fast tempo but it's important I have the lyrics cemented into my brain. Just pick music that makes you FEEL good and puts you into an excitable mood.

I am also a big fan of game and movie soundtracks. Big, loud orchestral pieces.

</comment><comment><USER13> Generally, total silence.

If in busy environment, I put on some headphones/earbuds and maybe a little Dave Brubeck.

</comment><comment><USER14> I dont really listen to music. But sometimes I like to run an action packed movie in the background. The movie shouldn't be new to me, preferably in other language too. Maybe I like it because of adrenalin rush. :).

Even those rainy moods are better than music.

Music distracts with an urge to sing with it. And with instrumentals I get bored soon.

</comment><comment><USER15> Essential Mixes via bootlegged mp3s are awesome to code with.

I've also been following THUMP on Soundcloud and they've been putting up a fair amount of awesome mixes: [https://soundcloud.com/thump](https://soundcloud.com/thump)

<comment><AUTHOR> Thanks, I really like these mixes.

</comment></comment><comment><USER16> Goodness. Just about anything, but I guess of note due to unusuality would be that when I need "motivation music" I'll code to Moombahton/trap/hip hop; It's the same sort of mood I get into during a good workout.

</comment><comment><USER17> Downtempo - [http://grooveshark.com/playlist/Programming+Music/60387099](http://grooveshark.com/playlist/Programming+Music/60387099)

</comment><comment><USER18> [http://grooveshark.com/playlist/Programming001/95161345](http://grooveshark.com/playlist/Programming001/95161345)

</comment><comment><USER19> You can try deepmix.ru.

It's an Internet radio station where every song is mixed with the following. I mean, no dj speech, non-stop chill-ambient music.

</comment><comment><USER20> I'm actually a huge fan of Tycho. I like the music I listen to to be good when I pay attention, but not overwhelming while coding.

</comment><comment><USER21> I listen to a variety of stuff on Spotify now but when I listened to EDM more exclusively I would hit the di.fm online radio stations.

</comment><comment><USER22> sorry, no stream here - just -uhm, a cd in my ps-one

connected to a old tube amp... listening actualy to

thermostatic-"tonight", some "newer" i-hate-this-

place-songs (muste me some songs of the album with

"spaceinvaders" on it), last weekend there was

ramblin dawgs-you let me down on my turntable, and

next weekend there`s a must for "pöbel & gesocks" -

drinking finest... enjoy

</comment><comment><USER23> Depending on time of day

I either listen to Reggae (Banton or Tosh) or Swedish House Mafia (Techno) all via Youtube Channels

</comment><comment><USER24> i've been listening to albums on youtube lately - it recommended me this the other day: [https://www.youtube.com/watch?v=y1v3NeGtm_Y](https://www.youtube.com/watch?v=y1v3NeGtm_Y)

it's pretty crazy. i (re)wrote a lot of code to it yesterday.

</comment><comment><USER25> [http://www.deepmix.eu/](http://www.deepmix.eu/)

</comment><comment><USER26> Nobody has a Spotify playlist for this?

</comment><comment><USER27> vaporwave /r/Vaporwave

<comment><USER28> late nite music

</comment></comment><comment><USER29> Bubblegum pop on Pandora.

</comment><comment><USER30> somafm.com -- drone zone, space station or groove salad stations

<comment><AUTHOR> Thanks, I'm giving this a try right now :)

<comment><USER30> You're welcome. Mission control on somafm.com is an odd one too. It is a mix of historic shuttle missions radio chatter and ambient. Sometimes it really works out well. Sometimes it is so so. Give it a try see what you think

</comment></comment></comment><comment><USER31> BBC Radio 4

</comment><comment><USER28> the velvet underground</comment>


Digia releases Qt 5.2 with Android and iOS support - <AUTHOR> http://thenextweb.com/dd/2013/12/11/digia-releases-qt-5-2-android-ios-support-previews-windows-rt-launches-qt-mobile-edition/ <comment><USER2> Anyone have a good link (video? blog entry?) discussing what problem QML solves and why it is better than other solutions? Within the docs the biggest thing I am able to find is the following hand wavy statement:

"QML is a user interface specification and programming language. It allows developers and designers alike to create highly performant, fluidly animated and visually appealing applications. QML offers a highly readable, declarative, JSON-like syntax with support for imperative JavaScript expressions combined with dynamic property bindings."

I have heard about it for a number of years, but never been able to wrap my head around everything it is offering and why various choices were made.

<comment><USER3> I've used QML / QtQuick for a while. Here are my thoughts

1\. It makes writing UI state machines _much_ simpler since it is declarative. Instead of saying "when this information changes, update the UI", you just say "This bit of UI shows this information" and then it updates it does it automatically.

2\. Animation is also much easier (and possible at all).

3\. Layout is... myeh it is not so good actually. UI files made it really really simple, but QML has a kind of Android-like overcomplication to it. For example I have no idea how to have two buttons above each other with the same width and have that width the minimum required to fit them both. With the old system I didn't even have to think about that.

4\. Javascript was a _seriously_ bad choice. Fortunately you don't write that much of it (and the non-javascript parts of QML are well designed). The biggest problem is that you have to run code to have even the vaguest idea that it will work (probably you misspelt a variable). With C++ if it compiles you at least have _some_ idea that it will work. Also there is a lot of hassle converting between C++ values and javascript objects. Particularly for lists/vectors of things which work very badly and... to be honest does not really work.

5\. It does force you to separate your logic and UI - kind of like HTML/CSS. This is a good thing generally.

6\. Once you've done the hard C++ work, building the UI is much quicker and less verbose than using the old system. It is also easier to change around.

In generally they are going in the right direction. They just made a huge mistake by choosing javascript. They've ended up writing their own javascript VM too, so I don't know why they didn't take the opportunity to use a sane, strongly typed language.

<comment> alok-g Is using Javascript mandatory (for common uses)?

<comment><USER4> You can keep it minimal if you want to. In some situations you can avoid javascript completely (e.g. QML based framework covers all details for you).

</comment></comment></comment></comment><comment><USER5> I have to say it again - I'm so glad Qt didn't end up at Microsoft.

</comment><comment><USER6> _> You can download a 30-day trial of Qt Enterprise from Digia's Qt site (version 5.2 is slowly trickling out throughout the day). The open source version can meanwhile be snagged from Qt Project._

Does anybody know the difference between the Enterprise and Open Source versions? Is it just tech support or is the Open Source version going to lack the features we really need?

<comment><USER7> The license is the critical feature: the open source version is available under GPL and LGPL. Beware of the implications for iOS development with GPL/LGPL (have to distribute source or .o files for your application).

<comment><USER8> > have to distribute source or .o files for your application

Not if you dynamically link

<comment><USER9> Do iOS guidelines allow dynamic linking?

<comment><USER10> AFAIK it's not allowed, so Qt commercial is actually the only option for non- OSS on iOS.

</comment></comment></comment></comment></comment><comment><USER11> Is this in the git? I only see the v5.2.0-rc1 tag:

      Q:\qt5>git ls-remote && git tag
      From git://gitorious.org/qt/qt5.git
      ... <removed>
      qt-v5.0.0-alpha1
      v5.0.0-beta1
      v5.1.0
      v5.1.0-alpha1
      v5.1.0-beta1
      v5.1.0-rc1
      v5.1.0-rc2
      v5.1.1
      v5.2.0-alpha1
      v5.2.0-beta1
      v5.2.0-rc1

<comment><USER11> I just saw that tag v5.2.0 has been added.

</comment></comment><comment><USER12> Does anyone have more info on what the Android/iOS support is like? Does it give native style low level binding ala Mono or does it try to be a generic API that is a write once run everywhere kind of thing?

<comment><USER13> Write once, run anywhere kind of thing.

Accessing native functionality is actually not easy. I'm sure they will be addressing this at some point.

<comment><USER14> > Write once, run anywhere kind of thing.

Usually this ends up being "debug everywhere" kind of thing, based on my experience, regardless of the technology.

<comment><USER13> I'm sure it's even moreso given the different form factors of the various devices. I've given it a decent run and I think it's actually a pretty good system.

</comment></comment></comment></comment><comment><USER15> Does this mean we can create Android and iOS apps with Python (via e.g. PyQt)?

<comment><USER4> Actually QML apps can be written only using QML + Javascript. Performance or platform dependent parts can be written in C++.

Some Qt based frameworks experience. Ubuntu Touch chose to develop apps using Javascript only where possible. BlackBerry apps support both Javascript and C++. There are people who believe that QML must be used only for UI and all logic must be written in C++. IMHO Javascript is good choice as it is fast enough in many cases.

As for Python that's not what you want to use with QML and pure Qt is not what you want to use for mobile apps.

<comment><USER16> Javascript in iOS is not a good idea, unless you are just prototyping/building a basic app.

<comment><USER4> Maybe. My experience (not Qt based) with Javascript on iOS is not very bad (I expected worse). While I don't like that Apple created fake problems using script languages in iOS.

</comment></comment></comment></comment><comment><USER17> Anyone know what's up with the Mac extras overview page? It simply does not exist [1] whereas the Windows one does [2].

[1] [http://doc-snapshot.qt-project.org/qdoc/qtmacextras- overview...](http://doc-snapshot.qt-project.org/qdoc/qtmacextras- overview.html) [2] [http://doc-snapshot.qt-project.org/qdoc/qtwinextras- overview...](http://doc-snapshot.qt-project.org/qdoc/qtwinextras- overview.html)

</comment><comment><USER8> If I have a desktop app written using Qt libraries directly (i.e. no QML, .ui files, etc) will this new version allow it to run on iOS and Android?

<comment><USER10> I did a small test on iOS with the RC2 and the widgets were shown, although the theme was similar to some Linux distro rather than iOS native.

</comment></comment><comment><USER18> Can I call a Java library (say, google play services) from Qt without having to jump through JNI hoops?

<comment><USER19> At it's heart, Qt is basically a C++ framework/library, so it's just like invoking Java from regular C++ code.

In other words, JNI is involved.

</comment></comment><comment><USER20> Can't seem to find Qt 5.2 anywhere. Are the installers yet to be released?

<comment><USER21> From the article: Update at 11:00 AM EST: Digia has contacted TNW [TheNextWeb] to say that "some last minute technical issues" have delayed the launch until December 12. Downloads are now expected to go live at 10:00 AM CET (4:00 AM EST) [9:00 GMT], or about 22 hours later than previously planned.

</comment></comment><comment><USER22> I have to say using 'native' tools sux big time.

Lets hear it for 3rd parties!

</comment><comment><USER23> QtQuick vs Kivy?

</comment><comment><USER24> Lets hope that tools and frameworks like this will be widely adopted, thus more and more jobs requiring these skills, rather than that crap, over- engineered "native" SDKs/frameworks...

<comment><USER12> What's over engineered about Android? I work with it daily and find it quite nice and it really didn't take too much effort to dive into.

Also if you want something small and simple, I think QT might be the wrong tree to bark up. I've only used it on casually used it on desktop but it is not a small framework.

<comment><USER24> Just too much plumbing and boilerplate code is needed to do some simple things...

Agree, that for some small projects, Qt can be overkill.</comment></comment></comment>


Ask HN: why do recruiters omit the name of the company they're hiring for? - <AUTHOR>

Presumably there is a class of people who would reject the job if they knew the name of the company at first, but would accept if they knew more about the job before finding out the name of the company.<p>I just find it odd. If any of you are recruiters, have you tested response rates when you include the company name vs. not including it? <comment><USER2> Yes it is to assure that they get their commission and that you do not go either directly to the employer or another staffing firm.

</comment><comment><USER3> It's to justify their ridiculous fees and to avoid being cut out of the equation.</comment>


Toyota Mirai: World's first mass-produced hydrogen-powered car - <AUTHOR> http://www.belfasttelegraph.co.uk/technology/toyota-mirai-worlds-first-massproduced-hydrogenpowered-car-has-a-range-of-300-miles-and-its-on-its-way-to-the-uk-31507944.html

<comment><USER2> Can anybody with insight into more details than a layman comment on the attractiveness of a hydrogen-powered car vs. electric cars?

I know Elon Musk views them extremely unfavorably, I'm curious if that's just a blind spot, or if there's good reason to be skeptical of hydrogen-powered cars.

The fact that a huge amount of additional investment (paying off by 2030) is needed to set up hydrogen plants with renewable energy to make this tech 'green' seems to be one big disadvantage.

Edit: or anybody with an informed opinion, for that matter!</comment>


Show HN: Rebase-editor, a simple CLI app specifically for Git interactive rebase - <AUTHOR> https://github.com/sjurba/rebase-editor <comment><USER2> Cute, but I can do the exact same thing in Vim. It has built-in commands :Pick, :Reword etc that change the current line, and I've just defined my own ftplugin/gitrebase.vim file that looks like:

      nnoremap <buffer> <silent> <LocalLeader>p :Pick<CR>
      nnoremap <buffer> <silent> <LocalLeader>s :Squash<CR>
      nnoremap <buffer> <silent> <LocalLeader>e :Edit<CR>
      nnoremap <buffer> <silent> <LocalLeader>r :Reword<CR>
      nnoremap <buffer> <silent> <LocalLeader>f :Fixup<CR>
      nnoremap <buffer> <silent> <LocalLeader>c :Cycle<CR>

This way I just press e.g. "\p" or "\f" (my localleader is \\) to change the line, which makes it just one more keypress than your command, but I have the full power of Vim and I don't have to go about changing my editor.

<comment><USER3> So this is just "change the word at the beginning of the line to squash"? All of the commands can be replaced by one-character aliases, so I just use "cws<esc>" to like, "change to squash". What is proving these (much longer and less general) commands like ":Squash<enter>"?

<comment><USER2> Sure, you could do that, but if you're going down the list making changes to 12 lines, it's much easier just to say something like \fj\ejj\sj\sj\fjjj\e instead of ciwfixup<esc>jciwedit<esc>jjciwsquash<esc>jciwsquash<esc>jciwfixup<esc>jjjciwedit<esc>

</comment></comment></comment><comment><USER4> Nice, magit for dummies. But note that the rebase commands are only the start of your problems. Much more important is the conflict resolution step, which is easily doable in magit, but hard with this one. You need the list, where you are, keybindings to get ours or theirs or to jump to the conflict. A Three-way diff editor hook.

<comment><AUTHOR> Yupp. It's not a complete git gui. Its only used to work on the rebase sequence. Once you finish editing that, git takes over again. You need to use other tools to sort your conflicts, etc. But if you are working on the command line its very nice.

</comment></comment><comment><USER5> Cool, but I think it's better if it's in your text editor. In Emacs I use Magit, it is spectacular.

<comment><AUTHOR> Yes, I respect that. I guess I wrote this app for the people who don't use Emacs and/or Vim on a regular basis, but still enjoy using git on the command line, like my self... I might have to check out magit though to see if there are some ideas I could steal. :) Any functionality/workflow in particular that works better with magit?

<comment><USER6> Even if you don't use Emacs regularly, using Magit just for git operations might be worth it. Just have an Emacs config ready with Magit installed and use that as your "git user interface".

Every git operation I've done is effortless with Magit: interactive rebase, selective staging (line based, not just hunk based), cherry picking, reordering commits and squashing, creating/pushing to/deleting local/remote branches, viewing graphical branch log, .. (list goes on).

</comment></comment></comment><comment><USER7> The author of this is not making use of

      git commit --squash <sha>
      git commit --fixup <sha>
      git rebase -i --autosquash ...

Autosquash puts things in the right order.

Of course, you have to pick the target commit at the fixup commit time. But that is less error-prone then later trying to remember what such and such commit was intended to combine with.

<comment><USER8> Saw this just last week

        $ git config --global rebase.autosquash true

<comment><USER7> How long has _that_ been a feature, darn!

</comment></comment></comment><comment><USER9> What a strange world we live in that that a terminal app would be written in Node.js.

<comment><AUTHOR> Yupp. I agree. And writing something cross platform for the terminal kinda sux. I have given some thought to porting it to something else, but am not sure what that would be. Any suggestions? Requirements: a nice language to work with, cross platform, easy to install the executable(s)

<comment><USER10> You should give Golang a shot. It checks all your requirements.

<comment><AUTHOR> Yes, I have looked at that, and it is tempting. But you still have to worry about cross compiling and distribution. Right?

<comment><USER10> Cross compiling is very easy since Go 1.5, just add some environment variables before running `go build`, which can be put in a Makefile.

Distribution is a little trickier since there is no package manager ala npm, however it's a little easier in that you don't need anything except for the binary. For people who have Go installed they just `go get REPO` and it's installed, for others they can just wget the binary into their bin.

</comment></comment></comment></comment></comment><comment><USER11> I've seen people use rebase like a patch queue a few times, and it always comes off as awkward and painful. This app seems to make that pattern of use a little less painful -- but patch queues are better. I wish more people knew about them as a source control tool.

mercurial queues - far and away the my favorite patch queue implementation - [https://developer.mozilla.org/en- US/docs/Mozilla/Mercurial/Q...](https://developer.mozilla.org/en- US/docs/Mozilla/Mercurial/Queues)

stacked git - a solid git patch queue - [http://procode.org/stgit/doc/tutorial.html](http://procode.org/stgit/doc/tutorial.html)

<comment><USER12> Out of curiosity, what about interactive rebases do you find awkward/painful? Or asked differently, what about hg's patch queues make them better?

Reading the linked documentation for patch queues, it isn't clear to me how they materially differ from git's interactive rebase. (Modulo hg's mutable/immutable differences.)

</comment></comment><comment><USER13> As it has been said a lot: you can use vim or whatever editor to do this just as easily for the amount of time this would save you.

How many times per day are you actually rebasing interactively? I myself might do it once per week and that in a project with 6 developers with a fairly strict commmit policy. I can only imagine having a job where doing interactive rebases is the only thing you do before you get a return of investment on a. building the tool (you) and b. learning how to use it (others).

You could probably have learned to use vim in the time it took you to build this, at least the basics. You could also start learning about vim by enabling vim-mode in your editor. Most editors have one at least.

<comment><AUTHOR> For me, I agree. I could easily learn vim in the time I wrote this. For others, I disagree. The time to learn my app is 0. Nothing to look up or check. The available keys are right there in front of you. And since they are what you would intuitively expect, you won't forget them. Up and down, shift to select, ctrl to move. f to fixup, s to squash, etc. If you are a avid vim user, yes. You don't need this tool (although it will still save you a few keystrokes), but if you are like most developers who struggles to remember how to exit vim, then you will love this app.

Vim is awesome and my app could never do a fraction of the stuff vim does. But my app can do interactive rebase. And since it is the only thing my app can do, it does it better then vim.

<comment><AUTHOR> And btw. since writing this app I started committing more often and using interactive rebase a lot more because it become so easy. I would say I use it almost daily.

</comment></comment></comment><comment><USER14> Interesting! We maintain some coding tutorials and use Git interactive rebase to match the commit history to the tutorial steps:

Text: [https://docs.starcounter.io/tutorial/](https://docs.starcounter.io/tutorial/)

Code: [https://github.com/StarcounterApps/HelloWorld/commits/tutori...](https://github.com/StarcounterApps/HelloWorld/commits/tutorial-20170327)

Interactive rebase instructions: [https://github.com/StarcounterApps/HelloWorld/wiki](https://github.com/StarcounterApps/HelloWorld/wiki)

</comment><comment><USER15> Cool. I also wrote a vim plugin to do stuff like cycling between keywords. There is already a gitrebase filetype to hook it to as well.

[https://github.com/mjbrownie/swapit](https://github.com/mjbrownie/swapit)

</comment><comment><USER16> One tip when rebasing in vim, you can execute commands in the session. I use sed to replace picks with other commands:

:%s/pick/squash/gc

Also, I've gotten used to using git commit --fixup with git rebase --autosquash, so I rarely need to interactively rebase these days.</comment>


Ask HN: How has learning a new language helped you in your career? - <AUTHOR> Looking for those who have learned a new language after they were already employed. <comment><USER2> Confidence, mostly.

I started out as a .NET developer, and I worked my way up from junior to senior over the space of a few years. At my last .NET role, I helped shape the structure of .NET development for my satellite office and the growing London team.

Despite being considered a decent enough .NET developer, I had felt a bit of imposter syndrome around my skills. In the wider tech community, .NET and C# has always been a pariah, and while looking at who was hiring in my local area, I decided to apply for a role that didn't involve any .NET.

Now, I write Ruby, and while there was a learning curve to start with, I can firmly say that I am capable of adapting to a new stack. I like Ruby, and I still like .NET, but I feel so much more confident about learning new things now that I've proved that I can do it.

</comment><comment><USER3> > How has learning a new language helped you in your career?

I have a success story, I would not say it helped me in my career. but it made me more confident as a developer.

I was a full-stack PHP developer. In my free time, I always learn new languages (python, ruby, go, rust, OCaml, Clojure, and some Haskell). even now I kinda enjoy learning new stacks. its just fun for me.

For one of our projects (it's back 3 or 4 years ago), we used node. To that point, I never really looked deep into it as I was always busy with go and rust. turns out I was really productive from day one. while others had to do some soul searching.

In short, it made me a better developer and more confident.

</comment><comment><USER4> I choose the best tool for the job and not necessarily the tool I know, this includes languages but also environments and technologies. I needed Perl (yes, I know), Python, C++, Java, JS, and a few other obscure scripting languages simply because of an existing tool or due to better performance so I simply learnt them.

If you are referring to spoken language, then I learnt Swedish to better communicate with my work colleagues.</comment>


Did Uber fail in China? Perspectives on the merger from a former employee - <AUTHOR> https://www.linkedin.com/pulse/did-uber-fail-china-perspectives-from-former-employee-chenyu-zheng?trk=v-feed&lipi=urn%3Ali%3Apage%3Ad_flagship3_feed%3B5sgJJRkFI57A6XYmYlLv3w%3D%3D <comment><USER2> Uber is also pretty much the only western company to have real success in China, which is something Google, Facebook and Amazon have yet to do. Owning almost 20% of the local giant is a lot more than having no presence in the country.</comment>


Technical Debt 101 - <AUTHOR> https://medium.com/@joaomilho/festina-lente-e29070811b84 <comment><USER3> I've had occasion to think a lot about the relationship of quality to long term productivity. The remarkable thing about building software quickly is that if you focus on speed, cutting quality where needed to "move forward", you end up slowing down after a while, due to the build-up of technical debt. A continued focus on speed will typically result in slower development, and a low-quality product, a sort of worst of both worlds scenario.

On the other hand, if you focus on quality, you end up making choices that enable fast development. You make sure you have high-quality requirements and a deep business domain insight in the whole team, which means you end up writing only that code which you truly need, and write it in the right order (most important features first). You make sure you have code that is well- covered by tests, which as a happy side-effect makes it easy to adapt to new requirements. You focus on having a high-quality deployment process, so the amount of customer issues that result from a broken deployment go down reducing the load on your dev and support teams.

Focusing on quality first is not about gold-plating code, it's about making conscious decisions to have a high-quality process from front to back, and those decisions typically result in a highly efficient organization. It's no accident that those teams which manage to ship releases every few weeks (e.g. firefox, chrome, facebook) have world-class products. You have to focus on quality to go fast.

This isn't just theory. Capers Jones actually measured this. The fastest delivery schedules were produced by teams with the highest quality product. [http://www.parasoft.com/products/article.jsp?articleId=2769](http://www.parasoft.com/products/article.jsp?articleId=2769)

<comment><USER4> As someone who works at a place that has tons of technical debt yet is able to release daily, I have to disagree.

We have things that are 6+ months old without any of the normal best practices and are able to continue to ship w/o delay.

 _Hell, for a new project /service two of my coworkers completely bypassed version control and unit tests_.

You can achieve high velocity without high quality. The cost to do that is sometimes you have an expensive production bug to fix.

Please note, I'm not endorsing the way my coworkers do things but I've given up fighting any of it outside of my narrow slice of turf. ;)

<comment><USER5> It sounds like releasing daily is part of your testing strategy in that you simply let your customers do the testing for you.

Making small incremental changes with extensive manual testing can work. It just looks like you don't have to pay for the test effort.

I've seen it a fair bit with internal projects at larger companies but most external customers I have met in my career would quickly switch products.

Edit: It also sounds like you are confusing best practices with good code. I've met teams, usually without a formal cs education, who haven't used version control and didn't have any unit tests, but still had a well designed codebase. Of course best practices are best practices for a reason....

<comment><USER4> > Edit: It also sounds like you are confusing best practices with good code. > I've met teams, usually without a formal cs education, who haven't used > version control and didn't have any unit tests, but still had a well > designed codebase. Of course best practices are best practices for a > reason....

1) They both have degrees in comp sci.

2) For very narrow definitions of the word "good" you would be correct. Its technically functional and reliable. However, it regularly has problems with security and/or changes to the common library breaking other people's services.

</comment></comment></comment></comment><comment><USER6> It's possible to minimise the technical debt you take on (without spending the full amount up front) by being smart about your application's design/architecture.

Using the user roles example given in the article, it's not beyond the wit of man to foresee that you're going to need user roles at some point in the future, so you can make provisions for adding it in later. Done right, the extra effort is minimal but means that you'll be able to plug in the new functionality at a later date without needing to refactor the entire codebase.

It might be as simple as figuring out where the permissions/role check will go and including a "# Future permissions check will go here" comment. Or you might actually include a check that calls a dummy service/function which always responds to a "Can this $user do $action to $resource?" query with "Yes". Then, in a few months, you can simply replace the dummy service/function with a real one.

You don't even have to design/architect the whole thing up front. You just need to avoid painting yourself into a corner. Ask yourself "What am I likely to need in the future and can I do something cheap now that will save me a lot of time/effort further down the line?"

If you ever need to explain this concept to a non-technical manager, tell them that it's like applying a kind of net present value calculation to development time/resources: Spending a little extra now means you can potentially save a lot further down the line.

<comment><USER7> > It might be as simple as figuring out where the permissions/role check will > go and including a "# Future permissions check will go here" comment.

Very good point. I was thinking about this issue not too long ago. And the ability to do that, comes with experience and often separates normal programmers from much better programmers.

It also takes a while to detect this, because there needs to be enough "Futures" that become present to tell if the original architect predicted or foresaw or did they just over-abstract or and overloaded the code with potential apis or features.

More often than not I see the later. "This code never runs","why is this here","we have 4 levels of abstraction for this, why?". "Oh because I thought we'd have this and that in the future so I added in".

Quite rarely I see the former. When a developer is asked "can we add this?" they come back and say "yes easily, I knew you'd come and ask for this so I added the abstraction to handle it or add stuff to it later". The one thing I noticed is that this becomes a pattern for people. Some people create the former type software some the later.

</comment></comment><comment><USER8> I don't understand why bad code is "not technical debt". It seems to me technical debt, _poorly spent_. Someone who takes a payday loan to buy beer is still incurring a debt.

If there is some more meaningful distinction here that I'm missing, can someone clarify?

<comment><USER9> 'Technical Debt' is a case where a specific thing was named before the general concept. Another case is the phrase 'mock object'. In the early 2000s, the original mock objects paper coined the term and defined them as testing stubs with builtin expectations. For years, people used the term "mock object" for any sort of stub.

Technical Debt is a very specific metaphor that Ward Cunningham framed as a strategy. Ever since, though, people have used the phrase for all sorts of entropy in software. If you look around the literature, you'll see people talking about type 1 and type 2 technical debt.

In my experience (and I'm the guy who wrote the Legacy Code book mentioned in the article), the typical entropy thing that we see in software has more to do with just taking the easy way and avoiding refactoring - different from Ward's concept.

</comment></comment><comment><USER10> To me, all code is debt so long as it requires maintenance. It will be read and modified hundred of times after being initially written hence why you want to have as few as possible. Code also need to be hosted on servers somewhere and that's a sort of debt too since you now are forced to maintain the infrastructure, keep the software updated, ensure it's always running. However, you have to accept a certain amount of debt otherwise you will never be able to launch anything. Everytime you can invest some time to reduce maintenance later down the road, it's like getting a lower rate on your debt. However no matter how hard you'll try, if the project is used it'll require love, time and hard work to keep it going. Then comes a time where either the project fails and you take it down (and stop paying any debt) or, if you're lucky, the balance between ongoing cost and benefits start to even out and you're finally out of the woods.

</comment><comment><USER11> While a good post, the real issue is that non technical managers of technical projects is quickly becoming more of a risk than many projects can prudently accept.

The old, and unfair, characterization of programmers as smelly trolls that can't handle client interactions is more of a crutch for fools than a reality.

The truth is my clients complain bitterly about how they'd prefer to just talk directly to the dev's and not be bothered by the various hand waivers trying to justify their line item on an invoice. Often this is a great way to annoy the dev team, but it's a good expression of the perceived value of a non technical intermediary.

In the end the old truism of "You can't manage what you don't understand" still applies to this new fangled industry of software development.

That being said, ramping dev's up on management techniques is another challenge, for another internet rant.

</comment><comment><USER12> I don't see why the analogy to debt is necessary when the direct analogy is to capital underinvestment: in fact what we're talking about _is_ or very nearly is just that, capital underinvestment, not simply something analogous to it. And the hypothetical businessy, non-technical types whom the debt analogy is intended to enlighten understand very clearly what deferring capital investment is and what the likely consequences are, at least if they actually know anything much about business.

<comment><USER13> Most of the people who are pushing for "features now, someone else's problem later" are probably not upper management but rather middle management. Upper management might understand capital underinvestment. Capital underinvestment is very nearly the sole job middle management is there for. And berating people for not being done yet. At least at a couple of the places I've worked.

</comment></comment><comment><USER14> I like the concept of Minimum Lovable Product, although MLP isn't as catchy as MVP (thanks to sports). It's probably good to think of an MVP as a step on the way to an MLP - the MVP is the one you release to specific audiences of likely users or show to angels or seed investors to show that it can work, and be very explicit about it not even being a beta version - more like a version 0.1.

</comment><comment><USER15> >Thousands of startups have launched and failed precisely for the lack of quality.

That was an emphatic statement in the article and I feel the discussion would really be constructive if the author (or posters in this thread) listed concrete examples of startups that failed _primarily_ because of software quality.

If success has many fathers, failures are not orphans and also have many fathers as well. Perhaps software quality was not the 1st but actually the 2nd or 3rd reason why the company failed. I'm not saying such examples of software execution killing the company don't exist. I just can't think of any prominent examples at the moment.

I'm leaving out poor software examples such as the Atari 2600 E.T Extra Terrestrial game cartridge because that was not a startup situation.[1]

[1][http://en.wikipedia.org/wiki/E.T._the_Extra- Terrestrial_(vid...](http://en.wikipedia.org/wiki/E.T._the_Extra- Terrestrial_\(video_game\)#Critical_response)

On the other hand, an internet company like Friendster looks like an interesting case study. Their infrastructure software was not efficiently traversing their social graph. It was something Facebook programmers conquered but Friendster did not. But was software quality the #1 reason behind Friendster's demise? Apparently, the board-of-directors didn't prioritize and throw money at the engineering challenges that Friendster was facing.[2] So the their failure can be reinterpreted as a combination of management of priorities and software execution. Maybe if they did throw money at the issue, it wouldn't have mattered because their programming staff didn't have the unique competencies to tackle at-scale social graph problems. In that case, it's not a "technical debt" issue but a "hiring talent" issue.

[2][http://highscalability.com/friendster-lost-lead-because- fail...](http://highscalability.com/friendster-lost-lead-because-failure- scale)

Another case study might be the Chandler software (chronicled in the book "Dreaming in Code"). However, it appears that the product got bogged down by architecture astronauts unable to make decisions and not "technical debt".

If there are thousands of companies that failed on software quality, it'd be interesting to see which ones can be disentangled from non-software issues and we can confidently say, " _yep, that technical debt is what killed them._ "

(My curiosity for real examples does not mean I'm endorsing technical debt. I'd just like to get some real-world perspective on this topic.)

</comment><comment><USER16> Here's the analogy I made up a bit ago trying to explain the concept.

As programmers We build code paths. Design mazes. In the beginning the maze is simple, there's only a few paths. To make things simple we separate our ideas into many small mazes. Since they're small, it takes a short amount of time and concentration to predict the different possible paths in our heads.

Technical debt is when, due to to time constraints the decision is made that it is quicker to draw one more line on an existing maze, rather than create a whole new small maze. In the beginning it seems not so bad, you can still take in the whole maze at once. But as time goes on, that one maze gets larger and larger, and finding a successful path through it takes longer, and longer. Eventually you get to the point where you can't separate the maze because too many of the paths are built on top of each other, but you also can't manage the maze because its to large itself. That's the default. That's the rewrite.

</comment><comment><USER17> This isn't a 'primer' about Technical debt - it's an opinionated piece about the value of the concept of technical debt, which I think is at least a 102 or possibly 201 level course on the subject, and needs to be taken in the context of other material. I suspect it hasn't been tested out on many nontechnical managers, either - using the concept of electron spin (for a nontechnical audience, remember) as an analogy for the concept of analogies is the kind of meta-analysis that I think will lose them pretty early on.

I think the real problem of this piece is that it flatters nontechnical managers, as businesspeople, by describing technical debt as a sensible business decision they can get into consciously through clearheaded negotiation with their technical team; then characterizes 'bad code' as something different, that happens when the technical team just don't do their job. This alleviates the nontechnical manager of any responsibility for bad code. The fact is that knowing about technical debt is not necessary to find yourself up to your neck in it. A team which goes for years taking shortcuts, being forced to hit unrealistic deadlines, or which lacks the skills to really build a good, robust system, is like a kid with a credit card who doesn't get that just paying the minimum payment each month isn't going to work forever. Every shortcut they get asked to take, they swipe the card, and they get to walk out of the store with the goods, and it seems to just keep on working; thousands of dollars worth of stuff, and they just have to pay a few hundred each month. It's magic!

But the consequences will show up in the end, either in the form of a long period of hard graft to pay it down, or declaring bankruptcy and abandoning the codebase.

That's why I love the technical debt analogy - different people manage financial debt differently, and most businesspeople understand the concept that planned debt is necessary and beneficial for growth; arguing that Ward Cunningham and the author don't think you should call other technical debt by that name seems petty, and not particularly useful, when extending the analogy to runaway debts works so well.

Overall the problem I really have with this piece is that if I tell a manager "This project is carrying a bunch of technical debt," now they'll google it, find this, and come back to me with "You mean it's a pile of bad code." Which is true, but how does that help us? When I make the argument that a troubled project needs to pay down some technical debt, I'm trying to make clear that we need to start paying off more than just the minimum payment every month. If the technical debt analogy is removed from the table, I'm left with just saying the team needs to replace the bad code with good code. And then they'll tell me that this piece also told them that the 'big rewrite' was a bad idea too... So how has this helped?

<comment><USER18> That's when you tell them to go read Big Ball of Mud. [http://www.laputan.org/mud/](http://www.laputan.org/mud/)

Then they start to understand.

</comment></comment><comment><USER19> I'm not really a fan of the story-point example. The article begins with:

> it's something that you get when you delay design decisions for later

But then presents us with a problem where we can "spend" 21 story points now, knowing we won't have to do much refactoring later. How do we know this? I thought the whole point was we couldn't see enough of the picture to make a stable design.

Instead of talking about how patches, hacks, and workarounds impact code, I'd like to see discussion on how you move forward when you know the requirements are going to change, but don't know how.

<comment><USER13> If you implement a robust permissioning system that has permissions related to group membership and one-off permissions related to a single user then MOST of your problems are solved. Nearly all new permission requirements can then be made without touching the code at all, or in more than a couple of places.

The idea is to choose a new design that scales better. If you have M permissions and N permission checks then each new requirement might cause M * N changes to the codebase.

If you have a reasonable permission system you might end up having to make N changes to the codebase (worst-case) or perhaps only M modifications to permissions or perhaps both. But in that case it's M + N changes, rather than M * N. For any values of M and N greater than 2 (and very nearly all of them will be) M + N is smaller than M * N.

<comment><USER19> The issue I deal with isn't in choosing a design that scales better, it is uncertainty in how things will scale. Say I need to handle group permissions depending on the context. I could hard-code the permissions changes for the one group that needs it now, or I could abstract and generalize context- switching behavior into its own component, ensuring changes to future groups will be easy and low-cost.

But, what if I _never_ get a second group that needs this? While hard-coding values was an ugly shortcut, I may never have a need to revisit the code. If I had gone with a generalized solution, I'd still have to contend with maintaining all that code.

<comment><USER13> That's an interesting point. Here's my take:

If you ask someone who knows about the business rules if something could EVER happen and they say "no" they're probably wrong, but not maliciously so. Be cautious when taking their word for something. Even if the CEO signs off on the idea of "such and such never needs to be able to do x, y or z" the second a big contract does need it, it all goes out the window.

As a result whenever possible choose solutions that give you SOME flexibility without necessarily creating a supremely robust, exhaustive module.

In this particular case, once you realize that you're going to have more in the way of permissions other than global can/can't do, it's time to be smart. Being smart might only mean creating a function which takes some context like userid and "permissions token" and/or the URL that the person is visiting and then doing a hardcoded permissions check for say one of a dozen userids who are basically root versus everyone else who isn't.

Yes you didn't make a giant scalable system of awesomeness including a web- based permission editor. But you did make a function you can insert every time a new permission item gets created and eventually a system could be created for storing those in the database such that users can eventually be mapped to permissions also in the database.

So if you want to hard-code those values into a single page, which then grows into two pages, which then grows into four pages which then grows into 29 pages that's the wrong solution. But if you want to hardcode those into a function which you then call, that's a good enough solution for now that doesn't hobble you later. Putting the function call in adds very minimal overhead in terms of execution and ranges from slightly negative to moderately positive on maintainability.

Parts of software development are similar to being a speculator in a financial market. You need to have a fairly intuitive grasp of what's going to be a "good bet" for spending a little more time now which has the potential to pay off big in the future.

</comment></comment></comment></comment><comment><USER20> I think analogies generally suck. Better to analyze things for what they are. Analogies are good for explaining difficult to understand concepts, but all to often people say, x is analogous with y, y has something good/bad about it, therefore x has something good/bad about it.

Technical debt is a good example of a bad analogy :

1\. Assume some piece of code works, technical debt is only an issue if that code ever needs to be modified. Financial debt is always an issue regardless of what happens, even if you die.

2\. Writing some code that generates the so called technical debt will often have an upfront cost saving, so whilst it might incur some extra work down the track, the extra work isn't a straight cost. The cost = (extra work - <USER2> saved up front).

3\. Attempting to avoid technical debt often ends up with over-engineered code.

4\. Being dogmatic and avoiding technical debt in all projects is often not good for the project / business / investors. Being early to market at the cost of code quality is often very important.

I think point 3 is the worst scourge of all. It is quite common amongst mid- range developers. After working for a while they start to get good development skills and start to think too much, looking for ways to express their skills.

In summary, it is like most things in life, there is a balance to be found.

<comment><USER20> Something that gives a counter opinion to group think is never appreciated. Better we all sit around and stroke our egos, with every statement implying how magnificent we are and at the same time implying how everyone else is churning out debt filled shit.

</comment></comment><comment><USER21> I am not sure "delaying business decisions for when you have better information" causes technical debt. Under this premise, pretty much every agile development project would be technically bankrupt.

</comment><comment><USER22> I like its target audience, but am I supposed to just forward this to my superiors? Can't imagine they won't feel at least a little insulted, even if it's a concept they need to understand.

</comment><comment><USER23> Always an interesting subject. I can't help but feel it would reach a much wider audience and achieve a greater impact if it was subjected to an automated grammar check, or edited by a native English speaker. I could not get through all of the distracting grammar errors, and I suspect most non- technical English speaking managers (who seem to be the intended audience?) would have the same reaction.

<comment><USER24> Could you provide some examples?

As a native English speaker and someone who prides themselves on their ability to clearly convey complex ideas through prose, I don't recall a point where a grammatical error detracted from my understanding.

</comment></comment><comment><USER25> "Bad code" is a completely subjective measure which everyone is sure they will know when they see it, but few agree on the actual definition.

Extreme examples will be floated, but in practice what people consider "bad code" are things that made decisions that aren't sustainable. For instance a complete lack of permissions. A lack of logging. A lack of multithreading if it's a CPU bound process. Locks. Dependencies. Etc.

Each person and team really does define bad code differently, and often in complete contrast with each other. There are people who considered DI heavy code bad code. Heavily abstracted and layered Java code is considered great code by some, horrendous code by others. And on and on.

</comment><comment><USER26> Can I upvote this like a million times?</comment>


Is Quora Ready for Pop Music? - <AUTHOR> http://amandapeyton.com/blog/2011/01/is-quora-ready-for-pop-music/

<comment><USER2> Perhaps this is not the right question for Quora. Explaining a rapper's success is akin to asking why Simon Cowell is as good as he is at what he does?

Personally to me Quora is great for answering questions that do not require very deep analysis but require specific knowledge in an area.

<comment><AUTHOR> Disagree. There's actually a pretty significant collection of answers around the "Why is X popular?" tag, though most of the questions are about startups and traction, etc. "Why is Instagram popular?" is the perfect question for Quora.

<comment><USER2> Let me clarify, if a question has already been asked such as "Why is x popular?" a search engine is likely to give you a good answer.

If you are the first person to ask a question and you need an opinion then something like Quora can be a great place.

</comment></comment></comment><comment><USER3> Quora is 6 months away from turning into Yahoo! Answers.

<comment><USER4> I'll believe you when I see the "caps lock question" on Quora.

[http://answers.yahoo.com/question/index?qid=20090903085749AA...](http://answers.yahoo.com/question/index?qid=20090903085749AAGT84W)

</comment></comment><comment> wh-uws I personally feel like she asked a question that couldn't be suitably answered by most of quora's current community.

This has nothing to with it as a whole or on the track its going

what about?

<http://www.quora.com/Why-is-Lady-Gaga-so-popular> [http://www.quora.com/Justin-Bieber/Why-is-Justin-Bieber- so-p...](http://www.quora.com/Justin-Bieber/Why-is-Justin-Bieber-so-popular-1)

And also why is this on the front page of Hacker News?

</comment><comment><USER5> I've had a hard time posting questions to quora with band names because I keep getting bounced by the automated capitalization and grammar rules.

</comment><comment><USER6> If it concerns Nicki Minaj, the question should be, "Dude, what were you thinking, civilization?"

</comment><comment><USER7> "Is Quora Ready for Pop Music?" would actually be a good question to be posted Quora itself and "Why is Nicki Minaj so popular?" would make a fine personal blog post... downside of that is the later would probably not make HN front page.

</comment><comment><USER8> YES</comment>


The Smart Hiring Standard - <AUTHOR> http://www.andyrutledge.com/the-smart-hiring-standard.php <comment><USER2> "Smart people can sometimes make stupid choices. Don't let stupid choices be the foundation for your department, your company, your work environment, or your life."

Words every founder should carry in their wallet.</comment>


A High Growth Driver or Just Another Hyped Tech? IoT in Manufacturing - <AUTHOR> The effects of IOT are ubiquitous. Pick out any industry that is fuelling modernisation of the society, and you will find the ample benefactors of IOT. While the ultimate motive of living an unflinchingly automated and connected life has been made possible solely by Internet of Things, the latter is still continuing to surprise us with uncanny evidences of its omnipresence in the parallel virtual world. <comment><AUTHOR> For more info visit the link [https://www.linkedin.com/pulse/high-growth- driver-just-anoth...](https://www.linkedin.com/pulse/high-growth-driver-just- another-hyped-tech-iot-bhavin-shah)</comment>


Consequences of Living on a Sphere - <AUTHOR> http://www.datagenetics.com/blog/june32012/index.html

<comment><USER2> This is an interesting topic. I always thought it was awesome that you can estimate the size of the earth using the difference in shadow angle between two points.

White text on black background website warning.

<comment><AUTHOR> Indeed. It's something that we smart folks are aware of, but it's difficult to comprehend the effects on a day-to-day basis. Makes me wish I were a few inches taller!</comment></comment>


Who does graphic design for YC companies? - <AUTHOR>

<comment><AUTHOR> I've noticed that a number of the recent YC companies have some pretty slick web 2.0-style graphic design (loopt, Wufoo, i'm in like with you, and Scribd, just to name a few).

I'm guessing folks aren't doing the design themselves? If not who is?

<comment><USER2> Wufoo and Likewithyou are doing it themselves. They have design backgrounds. Loopt is now a big co and presumably paid a good design firm. I think Scribd has an outside designer too.

<comment><USER3> That is not true. Ricky Pernikoff is a rockstar.

</comment></comment></comment><comment><USER4> In fact, I have this question of a couple of website ... For people on a budget, what makes sense?

So far, the way I've worked it ... I know a few people or friend-of-a-friend.

But what are the better and cheaper web teplate design companies out there?

</comment><comment><USER5> How about this YC site? Who does this UI? I mean its slick with vibrant orange. Just a curiosity thats all

<comment><USER6> PG is behind the site. I believe Likebetter's Bryan Kennedy added some style modifications a few weeks back.

Some of the YC companies have design backgrounds, and you can really tell. I'm a big fan of the Wufoo guys' design sense, especially their work for Particle Tree. As pg said in an interview: a hacker with a good sense of design is really dangerous.</comment></comment>