Facebook confirms it is scanning your private messages to increase Likes - <AUTHOR> http://thenextweb.com/facebook/2012/10/04/facebook-confirms-it-is-scanning-your-private-messages-for-links-so-it-can-increase-like-counters/ <comment><USER2> To me, this is just standard privacy hyperbole that rears it's head every now and then.

Anyone remember the headlines several years ago when "Google 'scans' your emails to serve targetted ads'? When was the last time you heard someone complain about that anymore? No one does, because it doesn't matter.

Why should me sharing a link via a PM and my action be aggregated into an anonymous number worry me? How is the argument different from Google 'scanning your emails'?

Social networks nowadays seem to be competing on ways of justifying bigger numbers on the counters. It makes sense, the bigger the number the bigger the social proof which will attract webmasters. Scanning PM's for shares isn't something I might of thought they would do, but they do and it makes sense. The whole privacy debate surrounding this particular case is a complete non- issue for me though and will probably fade into insignificance just like Google scanning your emails.

An action from a big company that shifts the boundaries of acceptability in privacy would be a justified concern, but in this instance no land here in the privacy war has been lost. Nothings really happened.

<comment><USER3> It's not the same thing.

Let's say I'm a republicrat and I'm furiously sending private messages with links to democan sites showing my friends how evil I think they are. Except now I'm told every one of my links as just made those republicrat sites more liked an I'm helping make it look like they are more popular than they really are.

Scanning emails to serve you ads does not leak information to the public indirectly. Increasing like counts does.

<comment><USER4> Lesson learned: stop linking to evil content.

<comment><USER5> Wonder if this will exacerbate the effect of everyone only seeing views that agree with theirs and decreasing exposure to different (/evil) perspectives.

<comment><USER4> Personally I'd be happy with fewer "look at this idiot" links, whether they be on Facebook or HN. If its more of a "something to think about" link, even if I disagree, I think I'm ok if their like count goes up when I share it.

</comment></comment></comment></comment></comment><comment><USER6> There's a reason I disable Facebook buttons on my browser and don't stick them on my own sites (including my blog). I don't trust Facebook with my browsing data, and I don't want to subject users of any website I work on to their abuse, either.

"Move fast and break expectation of privacy"

<comment><USER7> how do you go about disabling facebook buttons?

<comment><USER8> Run NoScript, never whitelist facebook. Crude but effective.

<comment><USER9> This only prevents FB scripts from executing, but you still get the images ( and FB the cookies). So this is not the solution for the paranoid.

</comment></comment></comment></comment><comment><USER10> This is known by most Facebook App Developers.

What makes up the number shown on my Like button? <http://developers.facebook.com/docs/reference/plugins/like/>

The number shown is the sum of:

The number of likes of this URL. The number of shares of this URL (this includes copy/pasting a link back to Facebook). The number of likes and comments on stories on Facebook about this URL. The number of inbox messages containing this URL as an attachment.

<comment><USER11> From the API you can actually get a breakdown of that number into those component numbers.

</comment></comment><comment> k-mcgrady Doesn't sound like a big deal at all. There certainly aren't any privacy implications. When you send a link to a website via PM the 'like' counter on that page on that website will increase by one. Makes sense (not perfect though e.g. if you're directing a friend to something you don't like). It's not like the 'like' is then shared publicly to your friends not part of the private conversation.

<comment><USER12> They know who you are and what link you forwarded. The only thing keeping it out of the public eye is Facebook's discretion, and they have a track record of unpredictably disclosing more data about you without an opt-in.

<comment><USER13> Facebook would have that data even if they didn't use it for the like button count.

</comment></comment></comment><comment> dumb-dumb The difference between Gmail and Facebook is that Gmail did not aim to track who you correspond with. Facebook is focussed on personally identifiable information. They have made it their business from Day 1 to know who your correspondents (friends) are _and_ to exploit that for profit.

To my mind, this is not something Google set out to do. Although to compete with Facebook, I imagine they may have changed direction. We have Facebook to thank for that.

Let's imagine for a second that the future brings us the proverbial "video telephone" that even the most non-technical person expects to one day be standard issue. Crystal clear, real-time communication with both audio and video as available to every person as owning a cell phone is today. Now, hold that thought.

Should companies be invited into every conversation we have on this device? Should they be permitted to show ads to us as we converse?

We never had companies keeping a record of everyone who we telephone and listening in to our telephone conversation to try to figure out what junk postal mail to send us. Would this be different? How?

Ok, now we can return to present day reality. The question is: Where do we draw the line? Should companies be a party to every conversation? What will happen if we leave this question to the unscrupulous kids working and compromised adults working at Facebook? I doubt they would see anything wrong with what I described in the previous paragraph.

<comment><USER4> Somehow gmail manages to auto suggest and complete email addresses for me. Sounds a lot like they tracking who I correspond with.

<comment> dumb-dumb Yes. 2s/aim/initially aim/

I rarely use Javascript (certainly not for email) so I wouldn't know about all the latest Gmail "features". :)

What I was hinting at was a sort of evolutionary pressure on Google... to start using personally identifiable information. That pressure being Facebook as a perceived competitor.

</comment></comment></comment><comment><USER14> So if I send a PM to a friend on FB with a link and note that says, this is the lamest site ever the "Like" counter on the site goes up by one? That makes perfect sense.

<comment><USER15> Actually it goes up by two, but Facebook claims that's the bug, not the fact that it goes up at all.

</comment></comment><comment> dumb-dumb "Private messages" and "Facebook" are mutually exclusive.

Facebook is the antithesis of privacy.

Dreamers think FB has value.

Does the average person, of any age, think privacy has value?

What's more valuable?

Can all value be measured in monetary terms?

Web traffic has value (e.g. we can sell display ads). FB has web traffic. But so did milliondollarwebsite.com.

Privacy OTOH seems a long-lived concept, dating from at least the dawn of civilisation. I'd argue we have a lot more privacy than our ancestors. A trend that has continued unabated for hundreds of years. FB is but a {milli,micro,nano,pico}second in the evolutionary timeline of privacy.

I'm not throwing away my fig leaf just yet.

</comment><comment><USER16> Why are people still using Facebook anyway? I can only presume people that do simply don't care much about privacy because Facebook has proved time and time again that your privacy does not matter at all to them.

<comment><USER17> All of their privacy breaches don't really matter if you consider all of the things that you do with Facebook to be explicitly public. My only privacy filters are discretion and sobriety, and they've worked well enough so far.

<comment><USER18> Agreed. In this day and age it's just asinine to expect privacy from the Internet, no matter what you are promised.

There is not privacy and I do not expect any. That's the way to be happy and care free on the Internet. It's simple: Don't post anything privately or publicly that you do not want the whole world to see.

<comment><USER19> Are you fine with the whole world seeing all you email and chat history, then?

</comment></comment></comment></comment><comment><USER20> I know FB scans private messages. You cannot send links with certain domains without getting an error message. Sure, they don't have some dude in a cubical looking at each and every message, but if they are scanning for domains, how hard is it to scan for keywords within those private messages? Mention your new iPhone in a message, and you see ads for iPhone cases. Make a Tony Romo joke and you see ads for an RGIII jersey, etc etc.

<comment><USER21> They scan for even more than that, they'll report you to the FBI if they suspect you of illegal activity. [http://www.reuters.com/article/2012/07/12/us-usa-internet- pr...](http://www.reuters.com/article/2012/07/12/us-usa-internet-predators- idUSBRE86B05G20120712)

</comment></comment><comment><USER22> "Privacy is a relic of a time gone by" -Sean Parker

<comment><USER23> "Fuck you" -Me, responding to Sean Parker on privacy.

<comment><AUTHOR> Ditto. Impressive attitude.

</comment></comment></comment><comment><USER24> the hubbub over "scanning" here is silly. Obviously Facebook's systems scan your everything. The issue is that FB considers a "private mention" as a "Like", but it's old news that a "Facebook Like" is not an "English like"

</comment><comment><USER25> What about the "ad-likes", where FB shows "Your friend Jill likes ponies. Here's an ad for My Little Ponies" -- are these similarly prevented?

Breaking things tends to make unhappy the people using.

<comment><USER26> Don't worry, Zuckerberg will write a heartfelt boilerplate apology soon enough. :P

</comment></comment><comment><USER27> I'd rather be shocked if they don't do it (think viruses, trojans, hoaxes etc)

</comment><comment><USER28> Facebooks private messages are censored. Here in the western world we can not message one another freely when using this Facebook, of which many think are some kind of nice private messaging system like email. Its not and never was. For example try to send a thepiratebay.org link to your friends as a private message. Who knows what more they censor, perhaps the really interesting bits to censor seem to you like they have been delivered, but facebook never actually shows it to your firend. You would never know.

Also, you cant send life-changing notifications through messages to all your friends, for example there is a cap I think on to message 30 people at once.</comment>


Gallery of database schema diagrams of open-source packages - <AUTHOR> https://drawsql.app/templates <comment><AUTHOR> Hey all, maker of DrawSQL here. To dog-food the app over the past year, I've been mapping out the database schemas of open-source packages and apps... lots of them in fact!

Then it clicked, these collected diagrams could be useful for other developers to use as references as well. And maybe bring some SEO juice to the DrawSQL over the long-term. Hence the idea to curate this gallery - A central place to browse & discover DB schemas.

First time posting in HN, let me know what you think, or if you have a schema to suggest that should be added. Thanks!

<comment><USER3> this looks great.

I would use it in a heart beat if there were an option for a one time license / activation fee and the ability to use it offline without associating the graphs with an account & communicating them back to a central server. my guess is that there may be more folks like me who work at companies that require a certain level of anonymity or security regarding sensitive information like database schemas. just a thought!

<comment><AUTHOR> Thanks, good to know of the alternate constraints in other companies. Pricing aside, indeed it would be a different challenge tech-wise to have this as an offline tool.

My motivation for building this stemmed from the use-case of smaller-medium dev teams. We were using offline tools (e.g. MySQL Workbench) as part of our dev process and trying to keep it updated as documentation. Which was quite a nightmare to keep in sync between different devs. In this case having a central server was the silver bullet.

Curious - do you all currently use other tools (eg: workbench) for this?

<comment><USER4> It could be interesting to separate the visualization functionality from the syncing/sharing aspect.

For example, if you store the schema representation as a logical dump (CREATE statements) in a git repo, syncing/sharing becomes trivial. This also provides a branch workflow for collaborative editing, and the commit history serves as an authoritative changelog.

From this point of view, it could be compelling to have an offline visualization tool that simply operates on top of the current local filesystem state of a repo. Ideally this could be paired with a self-hosted server/daemon that can generate a visualization of any arbitrary commit of a remote repo on GitHub, GitLab, etc.

Disclosure: I'm the author of an open source schema management tool [https://skeema.io](https://skeema.io) which is designed to support a repo- driven workflow for DDL execution. So I have a heavy bias towards storing schemas declaratively, as repos of CREATE statements.

</comment></comment></comment></comment><comment><USER5> [https://drawsql.app/templates/hacker- news](https://drawsql.app/templates/hacker-news):

> Database schema for

> Hacker News

> Social news website: Sample database schema diagram for Hacker News, _from > open-sourced Pythonic News_

Seems a little misleading. It's the schema from a clone, not a the original Hacker News site that most people think of when they see the title.

<comment><AUTHOR> Fair point, changed that now, thanks for the feedback!

</comment></comment><comment><USER6> Tried it out, there are several similar tools (DB Diagram being closest) but this has the nicest UI, I think. Really solid job on the UX details like tab- completion + enter/select when typing column types in tables.

Auto-layout would be a useful feature, a button to click to re-arrange the table cards in a nice way (unless I missed it).

Also: Made in Vue! I <3 Vue

<comment><AUTHOR> Thanks! Definitely put a lot of attention on the UX so glad to hear it's been a differentiator.

Auto-layout would indeed be nice might be a bit of a challenge tech-wise. Thanks for suggesting it!

<comment><USER7> This is indeed one of the nicest UI's I've seen, is this all custom made or are you using some open components? I wanted to get similar effect for something completely different I had in mind (like a flow based diagram), any advice greatly appreciated.

</comment></comment></comment><comment><USER8> This reminds me of a website that has been around for many years offering free example schemas, or at least free pictures of them. I think in this case they are just internally created rather than collected from external sources, and I don't know the quality or general usefulness, but perhaps handy as a prompt at least.

[http://www.databaseanswers.org/data_models/](http://www.databaseanswers.org/data_models/)

</comment><comment><USER9> This appears to have more features and is more generous in the free tier than my usual go-to for this sort of thing: [https://www.dbdesigner.net/](https://www.dbdesigner.net/)

It also looks slicker and handles a bit easier, so I think I'm going to switch!

</comment><comment><USER10> Your diagrams are awesome! Are there any lessons you'd be keen to share from creating a diagramming UX in Vue.js? Are you rolling your own or standing atop another library?

<comment><USER11> Interesting - the diagram isn't SVG based. I agree with you - one of the nicest I've seen lately. Was similarly blown away by Whimsical, see [https://whimsical.com/P53PjXCBWEi2fdMjP2Hti](https://whimsical.com/P53PjXCBWEi2fdMjP2Hti)

</comment></comment><comment><USER12> Curated lists can't be Show HNs: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html). Obviously your app itself could be, but that's not this thread.

Also, could you please change the name of the Hacker News one? As commenters have pointed out, it's misleading.

<comment><AUTHOR> Thanks for the feedback, wasn't aware of the curated list rule before. Good to know for the future.

Also, fixed up the naming for the HN template as well, cheers!

</comment></comment><comment><USER13> This is great. I first tried to find Airtable or Notion, obviously they're not open source but I'm curious about the meta schemas for apps with user defined schemas and can't seem to find a good answer.

</comment><comment><USER14> A bit tangential, but I hate that products like DrawSQL only have a subscription models. It seems interesting, and would like to use it but why should I pay for a subscription? What if I only need it for 1 project? Why should I keep paying every month when I will rarely be touching the model every now and then? I understand that software is expensive to build, maintain and grow, but I just can't seem to tolerate subscription models for every single product. There are some products/services that make sense to charge like that but nowadays everything seems to be like that.

<comment><USER15> Such apps are not targeted towards occasional user like you. These products are more targets towards people who need to constantly work with schemas , architects/ consultants etc . Perhaps they are more likely to pay in the first place . As you say it is hard to pay if you need it rarely .

perhaps tools like datagrip make more sense for you ? Especially if you already are in jetbrains ecosystem (although they have annual pricing as well, if you don't renew you get last version your subscription covered Perpetually )

</comment></comment><comment><USER16> The timing couldn't be more perfect. I'm currently working on re-designing a multi-tenant database schema with user-roles and stuff. I was looking for some tool like this. Thank you! Looks good.

<comment><USER17> I'm starting to work on this too :)

Any reference material to share?

</comment></comment><comment><USER18> What's really interesting I think is how "opposite" of enterprise software these ER diagrams look. Whatever happened to the thousands upon thousands of identical tables in a standard Oracle-backed enterprise solution?

It's almost like these things were designed without the intention of having to spend a fortune on consulting services.

<comment><USER19> Huh lol?

These are simple tables for simple services, like one of these diagrams is legit the boilerplate of Laravel and another is Spark which is a SAAS boilerplate built on top of laravel.

Very few of these are actual software in use, most seem to be boilerplates from different systems. And even the actual software tend to be lower level systems that require very little tables.

You are comparing "enterprise software" of who knows what with a random PHP boilerplate?

<comment><USER20> > another is Stripe which is a SAAS boilerplate built on top of laravel

Spark _

</comment></comment></comment><comment><USER21> I wonder if there is something similar for NoSQL?

For me it's much harder to plan for NoSQL databases. It's relatively easy to draw ER diagram for a relational database, as all in my mind are the problem and data model. With NoSQL database however, I need to take into account how the client(s) works at the same time.

<comment><USER22> Honestly, if you're finding it hard to plan that's an indication to me that NoSQL isn't a good fit and you actually need relationships.

<comment><USER21> Yes. Coming from a CS background, I'm accustomed to mapping problems to relational data. Everything can be stored in an RDBMS.

However, I often work in a one man band, and need to push out production ready system in weeks. In these cases, as a compromise, I choose a managed NoSQL database as it requires less code and DevOps work to be up and running. It's not ideal.

</comment></comment></comment><comment><USER23> Are these diagrams generated from the Data Definition Langauge (DDL) of SQL or some other descriptions/source ?

Are they showing Unified Modeling Language (UML) or Entity Relation Diagrams (ERD) ? or something else that is new to DrawSQL ?

</comment><comment><USER24> The wordpress schema blows me away. < 20 tables to create an entire industry.

</comment><comment><USER25> [https://drawsql.app/templates/hacker- news](https://drawsql.app/templates/hacker-news)

Nice. Meta-nice.

<comment><USER26> [https://drawsql.app/templates/drawsql.app](https://drawsql.app/templates/drawsql.app) would be "more meta" :-)

</comment></comment><comment><USER27> Looks slick! Congrats on launching :)

How would you compare this to [https://dbdiagram.io](https://dbdiagram.io)?

<comment><USER28> Strictly comparing by price, I would think this is _much_ better/feature-rich to justify the large difference. This is definitely pertier tho.

</comment></comment><comment><USER29> Really great stuff. Would appreciate a "full-screen" mode so I can more easily browse around the schema

<comment><AUTHOR> Great suggestion! (and an obvious oversight on my end). I've just added this in today - <USER2>

<comment><USER29> That was quick! Happy to contribute with feedback :) Thanks for adding and congrats on an amazing product. Will definitely be using it in the future.

</comment></comment></comment><comment><USER30> Looking at this I miss programming right away.

Super cool

</comment><comment><USER31> Does this rely on foreign keys?

<comment><AUTHOR> If you imported the diagram from a SQL DDL script, then it does generate relationships based on the foreign keys. I can then add the other missing ones.

In the future there will be smarter ways to infer them, e.g. searching for {table_name}_id etc. In fact I did use a crude script that did just that when curating the diagrams for the gallery. Just need to build a nice frontend for it.</comment></comment>


Kickstarter Senior Staffers Are Pushing Back Against Colleagues' Union Efforts - <AUTHOR> https://gizmodo.com/leaked-memo-shows-kickstarter-senior-staffers-are-pushi-1833470597 <comment><USER2> Just going to raise an eyebrow at the company's assertion that people with the titles "senior manager" and "senior editor" aren't in managerial positions. They're either being disingenuous or have some _serious_ title inflation going on there.

<comment><USER3> I know a lot of places put _Senior_ as just a way of differentiating from Tier 1,2,3 positions etc. Doesn't always mean they're managers. It's also like how the title VP is used these days in finance.

</comment></comment><comment> cde-v Well yeah, they're senior, they got theirs, fuck everyone else.

<comment><USER4> You might want to look at the LinkedIn of the Senior Software Engineer who signed this letter before getting too harsh with your scorn.

[https://www.linkedin.com/in/nilaratna/](https://www.linkedin.com/in/nilaratna/)

We're not talking about a senior executive here. We're talking about someone with ~5 years of experience.

<comment><USER5> More like 8 or so.

Completely apropos of the major topic, I love that this person got a degree in fine arts and is now a senior software engineer. That kind of thing is something that I really like about the technology space.

</comment></comment></comment><comment><USER6> So long as every one agrees that some sort of organization is desirable, I can't see what's wrong with potential members arguing out the details. That's the point of the democratic component.

On the other hand, subterfuge to derail the whole process with a form of concern trolling is not cool.

</comment><comment><USER7> Unions tend to equalize rewards because of their one worker one vote mechanics. Union representation will probably bring up the compensation of the worst workers and lower the compensation of the top workers, so senior employees are right to fight the unionization effort.

<comment><USER8> Senior employees _who are motivated only by personal profit, with absolutely no feeling for their fellow humans_ are right to fight the unionization effort.

<comment><USER9> This is black and white thinking. There is a wide range of possible positions between "motivated only by personal profit, with absolutely no feeling for their fellow humans" and wanting to build a union.

<comment><USER10> Parent post was responding to black and white thinking:

 _Union representation will probably bring up the compensation of the worst workers and lower the compensation of the top workers, so senior employees are right to fight the unionization effort._

</comment></comment></comment></comment><comment><USER11> > Forming a union is a great tool—for marginalized workers. Unions are > historically intended to protect vulnerable members of society,

Is this really true? Every union building site I see has mostly white guys. If I see a site with lots of other ethnicities its probably non-union.

<comment><USER12> I don't have a great intuition for this, so I looked it up. It looks like Black workers are more likely than White workers to be union members, while workers of other racial minorities are less likely [0]:

> _Among major race and ethnicity groups, Black workers continued to have a > higher union membership rate in 2018 (12.5 percent) than workers who were > White (10.4 percent), Asian (8.4 percent), or Hispanic (9.1 percent)._

But it's possible that the story is different for construction workers or for other individual sectors.

[0] [https://www.bls.gov/news.release/union2.htm](https://www.bls.gov/news.release/union2.htm)

<comment><USER13> I'm sure that it varies somewhat by industry. But also, the absolute populations of white and black people in America are pretty different, so it matters how you measure this. A higher proportion of blacks could be union members, and still the absolute number of white union members could be larger.

<comment><USER14> How else would you want them to measure it besides ratios? What would absolute numbers mean in this context?

</comment></comment></comment></comment><comment><USER15> "Senior" in your title doesn't really mean much, other than that you aren't entry level.

</comment><comment><USER16> > Kickstarter can fail. Our company is looking for funding to secure our > financials, as we've heard in multiple All Hands communications.

Looks like this is also leaking that Kickstarter is raising...

<comment><USER17> Kickstarter's CEO (and the last of their original founders) also resigned this week:

[https://www.sfgate.com/technology/businessinsider/article/CE...](https://www.sfgate.com/technology/businessinsider/article/CEO- and-co-founder-of-crowdfunding-giant-13701180.php)

</comment></comment><comment><USER18> > Forming a union is a great tool—for marginalized workers. Unions are > historically intended to protect vulnerable members of society, and we feel > the demographics of this union undermine this important function. We're > concerned with the misappropriation of unions for use by privileged workers, > some of whom receive compensation more than twice the average income in NYC, > in addition to flexible work from home hours, above-and-beyond industry > standards for parental leave, 25+ days of paid vacation, a wellness stipend, > a bike stipend, an education stipend, a weekly catered lunch, and a great > deal of other benefits. We're already a radically thoughtful and ethical > company with our PBC, and can do more to lead the way in the tech industry > by providing an open environment that's free of hostility.

Because a company treats their employees well, they always will. And employees should just take what they are given instead of trying to get a seat at the table. Welcome to the brave new world of woke stools and scabs.

<comment><USER19> It's not a guarantee that collective bargaining will help privileged workers, and union dues aren't free. The statement is a bit cheerleadery, but isn't necessarily irrational.

<comment><USER20> Yeah, I used to work at a company with a mix of union and non-union sites, and the unions were good in a sense that the company standardized a lot of general union policies across sites. So the end result was the non-union sites had most of the pros of a union and none of the fees.

</comment></comment></comment><comment><USER21> _before resorting to something as extreme as a union_

Either unions in the US are messed up, or they have a terrible terrible press.

<comment><USER6> US unions are no different than any place else.

There has always been a fierce anti-labor streak in US politics. Even the first red scare in 1920's (before the cold-war!) associated all unions and pro labor moments and even speech as communist.

There is a feverish anti-union attitude even among people who have never even met anyone in one. If you ask, you will even find intense dislike of every foreign union without even knowing it's name or where its country is.

<comment><USER22> I think it's inaccurate to claim that there are people who aren't enamored with unions simply because people don't like unions.

Take police unions for example. It is well documented that many unions are fervently against policies such as always-on body cams that theoretically should protect a (good) cop and the citizen. Fail that, they are against releasing body cam footage.[0] Police unions are also known to protect abusive officers. [1]

I'm not trying to claim that there isn't an anti-union attitude, but it is not simply associating them with communism.

[0][https://www.nytimes.com/2018/01/09/nyregion/new-york- police-...](https://www.nytimes.com/2018/01/09/nyregion/new-york-police-union- body-camera-lawsuit.html) [1] [https://www.theatlantic.com/politics/archive/2014/12/how- pol...](https://www.theatlantic.com/politics/archive/2014/12/how-police- unions-keep-abusive-cops-on-the-street/383258/)

<comment><USER6> And therefore an engineering union is probably going to be bad?

Some police unions do these things and need to be stopped. But that does not mean all unions in every field are bad. There are evil corporations too, are all corporations bad? Are the majority? Why does the public precive that differently?

Since the cold war, the communism claim has given way to universally negative portal: the sole presentation in fact is negative. Usually by tacitly implying an unusual behavior is typical and inevitable of every possible union.

The difference is Exxon runs ads of happy children running through flowery fields and unions don't. And pointing out a union's deficiencies is not going to loose sponsors, possibly the reverse.

</comment></comment></comment></comment><comment><USER23> Union shops are lowest common denominator places. High performers tend to leave because seniority and politics dominates promotion and wages.

Apart from this, senior union reps and management tend to get cosy and form coalitions against workers and shareholders.

The people that win are the people that are good at politics, workers that are mediocre, and people that are uncomfortable with fast-paced change. Unions are great at slowing things down and keeping things in slow comfort zone so people don't have to learn new things.

Imagine the mediocre 50% of your company gets to determine the processes and procedures used in your team. That's a union shop.

Imagine that manager who isn't very good at his job but is good at politics and that union rep getting drinks after work, and making a coalition against the fast rising manager with aggresive new initiatives in mind ... that's a union shop.

Long term your company will stagnate and die.

Short term, a bunch of mediocre people will feel comfortable.

Flavor of the day workers will get hired based on checking boxes ... not based on any objective criteria/merit. That's a union.

Ever wonder why 90% of cops are white in the Bay Area, even when the neighborhoods are 90% non-white? That's a union.

Unions are the big lie that political animals tell everyone else ... OH JUST GIVE US THE POWER AND WE WILL EMPOWER YOU!

It's only true if you are incapable of providing for yourself. If you have the skills, fight against the union as long as you can, and then leave.

Best decision my parents ever made was to leave the union-choked midwestern city where I was born, to come west thirty years ago. I probably would have been one of those rust-trapped casualties by now if my parents had stayed.

<comment><USER24> > Union shops are lowest common denominator places. High performers tend to > leave because seniority and politics dominates promotion and wages.

This is absolutely not true in the trade unions. In an earlier life I was a union plumber (on my way to becoming a master licensed plumber; and to this day I can walk into virtually any commercial or light industrial jobsite, and tell you at a glance, if it is a union or non-union job). I don't just mean the plumbing work either; but also the electrical, and the pipe and/or steam fitting, and I'd be right 90% of the time. Such is the difference between the training and tradition of taking pride in your work.

Salaries are also Not carved in stone. I was once paid $300 a week over General Foreman's wage to run a job, and that was in the mid-eighties.

They are not perfect, and yes it can be harder to get rid of a real slacker, but nothing is impossible. And FWIW based on what I read on here in terms of the problems a lot of coders have with age, performance reviews and interviewing--you guys should definitely consider forming a union...or for Pete's Code Up App and stick together!

<comment><USER23> How much does plumbing need to change with the times? I suspect it changes at a glacial pace compared to high tech. Also, how much does it matter whether your pipes are done by top 1% of plumbers vs just some average plumber? Probably the work is interchangeable as long as the plumber has some experience and has been trained.

None of that is true when you are building something cutting edge with competitors lapping at your heels. Maybe web development has become like plumbing now ... but search algorithms, robotics, space travel, etc. are certainly not.</comment></comment></comment>


The U.S. Needs More Colleges - <AUTHOR> https://www.bloomberg.com/view/articles/2017-01-06/the-u-s-needs-more-colleges <comment><USER2> Interesting thought. So the idea is that increase in supply of higher education will provide downward price pressure on the cost of higher education?

Somewhat related, isn't there a glut of supply in professors (academia) and super cutthroat competition to gain tenure? That would also address that problem.

The last thing to look at is perhaps introducing sanity into the major selection process? I know so many people who are investing hundreds of thousands of dollars and almost a decade into getting a PhD in something like Ancient Languages that make me wonder if that's an appropriate vocation. Avocation, sure, but how much benefit to society does that bring compared to say doctors (of which there's a shortage, right)?

</comment><comment><USER3> Not a bad article. I was afraid this was just another Bloomberg owner-biased screed, where the price of employees is Just Too High, So We Need More Candidates On The Market To Keep Salaries Down.

But it wasn't. Bloomberg editors asleep at the wheel? Their oligarchical masters will be angry!

</comment><comment><USER4> We need more scalability. I think the top 100 collages in the world should be scaled down to every person in the world.Second grade colleges are opportunity cost for a human life.</comment>


US Visitors May Have to Reveal Social Media Passwords to Enter Country - <AUTHOR> https://arstechnica.co.uk/tech-policy/2017/02/us-visitors-may-have-to-reveal-social-media-passwords-to-enter-country/ <comment><AUTHOR> _" John Kelly has informed Congress that the DHS is considering requiring refugees and visa applicants from seven Muslim-majority nations to hand over their social media credentials from Facebook and other sites as part of a security check. "We want to get on their social media, with passwords: What do you do, what do you say?""_

Given the current US climate, if this is the case, skip the US and go to Canada. How much US business will shift to Canada?

<comment><USER2> Not much considering that some people are already made unlock their phones when entering Canada.

<comment><AUTHOR> @gukov really? I purposely avoid electronics going overseas to stop this kind of abuse.

</comment></comment></comment><comment><USER3> Who says time only travels forward, look we are already in the nixonian days, i can only hope that we do not end up in 1939 at the current rate of stupidity progression.

</comment><comment><USER4> Aren't the EFF currently trying to persuade the courts that violating the TOS should not be a crime?

What's the situation if a border agent asks you to commit a crime?</comment>


Programmers say Uber Eats is systematically underpaying their workers - <AUTHOR> https://www.salon.com/2020/08/20/programmers-say-uber-eats-is-systematically-underpaying-their-workers/ <comment><USER2> All of them delivery apps are scumbags, do what I do, stop using them, go old school, call the restaurant, pick up the food, the restaurant gets to keep 100%, not the 70%. And, really, no one is commuting, so there is no traffic, get your asses of the couch..really..

<comment><USER3> A company is not properly paying their drivers so we should change our behavior such that we eliminate their jobs entirely?

<comment><USER4> Wouldn't this at least allow for an opening in the market that can be filled by an organization that doesn't exploit drivers? If we continue to support a company that could do better without placing either legal or market pressure, no one has any reason to change.

</comment></comment></comment><comment><USER5> Ooh, this resonates. I noticed Uber Eats at one point hadn't billed my card for several tips I'd given after an interface update, so I contacted support. Once I got past the usual scripted "here is how to tip", when I finally got through to someone who understood I was reporting a bug, they brushed me off insisting Uber had systems to always check they were charging and paying out the correct amount, so I must be mistaken. I gave up and switched to other apps.

A few weeks later, I eventually got a bunch of small Uber Eats charges. They ended up being all those tips I'd diligently reported to Uber, so I guess it was a bug and they just didn't want to admit it.

<comment><USER6> Contact centers for software services like this are usually implored, or given specific language on how to deal with user-reported bugs. They're trained not to admit a bug exists because that implies that the company is at fault. In most cases, this makes sense, as a majority of "bugs" are user-caused problems. In the edge cases where there really is a bug though, users can end up in these kafkaesque dungeons of unresolved problems that they have no control over. The company still benefits in the end as they never admitted fault and the user affected will probably give up sooner than the company gets the ticket resolved.

<comment><USER7> Exactly! That's why it took me (the guy in the article) so many phone calls and emails with Uber before somebody admitted the bug - and I got it on tape (with their consent). Must have spent five hours dealing with support before they admitted it.

I would love if Uber trained and trusted their support staff to identify real bugs, and to escalate appropriately...I was so tempted to just go on LinkedIn, find some engineers, and message them directly.</comment></comment></comment>


Getting weather via your command line - <AUTHOR> http://coderwall.com/p/gc1vpq

<comment><USER2>
      telnet rainmaker.wunderground.com

<comment><USER3> and for the automated, try this:

(echo "open rainmaker.wunderground.com";sleep 1;echo "\r";sleep 1;echo "nyc";sleep 1;echo "x";) | telnet

</comment></comment><comment><USER4> <http://packages.debian.org/squeeze/metar>

</comment><comment><USER5> Using powershell:

PS> Get-Weather

gives:

Location : Secret, Location (ABCD) 12-34N 123-45W 85M Time : Oct 18, 2012 - 02:30 AM EDT / 2012.10.18 0630 UTC Wind : from the SE (140 degrees) at 9 MPH (8 KT):0 Visibility : greater than 7 mile(s):0 SkyConditions : mostly cloudy Temperature : 50 F (10 C) DewPoint : 46 F (8 C) RelativeHumidity : 87% Pressure : 29.18 in. Hg (0988 hPa) Status : Success

</comment><comment><USER6> A while backed a hacked a little script to update the LCD display on old HP printers with the current weather: <https://gist.github.com/832730>

I doubt it works any more since I don't think that Google Weather API still exists, but it should work if you switch it to Yahoo or one of the others.

</comment><comment><USER7> I ran across a little CLI called "weatherman" [1] that does this, though you need to input your location manually each time. The data comes from WeatherBug.com, but it seems to work well enough for my purposes.

1\. <http://darkhorse.nu/software/>

</comment><comment><USER8> I wrote a script a little while back that texts the weather to you every morning. It used google's unofficial weather api.

[https://github.com/doctoboggan/Wake-up-to-the- Weather/blob/m...](https://github.com/doctoboggan/Wake-up-to-the- Weather/blob/master/textWeather.py)

<comment><USER9> That api is no more. For izulu, which also used that api, i switched to yahoo.

</comment></comment><comment><USER10> Here's a simpler version that doesn't require PHP or an API key. Only works on Plan 9, though, but you could probably port it.

<http://plan9.bell-labs.com/sources/plan9/rc/bin/weather>

<comment><USER11> I'm not quite sure why it's so complicated. Their telnet actually has a UI state machine built in.

On any linux computer: nc rainmaker.wunderground.com 23

<comment><USER10> Sure, I've used the telnet version, but it's nice to say "weather ROC" and get weather.

</comment></comment></comment><comment><USER12> Using windows: Go to window, open, stick your nose out, and you know the weather. Look up to sky to predict weather for next half day.

</comment><comment><USER13> weatherspect: <http://robobunny.com/projects/weatherspect/html/>

</comment><comment><USER14> Well this was a pleasant surprise to find.</comment>


PDP-1 FPGA Implementation in Verilog, with CRT, Teletype and Console - <AUTHOR> https://github.com/hrvach/fpg1 <comment><USER2> The code below doesn't sound right, can you double-check the intent? I don't think timeout will go to 0, unless you make it a blocking assignment.

            if(~old_download && ioctl_download) begin
                    cnt <= 8'b0;
                    timeout <= 32'b0;
            end

            timeout <= timeout + 1'b1;

That's why in Verilog RTL we generally try to keep always blocks as small as possible, so they focus on assigning the same small set of signals in all branches.

<comment><USER3> You are right, I missed that. Thanks for pointing it out!

It's hard to change your mindset from a programming language to a hardware description language and not make mistakes like these, especially when just starting to learn Verilog. :-)

<comment><USER2> One way to restructure your code is to move all the default assignments to the top of the always block, and then let if conditions change the ones that don't apply for that cycle.

This code would work just fine (many people would argue it's not very readable -- but it saves you a lot of else branches):

            // Default
            timeout <= timeout + 1'b1;

            // Special cases
            if(~old_download && ioctl_download) begin
                    cnt <= 8'b0;
                    timeout <= 32'b0;
            end

<comment><USER3> Thank You for the advice! I'm still very much a beginner and since I find the "blink a led" kind of projects too boring, this is basically the first thing I ever wrote in Verilog.

I hope my next project will have cleaner code, be more readable and have less issues like these. HDL languages seem to have a rather steep learning curve and it takes some effort to distance yourself from the usual programming mindset.

<comment><USER4> In general you should only use a <= to write a reg once within a clock (remember that the RHS of a <= is evaluated when the code is evaluated, the assignment happens later)

And you are mixing <= and = in the same code (look in execute() ) this should never happen.

In general use <= in places that are gated by an "always @(posedge clk)" and = in things gated by "always @(*)"

(with the exception that it's OK to assign a temp variable in a clocked always with '=' provided its lifetime doesn't extend past the block's execution (your use of SKIP_FLAG is an example of this being done correctly)

<comment><USER3> Thank you, I'll have to do some refactoring to avoid mixing the two assignment principles.

But it is ok to do something like:

cnt <= cnt + 1;

if (cnt > 100) cnt <= 0;

If not, how else should something like this be done?

Thanks for your help, I'm finding HDL to be anything but easy. :-)

<comment><USER4> probably not a good idea, because you are sampling cnt after think you have incremented it and you will get the wrong value

Essentially what happens is:

        tmp_cnt1 = cnt + 1;
        if (cnt > 100) tmp_cnt2 = 0;

some time later:

        cnt = tmp_cnt1;

and after that (if cnt >100)

        cnt = tmp_cnt2;

Better to say:

        if (cnt >= 99) {
            cnt <= 0;
        } else {
            cnt <= cnt+1;
        }

<comment><USER4> BTW: as an onetime verilog implementer those temporary storage locations that are made behind your back by the compiler when you use <= are potentially quite expensive, the compiler can optimise the normal case of:

       always @(posedge clk)
           r <= v;

and in some more complex cases where r is only set once in one always statement (or once in any path through an always statement) - but something like:

       always @(*)
          r <= c;

is a nightmare that essentially means that r can have many changes scheduled in the same instant of time, more importantly it's a number of changes that can't be determined at compile time (could be 1000s of transitions) - resulting in code that's mallocing space to store all those changes - simulation can slow down if you use <= in a non-clocked place because the behaviour can't be determined statically

Also using <= a smart compiler can merge multiple always statements:

        always @(posedge clk)
            r1 <= c1;
        always @(posedge clk)
            r2 <= c2;
        ......

into a single

        always @(posedge clk) {
            r1 <= c1;
            r2 <= c2;
            ......
        }

behind your back, effectively converting 2*N simulation events into 2 (a very good thing)

<comment><USER3> Thanks for taking the time to explain it, I wish I knew all of this when I started tinkering with Verilog - it would be much easier. Btw, consider writing a FPGA related blog, you have a lot to teach and you explain well! :)

<comment><USER4> I'm afraid I've mostly worked in standard-cells rather than FPGAs, and that was a while back, I used to be the software guy in the hardware group (and the hardware guy in the software group).

These days I build embedded stuff, living on the hardware/software edge I still get to make the software/hardware tradeoffs that others often can't do

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> If interested in PDP-1 history and development, check the scanned documents from 1959-1962 at [https://gordonbell.azurewebsites.net/digital/timeline/pdp-1s...](https://gordonbell.azurewebsites.net/digital/timeline/pdp-1story.htm) .

</comment><comment><USER6> This is an impressive undertaking, and hands-down one of the coolest things I have ever seen. :-)

<comment><USER3> Thank you very much! I always wanted to check out the PDP-1 and play Spacewar. Because I'm on the wrong continent, the only way to do it was to build my own :-)

There is a follow up - it can also play music, just like the original could. Check it out: [https://www.youtube.com/watch?v=ROPyR- tV7A4](https://www.youtube.com/watch?v=ROPyR-tV7A4)

<comment><USER5> Kudos for such an impressive achievement (hrvach is the author of the featured PDP-1 FPGA Implementation.)

A quick question: Were the original PDP-1 manuals enough to implement the system from scratch? Were there details or hidden issues you had to "guess"?

<comment><USER3> The manuals found on Bitsavers were a great help, they are very detailed and explain the system well.

The original instruction test tapes helped me a lot with debugging the various corner cases. For example, the multiply step opcode (MUS) is re-used in later versions which had full hardware multiply (MUL). The backwards compatibility was retained by flipping a switch inside the computer to selecting between MUS and MUL. I had some programs failing mysteriously because of this.

There were also various pixel brightness available and after implementing it, I discovered Spacewar actually uses that to make some stars brighter than others.

Music playing capability was very advanced for its time (having 4 voices) and after everything was a "silent movie" for a while, there was a rewarding moment when I finally fixed a bug and Mozart started playing from the speakers.

A cool machine, very advanced for its time...

Cheers!

</comment></comment></comment></comment><comment><USER7> This is great! And it makes me feel bad for not finishing my FPGA PDP-6 and -10 projects.

<comment><USER3> It's never too late! :) Those are 36-bit machines if I remember correctly and it would be very cool to play around with them.

<comment><USER7> You can check out my github repos: [https://github.com/aap/pdp6](https://github.com/aap/pdp6), [https://github.com/aap/pdp10](https://github.com/aap/pdp10), but best check out the group if you actually want to run something: [https://github.com//pdp-10](https://github.com//pdp-10)

<comment><USER3> This is very impressive and clearly took a _lot_ of work to make. I must admit I know nothing about PDP-10, but it seems interesting and will definitely take a look! Thanks for sharing.

<comment><USER7> If you want to talk about 36 bits PDPs, join us on #pdp-10 on freenode :) Other PDPs and lispms are also welcome topics.

</comment></comment></comment></comment></comment><comment><USER8> That is absolutely amazing. What a nice project. The snowflake demo is also very pretty. I got totally lost in reading all the old Digital documents, great picture at the bottom too.

<comment><USER9> Here's an analysis/walk-through of the Snowflake code:

[https://www.masswerk.at/nowgobang/2019/snowflake- archeology](https://www.masswerk.at/nowgobang/2019/snowflake-archeology)

<comment><USER3> This is a fantastic job with code analysis and Norbert, the author, helped me out with advice a lot. Highly recommended!</comment></comment></comment>


Adobe CS2 + Serials Free - <AUTHOR> http://www.adobe.com/downloads/cs2_downloads/index.html

<comment><USER2> I saw this the other day and it was down. Now it's back up. Is this "legitimate"? The story ( <http://www.diyphotography.net/download-adobe- cs2-for-free> as best I can tell ) isn't clear.

<comment><USER3> You're only meant to use the downloads if you already own CS2, but as CS2 is seven years old at this point, this is just enforced with an honesty system.</comment></comment>


Theranos Founder Faces a Test of Technology, and Reputation - <AUTHOR> http://mobile.nytimes.com/2015/12/20/business/theranos-founder-faces-a-test-of-technology-and-reputation.html <comment><AUTHOR> Am I the only one to think that Ms Holmes has been funded way too early ?

When reading the paragraphs about her first interactions with investors, I was thinking that if I had done that I'd have been turned down so badly that I'd have regretted to have become an entrepreneur.

This article has really reminded me that while we talk about innovation, easy access to funding and this sort of things, connected wealthy people still have a very unfair advantage in this world.

I'm not saying that to whine. It's just that I almost forgot it and find very interesting that no matter how institutions are named, or societies organized there are arrangements that survive centuries and will never and cannot change.

<comment><USER2> > Am I the only one to think that Ms Holmes has been funded way too early ?

Depends on the story. Time will tell. Assume that she did 99% on time and budget, but the last percent was some problem that just could not be solved - or the engineering requires an Eureka moment. In that case you could burn billions and still be at 99%.

On the other hand she may have committed fraud - knew her tech is not working and hoping for a miracle.

<comment><AUTHOR> Very good point ! Edit: But I'd say that the article tends to suggest that she never really had the tech.</comment></comment></comment>


Linux console tool to evaluate round trip latency within a TCP/UDP session? - <AUTHOR> For the life of me, I saw a tool in the last few weeks somewhere and I forgot to bookmark it.  This isn't a ping or traceroute or iperf tool.
Wireshark might do this, but I am pretty sure I saw a black and white console example where the tool evaluated the sub-second timings between when a packet leaves and it's response comes back.  Probably by setting a series of filters for interesting traffic.
A couple of examples come to mind:
1) evaluating dns queries: when people complain their 'internet is down', it isn't because they are disconnected, it can be due to dns queries timing out.  Or being slow.  And in some diagnostic scenarios, it is interesting to see what queries are slow and what queries are fast, and what the difference is.
2) Web browsing: what are the timings of the setup of the three way tcp handshake?  This gets a relative idea of latency to the server.  Then what is the timing of requesting an http header and it's response... which provides an idea of latency further up the stack.
Then I suppose, an open question, what do people use to measure these sorts of things? <comment><USER2> The kernel keeps RTT estimates already. Try "ip tcp_metrics" with the iproute2 package installed (it usually is by default these days)

</comment><comment><USER3> mtr?

<comment><AUTHOR> mtr is more of ping / traceroute tool.

I think I am thinking more along the lines of [http://www.tcptrace.org](http://www.tcptrace.org). I just came across it. I am not sure if that is the one about which I am thinking.

<comment><USER3> tcpdump?

<comment><AUTHOR> tcpdump/wireshark simply provides timestamped packet capture in a pcap file or console listing... reasonably hard to analyze manually as one needs to manually do deltas on all the timestamps.

tcptrace takes the output from these collectors and provides some time based statistics. but from what I've read, xplot is required to get a timeline of the individual packet interactions. I am in the process of loading it up to read the man page and give it a try.

I still don't think tcptrace was the tool I originally saw, but will check it out.

[http://prefetch.net/blog/index.php/2006/04/17/debugging- tcp-...](http://prefetch.net/blog/index.php/2006/04/17/debugging-tcp- connections-with-tcptrace/) provides some sample output... but not the timeline I had in mind.

<comment><USER4> > tcpdump/wireshark simply...

There's nothing simple about tcpdump/wireshark.

Wireshark does deltas for you if you want and can even calculate the RTT at every point in time during the lifetime of a TCP flow. Wireshark is fucking awesome and I'm sad you would say "simply provides..." :'(

But if what you want is just to know the RTT for a 3 way handshake against a remote endpoint, try something like gotcping: [https://github.com/pjperez/gotcping/releases](https://github.com/pjperez/gotcping/releases)

tracetcp (and variants) is not what you want, because it calculates the time it takes for you to get a "TTL expired in transit" ICMP back except on the last hop. Gotcping and other avoid wasting your time by just testing the final endpoint.</comment></comment></comment></comment></comment>


Show HN: Themer – a CLI for generating themes for all your tools - <AUTHOR> https://github.com/mjswensen/themer <comment><USER2> Interesting, but a bit light on the terminal support. I've been using [https://terminal.sexy/](https://terminal.sexy/) which supports way more terminals. Notably, for me, Guake, XFCE Terminal, and for when I'm on Windows, PuTTY.

I was expecting to find this within the `themer-terminal` repo, but instead it's just some mac thing.

<comment><AUTHOR> Good feedback. Yep, themer-terminal is for Terminal.app, the default macOS terminal. Feel free to log issues for supporting other terminals (or take a stab at implementing support for them as described at [https://github.com/mjswensen/themer#create-your-own- template](https://github.com/mjswensen/themer#create-your-own-template)).

</comment></comment><comment><AUTHOR> A while back I posted about the GUI version ([https://news.ycombinator.com/item?id=15087244](https://news.ycombinator.com/item?id=15087244)) but I'm realizing the CLI tool is probably more appropriate for the HN crowd.

Themer is a set of npm packages that allow for generating custom, matching themes for many of your development tools (editors, terminal emulators, desktop/device wallpaper, Slack sidebar, Chrome theme, Alfred, etc.). A custom color palette can be used, or there are a number of pre-built palettes to choose from.

<comment><USER3> Given that my thoughts while looking at the repo were "please don't be js, please don't be js, please don't be... fuck" (don't want to install the whole node toolchain), I'm very glad that a website exists. However, it seems to be down :(

<comment><AUTHOR> Hah, what are the odds. I post this and 10 minutes later zeit.co's Now service goes down. :(

But the site is just informational--if you don't want to install the Node toolchain, you can use the GUI wrapper around themer ([https://github.com/mjswensen/themer- gui](https://github.com/mjswensen/themer-gui)), a cross platform app built on Electron. There are downloadable builds for Windows, macOS, and Linux ([https://github.com/mjswensen/themer- gui/releases](https://github.com/mjswensen/themer-gui/releases)).

<comment><USER3> Oh fantastic, that works, thank you!

<comment><AUTHOR> No problem!

</comment></comment></comment></comment></comment><comment><USER4> Nice work!

From my classification this seems similar to base16 [https://github.com/chriskempson/base16](https://github.com/chriskempson/base16)

Is this correct and would you like to clarify the benefits of using themer instead of base16? Have you considered intercompatibility by i.e. allow conversion from and to base16 themes?

<comment><AUTHOR> That is correct! I pointed that out and listed a few differences on the "About" section of the README ([https://github.com/mjswensen/themer#about](https://github.com/mjswensen/themer#about)).

One thing I will add is that I found base16 more challenging to use if I wanted to use a custom color set instead of the default ones. It was also difficult for me to tell which packages of that project were maintained, which were deprecated, and how the packages were organized in general.

<comment><USER4> Awesome, I found that when I reread your description more in detail.

Back to base16, if you'd add base16 as an input and output you'd be able to benefit both by expanding the available set of themes with those of base16 and expanding the set of output formats to those supported by that ecosystem. That would make your tool far more interesting for someone like me who's already using base16.

<comment><AUTHOR> That's a great idea. The color sets themselves are actually compatible (you'll see that there are eight monochromatic colors and eight accent colors in both systems) and I think there is some low-hanging fruit for interoperability between the two. Fantastic feedback, thank you!

<comment><USER4> No problem, starred your GitHub project and will be following the development!

</comment></comment></comment></comment></comment><comment><USER5> Here's a suggestion: generate the wallpapers with [https://qrohlf.com/trianglify/](https://qrohlf.com/trianglify/) \- I've taken to using wallpapers created with it (around 50 altogether now), and like the semi-random geometric patterns.

<comment><AUTHOR> That is a fantastic idea. Noted. Thank you!

</comment></comment><comment><USER6> One of the reasons I run Solarized Dark theme as my default. Instead of requiring a themer tool to support all the tools I use, I have a theme that is always one of the first themes to be available for my tools. Google mytool+Solarized never let me down.

<comment><AUTHOR> Solarized is fantastic. Perhaps I'm fickle, but I tend to like to change my theme every few months, and relatively few themes are as good as Solarized when it comes to supporting so many applications.

But I agree that the quick and simple install is a huge plus. Perhaps in the future theme authors could use a tool like themer to generate their themes rather than each author individually spending time figuring out how to apply their theme to a particular tool.

<comment><USER6> The reason why I not fully believe in it is that there is no huge benefit to the parties for supporting a thing like themer. UIs are highly custom and if X companies make a product seperately you will have as many implementations of the theme keys and variables.

The comparison to mobile development comes to mind. There are cross platform options like cordova or xamarin but they are usually beaten by native implementations. Now, if the cost of doing things twice outweights by large the drop in quality it is still a viable option; hence their existance. However, with themes I'd say the cost of redoing is most likely not outweighting developping in the native application option.

</comment></comment></comment><comment><USER7> Haven't been able to access the site: [https://themer.mjswensen.com/](https://themer.mjswensen.com/) for the past hour or so...

<comment><AUTHOR> Yep, it's hosted on Zeit.co's Now service ([https://now.sh](https://now.sh)), and they are experiencing a major service outage today. :( Most of the information on the site can be found either on themer's readme ([https://github.com/mjswensen/themer](https://github.com/mjswensen/themer)) or the GUI wrapper app's readme ([https://github.com/mjswensen/themer- gui](https://github.com/mjswensen/themer-gui)).

</comment></comment><comment> juicy-fruit This seems to only allow you to create Sublime color schemes, it doesn't create a sublime theme. Sublime Theme is to style the whole window outside of the editor.

<comment><AUTHOR> That's correct. A Sublime UI theme is on the backlog!

</comment></comment><comment><USER8> Neat, I probably waste too much time trying to make everything go together which is why I tend to stick to popular themes but this seems very useful.

<comment><AUTHOR> Thanks! I am the same way. Except rather than wasting time trying to find themes that support all the apps I use I wasted a ton MORE time building a tool to do it for me. Haha!</comment></comment>


The Intercept cuts back - <AUTHOR> https://www.cjr.org/business_of_news/layoffs-the-intercept.php <comment><USER2> Glenn Greenwald spends too much time on Twitter railing imho when that time could gave been spent doing Journalism.

It was the in depth journalism that he originally did that made Snowden contact him. Not the current 75 tweets a day on everything under the sun.

Ideally journalists need to get off Twitter. It's a waste of their time. Especially the pointless fact checking of bullshit. I'd rather see and PAY for one Spotlight story a year than 24x7x365 days of tweeting.

<comment><USER3> The Intercept has become a pretty large organization that goes well beyond the vision (and personal views) of Greenwald.

GG has no doubt upset a lot of powerful people who want to see him fall professionally (or even worse). It's not surprising that he has his hands full on twitter fending off attacks. I don't think GG or his staff are only on Twitter in order to find scoops and topics for regurgitation (or that twitter is automatically a problem affecting the magazines output).

The Drone Papers[1] released in 2015 by Jeremy Scahill were an outstanding piece of writing.

In 2016 they revealed[2] that a AT&T site in NYC hosts a secret NSA surveillance site

It is probably hard to create such hits on a regular basis especially when their new content will always be judged on their previous (first) successes

I don't see the quality of their reporting being reduced though, but fwiw they did expand into a more mainstream political sphere which isn't always about tech-conspiracies (NSA, Snowden, Drone-papers) and so they have to compete with other outlets that cover the same stuff. If they have become less edgy (more "blah") than they used to be maybe less funding will be good for them and they'll find their roots again.

[1] [https://theintercept.com/drone-papers/](https://theintercept.com/drone- papers/)

[2] [https://theintercept.com/2016/11/16/the-nsas-spy-hub-in- new-...](https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-york- hidden-in-plain-sight/)

<comment><USER4> I'm a bit confused, if NSA mission is to be able to spy on other counties' military operations, why wouldn't that include the ability to intercept communications coming from outside the country or information going out from suspected spys? What I'm saying is the facility in NYC is not at all surprising, there are a ton of fiber cables that come in from overseas into NYC. Anyone with half a brain about internet infrastructure and has ever read any of the mission directives or legal authorities of NSA will realize exactly what they're doing there. That is looking at cyber operations/attacks coming into the country and looking for covert communications from people who are trying to influence our government for their foreign government's military or economic benefit.

Also, for what it is worth, NSA is also pretty important in ensuring weapons proliferation and military equipment movements (which helps indicate possibly wars, covert actions or invasions) using measurements of various types to track nuclear, biological and other weapons. That is fairly essential for upholding and enforcing international laws and treaties.

Finally I'm also confused when people say "domestic" tracking. Basically the NSA had databases they could look at if given legal authority to do so (meaning they think someone is a spy and show evidence of that) to see interactions between a person and other people (who they call, how often, where their phone is, etc). Apparently it seems now they just have to request or, like anyone else, buy that data from the telecoms instead of it being in house.

<comment><USER3> _> Anyone with half a brain about internet infrastructure and has ever read any of the mission directives or legal authorities of NSA will realize exactly what they're doing there. _

It's a good thing when long running rumors can be corroborated, so labeling this as non-info is somewhat unfair. News in Europe of cell towers listening- in on national parliaments discussion or phones being directly targeted, make scary headlines outside in Europe or anywhere outside US. This story drove home the same message to Americans: that it's not just something the NSA does overseas to _" keep us save"_. The story also made sense since it continued the established narrative from previously published Snowden leaks in The Intercept.

 _> NSA is also pretty important in ensuring weapons proliferation and military equipment movements (which helps indicate possibly wars, covert actions or invasions) using measurements of various types to track nuclear, biological and other weapons_

as a non US citizen, this deeply terrifies me (even without the current geo- policial climate).

edit: reduce waffle

</comment></comment></comment></comment><comment><USER5> The Intercept lost all credibility when it didn't even take basic steps to protect the identity of a confidential source who emailed them internal NSA documents (Reality Winner). The fact that in this case the documents contradicted Greenwald's public position raises the possibility that the reality was even uglier, with their actions potentially being deliberate.

They have also been accused of having revealed identities by a couple of other NSA whistleblowers.

[https://en.m.wikipedia.org/wiki/The_Intercept#Exposure_and_a...](https://en.m.wikipedia.org/wiki/The_Intercept#Exposure_and_arrest_of_a_confidential_source)

<comment><USER6> The article you link to only mentions Ms. Winner. Do you have a citation to support your claim that multiple sources have been outed?

</comment></comment><comment><USER7> For $250m, The Intercept was a noble freshman effort.

For comparison, Fox News was run at a massive loss for its first decade. Most of the other right leaning orgs have patrons.

One needs stomach, fortitude, deep resources, and business acumen to build a self-sustaining media presence from the ground up.

Alternately, use the seed capital to start an endowment, keep the effort modest.

</comment><comment><USER8> There has been zero consequences from the entire set of revelations. What is the incentive to continue to do investigate journalism as great risk to one self when there are no results?

What Snowden seems to have inadvertently revealed is a culture that is a lot more interested in posturing around these issues than the issues themselves. And its those breaking the illusion be it Snowden, Manning or Assange who will face the music while civil society looks the other way.

<comment><USER9> Zero consequences? There was one illegal program (phone metadata collection) in the revelations. It was shut down. The revelations showed that the NSA had in the past extracted email metadata from email companies from international cables. The email companies have since encrypted their cross-datacenter internal traffic. Snowden disclosed many Chinese targets to the PRC. The PRC has presumably secured them.

<comment><USER8> If you think Snowden leaks was about 'one illegal program' you are seriously misinformed and have a lot of catching up to do. These are large scale and illegal mass surveillance programs. [1][2][3][4][5]. More can be found here. [6]

No one has been held accountable for these illegal programs. The then head of NSA James Clapper brazenly lied to Congress and has still not being held accountable. [7]. On the contrary there is a grand jury out to get Assange, Manning is back in jail and Snowden is being hounded and in exile. No good deed goes unpunished.

China had nothing to do with the Snowden leaks or any of these secret mass surveillance programs as you will discover. Happy reading!

[1] [https://en.wikipedia.org/wiki/PRISM_(surveillance_program)](https://en.wikipedia.org/wiki/PRISM_\(surveillance_program\))

[2] [https://en.wikipedia.org/wiki/XKeyscore](https://en.wikipedia.org/wiki/XKeyscore)

[3] [https://en.wikipedia.org/wiki/Tempora](https://en.wikipedia.org/wiki/Tempora)

[4] [https://en.wikipedia.org/wiki/Fairview_(surveillance_program...](https://en.wikipedia.org/wiki/Fairview_\(surveillance_program\))

[5][https://en.wikipedia.org/wiki/Boundless_Informant](https://en.wikipedia.org/wiki/Boundless_Informant)

[6] [https://theintercept.com/search/?s=snowden](https://theintercept.com/search/?s=snowden)

[7] [https://www.theguardian.com/world/2013/dec/19/republicans- co...](https://www.theguardian.com/world/2013/dec/19/republicans-consequences- james-clapper-testimony)

</comment></comment></comment><comment><USER10> I'm always amazed by comment threads at TI. So much vitriol! At least they are hidden by default. We are told that lively comment sections increase engagement, but I wonder if that's really the case for TI. ISTM they should have just set up something on Reddit and not had any comments on the main site. E.g. "reddit/r/theintercept/russiarussiarussia" would be irredeemable, but only those who are interested would be exposed to it.

</comment><comment><USER11> It is interesting to see how The Intercept/First Look has evolved, both as a news organization and a non-profit, speaking as someone who has also worked at a billionaire-founded nonprofit news org [0]. Both orgs have a focus on accountability journalism, and PP, like TI, drew criticism for its seemingly high salaries (for the non-profit world). I think undoubtedly TI had significantly more attention/awareness/pageviews than PP, when comparing the first few years; I wouldn't be surprised if Greenwald has more Twitter followers than the entire PP staff combined. Beyond that, I don't know how directly comparable the two orgs are, because the state of online-first journalism in 2008 was so much different than it was 2014, when TI launched.

That said, one main difference might be ProPublica having more a general plan for self-sufficiency through philanthropy. The Sandler Foundation promised $10M for the first 3 years, and to provide support afterwards -- their share would shrink as contributions from other donors came in (don't remember if there was a solid plan if PP failed to attract significant donors after the first 3 years). PP's early investigations [1] were relatively niche topics (at least at the time, and most certainly compared to anything Trump-related today). But the drive to have "impact" \-- awards, collaboration with other news orgs, spurring legislative action -- was ostensibly attractive to philanthropic foundations looking to donate. It's worth noting that PP has for awhile dedicated fundraising staff -- $1M in fundraising expenses according to its 2017 990; I don't see First Look listing any fundraising expenses in its 990s so I don't know if they'll start going that route or plan to find revenue from other sources.

0: [https://www.propublica.org/article/propublica-10th- anniversa...](https://www.propublica.org/article/propublica-10th-anniversary- welcome-to-our-second-decade)

1: [https://propublica.s3.amazonaws.com/assets/about/PP_2010_ann...](https://propublica.s3.amazonaws.com/assets/about/PP_2010_annualrep_forWEB.pdf)

</comment><comment><USER12> The article didn't dive into it much, but if The Intercept were declassified as a foundation, the deductibility of Pierre Omidyar's donations would be capped based on his AGI.

</comment><comment><USER13> Why don't they fire Mahdi Hasan, James Risen and everyone else who was only hired to shill for the establishment?

</comment><comment><USER14> There's only so many NSA PowerPoint you can publish from Snowden before people become bored.

<comment><USER15> Very reductive view of the last bastion of investigative journalism

<comment><USER16> OCCRP?

<comment><AUTHOR> Shhh. Apparently people don't like to hear about an ethical group of investigative journalists. They only want to focus on the ones tied to Assange.

</comment></comment></comment></comment><comment><USER17> It's hard to care too much about the publication that hosts Sam "Bring Back Bullying" Biddle [0] and his reporting on technology and the people involved in it through a lens of deep personal contempt. Funding a _reporter_ (he is their tech reporter, not an opinion columnist) to grind an axe about his own hatreds and social status anxieties is not a recipe for truthful engagement with real-world complexity.

[0] [https://archives.cjr.org/the_kicker/gawker_bullying.php](https://archives.cjr.org/the_kicker/gawker_bullying.php)

<comment><USER18> Making an ad hominem attack on one reporter who said something sarcy and twitterlike on Twitter (not in an article) five years ago, while employed at a different company, should hardly determine whether you care about The Intercept. His output for them is here if you care to identify how is 'hatred and social anxiety' is affecting his work: [https://theintercept.com/staff/sambiddle/](https://theintercept.com/staff/sambiddle/)

<comment><USER19> Sarcy and Twitterlike isn't some kind of a defense. People that are assholes on Twitter are in fact assholes.

<comment><USER10> We're all assholes to some extent, but Twitter accentuates that aspect of many personalities. It seems fine-tuned to generate heat with no light. Many people have withdrawn from public life entirely because Twitter could never be arsed to implement decent blocking mechanisms.

</comment></comment></comment></comment><comment><USER20> That is quite fascinating. Billionaire pays millionaire rock star journalist and calls it charity. I wondered why it was that I never find anything meaningful in The Intercept.

I prefer the journalism that is more citizen journalism, a guy with a Wordpress blog and time to spend in front of a keyboard with maybe 50 people paying $2 a month on Patreon.

The joke of content is the price of it, how much does it cost to keep the lights on really? Does it have to cost thousands for an article? I can understand this if you are writing a research paper on difficult science, but working out what happens in the world for real, can that only be done by people paid telephone number salaries?

<comment><USER21> _how much does it cost to keep the lights on really?_

Depends. Would you like original reporting based on reporters actually going somewhere and investigating, and not just reviewing documents in the evenings? Would you like them to have health insurance and a retirement plan?

Should the publication be edited and fact-checked? Should their website be capable of supporting more immersive style than simple blog posts: videos, visualizations, timelines, graphs? Should they host independently or remain at the mercy of censors at YouTube?

Would it only cover one city? One country? A big one like the US or an organization like the EU? The whole world?

The cost can easily range from $20 a month to $20 million a month.</comment></comment>


Ask HN: How do you take money for side project without forming a company - <AUTHOR> Non US developers how do you charge money for your side project (saas/app/web) without creating a company. <comment><USER2> UK you can be a sole trader, basically a person acting as a business. I believe there are some rules about how you legally present yourself (like in your contracts your name has to be "Bob Smith trading as Acme Widgets").

[https://www.gov.uk/set-up-sole-trader](https://www.gov.uk/set-up-sole-trader)

However, as the page says, you're personally liable if something went seriously wrong.

The alternative is to pay £50 to register as a ltd company, though there are costs in running one (£12.50 per year + doing your own accounts vs paying an accountant £200-£300).

</comment><comment><USER3> In the US you can use a fictitious name dba "doing business as" name. You can also open up a bank account using a dba name. You may need to file taxes as a sole proprietor.

[https://www.sba.gov/starting-business/choose-register- your-b...](https://www.sba.gov/starting-business/choose-register-your- business/register-your-business-name)

I think this is called a "trade name" in other countries. Wikipedia has some examples for other countries.

[https://en.wikipedia.org/wiki/Trade_name](https://en.wikipedia.org/wiki/Trade_name)

</comment><comment><USER4> In the Netherlands, there is a threshold, and you do not have to incorporate if you stay under that, and you'll still have to report it. But this obviously depends on the country you're in.

Paypal could be a good way to take money from people privately, and it's probably entirely legal, up to a certain point.

<comment><USER5> > In the Netherlands, there is a threshold, and you do not have to incorporate

But you still have to register some form of sole-proprietorship company?

<comment><USER4> Nope, you take it as a private person, and when you submit your income taxes you state it as extra income.

<comment><USER5> Even when you are selling SaaS (so it's a "service")?

I think you can have problems with payment processing companies as they might not want to make business with a private person.

<comment><USER4> True, but if you're going to SaaS, why would you not incorporate?

Of course there are downsides, you will look a lot less professional without a KvK or Chambers of Commerce number.

But if you want to look professional, you need to incorporate

</comment></comment></comment></comment></comment><comment><USER5> Not sure how general this is, but in Poland if you have SaaS you need to have a company (because it's a "service"). But when you are selling just source code to someone else, it can be counted as personal income (no company needed).</comment>


BitAuth for Decentralized Authentication - <AUTHOR> http://blog.bitpay.com/2014/07/01/bitauth-for-decentralized-authentication.html <comment><USER2> OK, I'll be the obligatory critic: I don't see how this solves any problems that TLS client certificates don't. The introduction says BitPay considered client certificates, but doesn't say why they rejected them. And "easy to implement wherever TLS is implemented" sounds like more of a selling point than "easy to implement wherever the Bitcoin protocol is implemented."

Also, it seems a little questionable to claim "passwords may travel over plaintext" as a benefit of BitAuth over password authentication. My initial impression is that when not using HTTPS, BitAuth is more secure than password authentication against a _passive_ adversary, but that both are equally vulnerable to MITM attacks.

<comment><USER3> Author here. Thanks for the healthy criticism! This is still a work in progress, and we're looking for this kind of feedback.

We had the objective of minimizing the surface area for attack, so we did not want to expand the scope to include non-ECDSA algorithms. Utilizing the same curve as Bitcoin (secp256k1) has a number of advantages, not the least of which is incentivizing the verification of its security (not to mention, the integrity of the secp256r1 curve is in doubt).

Furthermore, the path to building a clean user experience around a clean Javascript library that runs [and performs] well in all browsers is much less tenuous than getting browser support for a new algorithm — lending to faster innovation.

<comment><USER4> Can you unpack on why begin a new protocol with an algorithm in doubt? I understand implementations are well understood, but the "incentivizing the verification of its security" period will seem small comfort when the break comes, no?

For other readers, here is some discussion of secp256k1 security. (You mention r1 above, but BitAuth references k1?)

[http://blog.cr.yp.to/20140323-ecdsa.html](http://blog.cr.yp.to/20140323-ecdsa.html) [https://bitcointalk.org/index.php?topic=380482.0](https://bitcointalk.org/index.php?topic=380482.0) [http://lists.randombit.net/pipermail/cryptography/2014-Janua...](http://lists.randombit.net/pipermail/cryptography/2014-January/thread.html#6176)

</comment></comment></comment><comment><USER5> It's Tuesday, so I guess it's time for another "assume a public-key infrastructure" post - this time with OMG BITCOINZ sauce on top.

It still handwaves away the biggest problem: getting users to store a private key securely. If that was straightforward, we'd all be using GPG already...

<comment><USER6> For decent security, both problems need to be addressed- trusting the identity of public keys, as well as securing your private key.

Unfortunately, I can't think of a decent key-protection solution that doesn't involve custom hardware.

</comment></comment><comment><USER7> This seems like the HMAC authorisation in OAuth 1, moved to HTTP via JS and custom headers. If the comparison is right, it should be a generally secure and easy to implement auth protocol.

It would be great for something like this to be commonplace, but the UI definitely needs to be solid. A few questions looking at it initially:

\- How does the browser know your private keys?

\- How does the browser know how to send the signed header?

\- How are nonces managed (especially over multiple devices, if the new nonce always needs to be higher than a previously used one)?

\- Can you have more than one SIN?

\- If so, what's the benefit of having multiple SINs vs multiple passwords?

On a sidenote, bitpay make some seriously kick ass tools and I love how creative they are.

<comment><USER3> Multiple SINs (read: identities) are an intended benefit of this mechanism. In fact, nonces are verified _per SIN_ , so this provides sequence enforcement _per client_ as we intend for each device to have its own SIN.

We have a reference implementation for key management in [our example client]([https://github.com/bitpay/node-bitpay- client)[1]](https://github.com/bitpay/node-bitpay-client\)\[1\]), and will be publishing a more formal document as soon as it is complete.

[1]: I am fully aware that HN does not support proper Markdown.

<comment><USER8> Not only does HN not support markdown, but it breaks links you write using markdown :)

Really nice work. Question - if you generate the private keys client-side and use a password only to decrypt them for use (still client-side), wouldn't this make associating accounts across devices kinda difficult? As insecure as email/password auth is, it's pretty portable.

Looking forward to playing with bitauth!

<comment><USER3> Not particularly. The pattern for resolving this is already increasingly commonplace; login with your username and password, then _confirm_ the login from one of your already authorized devices.

In fact, this even lends itself to expansion into n-factor authorization methods.

</comment></comment></comment></comment><comment><USER9> So, they've basically just reinvented SRP [1] using EC crypto. I'm a big fan of SRP and use it in production, but it has already years of refinements which makes it very secure. Designing auth mechanisms is hard, there are many subtle ways you can get it wrong. If you're looking for this kind of auth mechanism, I recommend to take a look at SRP first.

Still, kudos for their efforts. If they continue to improve this, it could take a fair amount of auth "market" some day.

[1] [http://srp.stanford.edu](http://srp.stanford.edu)

</comment><comment><USER10> As usual in decentralized authentication posts, I'd like to mention Mozilla Persona[1] which is a decentralized third party authentication service over the open source BrowserID protocol.

I don't mean to diminish the author's work in any way; but if you're interested in these things and don't know about Persona, please look into it!

[1]: [https://www.mozilla.org/en-US/persona/](https://www.mozilla.org/en- US/persona/)

<comment><USER11> Which, by the way, was discontinued: [http://techcrunch.com/2014/03/08/mozilla-stops-developing- it...](http://techcrunch.com/2014/03/08/mozilla-stops-developing-its-persona- sign-in-system-because-of-low-adoption/)

<comment><USER12> The right intrepation is that Mozilla is not funding the project, but the protocl (browser id) and Persona source code are still out there.

The downside is Mozilla MIGHT sunset their Persona infrastructure one day. But that's not a real concern because Mozilla is never interested in being people's Persona verifier. They were hoping Persona would take off and people would host their own bridge, instead of relying on Mozillia's.

</comment></comment></comment><comment><USER13> I mean this stuff is just catnip for me. Unexpected new uses of technology from one domain to another, just serves to reinforce how seminal bitcoin was/is.

Having looked at it with my very layperson eyes, I struggle to see how it is significantly better than say client side certificates. Same idea - sign a request with local private key, only difference is using the SIN mechanism to let the server know I am to be trusted.

But it's fascinating to see the evolution of these things in real time

<comment><USER14> Digital signatures were not invented with Bitcoin.

TLS supports client certificates perfectly well, and your browser probably supports them.

This scheme also has a lot of beginner-level oversights, IMO. It doesn't delimit the URI from the body, and it doesn't protect the HTTP method itself nor any potentially important headers. This makes me suspect that no cryptographers laid their eyes on this before the announcement.

<comment><USER15> I really really really want to do a redesign of the client certificates UI for Firefox, but alas I'm not a UI person.

Client certificates certainly work, but most people wouldn't see them in their browser, let alone seek them out.

</comment></comment></comment><comment><USER16> The most important piece that needs to be handled is described in the github repo:

'There also needs to be a public place to store SIN's, preferably in a decentralized blockchain or datastore like namecoin. Key revocations could be stored here as well as reviews/feedback to build a reputation around an identity.'

Otherwise, apps that integrate will need to store SINs in their user tables. I see that this would add an unnecessary amount of work around management of SINs.

Great work, I'm looking forward to see where this goes.

</comment><comment><USER12> So the workflow is generate asymmetric key pairs, generate SIN, sign the request with your private key to verify?

How exactly does it work for multiple devices? Each device has its own key pair and an unique SIN? How do we connect multiple SINs as one user?

<comment><USER17> Supporting multiple devices is a hard problem. We worked for a long time to enable it. Not Bitcoin protocol specific, but some words about our asymmetric key based multi-device solution here; [https://www.mepin.com/lost- device/](https://www.mepin.com/lost-device/)

<comment><USER12> The solution ^ still require a traditional account registration, or at least connection to the device that was used to create the account (if we go with passwordless registration). Otherwise, "must link their MePIN app to an actual user account in the target service" wouldn't be true.

</comment></comment></comment><comment><USER18> How is this different/better than SSH?

</comment><comment><USER19> Just use LaunchKey - [https://launchkey.com](https://launchkey.com) or [https://github.com/launchkey](https://github.com/launchkey)

<comment><USER20> Why on earth would you outsource two factor auth to a cloud service?

Talk about putting all your eggs in the same shared basket.

<comment><USER17> Funnily; the reason to outsource is exactly about not putting all your eggs in the same shared basket. You outsource the 2nd factor and keep the first factor (passwords) in-house. Implementing everything in-house is a "same shared basket".

<comment><USER20> So you're dependent on a cloud startup for basic auth and you've got no more security than any other isolated two factor auth system.</comment></comment></comment></comment>


Skylight, a Ruby profiler, free for open source applications - <AUTHOR> http://blog.skylight.io/announcing-the-skylight-for-open-source-program/ <comment><USER2> The Rust language community has recently released a case study on Skylight and how Rust has been a competitive advantage for them.[0]

[0] [https://www.rust-lang.org/pdfs/Rust-Tilde- Whitepaper.pdf](https://www.rust-lang.org/pdfs/Rust-Tilde-Whitepaper.pdf)

</comment><comment><USER3> If you're building a Rails app, you should be using Skylight. It gives you:

1\. What's slow.

2\. What's hit frequently.

This combined gives their "agony" ranking for you to fix problems that impact the most. In a very clean UI!

Terrific product. I wish I had Skylight for my Phoenix/Elixir stack.

<comment><USER4> [https://www.appsignal.com](https://www.appsignal.com) has a great product, and works for Elixir / Phoenix too.

It also supports, profiling background jobs.

<comment><USER5> Funny enough: also Rust production users.

<comment><USER4> Indeed, rust is amazing. Much thx to the likes of you for putting in those hours.

</comment></comment></comment></comment><comment><USER6> Has anyone used New Relic and switched to Skylight or vice versa? Been looking for some comparisons [1].

[1]: [https://twitter.com/sunnyrjuneja/status/951973556170215424](https://twitter.com/sunnyrjuneja/status/951973556170215424)

<comment><USER7> I could never find anything actionable in NewRelic. Seems like interesting data, but nothing I could optimize for. Skylight has identified slow performing areas where we've worked on and watched a downward trend.

<comment><USER8> Come on, I love Skylight, but really! Slowest queries, slowest requests, breakdown of every hit into details how much time everything took. It gives you too much actionable data if you ask me. You can constantly optimize some slow-pokes, I have to remind myself to not optimize pages that are not most used.

</comment></comment></comment><comment><USER9> Note to the Skylight marketing team: I had never heard of your service in 10 years of using Rails, even if it was something that could very valuable to me. But if I open the homepage what I see is:

"DO THE ANSWER DANCE". Cool looking weirdo characters dancing. Generic charts- filled dashboard screenshots. Comparatively very small text saying "learn why your app is slow".

If you hadn't been vouched by this HN thread, I would have never read below the fold to learn that you allow profiling Rails apps.

</comment><comment><USER10> I see that the logs and analysis will be open to everyone. I guess that's equivalent to using Travis, CircleCI, etc. on their free/open tiers. But API logs and analysis like Skylight performs can have much more unpredictable and sensitive info in them than test/build logs.

Does this mean that all private fields needs be scrubbed in-app, before Skylight? For example, a hosted OSS service that includes e-mail addresses or location data in API query strings.

<comment><USER11> The short answer is no.

We work differently than other similar products, in that we rely heavily on aggregation, both for presenting useful data in the UI and also to keep our backend scalable. We don't keep around particular aspects of individual requests. Individual requests are essentially only used as "data points" to build statistical models about your app/endpoints. For example, any SQL queries are parsed and sanitized on _your_ server before they are sent to us[1].

That probably sounds more involved than it actually is in practice – you can see it for yourself on the dashboards for The Odin Project[2] and the Homebrew formula browser[3]. The bottom line is that there is no way to get from the aggregated data back to an individual request.

[1] [https://www.skylight.io/support/faqs#security](https://www.skylight.io/support/faqs#security)

[2] [https://oss.skylight.io/app/applications/g0gJSNnzYAws/recent...](https://oss.skylight.io/app/applications/g0gJSNnzYAws/recent/6h/endpoints)

[3] [https://oss.skylight.io/app/applications/jut3BrkJo722/recent...](https://oss.skylight.io/app/applications/jut3BrkJo722/recent/6h/endpoints)

<comment><USER10> Good to know. Thanks.

</comment></comment></comment><comment><USER12> Been using this on production for ~1 year now, no complaints so far!

</comment><comment><USER13> "Skylight is a smart profiler for Ruby on Rails applications."

<comment><USER14> As a further historical note that may interest HN users specifically, Skylight was the world's first production user of Rust (the Ruby gem they ship is written in it), dating back to well before Rust was even stable.

<comment><USER15> Which is mainly because Yehuda Katz (Rust core member) works at Skylight.

<comment><USER5> To be clear about the chronology here, wycats made the decision to go with Rust, then did a lot of work in Rust, then became a core team member. He chose Rust because of his needs in Skylight, not because he was already invested in Rust.

[https://blog.rust-lang.org/2014/12/12/Core-Team.html](https://blog.rust- lang.org/2014/12/12/Core-Team.html)

> Yehuda Katz will be known to many in the Rust community for his work on the > initial design and implementation of the Cargo project. He is also a co- > founder of Tilde, which has been using Rust commercially in their Skylight > product for quite some time

<comment><USER11> For slightly more context, I wrote the first lines of Rust code for Skylight as a spike at the end of 2013, and joined the Rust core team more than a year later. :)

I was largely inspired by a blog post in June 2013 by Patrick Walton: Removing Garbage Collection From the Rust Language[1]

[1]: [http://pcwalton.github.io/blog/2013/06/02/removing- garbage-c...](http://pcwalton.github.io/blog/2013/06/02/removing-garbage- collection-from-the-rust-language/)

<comment><USER16> Do you code in Ruby any more or is it all Rust these days? If you had to build a web app what would you use?

<comment><USER11> I split my time between Ruby, JavaScript (mostly with TypeScript) and Rust, with occasional Java and devops work. Of those, JavaScript (with TypeScript) is my predominant language at the moment, but the mix changes pretty often.

Skylight's stack is Rust and Ruby for the agent, Rails for the backend, Java for our data processing pipeline (essentially a custom data store) and Ember for virtually the entire front end. The graphs in Skylight are Ember components written in d3.

I still think that Rails is a great choice for most web apps, since (to this day) it provides an extremely productive baseline for building account management and working with third-party integrations, which turn out to be a surprising percentage of the total code (and an even higher percentage of backend code changes) in even an ambitious project like Skylight.

I also think it's reasonable to use something like Java or Rust for any heavy data-crunching your app might do, but I think people over-estimate which aspects of their application are truly performance and efficiency critical.

<comment><USER16> Interesting. I see, thanks. From your list Ember stands out, was not expecting that. Rails and Ember integration looks painful? Maybe using Rails 5 and API mode is the way to go.</comment></comment></comment></comment></comment></comment></comment></comment>


Cascadia Code: monospaced font for command line experiences and code editors - <AUTHOR> https://devblogs.microsoft.com/commandline/cascadia-code/ <comment><USER2> I was eager to test it as I always like a new monospaced font, but it feels "bold" on MacOS (VS Code).

IBM Plex Mono has been my font of choice for the past 2 years, after many years of using Ubuntu Mono.</comment>