How a banner ad for H&R Block appeared on Apple.com without Apple's OK - <AUTHOR> http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ <comment><USER3> _Facebook eventually addressed the issue by making the site accessible over HTTPS—though, as the authors of the 2008 paper note, HTTPS can be a "rigid and costly" solution._

This same excuse has existed for about as long as HTTPS, which dates to Netscape Navigator 1. Is it still that "rigid and costly"? Is there a technical reason that this is an unsolvable problem?

Considering the increase in computer and network speed over the last decade and a half, it seems strange that this would still be the case. Perhaps it's just that without pressure from competitors there is no pressure on the sites to solve it?

<comment><USER4> an annoying thing about HTTPS is that it requires you to serve each domain name from a separate IP address, and that can be somewhat costly.

<comment><USER5> If you ignore IE+Windows XP, you can safely use SNI.

<comment><USER6> It's any browser on XP which uses the Windows Crypto API, most notably probably the second most used browser, Chrome. As long as XP is around, we're going to need One IP address per domain if we want to do SSL.

<comment><USER7> Chrome 6+ appears to support SNI on XP

[1] <https://code.google.com/p/chromium/issues/detail?id=43142>

[2] [http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers...](http://en.wikipedia.org/wiki/Server_Name_Indication#Browsers_with_support_for_TLS_server_name_indication.5B6.5D)

</comment></comment></comment></comment></comment><comment><USER8> TLDR: ISP injected script tag ads.

I heard on the latest This Week In Security that Comcast was apparently not just injecting JS, but injecting _bad_ JS. Meaning that closures weren't used, so name collisions could occur with the actual sites users were visiting.

For this reason, I can see HTTPS becoming standard, even for public, non- logged in users. I'm in the process of updating my site to be all-HTTPS and recently got confirmation (as much as one could ever expect) from Google there's no SEO penalty (<http://goo.gl/sbtxq>).

<comment><USER9> If your site has a login page _anywhere on your domain_ , I think that really _every page_ should be served over HTTPS, and it should use HSTS to make sure the browser knows it should always be accessed that way.

Even if your login page posts to https, if there's a man in the middle somewhere between your server and user and your login page is HTTP, they can alter the login page to post somewhere else. If your login page is HTTPS, then they can change links to that page to something different.

Only with HTTPS for the entire site is it safe from those attacks. It is still vulnerable if there is a MITM the very first time the browser has ever visited the site, but it's a whole lot better than always being vulnerable!

</comment></comment><comment><USER10> Thinking about ad injection, it is actually quite scary what a ISP can do. Not only is it easy to display ads (or possibly even malware), but even worse my ISP is installed as a default CA by Firefox. So that they can even inject into SSL connections, with the only "warning" that the certificate was signed by the ISP...

<comment><USER11> Who is your ISP, and what CA cert do they have installed?

The thought of an ISP having CA certs that are a part of default installs is unnerving.

<comment><USER10> Telekom ( actually T-Online, the German ISP branch). The certificate is identified as T-Systems (and I just found another one, Deutsche Telekom AG). Additionally looking through the certificates I found at least Swisscom who appear to have both a CA and an ISP, and AOL. But this is certainly not an exhaustive list but just the ones that caught my eye scrolling through the list of CAs.

[EDIT]And for the added 'told you so,' the German parliament uses precisely this certificate <https://www.bundestag.de/>

<comment><USER11> Here's where it was introduced: <https://bugzilla.mozilla.org/show_bug.cgi?id=378882>

Interesting comment on that thread:

> This CA was singled out as a CA that signed an excessive number of > intermediate authorities (252) which together only have issued 4164 > certificates in EFFs talk at C3. This is, by far, the highest number, the > next contender is GTE Cybertrust with 93.

<comment><USER10> The bugzilla thread is an interesting read. And to be fair, the issue with the thousands of certificates is explained in it. It appears that the certificate is used to sign DFN, which in turn signs certificates for most German universities.

Btw, Video of the 27C3 talk in question: <https://www.youtube.com/watch?v=DRjNV4YMvHI>

</comment></comment></comment></comment></comment><comment><USER12> Original (and better imo) article here: <https://news.ycombinator.com/item?id=5486006>

</comment><comment><USER13> My problem with HTTPS is Google: They push it on every front, but - <USER2> various reasons - consider HTTPS and HTTP different pages, meaning you do not get link juice from any HTTP links if you're site is HTTPS only.

(1. don't listen to people telling you otherwise, it's an expensive experiment 2. redirects do not transfer all the juice, they count as links themselves, from my experience it's like not having external links to your site at all 3. If you do not depend on Google b/c you're SaaS, go for HTTPS only)

<comment><USER14> Where are you getting the data that you don't get Google juice for HTTP-to- HTTPS links?

<comment><USER13> From first hand experience. Then lately there was a discussion on /r/seo I currently can't find with a link to Matt Cutts who said redirects are handled the way links transfer juice.

[edit] People extrapolate that 301 are different because Google tells them to use 301 when moving pages.

</comment></comment></comment><comment><USER15> I remember reading about someone with neighbours that were stealing their wifi. You can do much more interesting things with a proxy server than just inject ads: <http://www.ex-parrot.com/pete/upside-down-ternet.html>

</comment><comment><USER16> Is Ars just ripping sites now? Although now changed, <https://news.ycombinator.com/item?id=5505890> pointed to an Ars article from yesterday (that reached the front page) that was basically a copy-paste of an SE question

<comment><USER17> Ars has been featuring Stack Exchange questions, with their permission for quite some time. I think it's some sort of partnership. <http://arstechnica.com/author/stack-exchange/>

<comment><USER18> It's one of the worst features that they run. I've gotten good enough at guessing which is "Ask Stack" from the headline that I don't click them anymore, though.

</comment></comment></comment><comment><USER19> This is probably the best counter-argument to the best counter-argument that gets leveled at the people promoting HTTPS-everywhere. People like to say that HTTPS everywhere would break transparent cacheing by ISPs. After all, HTTP is designed to allow caching proxies to exist inline and still supports dynamic content gracefully (er, somewhat, anyway).

But in fact the same features that make transparent caching easy make this kind of shenanigans easy. There are tons of companies in this space now. Not just people like NebuAd and R66T, but lots of "subscriber messaging systems" like FrontPorch (which I've heard sells messaging data for behavioral advertising) and PerfTech (which has assured me that they do no such thing).

This should be an easy way to push back one of the last "real" arguments against using HTTPS everywhere. There's no excuse not to be running your site on HTTPS all the time - it protects you and your users from all sorts of mischief for a minimal overhead.

<comment><USER20> It's getting to the stage now where I think domains should be sold with an SSL certificate as standard (minimal vetting, no warranty) - just enough to provide encryption, rather than treating it as an optional extra.

<comment><USER19> One could argue that DNSSEC is a variant of this - put your SSL certificate in a TXT record in your DNSSEC-signed domain and you no longer need a certificate authority system to sign the certs. Now you can self-sign the cert and get it for free!

</comment></comment></comment><comment><USER21> Holy cow. It seems this has had a direct effect: they're no longer injecting javascript into webpages. I just tried Amazon, eBay, and a few others where the script injection used to be present, and it's no longer there.

I absolutely can not understate just how happy I am about this.

<comment><AUTHOR> you mean overstate? :)

<comment><USER21> Absolutely; thanks for the correction. It seems I was just a tad too excited to post, haha.

</comment></comment></comment><comment><USER22> HTTPS will not prevent this: the ISP can issue their own CA to their users and then decrypt/encrypt https as it passes through them. (Many corporations already do this). What will prevent this is legislation and/or competition.

It amazes me that US Internet access has very little of either. All the drawbacks of monopoly Internet, with all the drawbacks of unregulated Internet.

<comment><USER23> I believe ISPs can not have a transparent HTTPS proxy without the "invalid certificate" browser warning. ISP users would have to manually trust their ISP's CA.

<comment><USER22> Or have it added to their chain beforehand. An ISP could trivially include this as part of their "welcome pack" installer CD or the like.

Would that silently affect people like us? No. Could they do it to all their non-technical customers? Absolutely.

<comment><USER24> Not going to help if their non-technical customers are using ipads or similar though, which non-technical users tend to like

<comment><USER22> IOS gives you a friendly and official-looking "accept this certificate?" dialog when you connect to a router that offers one. Non-technical users will accept and proceed without blinking.

</comment></comment></comment></comment></comment><comment><USER25> It should be made illegal if it isn't already. Since "any site" did not consent, doesn't this injection really "change" their site?

<comment><USER26> Maybe they should lose their "common carrier" status if they mess with the content? Then they would be responsible for whatever is said on the internet, which would probably dissuade them from doing it.

<comment><USER27> Most ISPs in the US don't operate under common carrier regulations. Even the ILECs (essentially the only common carrier data networks) sell their internet services via subsidiaries to avoid it.

<comment><USER26> Oh, interesting. What protects them from libel suits and the like, then?

<comment><USER27> Libel for? Cases like this where they are making Apple look bad? I think that would be a stretch. Typically ISP terms of use say they can do pretty much whatever they want (see the Computer Fraud and Abuse Act/The Whole Aaron Swartz Thing). In theory if you don't like it you can take your business elsewhere.

This "take your business elsewhere" competitive environment is supposed to foster innovation blah blah. Many would say this is BS and more regulation is needed because of a duopoly. As a competitive ISP I have to disagree, but it is true that the duopoly providers spend more on advertising so most people aren't aware of alternatives.

One could argue that rewriting pages to insert JS makes a derivative work or something and that gives Apple grounds to sue because of copyright, but that's tough as ISPs are supposed to be finding ways to inflict the Emergency Broadcast System on users and JS insertion is generally less obtrusive than hijacking all HTTP/HTTPS until the alert clears.

My perception is that most ISPs avoid this kind of thing because we don't want to give the FCC any more excuses to mandate things like "Net Neutrality" with poorly understood policy consequences.

On the other hand inflicting one of those DNS-hijacking special offers systems can increase revenue from the typical residential user that wouldn't care by a few percent so there's always a bit of business pressure.

</comment></comment></comment></comment></comment><comment><USER28> I have always wondered how long it would take for this sort of behaviour to kick off.

This is to the internet what global warming is to the earth... well that might be too far, but this is high tech pollution at its worst.

</comment><comment><USER29> zmhenkel's Reddit comments if anyone wants first person accounts:

<http://www.reddit.com/user/zmhenkel>

</comment><comment><USER30> Wouldn't you know it, the CMA Communications (the ISP mentioned in the post) website is not accessible via HTTPS. "View My Bill" and similar link you off to a third party domain.

</comment><comment><USER31> Yet another reason blindly running javascript from unknown parties is a bad idea. Whitelists for progressive enhancement I _want_ should always have been the default.

<comment><USER32> If the ISP is injecting Javascript, they can just inject it as coming from the same domain.

I don't like "force HTTPS everywhere" but these jerks are forcing it. It sucks, but it sucks less than this.

<comment><USER33> @begurken you've been hellbanned since this post <https://news.ycombinator.com/item?id=5466310>, no idea why

<https://en.wikipedia.org/wiki/Hellbanning>

<comment><USER32> > The idea has a great number of pros, and almost no cons.

1\. Certificate problems with embedded devices.

2\. Much harder to control what's going on with your network.

</comment></comment></comment></comment><comment><USER34> We have had a similar case publicly exposed here in the UK a little while ago with Phorm and British Telecom:

<http://www.bbc.co.uk/news/technology-13015194>

There is a good chance that such practices may be found to be illegal in a UK court (Regulation of Investigatory Powers Act primarily with some discussion about applying the Data Protection Act or Computer Misuse Act) but they haven't been tested yet. Both companies very quickly stepped back from the 'trial' they were conducting when it became clear there might be public support for a test case.

</comment><comment><USER35> An interesting article but was overly verbose. Could have said the same thing in half the space.

However, a big FU to Arstechnica for prostituting the name of Apple to get more visits to the article. The headline did not need to imply that Apple.com was hacked or that Apple was somehow unaware of what's happening at their site.

It's sleazy journalism and beneath the usual ethics of Arstechnica

</comment><comment><USER36> Does anyone know the CFAA implications here? My system is a "protected" system, this would clearly be unauthorized access.

</comment><comment><USER21> As exciting as this is to be posted on a high-volume website, I honestly doubt CMA is going to change their practices on this issue.

If anything, the Acceptable Use Policy change on the 4th was a sign that they'd be reluctant to change their stance on this issue at all. They honestly don't care.

<comment><USER37> They might change their tune if they get a letter from a lawyer or two. Can't imagine Apple, for example, likes the idea of third-party ads overlayed on their site.

<comment><USER38> I could see google bringing a hammer down on them if its true that they are overwriting ad space on certain websites.

</comment></comment></comment><comment><USER39> I'm terrified to let them tamper with it but Congress really needs to make laws that regulate ISP behavior in the USA. They will never do it on their own.

The problem with such a bill is it will have a dozen riders for very horrible things.

</comment><comment><USER40> The "root" of the problem -- on what marketplace are these display ads being sold?

<comment><USER41> Any of the hundreds of different advertising services that feed into the exchanges that are carried by the major networks. There's likely no direct connection between who sold the ad and who made the deal with this ISP to let them serve that network. H&R Block probably had no idea their ad ever appeared on Apple's site.

[http://blog.inuvi.com/wp-content/uploads/2011/01/LUMA- Landsc...](http://blog.inuvi.com/wp-content/uploads/2011/01/LUMA- Landscape2010-12-12.jpg)

<comment><USER40> Yeah, but somewhere H&R Block purchased the inventory. You don't just generically purchase a 300x280 banner ad without regard to where or how it runs. It has to be connected with some sort of property or impression.

It could be a re marketing add, or a demographically targeted ad, but in that case the buyer still purchased it somewhere and some company or company is responsible.

<comment><USER41> Ex: ISP signs a contract with "Google Ads for Publishers" to carry their display ads. H&R block buys a retargeting campaign through AdRoll. AdRoll runs this campaign by bidding on the matching cookies through AppNexus. AppNexus feeds into DoubleClick which serves Google's ads. H&R block shows up on the Apple website. H&R is 3 companies separated from their buy and where the ad is shown, and never signified any intent to advertise with an ISP or with Apple. Tracking back the ad to where it was sold gives you AdRoll, which wasn't complicit in the scheme either. Google is the "root" problem in the fictional example.

</comment></comment></comment></comment><comment><USER42> Did anyone else have trouble hitting the back button after that article? I find that equally skeezy.

Edit: It seems they've mapped command-back-arrow to a non-default action. Not cool.

</comment><comment><USER43> Anyone else find it interesting that R66T is vaguely read as "ROOT" -- this is some kind of cruel joke, right?

</comment><comment><USER44> Very interesting that r66t.com doesn't appear in the 2 most popular adblock+ block lists!

</comment><comment><USER45> So an internet provider inserted ads into web pages and two bloggers blogged about it.

I hate this ultra-low signal to noise style of writing anyway, but using it for a tech piece is more than ridiculous. This isn't a 1970s western movie, nor does it appear in the NYT arts & culture section.

</comment><comment><USER46> Did he complain to the FTC?

</comment><comment><USER47> This is quite common in China. Even the largest ISPs do it.

</comment><comment><USER48> why wouldn't all ISPs do this for the economic incentive? Is advertising going in this direction?

<comment><USER37> If my ISP did this I would switch instantly.

<comment><USER49> And when they all do it, or no other ISP will service your area?

<comment><USER50> `ssh -D 8080 micro-ec2` and proxy through localhost:8080 till it's sorted out.

<comment><USER49> Exactly! No need to switch ISPs after all. (Though personally I add the -N flag so that the tunnel is clearly separated from the remote shell.)

</comment></comment></comment></comment></comment><comment><USER51> It's a brave new world out there. Well, I knew this would happen eventually, and I got a lot out of the internet while it lasted. Shit, the last 15 years of my life have been grand thanks to the net, but now it's time to kiss it goodbye.

I, for one, welcome our new corporate master feudal lords.</comment>


Ask HN: I want to email ads to content outlets like NYT. How? - <AUTHOR> I would like to start emailing "all human addresses that I can find" at premium content outlets like NYT, Wired, etc, as well as the FCC and FTC, Congress. Just something pleasant to do in the mornings over coffee.
The content will be my thoughts, observations, complaints and desires about online advertising.
I want to include really eye catching and noticeable ads in these emails, served from any really privacy and resource violating ad network.
Would I go directly to an ad network? Which ones?
Or is there an email service I could contract with, that handles the ad part for me?
I would prefer that the email appear to come from my main email address, not some third party, and any reply-tos would come to me.
Bonus if I can somehow be notified that an ad blocker was used, so that I can auto-reply with "Please do me a solid, and unblock my domain, so that I can afford to pay my broadband bill and communicate with you."
Also, I want to easily NOT email ads to my everyday correspondents. <comment><USER2> This email campaign will probably be marked as spam by most of the recipients.

Why don't you just open a blog?</comment>


Why I'm never buying HTC again - <AUTHOR> https://outlookzen.wordpress.com/2016/07/24/why-im-never-buying-htc-again/ <comment><USER2> This reminded me of my experience with HTC Desire S about 5 years ago. Bought it from Amazon, used for about 3 months with the utmost care possible only for the phone to get bricked when trying to install an over the air update.

HTC customer support asked me to post it to them. I did as I was told and after a few days they respond with a quote of about £120! According to their report, the LCD unit and the microdrive had to be replaced due to user abuse. I was totally disappointed that instead of admitting that it was a faulty device they tried to charge me for no fault of mine.

I paid £20 for return of the device without repairing and reached out to Amazon who refunded me fully without asking a single question. Notice any difference in customer service by these two companies?

<comment><USER3> I've noticed phone companies just don't care. Had a Nexus 5 with a faulty internal power button. One day it wouldn't turn on anymore. Was quoted $150 or so for a fix, despite it being a result of shitty parts and not abuse. I just binned it and moved on.

<comment><USER4> My Nexus 5 fell victim to the underwater camcorder defect roughly a year back. I had to start flashing a community made patch from XDA to keep it going (which also keeps me from using the stock firmware ever again). There were multiple bugs listed on Google's tracker citing the issue, but Google either remained silent, tried to shift the blame to a Qualcomm driver that they supposedly had no control over, or just silently close the thread with a self serving "won't fix" tag. CM 13 incorporates the patch automatically now, so it's gotten better. But still, the hardware on the Android side of things has gotten so bad in recent years.

All of this makes me want an iPhone as my next device solely for the hardware support.

</comment></comment></comment><comment><USER5> I fix phones for a living and frequently assist customers with calling manufacturers for warranty issues.

LG and HTC are the worst, with the most frequent denial of customer assistance. Samsung and Apple have their faults, but you can typically reach someone helpful when there is an issue.

HTC has some of the worst design decisions I've ever seen. The M8 and M9 each contain approximately 20 pieces of tape on the inside, holding important components together. It takes about 4 hours to replace a screen or charging port, and usually doesn't go back together well.

LG is pretty terrible, as well. Read the horror stories about the G4. The G5 is already exhibiting some of the same flaws, such as half the screen freezing or just showing static, or the device not powering on fully straight out of the box.

Nothing is perfect, and every device has its own faults, but I strongly caution people about dealing with companies like this.

<comment><USER6> Could you tell more about the LG G4?

I have one and only had problems with a bad screen protector (that covered the sensor). Despite that, I was going to the G5, just thinking because off the smaller screen.

<comment><USER7> I have a G4 and I can feel myself getting emotional and doubting grandparent. I both want to and don't want to know.

</comment></comment></comment><comment><USER8> Is nobody reading the actual story of the article? The interesting take away here is design of IT systems, not anecdotes of phone quality.

It's very easy to hack together a web form that always work when taking the happy path. When reality hits you you will notice that you always need some kind of manual override, the dilemma is that this will break automation further down the stream. In one place I worked where we made similar systems we made all forms free text instead of constrained to dates, numbers, addresses etc. The UI would initially constrain the input but you could always enter advanced mode which just made everything into text and marked the whole form as non-machine-processable. It wasn't pretty but in the end it was the only thing that worked in practice. Similarily, editing forms once they are submitted is also commonly overlooked, I've been in contact with many organizations where deleting the order and creating a new is easier then modifying the existing one, as the experience in the article also shows.

<comment><USER9> My takeaway was the same team designed the device and the support system. I know, doubtful. However, the do obviously share the same culture.

</comment></comment><comment><USER10> When customer service says _" can't"_ or _" impossible"_ what they mean is _" won't"_ or _" don't know how"_.

Hang up the phone and try your call again. If that doesn't work call the sales number and pretend you're evaluating the unit for possible use with a school full of kids.

</comment><comment><USER11> Warranty is expensive to manufacturers and they try and make everything not to fix your stuff.

This is why you should buy from brands that are known for good warranty: I had an awesome experience with Lenovo for my ThinkPad and terrible experience with Dell (they literally refused to fix my laptop, just a year old, because it was second hand and I didn't have the original buying receipt -- though the laptop still had its service tag and more than a year of warranty).

Next time, buy a Lenovo tablet.

<comment><USER12> >Next time, buy a Lenovo tablet

This is why you shouldn't trust anecdotes.

I had the opposite experience. I had a problem with a Dell laptop a few years back and they didn't ask me to ship it back, they sent a tech out with a part to my home! Same week! Nothing beats having the tech fix it and test it and make sure it's working right there.

Lenovo, on the other hand, had 2 week shipping turnarounds and had me waiting for over a month before saying "we can't do anything except put in a new motherboard at your expense", putting me out of a device for 6 total weeks between shipping, waiting and shipping. My local computer repair shop had me fixed in a two day turnaround

I'll never buy Lenovo again, absolutely never.

<comment><USER13> I had a similar experience with Lenovo. I was unable to use my device for nearly six months, during which I went through about four returns. They kept sending my laptop back broken! They sent it with a range of issues - initially, they failed to fix the intermittent display flickering, afterwards, it came back with a keyboard containing dead keys, dead LED indicator lights, and missing screws. In the end, I called and told them they were going to pay me for the laptop and we'd part ways.

I will never buy Lenovo again.

I have amazing small/medium business support from Dell on my monitors. If I see a dead pixel, slight backlight fade, or any other issue, I can call Dell and have a new monitor sent overnight to my door.

<comment><USER14> I bought a Dell monitor from Amazon. It had a defect in the coating, and Dell wouldn't honor the warranty without a dell order number. you can imagine how this turns out. I bought a different brand monitor.

</comment></comment></comment></comment><comment><USER15> Wait, what about warranty? It's a manufacturing defect and it sounds like they acknowledge that, thus warranty.

I heard that in America there's less warranty by default than in Europe, but isn't 2 years the standard anyway?

In the Netherlands at least, if something breaks unreasonably fast, you can go back even if it has been 10 years. And they can't forward you to the manufacturer or anything: the shop you bought it from has to handle it. Per European law it's 2 years minimum on new electronics (and 1 year second hand) but the Netherlands adds to that.

<comment><USER16> So, in Australia there's a standard one-year warranty, with an indeterminate exception if you market yourself as a premium brand ("what a reasonable person would expect...").

It was hilarious watching Apple try to convince the government that they weren't a premium brand and therefore didn't have to give longer warranties than a year, while at the same time marketing themselves to the public as a premium brand. The government did the legal equivalent of "cool story, bro" :)

<comment><USER17> _It was hilarious watching Apple try to convince the government that they weren 't a premium brand_

IMO in the USA they are the _only_ premium brand in terms of service to consumers.

I'm lucky to live where I do, but I have an Apple retail store just 10 minutes from me and another one 30 minutes away. Apple customer service at those stores is second to none.

There are many horror stories of non-Apple consumer laptops breaking, and it taking weeks for them to be repaired. At Apple they fix laptops in the store in a day or two, depending on whether they have replacement parts in stock.

Same with phones. They will either replace a phone on the spot or take less than a day for repairs such as new batteries or new screens.

They even price match. When new computers have just been announced, and older ones are being sold at low prices by third parties, the Apple store will match those prices. I've gotten 28% discounts from them in those situations.

That's all part of the "premium brand" experience, but you do often pay quite a bit more than comparable hardware from other manufacturers.

<comment><USER18> > There are many horror stories of non-Apple consumer laptops breaking, and it > taking weeks for them to be repaired. At Apple they fix laptops in the store > in a day or two, depending on whether they have replacement parts in stock.

The only time I ever went to an Apple Store for support on a laptop it did get get fixed within a couple days, but they also replaced my fully-functional hard drive (with all my data) when the only thing broken was the SATA cable. The conversation I had to have with them to convince me to put my original hard drive back in the laptop was pretty mind-numbing, going through stages of "we don't know where the hard drive is" to "we have it, but we can't give it back to you". I did eventually get the original hard drive back, but that experience kind of soured me to the whole "Apple experience", one of the many factors that eventually led me down the road to learning Linux and basic PC repairs, allowing me to order SATA cables and the like from Amazon and replace them in laptops myself.

</comment></comment></comment></comment><comment><USER19> If you're talking with an unreasonable rep who won't transfer you to a supervisor, hang up and try calling again, hoping for a more reasonable rep.

<comment><USER20> This is correct. I once had a series of customer service reps deny me access to my account to the point where they told me my account was irretrievable. Irretrievable? I called back the next day and the new rep told me those other people were totally incorrect, and he resolved my issue in 15 minutes.

With high turnover rate and minimal training, most service reps are reading from a script and attempting to appease you into hanging up the phone anyway.

<comment><USER21> Some places get "rated" by the length of the calls, not number of happy customers, or resolution to call ratio... just length of calls. Keeping it short, even if it pisses off the customer is better for keeping their job.

<comment><USER22> I think a lot of people would discount this anecdote as absurd to be true, but I have found this too. I have a friend who did tech support for google and she was quantified on all sorts of naive tracking metrics that were company- focused instead of customer-focused (# of upsells, customers handled per day).

<comment><USER23> Google has tech support?!

<comment><USER24> If you are a paying customer :)

</comment></comment></comment></comment></comment></comment><comment><USER25> I probably _will_ buy HTC again as long as they honor the commitment they made. My HTC One A9 had all the specs I needed at the time -- removable storage, fingerprint sensor, NFC, 3GB RAM. But what I really like about it is that HTC promised updates within 15 days of Nexus phones receiving their security updates. So far they've lived up to it in spirit, if not in letter. i.e, updates aren't always within 15 days but I'm on the June 1 security patch, the same as the Nexus devices.

EDIT: Forgot to mention the "Uh-oh" protection. They replaced my device (many questions asked, but not super painful) when it fell down and I broke the glass.

</comment><comment><USER26> Horrible way to treat a customer. What OP experienced was a very strict fraud prevention system. I'm not trying to excuse HTC in any way, they should have a way for a manager to override. Nevertheless, I thought I'd share my experience with a different company with similar anti-fraud policies. Should anyone find themselves in a similar situation, call your bank and ask about adding an additional address to your account. This way the address verification check with the processing gateway will succeed when your shipping address is submitted.

</comment><comment><USER27> There's alot of mixed opinions about HTC customer support on the vive subreddit currently, with people trying to get various HTC vive faults resolved. The secret seems to be that you keep contacting until you get a competent support rep.

I've seen a few people suggest the US support is worse than the EU support, but I've not personally had to deal with HTC support so can't really give any personal anecdotes.

</comment><comment><USER28> I just went through this exact same frustrating process when trying to buy a phone and activate a new line of service with T-Mobile. After three days of back and forth on Twitter (yes, it's the best way to actually talk to them) and phone, I was finally told what I was trying to do simply could not be done because the order could not be "verified" by their system. I've had the same T-Mobile account for over a decade, and I spend nearly $200/month on mobile service with them...but, I can't be "verified".

I _think_ it was the billing/shipping mismatch (I travel full-time, so my billing address is a forwarding service in a city I'm unlikely to see again for years, while my shipping address is wherever I'm parked this month). But, their system wouldn't allow changes once the verification had failed. No level of "escalation" could resolve the issue. It was simply a "sorry, no". I guess I am now in a permanent state of "unverified" with T-Mobile, and if I want to buy another phone or activate another line it'll have to be with another provider. I had similar problems with Sprint, which is why I ended up trying to add another line to T-Mobile (I have both, for a variety of reasons, and Sprint would have been a better deal, but their customer support is _even_ worse, if that's imaginable).

It's scary how systems like this can make it impossible to provide a basic level of customer service to someone who doesn't fit the systems exactly. There was a time when customer service reps, or at least their managers, had the ability to override the system when the system prevented a reasonable level of customer service. That doesn't seem to happen anymore, at least in my limited recent experiences dealing with customer service reps at big companies.

</comment><comment><USER29> The one HTC phone I ever bought was the HTC Freestyle - biggest piece of garbage I've ever spent any money on. The apps would crash constantly, and texts would either send 4 times or never send at all. All of these were bugs that were known and documented, but never fixed in the several updates my phone received. I'd love to know the story behind that phone...

</comment><comment><USER30> Unless the vendor is known for exceptional customer service then don't waste your money on extended warranties and make sure you have reserve funds to replace such purchases. Yes - cynicism will not prevent or solve these problems - but it will eliminate the anger and disappointment.

</comment><comment><USER31> I've been debating spending the $ buying the HTC Vive a lot these past few weeks and this is scarying me :/ There were some horror stories on r/vive as well (about them not wanting to fix dead pixels because of the law about <5 dead pixels for TV screens).

</comment><comment> jor-el Is it common for a customer assistance to ask for your Credit Card number over the phone? Or they are having a secure telephone payment system?

</comment><comment><USER32> The day they made batteries unreplaceable was the day I decided to never buy HTC ever again

<comment><USER33> I hope you don't buy Apple.

</comment></comment><comment><USER34> That's too bad. I didnt realize their CS was poor. I've had a M8 One for just over a year now and its my favorite phone since the iphone 4s. I dont know if I'd be able to switch back to an iphone.

</comment><comment><USER35> Although their system had a very weird quirk that was probably the result of trying to streamline operations, HTC's behavior here is pro-consumer.

Having different billing and shipping addresses is a common tactic in credit card fraud, and it's not common in other cases. I prefer companies who prevent people from shipping to unknown addresses unrelated to the payment method (unless authentication is handled some other way).

<comment><USER36> In Canada the Canada post system is notorious for being very bad at delivering things. So although my billing information is at my house, me and most the other people in my office have things delivered to our work instead.

<comment><USER37> I do that for convenience. I'm at work during the day, shipping to my office ensures somebody is there to receive the item. Item doesn't get stolen from the door-step and item doesn't bounce back and forth between warehouse and house waiting for a signature.</comment></comment></comment>


Ask HN: Putting knowledge into imperfect containers - <AUTHOR>

Files are the recording of observations and also contain the product of thought and instrumentation. They are a History. Because of software dependencies many file formats require periodic ports to new formats. Many of these translations can be lossy. What amount of knowledge is being put into formats that are certain to suffer gross or meaningful loss of fidelity during future format translations? <comment><USER2> A very thought-provoking notion, indeed.

However, must we take such a pessimistic view of the future data porting/migration methodologies?

> Many of these translations can be lossy.

Agreed to _'can be'_.

But, on the contrary, just as they can be lossy, they _could be_ more _intelligent_ or _smarter_ too, leading to not just 'not lossy' migrations, but even to more enriched output.

One quick scenario I can think of, off-hand:

Let us take the example of legacy, (scanned) photographic images. A 'smart' porting tool can add value to such data in at least two ways.

1\. Read the date stamp of the original file and superimpose it on the output.

2\. Apply face-recognition technology to it and offer (various) option/s to the user to tag/store it in different ways.

Of course, I know that this is just a very small sample of the entire data 'universe', but, as they say at the end of many patent documents:

While the detailed description disclosed above relates to one specific embodiment of the claimed method, it should be evident that the same can be put into practice in any number of different ways, without actually departing from the scope and the spirit of the claimed method. ;-)))

Your views?

<comment><AUTHOR> The question was deliberately broad and honestly inquisitive. But born of the narrow observation that while there are standardized, published formats that separate style from content (HTML/CSS) and similarly, say, LaTeX, much human "work" is put into formats where the style /is/ the content. Say, a pretty resume in Word or a PowerPoint presentation.

We have conversations where we say things in passing. Maybe we don't care to preserve those words. But when we bother to document things presumably they are worth something. So I wondered how much "worth" was being lost or later mis-read.

Perhaps some or much documentation is simply a means to an end and its longevity is immaterial.

</comment></comment><comment><USER3> This seems a perfect title for an article about educating people!</comment>


Leaked UN Climate Report – Warming Oceans Are 'Poised to Unleash Misery' - <AUTHOR> https://nymag.com/intelligencer/2019/08/leaked-un-draft-warming-oceans-could-unleash-misery.html <comment><USER2> I grow more and more convinced that we're going to need to geoengineer our way out of this on a massive, massive scale. Even if we went zero emissions tomorrow, the cascade of secondary and further effects from what we've already done is going to need to be undone. Project Vesta still seems by far the most promising to me: low tech, moderately low energy, and actually addresses the root cause, unlike approaches that aim to cool the planet by shading or tweaking albedo. Check them out if you haven't already.

</comment><comment><USER3> We need more green solutions for food and animal husbandry .

Conversion of forest for animal feed as well as plants for human consumption is getting to be unsustainable.

</comment><comment><USER4> > rock phosphate is a finite resource and the biggest supplies are mined in > politically unstable places

A similarity with oil? I think it's a forgone conclusion that politically unstable places are ripe for becoming stable under whatever guise a mining nation chooses. The profits must flow.</comment>


GitHub is undergoing a full-blown overhaul as execs and employees depart - <AUTHOR> http://www.businessinsider.de/github-the-full-inside-story-2016-2?r=US&IR=T <comment><USER2> Past discussion: [https://news.ycombinator.com/item?id=11049067](https://news.ycombinator.com/item?id=11049067)

</comment><comment><USER3> Note that this article is almost half a year old and might not be fully up-to- date...</comment>


Analyzing the 2013 Bitcoin fork: centralized decision-making saved the day - <AUTHOR> https://freedom-to-tinker.com/blog/randomwalker/analyzing-the-2013-bitcoin-fork-centralized-decision-making-saved-the-day/ <comment><USER2> Decentralized decision making doesn't mean that decisions occur in some sort of abstract, Platonic "decentralized space" in which ideas spring into being from the ether and just sort of magically percolate into people's mind. It means there is no central authority with the capacity to use one or another variety of force to enforce their decisions. If a dozen people with no enforceable authority over each other look at a problem, discuss amongst themselves (even if there is an informal, unenforced hierarchy), come to similar conclusions, and agree to take coordinated action with no enforcement, it's still a decentralized decision.

There was no central authority here. Not even BTC Guild, because nobody had the power to force them to do what they did. They did it for their own reasons.

This is not a demonstration of how centralization saved the day; this is a demonstration that the decentralized BitCoin network still responded rapidly and solved a major problem, without having to fall back to some sort of centralization.

Decentralized networks still develop structure, usually with some sort of power law appearing. They just don't form one single central node that defines the very network, upon which the network lives or dies, and the dominant nodes can and often do shift and flow over time. BitCoin has been repeatedly resilient against even very large nodes in their graph dying.

(And I say this as a repeated and continuing BitCoin skeptic, not a cheerleader. This sort of decentralized rapid response isn't even particularly unusual; the Internet itself faces this sort of crisis fairly routinely and solves the problems without a single centralized authority dictating solutions to everybody else. "Rough consensus and running code" is another similarly- decentralized credo that has built a lot of things.)

</comment><comment><USER3> Yeah, while I agree that the 2013 fork could have resulted in significantly more lost money than it did, I'm far from convinced that it would have proved catastrophic for Bitcoin. For one thing, the idea that a Bitcoin fork would be likely to endure for anything other than ideological reasons is pretty far- fetched. There are strong incentives for miners to be on the same side of a fork as the economic majority, and vice versa.

Now, in the case of a major ideological disagreement, as this block size debate has (suprisingly) turned into, I could see a lasting fork happening to the Bitcoin ecosystem. But back in 2013, there were no such major disagreements, just a bunch of minor squabbles.

So yes, it could have been worse, but not _that_ much worse.

<comment><USER4> What damage do you think would've happened? I am honestly confused as to why people are so afraid of a fork.

If there is a fork, it just means that people have to decide which branch they believe in. They might even get different names. If you have coins on both forks, you can spend both coins.

In practice, the total market cap of the two forks should approximate the market cap of the original, which means your coins didn't lose any value. And in practice, whichever fork has more mindshare will probably win, not because of any technical reason, but because that's the one people are paying attention to so that's the one that seems safer to mine on.

Heck, if there really were a long-lived fork, people could just require people who want to spend pre-fork coins to send the coins on both forks before they consider the bill "paid".

How bad exactly do you think it could've gotten, in the worst case scenario? To me, the beauty of Bitcoin is that the worst case scenario just isn't that bad.

</comment></comment><comment><USER5> Yes, the 'ultimate decentralized solution' relied on 'who happened to be on an IRC channel' for forcing things the right way.

<comment><USER6> Considering the "who" was major bitcoin developers and pool operators, yes. #bitcoin-dev currently has 462 nicks and there were probably more during 2013 due to the crazy price increase. Keep in mind that a ton of communication happens on IRC and even bitcoin itself utilized IRC for finding other nodes to connect to.

<comment><USER5> "Major developers and pool operators".

Pool operators, kinda like banks, or exchanges? There's just a little irony there.

<comment><USER7> Pool operators have vastly different roles (responsibilities and authorizations) in the bitcoin system than banks do in the fiat system.

There's no irony.</comment></comment></comment></comment>


Ask PG: will disabling upvotes on the front page reduce hype stories? - <AUTHOR> Lately there is a discussion going on @ HN about the quality of high rated stories. To me it seems people just upvote articles by reading the title alone instead of reading the linked article.<p>Will disabling the upvote button on the front page cause people to read the article first, or read the comments first and make a better decision about there upvoteabilities? <comment><USER2> While not impossible, I think assuming people vote without reading is doing a disservice to HN readers. The ratio of hits on a story to upvotes is huge - from purely anecdotal data (mine and others) a 20x ratio is common. Since the ratio is so high, it seems reasonable to assume that most if not all votes came from people who did actually click through. I have no data on the upvote to comment page ratio but I would guess it is even higher.

Of course subject matter, headline, other people's comments make a difference, but I doubt there is a significant blind upvoting of something that hits the front page.

I think it is however a good suggestion - simply an invisible reminder that we put content first. I like it.

</comment><comment><USER3> It's important to recognize that any method open to public votes can be played. When you see two or three posts with the same origin suddenly and inexplicably rise to the top of the rankings for some reason other than their obvious worth, you see the role played by gaming the system -- and that's a common occurrence.

> Will disabling the upvote button on the front page cause people to read the > article first, or read the comments first and make a better decision about > there [sic] upvoteabilities?

s/there/their/

That would essentially disable voting. I think they call that a draconian solution.

<comment><USER4> Would it essentially disable it, or just reduce the points stories get drastically? I think only allowing voting within the comment page would make it more likely that votes would be on content (or up-voted summaries in the comment page, at least) instead of the headline. If this affected all submissions, would that be a bad thing?

<comment><USER3> > I think only allowing voting within the comment page would make it more > likely that votes would be on content (or up-voted summaries in the comment > page, at least) instead of the headline.

Maybe. And maybe someone intent on playing the system would simply move to the comment page and upvote there.

</comment></comment></comment><comment><USER5> I'm sure you are referring to the hyperloop post. I don't think the system is being game here, most people want to know about that piece of news. And if the post is bogus, well a moderator can simply flag it.

</comment><comment><USER6> Alternatively, how about a karma threshold to be able to upvote stories on the front-page? Make it the same threshold as downvoting, 500.

This should go a long way to prevent the redditification of HN.

If you aren't a committed participating member of the community, you don't get to push things to the top of the fron page as easily. It should also help a lot with sock puppetry, since it would not be trivial to create accounts to push things to the front page.

</comment><comment><USER7> I think this would be much like disabling jobs for (or heavily taxing) rich people. When you reach the top, it is much easier to continue ascending, just the same as a larger lion has an easier time finding a mate, and gets fed first.

C'est la vie

</comment><comment><USER8> I'm currently using an android app to browse HN which uses the hn api. No matter how you change the api there would be no real way of preventing app makers from allowing upvoting from their main story browsing page.

<comment><USER6> Unless you only allow voting based on reputation like downvoting privelages, which is something that can be validated server side.

</comment></comment><comment><USER9> Just disable users to view their and other people their karma totals because the only thing it does is promoting the writing and submitting of content for the common denominator just to collect karma points.

</comment><comment><USER10> On a related note - [http://www.livescience.com/38763-positive-online- comments-ho...](http://www.livescience.com/38763-positive-online-comments- hold-sway.html)

</comment><comment><USER11> Yup.</comment>


Did Ken, Ritchie and Brian choose wrong with NUL-terminated text strings? (2011) - <AUTHOR> https://queue.acm.org/detail.cfm?id=2010365 <comment><USER2> Worth keeping in mind that the security cost here is illusory: the track record of length-delimited data structures isn't much better than that of ASCIIZ, especially since integer handling in C is so treacherous.

<comment><USER3> > ...especially since integer handling in C is so treacherous.

I'm still learning C, having not had much reason to do so until recently, so I'm not quite sure I understand this statement. How is integer handling in C treacherous (any more so than any other language, especially other languages that operate as close to the metal as C)? Is it something to do with signed vs unsigned, and beware of over/under-flow when doing math? Or is it a more insidious subtlety I'm ignorant of because it has been biding its time for a more perfect opportunity to bite me in the ass?

<comment><USER2> Two bottles of beer on the wall, two bottles of beer.

Take one down, pass it around, one bottle of beer on the wall.

One bottle of beer on the wall, one bottle of beer.

Take it down, pass it around, zero bottles of beer on the wall.

Zero bottles of beer on the wall, zero bottles of beer.

Take one down, pass it around, four billion, two hundred ninety-four million, nine hundred sixty-seven thousand, two hundred ninety-five bottles of beer on the wall.

(Yes, you pretty much have it in your question; the Google search you want to make to learn more is [integer overflow]).

<comment><USER4> And various undefined behaviours (signed overflow etc.) colluding against the programmer to the effect that compilers sometimes delete range-checking code.

Integer promotion rules are not simple, either. Integer width rules, far from simple.

</comment></comment></comment></comment><comment><USER5> >Using an address + length format would cost one more byte of overhead than an address + magic_marker format, and their PDP computer had limited core memory.

I find this interesting - why only _one_ more byte of overhead? That would've limited string lengths to 256. So 2 bytes would seem the minimum, and even then, how do you go to 4 bytes once memory becomes cheap without breaking everything? Using NUL-termination, the upper bound for a string is effectively the amount of memory the OS is willing to give you, and code can keep working without modification for decades.

Am I missing something here?

<comment><USER6> 1 additional byte of overhead would give you 2 bytes for the length, since you wouldn't have to have the NUL byte at the end of the string.

You could do some kind of variable int encoding scheme, where longer strings would require more bytes for length, with some overhead to indicate how many length bytes are required for each string.

<comment><USER7> In the PDP era, they would have noticed the overhead of having a variable- length int at the beginning they would have to decode.

In the modern era, it's probably cheap to the point of being free, because in the vast majority of cases I would expect branch prediction to largely eliminate the checks as being very predictable.

<comment><USER5> So then....they chose correctly?

<comment><USER7> Despite being vigorously opposed to NUL-termination in the modern era, yes, I would not criticize the people who actually made the decision for the PDP. They had no real reason to believe we'd still be discussing that decision 60 years later.

</comment></comment></comment></comment></comment><comment><USER8> Many prior comments over the years:

[https://news.ycombinator.com/item?id=2837571](https://news.ycombinator.com/item?id=2837571)

[https://news.ycombinator.com/item?id=7572711](https://news.ycombinator.com/item?id=7572711)

[https://news.ycombinator.com/item?id=3892410](https://news.ycombinator.com/item?id=3892410)

[https://news.ycombinator.com/item?id=8385306](https://news.ycombinator.com/item?id=8385306)

</comment><comment><USER9> A null-terminated representation is as close to a fundamental datatype for a string as possible. It is same in spirit as other fundamental data types in C like array. People have built abstractions over these fundamental datatypes over the years.

<comment><USER10> It's not fundamental at all. You can't even represent null bytes in a null- terminated string.

A length prefix is pretty clearly superior.

<comment><USER11> A string contains characters. NUL is not a character; it's nothing.

"Fundamental" in this case means "matches reality". Having a number at the beginning doesn't match reality as closely as having the string of characters in sequential memory addresses with something to terminate them.

The quick fox made the jump\N

or

27The quick fox made the jump

The second one requires more work to store (a character-counting routine), and needs even more work to handle variable length strings that may exceed 255-ish bytes/characters.

I'm not discounting the benefits of prefixing the length, just saying it's not more fundamental than null-terminating an arbitrary sequence of characters.

<comment><USER7> "A string contains characters. NUL is not a character; it's nothing."

You already couldn't make this argument stick in the ASCII era, where a string can't contain NUL but can contain SOH (Start of Heading), STX (Start of Text), ETX (End of Text), EOT (End of Transmission), ENQ (Enquiry), ACK (Acknowledge), BEL, BS, HT (horizontal tab), LF, VT (vertical tab), FF (form feed), CR, SO (shift out), SI (shift in), DLE (data link escape), DC1, DC2, DC3, DC4 (device control 1-4), NAK (negative ACK), SYN (synchronous idle), ETB (end of transmission block), CAN (cancel), EM (end of medium), SUB (substitute), ESC (escape), FS (file separator), GS (group separator), RS (record separator), US (unit separator), and DEL, but Unicode makes that argument even sillier. Strings have always contained things that aren't "characters".

The real problem is no matter what in-band character you take as the magical termination character, you will have strings that want that in it, because in the general case strings can contain anything, because C is always asking you to pass them around to things as the general-purpose storage data structure. You can fix that with an escaping scheme, but now you have an _escaped_ string, not just "a string". Since strings do indeed need to be able to carry NUL in the general case, you either _must_ have some sort of scheme for representing them, or expect a ton of errors when things jam the distinguished character into your string when you didn't expect it. (Note that for precisely the same reasons that NUL-termination isn't a good idea, there isn't any way to "filter" wrong NULs. You can't tell.)

You might just barely be able to argue the problem is that C's _library_ mistook NUL-terminated strings for arbitrary-sized arrays that can contain anything, but in C if you want arbitrarily-sized arrays you would then have no choice but to pass the array size around to every call that expected such a thing. The next immediately obvious thing to do is to pack the number together with the array in a struct, and lo, we're back to length-delimited strings.

No matter how you slice it, C's got a major foundational screw-up in this area somewhere. If NUL-terminated strings are the bee's knees, C's APIs still took them in _way_ too many places where they are not appropriate, and it caused decades of serious and often exploitable bugs.

<comment><USER12> NUL is a character in the ASCII character set. That is a problem because you cannot create all the strings composed of ASCII characters in C.

But C never claimed to support all ASCII strings. C doesn't even have strings. C just has char arrays, which are byte arrays. When strings were formalized by convention in the stdlibs, clearly the supported strings are 1-255 strings, NUL excluded. That's the character set available for strings in the stdlibs. If you insist on using stdlib strings for some other kind of strings, that's your own problem.

<comment><USER7> "But C never claimed to support all ASCII strings."

That is precisely my point... there _is_ no well-supported solution in core C for arbitrary binary strings, despite C's _extremely_ frequent use in domains that require them. If you insist on using stdlib strings for other kinds of strings, you _do_ have a problem... but you also have _no other choice_. Which brings it back to being a language/library problem.

As I already alluded to, C itself doesn't have a problem with length-delimited strings, and there are plenty of libraries you can get for them. But the core library for C does force this problem in your face by leaving you no other choice, and it is a valid criticism of C.

(C is such a disaster that the only thing to do is to leave it behind as quickly as possible. However, if we were somehow stuck with the language itself, there's a lot of ways we could improve the libraries it comes with, as again demonstrated by the many such improved libraries you can get. However, one of the things I've learned from learning a ton of languages over the past couple of decades is that a language almost never manages to escape from its own standard library, and the few that manage it (like D) pay a stiff adoption price in the process. C's standard library has a real problem here, that has caused real bugs, and no amount of wordplay is going to fix those decades of bugs.)

</comment></comment></comment></comment></comment></comment><comment><USER13> There is one author who does not use memcpy, strcpy, etc. He wrote his own "standard" C library routines. Others have used these routines; they are public domain.

The security track record on the authors internet-facing programs is better than most. In fact, I cannot think of any author writing similar software with a better track record.

Sometimes the most popular solutions are not necessarily the best ones for every purpose. Whenever I write programs in C from scratch, I use byte.h, buffer.h, etc., from the above mentioned author. I do not use memcpy.

In doing this, I am not a professional programmer and I am not writing internet-facing programs for other users. I am a student of C learning how to use C, the language. If I know how the language works, then it stands to reason I should be able to use a variety of libraries, including alternatives to the "standard libraries".

Otherwise it is arguable I would be just learning how to use a standard library, not a language.

The C language has utility on its own, as form of a notation, and it is that utility which I seek to learn about. Historical records indicate there was C language in productive use for some time before there was a "standard library".

<comment><USER3> Who is this author, and where is his code? I'd like to study it -- I might learn something.

<comment><USER14> Almost certainly D. J. Bernstein's string API from daemontools , [http://cr.yp.to/daemontools.html](http://cr.yp.to/daemontools.html) and his other bits of code. Some commentary at [http://www.and.org/vstr/comparison](http://www.and.org/vstr/comparison) . Probably more commentary elsewhere.

</comment></comment></comment><comment><USER15> >The CPUs that offered string manipulation instructions—for example, Z-80 and DEC VAX—did so in terms of the far more widespread adr+len model.

Hold up, the z80 offered string maniuplation instructions? Using adr+len, no less? You miiiight call LDIR a string manipulation function using adr+len but in practice almost all z80 machines I've seen use NUL terminated strings and something like CPIR to find it.

</comment><comment><USER16> The title should have "Dennis" instead of "Ritchie".

</comment><comment><USER17> Null terminated strings are just application level logic. "strings" are just bytes in memory. There are no strings.

<comment><USER18> No, If you quote a string in c "string data here" you get a piece of data with null termination.

Null termination is part of the C language.

Example: char str[]= "1234";

        printf ("%s: %lu", str, sizeof(str));

Prints: 1234: 5

<comment><USER19> Use "%zu" to print a value of type size_t.

A couple of ugly corner cases:

        const char str[] = "abcd\0efgh";
        printf("length = %zu, size = %zu, value = \"%s\"\n",
               strlen(str), sizeof str, str);

output:

        length = 4, size = 10, value = "abcd"

And:

        const char str[4] = "abcd";
        printf("length = %zu, size = %zu, value = \"%s\"\n",
               strlen(str), sizeof str, str);

This has undefined behavior. (Which is a good reason to let the compiler figure out how big the array has to be. Computers are better at counting things than you are. Let them.)

</comment></comment></comment><comment><USER20> Maybe - but the people who followed definitely chose poorly by continuing to use null terminated strings.

</comment><comment><USER21> Did they choose "wrong"? No. Did they make a choice and move on? Yes.

<comment><USER22> Yes, because there were already safer systems programming languages being used by the time C got invented.

OS safety was already a concern in 1961.</comment></comment>


SciRuby - <AUTHOR> http://sciruby.com/

<comment><USER3> I'm glad to see this project is coming back.

I'm in the middle of writing a Stats library for Ruby[0]. Maybe we can join forces?

[0] <https://github.com/davejacobs/stats>

<comment><USER4> I scanned your project and it looks great. This is one of the major things we are trying to accomplish with SciRuby - simplified access to things like GSL for basic/essential science and stats. Seems like you and Claudio Bustos should get together (Claudio is working on distribution[0] and is very involved in sciruby). We should join forces.

[0] <https://github.com/clbustos/distribution>

<comment><USER3> I'll be in touch this week. This could be exciting. More than anything, I think this will give statistics a home on the Web and will give a new face to statistics for non-engineers. Maybe we can do for statistics what Rails did for Web development.

</comment></comment></comment><comment><USER5> I noticed this is licensed as GPLv3 as opposed to a BSD license for SciPy. Isn't this going to be a huge barrier to adoption, or am I missing something?

<comment><USER6> Could you go into more detail? Since we haven't released yet, we might still switch. But I haven't heard a lot of compelling reasons for doing BSD instead.

<comment><USER7> As a matter of course, MIT and BSD licenses are non-threatening to businesses and organizations who do not necessarily have software as their primary focus.

Non-software shops who may be interested in using a piece of software may balk at using GPL3'd software because they don't know what the legal ramifications are of failing to comply, or the knowledge/wherewithal/processes to do release the software that they're using.

Talking to people about BSD/MIT is really easy: "You can do whatever you want with it as long as you retain the license and copyright".

At the risk of getting into a FOSS license debate, i'd like to think that FOSS contributors do it out of a motivation other than license restriction (and hell a lot of people still rip libs off, even when they are GPL'd!).

<comment><USER8> I am sure that most FOSS contributors do it out of a motivation other than license restriction, but I am also certain that many potential FOSS contributors work for organizations that may have questions about contributing to a GPL project (not particularly valid concerns/questions, but the less you have to deal with the legal department the easier it is to get sign-off on contributing to a project...) When you are talking about semi-specialized software like numerical analysis tools it is quite possible that there is a latent pool of potential contributors in industry who would find it easier to contribute to a BSD/MIT project than a GPL one.

It is also the case that this is basically a library, and many who would have no problems using/contributing on a GPL application will balk when it comes to a library or framework.

</comment></comment></comment></comment><comment><USER9> Why?

The two technical justifications (objects all the way, and enumeration) in the FLOSS interview [0] are both arguable and not nearly convincing enough to justify further fragmentation of the open-source science ecosystem. If I want cleaner semantics, s/python/ruby is at best moving sideways - for the sake of a few keystrokes? Ruby is slower both in the interpreter itself and in the lack of f2py,Cython,Numexpr,PyCUDA,weave (even Theano sometimes).

If I need a real change, I'll use Ocaml or Clojure, and gain speed from the change.

It seems like a waste to discard (or attempt to replicate) the 10s-100s of person years represented by SciPy and the ecosystem including f2py, Cython, MayaVi, IPython (not just a REPL), Pandas, Chaco, PyCUDA/OpenCL, and SAGE - <USER2> name a few.

Are there any other, better reasons to want to build an ecosystem from scratch?

[0] <http://www.floss4science.com/interview-sciruby-team/>

<comment><USER4> The same arguments could have been used when scipy was starting up: * Why did folks build scipy when there was PDL? Just to avoid a few sigils? * Why build scipy when R had been released just before? * Why didn't they just support matlab/octave? (scipy and matlab are so close in syntax anyway) * If syntactical differences are not enough to justify a new scientific library, why not just stick to Fortran, or C/C++? One can argue that an enormous amount of time has been wasted on writing python wrappers. For what? Just to save a few keystrokes? However, most would agree that the world is a much better place now that scipy and related tools are in it.

Some arguments: * Ruby is expressive and flexible in ways that python is not. For example, Rubyvis is flexible enough (or similar enough to javascript at least) to essentially accept protovis (javascript) code directly. I don't think python can do this. * Ruby uses blocks/enumerators instead of 'for' loops. How much programming involves enumeration of one kind or another? * len(array) vs. array.length

Coding is not just getting the computer to do what you want, it is also how you think about it and the form that it takes. 'len(array)' vs. 'array.length' may not matter to most, but it matters to some of us.

The great news is that we can still use scipy when we need to. I'm betting there is room for both projects, especially considering how small sciruby is at the moment.

Ocaml and clojure are great, but have a steeper learning curve; getting non- programming scientists to contribute is far easier in a language like ruby or python.

A beginning-programmer scientist who wants to start writing code to solve problems currently has to 1) code in python or 2) learn ruby _and_ python/scipy or matlab or R in order to do some scientific computing. SciRuby means (eventually) that for _most_ things, novices only have to learn ruby. It is hard to overstate the importance to new programmers of being able to use just one language (at least to start with).

If you like python over ruby, this is easy. If you like ruby over python, it gets old piping all your data over to a python script to use the basic features of scipy.

<comment><USER9> SciPy is not currently starting up. There were other open-source alternatives to Matlab in 1995, but certainly none with the scope and community of SciPy in 2011. That full-spectrum alternative is not Octave, not now or then. R is a very nice statistics dsl with prevalence in publications and thus a trove of code (arguments much weaker at that time) - but there is no PyMol or MayaVi in R for good reasons.

For the record, NumPy predates PDL by a smidge, and the existence of PDL is more of an argument against SciRuby, considering the cultural similarity and continued strength of BioPerl. As for C/C++/Fortran wrapping - there's a bit more to it than syntax efficiency, plus wrapping is often semi-automatic and leverages multi-language, science-ambivalent toolkits (ie SWIG or SIP). However, one nice consequence is the fact that via buffer wrapping, the NumPy array has become an efficient common currency for a huge number of legacy libraries.

IMHO, the advantages you have cited pale in comparison with the task of reimplementing 15 years worth of work for what is essentially unity gain in code style (+/- 2% depending on your flavor preference). Regarding that code style, you may be missing the forest for the trees: the inflexibility of Python is a small price to pay for community cohesiveness, and the resulting multiplier effect is non-trivial. Put another way, the time I've spent attempting to read Perl code-golf leaves me very leery of Ruby.

My basic argument though is not that Python is superior or coexistence impossible, it's that every person-year spent reinventing a mature system that is far beyond 'good enough' is a person-year that could be spent advancing the state of the art in scientific computing by building on Theano or improving SAGE - or preferably, doing real science.

<comment><USER4> Re-implementing is much easier than implementing. Scipy source code is all available, right? Besides, we aren't trying to duplicate the entire scipy stack and ecosystem. We are just trying to make it easier to do common scientific computing in Ruby. Also, trying to do it in new ways.

You seem to be saying that ruby is python, just with perl's inconsistency and unreadableness. The syntax differences between python and ruby (more than 2% IMHO) amount to very large differences in code organization. The ruby community places a high premium on brevity and clarity, and ruby's flexible syntax _facilitates_ this. Part of the reason monolithic code bases are more rare in ruby is because we tend to do more with less code. We are talking about two very different forests.

We weren't going to be working on Theano or SAGE anyway, just doing basic science computation to solve real problems in our fields. That's really the problem, we find ourselves quite productive doing science in ruby at the moment, despite its relative immaturity in this area. It's hard not to imagine what we could do with a few more foundational tools. It really is a small cost to enable us to be able to do science in ruby. Plus, building scientific computing libraries is good fun. Every community should have the chance. As Abe Lincoln suggested, 'Let not him who is houseless pull down the house of another; but let him labor diligently and build one for himself.'

Is it so terrible to want to do science in the language you most enjoy and are most comfortable with? To continue with the maladroit quoting of Abe Lincoln, "it's best to not swap horses when crossing streams."

I made the point further down, but will restate it: if ruby hadn't persisted in existing (the nerve!), would django exist today? I find it hard to believe that this is a zero-sum game, and I wish python and scipy every success. Perhaps the most valuable scipy contribution we could make will come by making sciruby something worth borrowing ideas from?

</comment></comment></comment></comment><comment><USER10> I hope they don't set up SciPy as the project to emulate and improve upon. Deep knowledge of R, Fortran, and Matlab would better inform this project of what scientists need.

SciPy is great, but it's clearly best for programmers that have a slight scientific bent and can't stomach learning the existing scientific tools (which are admittedly a bit difficult to combine with modern software engineering). There are some great ideas in SciPy, but a broader set of influences is essential to making a great scientific toolkit.

<comment><USER11> > can't stomach learning the existing scientific tools [I assume you mean R, > Fortran, Matlab]

The sum of anecdotes is not data, but

It might be the opposite: people who know the pain to work with this tools move to Python for complex projects if they can.

<comment><USER12> >> Sometimes when a solution of sugar and water becomes super-saturated, from it precipitates a pure, delicious, and diabetes-inducing crystal of sweetness, induced by no more than the tap of a finger. So it is, we believe, with the need for numeric and visualization libraries in Ruby.

Great point about sugar water. Totally on point.

</comment></comment></comment><comment><USER13> This is a sincere question, if you're doing science, why would you want to use ruby over python?

<comment><USER14> My answer to this question is transparency. At my company Brighter Planet we write all of our scientific/methodological code in Ruby so that people with basic technical skill can understand what's going on. The ability to create expressive DSLs is really crucial.

<comment><USER15> I have a similar answer - I'm a data analyst at a company full of rubyists. I can (and do) use R for most of my analyses, but there's a cost in transparency -- I can't realistically ask someone to review my R code when they don't know the language, and the bus factor is high if anything I write in R is at all important.

That's why I'm trying to use Ruby where possible, even at the cost of a small productivity hit. The benefits of others being able to read my code far outweigh the few extra minutes it takes for me to do something (and in many cases, the sheer brevity of Ruby as a language means it's faster, simply because it's less typing).

I'd love to see SciRuby become a more useful project, and I'd love to contribute. Unfortunately, they don't make it especially easy to get involved -- the mailing list points people to the roadmap, but it's not at the level of detail where someone could jump in (and the component gems don't seem much better), so it's a bit hard to know where help would actually be useful.

<comment><USER6> Noah -- I'd love to get your thoughts on how to make it easier to include people in our project. Would you be willing to send me an email? john dot woods at marcottelab dot org.

</comment></comment></comment></comment><comment><USER16> Wow. This is very much needed. That being said, to what end are they going for ?

<comment><USER17> I think this was posted in response to this article (<http://news.ycombinator.com/item?id=3179370>) rather than because of some recent update.

<comment><AUTHOR> That is correct. I am somewhat connected to a few guys working on this, and I saw the article and thought I would share.

</comment></comment></comment><comment><USER18> I'm really glad they're implementing Protovis instead of trying to copy Matlab's plotting facilities like Matplotlib. Matlab plotting is pretty terrible.

<comment><USER19> matplotlib is very flexible and has a wide array of plot types. It's great for quickly making plots of some data in Python. But IMO the output is not really nice to look at, it takes a lot of customization to make the plots publication-quality, and it feels kind if clunky for making interactive plots (however, some animation support was added recently, I haven't looked at that in deail yet).

The screenshots of protovis/d3 look very promising, I'll have a look at it. The last time I needed a JS charting library I went with Highcharts, as it had somewhat better support for the run-of-the-mill chart types I was using in my project.

<comment><USER18> Matplotlib is ok for a first plot during exploratory analysis, but is a far, far cry from the facilities available in R through base graphics, grid graphics, trellis graphics, or ggplot2.

Protovis/d3 take a different approach, also focused on a similar Grammar of Graphics like ggplot but primarily concerned about the tooling, instead of the application.

Tooling level libraries are nice because they tend to be flexible enough for high data ink ratios, unlike highcharts, which turns me away with every example.

<comment><USER20> Your choice of terms is very interesting! I would say that Protovis and d3 do _not_ take a Grammar of Graphics approach per se; rather, they tackle mostly just the lowest level of the grammar, namely aesthetic composition and some transforms. ggplot is very nice for the kinds of datasets that people use R for, but it's only one part of the story.

For large dataset and interactive visualization in Python, take a look at Chaco: <http://code.enthought.com/chaco>

<comment><USER18> You're right to point that out. I abused the term. The real thing I think ggplot and protovis/d3 share, and the fundamental thing that makes them powerful and interesting, is the declarative nature of those DSLs. GoG is quite a bit more on top of declarative syntax, but, while I really enjoy Hadley's work, I don't think it's the end all be all in declarative graphing DSLs.

</comment></comment></comment></comment></comment><comment><USER21> Great idea and something that will definitely be highly used (I'm downloading it now!), but I really would be cautious attempting to provide what R provides, 'but better'.

R's power comes from the fact that hundreds of scientists have written packages for it when they have a new method - you won't be able to get that overnight. Also, R has strong links with other languages like C.

Finally, while I agree that sometimes R's syntax can be slightly obfusicated, I don't really think the examples on their site are fair... You can 'plot(y~x)' guys :p

</comment><comment><USER22> Interesting stuff, but given the sheer brainmass that SciPy has attracted its going to be hard to draw users away from that crowd. I think the only appeal of this project, at least for the time being, is labs that are already entrenched in Ruby.

</comment><comment><USER23> hopefully they make the DSL similar to matlab. Having worked in matlab & numpy, I can definitely say that having numpy's syntax semi-close to matlab helped a lot when we do ports. It (porting) happens more often than you'd think.

</comment><comment><USER24> Looks good. I'm a big fan of narray to get decent performance for array operations, interesting to see how the rewrite of that will perform. Narray is pretty damn close to realtime compared to native ruby implementations.

<comment><USER20> realtime what? Realtime like C? Realtime like ATLAS or MKL?

<comment><USER24> realtime like it's fast fortran matrix stuff. compared to slow-as-molasses ruby native Array#mean (which has to be implemented in ruby).

</comment></comment></comment><comment><USER25> This is absolutely needed. Glad that the project is come back to life. Big up to the developers.

</comment><comment><USER26> God forbid you use existing mature tools appropriate to your task.

<comment><USER4> And while we're at it, may he forbid the co-existence of emacs, vim, and textmate; java, C++, C#; javascript and dart; KDE, gnome, enlightenment, fluxbox, fvwm, icewm, metacity, compiz, wmii, monad; ubuntu, debian, gentoo, redhat, and arch; bash, csh, and zsh ... nothing good ever comes out of approaching a problem from a new angle.

<comment><USER6> This made my day.

</comment></comment></comment><comment><USER12> This is terrific. This is newsworthy. Hope it gets legs.

</comment><comment><USER27> python's concurrent programming is not that good. how is the situation in ruby?

<comment><USER28> It's the same. The Ruby 1.9.x (YARV) interpreter uses a GIL as well, although like Python, there's a way for C extensions to release the GIL.</comment></comment>


Archive A/B test results by automatically generating screenshots of variations - <AUTHOR> http://visualwebsiteoptimizer.com/split-testing-blog/archive-ab-test-results-by-automatically-generating-screenshots-of-variations/

<comment><USER2> Nice one Paras. I have regretted the lack of this feature in my own A/B testing a few times before, and papered over it by doing boring makework. Of course, since I am very sporadic about completing boring makework, I have rarely had it available when I needed it.

<comment><AUTHOR> If you need technical details, implementing it is quite simple. For generating screenshots on an Ubuntu machine, you just need a script called webkit2png.py <http://www.paulhammond.org/webkit2png/> and XVFB (fake X server).

After that, taking screenshots is as simple as firing this command on shell:

xvfb-run --server-args="-screen 0, 1024x768x24" python webkit2png.py -o google.png -F javascript -w 2 <http://google.com/>

Even though it is resource-intensive operation, I decided to generate screenshots on our own servers over using an existing service because I didn't find a satisfactory screenshot generation API that captures full-page screenshots (as opposed to just thumbnails).

Next feature is to implement nicely formatted PDF reports. But my initial research says it is a VERY hard task! (That's because VWO charts are all JavaScript powered)

<comment><USER2> Thanks, that made my day. I'll see about doing that for A/Bingo if I can get it to work without majorly changing the API...

What sort of charts are you using? (Not the name of the Javascript, I mean, bar charts, pie charts, etc?) If you're using anything that can be done with the Google Chart API, then doing PDFs is fairly easy: you grab the GIFs from Google, convert them into PNG or whatever, insert them into your PDF template, and you are pretty much done.

I unfortunatley am not at liberty to just give you the code to do this, but if you are comfortable with Ruby, this is only a few hundred lines in Prawn (think single-page reports of middling complexity, with data access included). I don't work professionally with PHP and am unaware of good ways to do PDF generation in it.

P.S. If you want to fake it, render the report as HTML using webkit2png, then use ImageMagick or GraphicsMagick to turn the PNG into a PDF. It won't be editable but, hey, who cares. :)

<comment><AUTHOR> Thanks!

The issue is not PDF generation per se. The only bottleneck is the charts, they are rendered on CANVAS element directly. The charts are mainly sparklines and line chart. Replacing them will be a non-trivial task.

Your suggestion of converting HTML -> PDF is a great one but then again the rendered HTML will require static charts (as GIF or JPG). I will probably go down this route: Screenshot of Report -> Image -> PDF. Inefficient, yes. Heavy file, yes. But it will work :)</comment></comment></comment></comment>


Show HN: Jobs Done – A ritual app for ending the work day inspired by Deep Work - <AUTHOR> https://github.com/skidding/jobs-done <comment><AUTHOR> Hey, Ovidiu the author here.

So how could this be interesting to you?

The app

I read a book called Deep Work to improve the quality of my work and found the simple "shutdown ritual" idea powerful. I started with a dead simple list that I went through every evening to clear my mind and disconnect from work.

Then I decided to build a simple app and keep iterating in small increments every day I also use the app. After about 2mo I use it daily and it looks good enough to draw a line. So I made it public in case anyone else finds it useful.

The codebase

Meanwhile, I wanted to learn React Native and try react-native-web. I also wanted to see how well styled-components behaves "unversally" and how to do server-side-rendering with RNW. It worked pretty well (for the most part...) and I learned a lot.

If you're interested in this tech stack I encourage you to dig through the codebase and maybe run it locally to get a feel.

If you have any questions related to the app or the codebase, fire away. I'll answer gladly!

<comment><USER2> Hey, cool project!

I haven't read the book. Is that possible to understand the idea without reading the book?

<comment><USER3> The book is worth a read. Don't forget about your local library!

The end-of-day shutdown is just that. You put your work day in order, you make sure your papers are tidy, you check what you need to do tomorrow (no nasty surprises) and perhaps a few days ahead, then you actually say, out loud, "shutdown complete".

It's supposed to help separate your day of (deep) work from your time off. I like the idea but – ha! – never remember to do it.

OP: cool looking app, it's really nicely done. Was this a "teach myself a language" sort of project? If not, what was the motivation? [Edit: just seen your comment below.]

<comment><USER4> I agree that Deep Work is worth a read. Quite a few meaningful ideas in quite few pages. The end-of-day shutdown is one of the ideas that stuck in me. After a workday my mind is usually buzzing a bit too much for most activities. Focusing on winding down helps very much. Having accepted the point made by the author in combination with it being such a small thing to say the phrase when walking from work means that I often remember to say the phrase and then instantly accept that I should focus the last drops of work-related attention on disconnecting from work in a good way. Helps me a lot!

</comment></comment></comment></comment><comment><USER5> I've printed my own custom notebooks to track my planned vs. actual daily activity in 30 minute blocks, inspired by Deep Work.

This would make an excellent companion to that. The lessons I've learned from that book have been incredibly valuable in helping me work more efficiently and happily. Thanks for building this.

<comment><USER5> I'm glad people are interested in my notebook! Here's a thread I just put up with a link to the PDF and photos of the notebook in action:

[https://twitter.com/JaysonElliot/status/1057490478625705985](https://twitter.com/JaysonElliot/status/1057490478625705985)

The front page has an unmarked calendar so you can write in any three month period. It's meant for the Jerry Seinfeld chain method. Write the one thing you want to do every day at the top, and X out the days that you do it.

Inside, each day has one page broken into 30 minute blocks, with a column for "plan" and one for "actual." Next to that is an open area with a dot grid for planning. (I also put a full page of dot grid on the back, for random notes.)

Use your shutdown ritual each evening to make a list of things you want to do the next day in the dot grid area. Then assign them to 30-minute slots in the "plan" area.

As you go through your day, write down what you really did with your time in the "actual" column. Then you can review in the evening, and see how your plans differed from reality, to help you plan more accurately as you continue to use the notebook.

I hope this is helpful to someone, it's been a great tool for me.

</comment></comment><comment><USER6> Very nice! I have added your project to Awesome Humane Tech [0], in the Mindfulness section. Thank you!

[0] [https://github.com/engagingspaces/awesome-humane- tech](https://github.com/engagingspaces/awesome-humane-tech)

<comment><USER7> That is a list worth checking out, Thank You.

</comment></comment><comment><USER8> I think I will try doing this. It's a bit embarrassing to admit but I really struggle to go to bed at a regular hour. It's really bad when I'm "in the zone" and working hard on a project. I'm based overseas and all of my clients and customers are in the US, so I already stay up very late (usually at least 2am so that I have enough overlap with PST/EDT.) But then 2am turns into 3am, 4am, and eventually the sun comes up.

Maybe this will help. I think I'll schedule an event on my calendar to visit jobs-done.now.sh and go through the checklist. Then it would be good to relax for an hour or two and read/watch something before sleeping. The problem with my weird schedule is that I usually go to sleep immediately after finishing work, so I don't think that's very good.

<comment><AUTHOR> No shame in admitting this. I still struggle with it. Computers are very effective at messing up our sleep function.

Happy to hear you're giving Jobs Done a try. Note that you can customize the steps, set phrase and suggested activities by cloning the repo, editing data.js, building and publishing the static build with a service like [https://zeit.co/now](https://zeit.co/now) or [https://surge.sh](https://surge.sh) (free).

Good luck!

<comment><USER9> It also helps to use a app like f.lux that dims the screen to emit less blue light. The blue light mess with the sleep cycle.

</comment></comment></comment><comment><USER10> This layout immediately reminded me of a Typeform form, and then got me thinking that if this were a Typeform form it would automatically log your responses and you could have historical data on your tasks, thoughts, and actions.

</comment><comment><USER11> > So how could this be interesting to you?

Dumps all work related ideas out of my head for me to feel like I can leave work at work.

</comment><comment><USER12> Hmm, nothing seems to happen when I press the Start button.

Windows 10, Google Chrome Version 70.0.3538.77 (Official Build) (64-bit)

It works on Firefox Quantum though!

EDIT: It seems on Chrome I need to press on the Start text itself; clicking the button doesn't work.

<comment><AUTHOR> Do the official react-native-web examples work OK on Win10/Chrome70? [http://necolas.github.io/react-native- web/examples/](http://necolas.github.io/react-native-web/examples/)

<comment><USER12> The linked examples work fine here.

<comment><AUTHOR> I fixed some Firefox & Safari issues in the meantime, and added more browser polyfills. If you have the chance let me know if you see any improvement on your side after clearing the cache. Thanks!

<comment><USER12> I'm clicking away and everything works fine now! Best of luck to your project & future projects :)

</comment></comment></comment></comment></comment><comment><USER13> >I extended the original shutdown ritual with the last step because I've often found myself clueless about how to spend my evening after a day fully immersed in work.

This must have been the most depressing thing I've read in a long time.

<comment><AUTHOR> I guess it's sad but true :)

Probably only applies to single people, though.

I have to say I've gotten much better at avoiding overworking myself lately, but evenings are still an issue (again, probably only relevant for single people).

The suggestions I've added help but not entirely, as evenings usually have to be planned in advance (you can't just summon friends at 5:59pm).

Going through these activity suggestions daily helps me in two ways: 1) it reminds me what a true afterhours activity looks like (ie. not more work stuff desguised as leisure) and 2) it reminds me to plan ahead my evenings in the near future.

<comment><USER14> I am very single and this is never true for me. I love my work, and then I go hang out with a friend or two for dinner or dessert, explore neighborhoods, cook myself some interesting food, play some games, work on some serious side projects, talk to my housemate, scribble notes for an essay or blog post, and generally find myself not having enough time to enjoy the things I would like to do despite not investing any time in a romantic relationship. This when I'm not keeping myself busy with traveling out of town.

<comment><USER15> That sounds just exquisite, and I hope to someday have a similar set of habits. It's been a real challenge though so far.

</comment></comment></comment></comment><comment><USER16> Does it play the sound from Hearthstone? That would be fun!

[https://youtu.be/bBCB0y9Mgns](https://youtu.be/bBCB0y9Mgns)

<comment><AUTHOR> The first version did! But I removed it because I didn't want Blizzard to take me down for copyright infringement, haha. And to be honest it was getting annnoying while I was working on the app cause I heard it dozens of times a day.

But Heartstone? Ha! Go back in time another 12 years.

I used to play Warcraft III in highschool and that sound stuck with me for sure.

</comment></comment><comment><USER17> I realize that the web version works fine, but I'd love to have a local version for iOS.

<comment><AUTHOR> Is it not possible to bookmark web pages on the home screen on iOS?

PWAs play nicely like this on Android, which is what I'm using atm. I'm actually planning to switch back to iOS soon but not being able to have web app shortcuts on my home page would be a bummer!

<comment><USER18> > Is it not possible to bookmark web pages on the home screen on iOS?

It is possible. This is actually what they had in mind before the app store... every app was just going to be a shortcut to a webpage.

</comment></comment></comment><comment><USER19> Yay! Thanks for including WorkFlowy in this, very cool.

<comment><AUTHOR> Oh I love Workflowy. I manage my life using it!

</comment></comment><comment><USER20> Awesome! Any plans to monetise?

<comment><AUTHOR> Thanks! I think the scope of this app is too limited to monetise. Happy to see it grow as an open source project for now. But hopefully this sort of exposure (and building experience) will increase my chanses of finding customers when I focus on a paid app/service.

<comment><USER20> I'm working on something in that area too.</comment></comment></comment>


Credit-Card Fraud Keeps Rising, Despite New Security Chips - <AUTHOR> https://www.wsj.com/articles/credit-card-fraud-keeps-rising-despite-new-security-chipsstudy-1485954000 <comment><USER2> Coming to the US I'm shocked at how easy a Debit Card transaction is. In Chipotle (fast food) the card is just swiped. No PIN, no Signature, nothing: give the card to the operative, they swipe it and hand it back, a practice obviously not restricted to Chipotle - but I guess that's similar to contactless paying which I use in the UK - though my friend has deliberately drilled through his card to disconnect the wireless bit.

For buying gas at an automated pump, at some places all I need is my Zip code.

It feels very unreal compared to the Signature to -> Chip & Pin systems I'm used to.

I have "Ask for photo ID" written on my signature strip - though I've never needed it.</comment>


Tinder for Networking - <AUTHOR> http://ladderup.co

<comment><USER2> Site is too slow to load on my phone.

I'm assuming its "professional networking based on proximity" based on the splash image?

<comment><AUTHOR> yeah. i think same model as tinder, ie each person has to opt in.</comment></comment>