SourceForge: Third party offers will be presented with Opt-In projects only - <AUTHOR> https://sourceforge.net/blog/third-party-offers-will-be-presented-with-opt-in-projects-only/ <comment><USER2> "As a company, we at SourceForge pride ourselves on being highly responsive to our community members and, with that in mind, do our best to respond to all communications and address all concerns in a timely manner."

"Comments are closed."

<comment><USER3> ...and the post is unsigned.

</comment></comment><comment><USER4> i use one program with frequent updates which distributes from sourceforge.

the installer is a piece of work.

first, it is a fake-installer (that installs nothing) with the actual installer inside. that program first offers you "standard" and "advanced" fake-install options (remember, it install nothing)... when you click "advanced" it now shows 3 checkboxes, checked, that will 1. install a browser toolbar, 2. set your default homepage, 3. set your default search engine. You uncheck them all and click accept (it is also showing a terms and conditions). now it will show something like "also install this tracking or browser or i don't even know what it was?" and there is only the same buttons as before on the fake-installer: "decline" and "accept". Now you have to remember to go against all your knowledge of install wizards and click the left button "decline" to proceed with your desired program only. now you click accept or finish, don't remember, one last time, and the fake-installer forks to the actual installer that you wanted from the beginning.

<comment><USER5> Opening in 7-zip and extracting the contents manually has worked in the past for me when encountering such things.

(Incidentally, many people don't know that 7-zip can extract installer executables and various other formats too...)

<comment><USER6> So does WinRar and Ubuntu's Archive Manager.

<comment><USER4> i tried with winrar. i don't think it worked.

</comment></comment></comment></comment><comment><USER7> This is nice and all, but...the mere fact that SourceForge, an _Open Source community site_ , ever thought it was even close to OK to intentionally distribute malware to anyone under any circumstances (whether with the permission of the developer, or not). AFAIK, by calling themselves and Open Source community site, SourceForge has opted into an ethical obligation not just to their developers who build the software but the entirety of the Open Source software community to protect their users from malicious code.

This episode was indicative of a severe loss of direction and guiding principles.

<comment><USER8> This is where the distinction between "Open Source" and "Free Software" actually matters.

<comment><USER9> Say more, what do you think the distinction is? I think I know what 'open source' means (any software released under a license that complies with OSI's definition of open source[1]), but I'm not sure what you mean by 'free software' and the distinction.

[1]([http://opensource.org/osd](http://opensource.org/osd))

<comment><USER8> I'll leave it to Stallman: [http://www.gnu.org/philosophy/free- sw.en.html](http://www.gnu.org/philosophy/free-sw.en.html)

But simply - ""Free software" means software that respects users' freedom and community." This carries with it ethical obligations that Open Source software does not.

In the extreme case, you could have Open Source pacemaker software which kills you if you don't keep up your payments, but the same thing would not be Free Software.

</comment></comment></comment></comment><comment><USER10> Some context, for those who haven't been following this story:

[https://news.ycombinator.com/item?id=9612152](https://news.ycombinator.com/item?id=9612152)

</comment><comment><USER11> Sourceforge has killed itself by completely breaking the trust with their developers and their end-users.

<comment><USER12> 100 times this.

Way too little, way too late.

And this is a typical corporate-speak fauxpology "Sorry you were offended"-style. _Maybe_ if they'd confessed to unethically pushing shit-ware via dark patterns, they might regain some trust, but "3rd party offers" and "easy-to-decline" are not the phrases they need to be saying to turn around my opinion/advice of "Download from Sourceforge? No chance, I wonder if there's an alternative way to get that software, or if I have to find an alternative?"

</comment></comment><comment><USER13> Oh right, like a project such as the GIMP ( _GNU_ Image Manipulation Program) would "opt in" with having "third party offers" (e.g. spyware) in their distribution packages. Just pull the plug, SourceForge. You are done.

</comment><comment><USER14> >>> "At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, _or if the project is already bundling third party offers_."

Uhhhh ... I'm undoubtedly being way too cynical, but that sure sounds like a back-handed way of saying they're going to "present" these third-party "offers" _on top of_ any projects that are already bundling such "offers".

Also, "present" ... really? What a horrible word choice, given the UX patterns involved here. Total bullshit.

And furthermore, how exactly will SourceForge gain this explicit approval by the project developer? I'd like to hear more on that note. Do they modify their terms & conditions to make this an auto-opt-in for all new accounts? Are existing accounts grandfathered into this by a default opt-in, on account of having been notified by email of newly updated Terms, the way various companies like to engage in wrong patterns for implied approvals by-means-of- using-our-service that benefit the bottom-line first, and preference typical user sentiment second?

[EDIT: wording correction]

</comment><comment><USER15> In my mind, the damage is already done. And as damage control goes, this leaves something to be desired:

       While we had recently tested presenting easy-to-decline
       third party offers...

That sounds almost like "you should have read the fine print". They could have at least started the announcement with "We're very sorry for the problems caused by our recent..."

</comment><comment><USER16> On top of this /. is burying articles critical of this: [http://danluu.com/slashdot-sourceforge/](http://danluu.com/slashdot- sourceforge/)

<comment><USER17> Slashdot still exists?

</comment></comment><comment><USER18> With the likes of github around and offering much better experience, sourceforge seems outdated anyway. The damage is already done.

</comment><comment><USER19> Oh thank you SF, that's really nice.

</comment><comment><USER20> SF.net died years ago. This remnant that continues is a farce.

</comment><comment><USER21> damage is already done, its a real shame too.

</comment><comment><USER22> The death throes of a company.

</comment><comment><USER14> Why is it so hard for many online companies/services that desire to monetize their product(s) to accept that, given the choice, _nobody_ opts-in to ads, marketing, privacy invasion, and other shit that turns them into a product? I've been reading HN for years, and this news cycle of OMG-Custom-Whizbang- Inc-has-opted-you-in-to-Shady-Feature-Fizzbuzz seems to break on the regular.

Want to monetize your product? Start on Day Fucking One, with User Number One. Make them pay.

Want to start off free, and worry about monetizing your product later? Don't fucking automatically opt your users into being the product you sell to advertisers. Don't snoop on them, or otherwise invade their privacy. Don't be an asshole to them and force something on them they haven't already agreed to. Default to every new & existing user being opted _out_ of any of these things. Make it an organizational principal that explicit opt-in behavior is The Right Way™ -- such as signing up for a paid tier of service, like Github and many other good actors do in this regard.

I seriously cannot think of many things that happen in the lifecycle of an online service in which automatically opting users into some process is the best and most honest experience, and the thing most people want. That people accept this crap is beyond me.

Nobody would allow this to happen in their non-digital lives:

"Hey, John, Jerk Pest Control here. You've been using our quarterly service for a while now. We're rolling out a new service that visits every month, and we're going to keep the price the same as before by selling your information to some other local businesses that want you as their customer. We've opted you into the service automatically. Why? Well, we're looking to break out of our cyclic dependency on quarterly fees to help hit business growth targets. There was a small note informing you of this opt-in that went out with your last bill."

 _grumbling and swearing commences. phone beeps with another call..._

"Hey, Mary. Dick's Accounting Service. You left a message about phone calls received from other companies who say we shared your number. We've been taking care of your taxes for the past few years, and are testing out a new service of presenting easy-to-decline third-party financial services to you, based on how well we think they fit what we know about your annual financial picture. We've carefully chosen our partners, and we only share just enough information to help them verify your viability as a candidate for service. We opted you into this service for your convenience. Why? Well, we're trying to maximize the returns of providing excellent service for your needs beyond just the once-yearly tax visits. We sent you an email about new Terms of Service around tax time, and you agreed to them when you used us to file your taxes this year."

 _grumbling and swearing. inquire about opting out of the service._

"Oh, that's _easy_. To decline the offers, just tell them you're not interested in the service. When they ask if you would like to confirm you are sure you're not interested in being removed from their call list, or would like to decline being removed from their call list, tell them you're not interested and would like to decline. Piece of cake."

Yes, SourceForge are being total assholes with this whole debacle. But let's maybe take a minute to ponder where they even got the ideas from, and why we are only offended when a once-free service that markets itself as having something to do with "open source" or "free software" is the bad actor.

 _Too many online companies and services think this behavior is perfectly acceptable, and build up their services in a tech culture that accepts it_. It's a bit ridiculous to draw lines in the sand and have so much outrage only for the likes of SourceForge. None of this ought to be _that_ surprising.

</tangentially_related_rant></comment>


The German Tank Problem - <AUTHOR> http://en.wikipedia.org/wiki/German_tank_problem

<comment><USER3> I wonder how did the "conventional intelligence" so grossly overstate the production of German tanks. If the conventional analysis were true there would be ~350,000 tanks produced for two years of intensive warfare! Which is really funny considering that Germany invaded the Soviet Union with something like 4000 tanks if I recall correctly. 246 a month is the statistically estimated data, which is both close to the real number (245) and common sense - <USER2> matter how much you militarize a country you still need raw materials and Nazi Germany was no Soviet Union.

the source for this in wikipedia is the Guardian:

[http://www.guardian.co.uk/world/2006/jul/20/secondworldwar.t...](http://www.guardian.co.uk/world/2006/jul/20/secondworldwar.tvandradio)

addition: such a feat of production was possible, but in the Soviet Union and at an extraordinary high cost of human lives and slave labor.

addition2: In fairness the Germans could produce more tanks if they wanted to. But they built some pretty useless ships thought - Graf Zeppelin or Bismarck, for example and oversize guns like the famous Dora. But still.. there is a limit to the number of tanks realistically produced and Allied intelligence must have been aware of the availability of raw materials in the Reich and the construction of Bismark and Tirpitz and all the other huge ships (their construction began before the war).

<comment><USER4> >how did the "conventional intelligence" so grossly overstate the production

Probably 1 word - fear.

Or more explicitly fear of underestimating the figures; that kind of thing can be fatal! The human factor in this example is huge (nearly a factor of 8 I think for some months) but you can see the same happening everywhere. No matter how precise the statistical estimates are a human will always think "yeh but they could......"

:)

</comment></comment><comment><USER5> I assume this is getting mentioned because of this story I submitted to HN: <http://news.ycombinator.com/item?id=670065>

<comment><AUTHOR> Yeah, I hadn't seen this since college until reading your request, thanks. :)

</comment></comment><comment><USER6> Tanks and math! Best way to start my morning. Thanks subby.

</comment><comment><USER7> Heh, I was just thinking about this problem recently; it played a (small) part in my decision to use random-ish strings as primary keys rather than autoincrementing ints. :)

<comment><USER8> hah, you better not be doing this on mysql/innodb

<comment><USER7> I am for the moment; if postgres is really that much better in this regard, please let me know why you think so.

Incidentally, I'm using VARBINARY, not VARCHAR for the keys.

<comment><USER8> Mysql/innodb lays out the data on disk in sort order of the primary key. If you use GUIDs as primary key it will have to re-write the entire disk layout every time you insert. Just use auto inc IDs, they are by far the best option as long as you use a suffix of 10 or so to avoid ID collisions when you ever have several masters to write to ( which you will never have ).

<comment><USER7> There are other reasons I want to use strings-as-keys. Are you familiar with how, say, postgres handles this sort of thing, and is it any better in this regard?

<comment><USER7> It occurs to me that I could still use integer primary keys internally and have indexed strings as external lookup keys. I want the same key to be able to show (a) which user, (b) which database, and (c) which row, so I can verify ownership and route directly to the particular sub-db without having to do several lookups first.

</comment></comment></comment></comment></comment></comment><comment><USER9> Same reason you shouldn't ever expose (or use) auto_increment numbers.

</comment><comment><USER10> <http://search.twitter.com/search?q=i+got+new+iphone> will yield _slightly_ better results.</comment>


Cross-Cluster Traffic Mirroring with Istio - <AUTHOR> https://tech.trivago.com/2020/06/10/cross-cluster-traffic-mirroring-with-istio/ <comment><USER2> OP here, I'm really glad that this got people's attention because some time ago, I had to generate my own mock traffic to simulate the live one, it was bit of a pain. I can confidently say this one really eased the discomfort I had, the reasons are inside!</comment>


HTTP/HTTPS not working inside your VM? Wait for it - <AUTHOR> http://rachelbythebay.com/w/2016/03/22/6nat/ <comment><USER2> > Someone else in the world reported the problem back in September, and aside > from some random person asking a totally useless question, nothing had > happened on the thread.

It's a special kind of horror to find, after hours of high-end-googling, the one thread where someone reports the same problem you are experiencing, and it's just the question, and then one other person asking if the problem has been solved because she/he is having the same problem.

The one thing that is worse is if the OP then makes another post that simply says "Solved it! =D", without giving any explanation on _how_ they solved it.

<comment><USER3> Or when you find a thread where someome is asking the question and the only response is by some wise guy telling him to "search". And of course, searching keeps pointing you back to the same thread.

<comment><USER4> My favorite is "Oh, you can find the answer here: [http://brokenlink.com"](http://brokenlink.com")

<comment><USER5> This can often be solved by prepending

        https://web.archive.org/web/*/

to the now broken URL.

<comment><USER6> Hmm, there must be some extension that detects 404 errors and/or server unresponsive and prompts whether you want to check Google's cache or the Internet archive. That browsers haven't already integrated this (with a configurable list of archiving services, like search engines), is actually rather surprising to me.

<comment><USER7> There are many such extensions, but yes, we're working on getting directly integrated into Firefox, Chrome, Edge, and if anyone has a contact at Safari (or one of the other browsers), my email addr is in my profile. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER8> Well, considering that VMWare fired their entire dev team in January [1], it's not surprising that this isn't fixed... I'd expect more of these kinds of issues to crop up without traction in the future.

1\. [http://www.loopinsight.com/2016/01/28/vmware-abruptly- fires-...](http://www.loopinsight.com/2016/01/28/vmware-abruptly-fires-fusion- dev-team-outsources-to-china/)

</comment><comment><USER9> Funky! This feels like the connect(2) is returning before it has actually done its work, async-style.

Rachel, could you write a small sneaky program (using eg libpcap) to see if the TCP handshake has completed by the time connect(2) returns control to your program, before your first write(2)?

</comment><comment><USER10> An issue a little bit like this that I've seen is overzealous admins who block ICMPv6, creating PMTU black holes. Short web pages load, and long pages hang. Too bad I discovered this during tax season a couple years ago, and the affected site was eftps.gov.

<comment><USER11> It does feel like an MTU issue. I'd grab a tcpdump at all 3 points (server, host, vm) and see what is getting dropped.

From what I know about tc, to only delay ip6 traffic you've got to create a root qdisc that has multiple subclasses (like tc-prio [0]), and attach tc- netem to one while passing the other straight through. Then classify packets between the two, although I'd do that with iptables rather than figuring out any more of the tc workings that necessary.

[0] The default pfifo_fast has multiple subclasses, but from what I remember it had some problem with child qdiscs?

<comment><USER12> PMTUD broken on v6 happened to me too... in 2015.

[http://rachelbythebay.com/w/2015/05/15/pmtud/](http://rachelbythebay.com/w/2015/05/15/pmtud/)

</comment></comment></comment><comment><USER13> After reading this post, my understanding is that it doesn't affect normal machines or vms only the ones which are VMWare based. Am I right?

Also does anyone know what is the reason behind this peculiar behavior? A bug or something more fundamental ?

</comment><comment> mike-cardwell "parts of the web are going IPv6-only", "Certain web servers have been going IPv6-only of late" \- Really? Which parts of the web? Why would anyone configure their servers that way?

<comment><USER14> Some budget hosting providers offer IPv6-only hosting for a lower price, since IPv4 addresses are getting harder to acquire en masse (and thus are more expensive).

<comment><USER15> We've had vhosting for eras and SNI for years. So shared hosting is out.

And I've never seen a VPS provider that doesn't offer v4. Even a $5/mo DigitalOcean box has it.

<comment><USER16> I have a 3€/yr VPS with IPv6 and natted IPv4 for port 80 at [http://lowendspirit.com/](http://lowendspirit.com/).

<comment><USER15> Well, congrats, but you're getting ripped off.

[https://lowendbox.com/](https://lowendbox.com/) has many options cheaper than that which do have real IPv4.

<comment><USER16> 3€ _year_ , not month. I can accept being ripped off at that price. I think I found those guys on that same page you just linked, actually. But anyway, most stuff on [https://lowendbox.com/](https://lowendbox.com/) is quite more expensive than that, and I don't feel like browsing the entire site.

<comment><USER15> Woops. Yeah, I misread that. In that case you're definitely not being ripped off, and given how much IPs usually cost, that is probably something which can really only be a v6 deal. Interesting. First I've seen anything like it. Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> What OP really needs to do is get tcpdump (or similar) output from the vm, and just outside the vm (host or router).

<comment><USER18> Too right. This _reeks_ of something attempting to optimize traffic and screwing up the first few packets.

</comment></comment><comment><USER19> I have the same problem with VirtualBox Linux VM, was wondering what is going on, and this post comes up. I am not sure if it is the same reason. I tried:

tc qdisc add dev eth0 root netem delay 100ms

and:

printf 'HEAD / HTTP/1.0\r\n\r\n' | nc -6 rachelbythebay.com 80

returns nothing whereas

printf 'HEAD / HTTP/1.0\r\n\r\n' | nc -4 rachelbythebay.com 80

returns as expected.

In my case, firefox has no problem if invoked from command line, but "sometimes" it just hang up when invoked from script.

<comment><USER12> Try > 100 msec. Some people have been reporting they need more. It'll be interesting to see what's causing it to vary.

</comment></comment><comment><USER20> It doesn't seem like VMware is the culprit here, mainly because it has nothing to do with anything above layer 3. Here's some points to look into and possible fixes.

      [1] VMware's network driver does not handle TCP, or IP. It's just layer 2; it
          implements one of a couple kinds of network hardware, that's it.
      [2] VMware Guest Tools does install a para-virtualized network card driver
          - vmxnet2/vmxnet3. It communicates with the physical network device by
          communicating with the host OS, rather than emulating a network driver. That
          potentially may do something wonky with something above layer 3, even though
          it really should not be.
      [3] VMware does have a virtual network switch, which forwards frames between
          the physical NIC and virtual NIC based on MAC address.
      [4] VMware may handle moving frames from a virtual NIC to a physical differently
          than moving it to another virtual NIC.
      [5] VMware provides VMDirectPath I/O, which allows the guest to directly address
          the network hardware.
      [6] TSO/LSO/LRO can have a negative impact on performance in Linux (though
          supposedly, LRO only works on vmnet3 drivers, and from VM-to-VM,
          for Linux).
      [7] Emulated network devices may not be able to process traffic fast enough,
          resulting in rx errors on the virtual switch.
      [8] Promiscuous mode will make the guest OS receive network traffic from
          everything going across the virtual switch or on the same network segment
          (when using VLANs).

[1] You can try changing the VMware guest's emulated network card (vlance, e1000) and trying your thing again, but I doubt it will change much.

[2] Try installing or uninstalling VMware Guest Tools and corresponding drivers.

[3] Nothing to do here, really. If you have multiple guests sharing one physical NIC, try changing it to just one?

[4] Try your test again between two VMs on the same host.

[5] Try this, or not?

[6] Try enabling or disabling LRO. Or play with all three settings and see what happens. [https://kb.vmware.com/selfservice/microsites/search.do?langu...](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2055140)

[7] Try increasing buffer sizes. [https://kb.vmware.com/selfservice/microsites/search.do?langu...](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1010071)

[8] Disable promiscuous mode on your NIC.

Other non-VMware things to investigate:

      [1] Your guest OS may have bugs. In its emulated network drivers, in its
          tcp/ip stack, in its applications, etc.
      [2] An intermediary piece of software may be fucking with your network
          connection. IPtables firewall, router/firewall on your host OS, after
          the host OS/before your internet connection, at your destination host, etc.
      [3] Sometimes, intermittent network traffic makes it look like there is a
          specific cause, when really the problem is hiding in the time it takes
          you to test.
      [4] The Linux tcp/ip stack (and network drivers) collect statistics about
          erroneous network traffic.
      [5] Network traffic will show missing packets, duplicate packets, unexpected
          terminations, etc.
      [6] Your host OS or network hardware may be buggin'.

[1] Try a different guest OS.

[2] Make sure you have no firewall rules on the guest, host, internet gateway, etc. Try a different destination host.

[3] Run tests in bulk, collect lots of samples and look for patterns.

[4] Check for dropped packets, errors on the network interface, in tcp/ip stats.

[5] Tcpdump the connection to see what happens when it succeeds or fails.

[6] Try a different host for your VM.

 _edit_ one more idea: Look at the response headers for the request to the site. The content length is 1413 bytes. Add on the TCPv6 and IPv6 header overhead (and http headers, etc) and this is probably over 1500 bytes, the typical MTU maximum. Try requesting a "hello world" text file and try your test again.

</comment><comment><USER21> I would love to know what sort of problem has such an odd solution.

</comment><comment><USER22> 10 years ago, VMWare did not fragment / reassemble packets for me, so I had to set NFS rsize option.

Maybe I was just missing a setting somewhere, but couldn't find it then.

</comment><comment><USER23> I wonder if this is because of happy eyeballs...

</comment><comment><USER24> TCP Chimney

</comment><comment><USER25> wow

</comment><comment><USER26> Is this the millenials' version of the "500 Mile Email"? - [http://www.ibiblio.org/harris/500milemail.html](http://www.ibiblio.org/harris/500milemail.html)

<comment><USER27> I love that story, it is one of those classics, right up there with Mel the old school programmer.

<comment><USER28> Obligatory link to Mel: [https://www.cs.utah.edu/~elb/folklore/mel.html](https://www.cs.utah.edu/~elb/folklore/mel.html)

</comment></comment></comment><comment><USER29> Which is actually about IPv6 networking peculiarities/issue within a VMware, just fyi.

<comment><USER30> Uh... but why?!?

<comment><USER31> Software is unreliable. Bugs happen. Always. There are bugs in avionics, medical devices firmware, nuclear power plants monitoring software, bank transfers backends, all places.

Once upon a time it was common to think that we can design software without bugs, or at least almost. That didn't work at all! What did work is redundant systems, invariant testing and fail-fast with restarts. This is how reliable systems are written these days.

Bugs are common; we have to learn to work around them.

<comment><USER30> > _Bugs are common; we have to learn to work around them._

Or we could, you know, fix them.

I wasn't asking for a justification. I was just asking why this is occurring. If you don't know, that's cool. I mean, one of the reasons I ask is because I'd like to know if VMWare are going to fix this bug.

So thank you for explaining that software has bugs. I'm sure I'll remember that the next time I fix a regression in LibreOffice, as I did with the issue with EMF dashed lines not displaying correctly or when I fixed the issue where JPEG exports didn't export the DPI value correctly...

<comment><USER32> Just for future reference, something like "Do we know exactly what the bug in VMWare is, and whether they're going to fix it?" would be _way_ more effective at getting the answer you're looking for here. "Uh... but why?!?" sounds like cursing at the sky, and gets a response appropriate for that.

<comment><USER30> Fair point.</comment></comment></comment></comment></comment></comment>


Apple's Thirty Percent Cut - <AUTHOR> https://inessential.com/2020/07/22/apples_thirty_percent_cut <comment><USER2> It's daylight robbery, considering you cannot install apps from elsewhere (like you can on Android).

The EU and the US need to fine the hell out of Apple to stop their monopoly.</comment>


How to encrypt your entire life in less than an hour - <AUTHOR> https://medium.freecodecamp.com/tor-signal-and-beyond-a-law-abiding-citizens-guide-to-privacy-1a593f2104c3#.ng2gfv9yj <comment><USER2> The article is very slightly more nuanced but the conceptss the title purports is __DANGEROUSLY INCOMPETENT __for any security expert / discussion / context.

1) idea that security is something you check off and be done with is dangerously wrong. Security must be continuous, must be updated, reviewed, etc.

2) idea that you can "encrypt" [secure] your entire life is ludacris and leads to many dangerous security misconceptions. You don't even have control of your entire life, let alone ability to secure it. Most the data on you is owned by others and not even available to you to secure. __The world is not private or secure __. Everyone needs to know and think about this when they are tweeting, sexting, talking shit about future president and then being surprised when SS comes to investigate.

3) idea that security is either on/off, a binary, that you can be secure or not. Is False and leads to extremely poor security choices, over/under securing. Nothing is secure. __There is not such thing as SECURE __. Things lie on a gradient of security from easy to break to impractically difficult. Things on the impractical to break technically end are still broken due to social engineering, externalities (power consumption of cpu), poor practices surrounding item, etc. Security is making the effort required to get an item greater than the value of getting the item.

<comment><USER3> > your entire life is ludacris

I'm sure you means ludicrous and not [https://en.wikipedia.org/wiki/Ludacris](https://en.wikipedia.org/wiki/Ludacris)

</comment></comment><comment><USER4> [Copied from my comment on a duplicate post -- there seems to be random tracking junk at the end of the URL that prevents these from being detected as duplicates!]

I appreciate how practical these tips are and I hope people will follow them.

I have two quarrels with this:

> Andy Grove was a Hungarian refugee who escaped communism [... and] > encourages us to be paranoid.

I'm pretty sure that Grove was referring to business strategy, not communications security.

> Congratulations — you can now use the internet with peace of mind that it's > virtually impossible for you to be tracked.

Something I've seen over and over again is that Tor users tend to have a poor understanding of what Tor protects and doesn't protect. The original Tor paper said that Tor (or any technology of its kind) can't protect you against someone who can see both sides of the connection -- including just their _timing_. Sometimes, some adversaries can see both sides of a person's connection. As The Grugq and others have documented, Tor users like Eldo Kim and Jeremy Hammond were caught by law enforcement because someone was monitoring the home and university networks from which they connected to Tor and saw that they used Tor at exactly the same time or times as the suspects did. (In Hammond's case, recurrently, confirming law enforcement's hypothesis about his identity; in Kim's case, only once, but apparently he was the only person at the university who used Tor at that specific time.)

As law enforcement has _actually identified Tor users_ in these cases, I think people need to understand that Tor is not magic and it protects certain things and not other things. In fact, I helped to make a chart about this a few years ago:

[https://www.eff.org/pages/tor-and-https](https://www.eff.org/pages/tor-and- https)

This chart was meant to show why using HTTPS is important when you use Tor, but it also points to other possible attacks (including an end-to-end timing correlation attack, represented in the chart by NSA observing the connection at two different places on the network) because many people in the picture know _something_ about what the user is doing.

I've been a fan of Tor for many years, but I think we have to do a lot better at communicating about its limitations.

<comment><USER5> Re: Tor. It's very effective but users must read the documentation not just plug and play.

<comment><USER6> What do you think most users get wrong when they do it "plug and play". What steps does reading the documentation have you do that makes it safer?

<comment> nommm-nommm IIRC the docs say not to change the default window size to prevent tracking based on window size.

<comment><USER7> The tor browser bundle pops up a warning if you try to resize it.

</comment></comment></comment></comment></comment><comment><USER8> Signal is atrocious for security. You literally log in with your phone number. Anything you send is directly and irrevocably tied with your physical identity. What good is to me that the messages are encrypted? When the police come knocking, either I'll decrypt them, they'll beat me until I decrypt them, or I'll die in prison for not decrypting them. I do want my messages encrypted, but more than that I really want them not tied to ME.

<comment><USER9> It's an interesting problem! There's a lot of pieces that are equally strong "personal identifiers" to a phone number, including your carrier tying your IP address to your IMSI. Add to that, if both parties of the communication are under surveillance, there's going to be strong time correlations.

You're describing a very different use case than what I use Signal for (discussing things that could be harmful for clients if it got out, not things where I'd want repudiation).

I think my use case is relatively well solved, but I'd be super curious to see how algorithms could be changed to solve yours.

<comment><USER8> Mine was solved decades ago when I was allowed to just make an account with an e-mail and create any number of pseudonymous accounts. This allows me things like to have a personal and work account, and not leak information between different identities. And, most importantly, it lets me talk to someone without having first to reveal my real-world identity. With Signal, I have to already know that person and trust them with my phone number. It's not really state surveillance, it's the fact that what used to be private information I only shared with close friends now has to be public and told to every random person online I want to chat with. Just.. just let me make an account tied to an e-mail or to my google profile or anything but my phone number. The entire thing creeps me out.

</comment></comment></comment><comment><USER10> I tried using Signal but the problem is no one else wants to. So yeah I'd love e2e encryption but it requires both parties to use it, which is a problem.

<comment><USER11> For iOS, iMessage is usually sufficient for most people, so I can see why they don't bother with other stuff.

</comment></comment><comment><USER12> If you're being specifically targeted by a sufficiently capable adversary, this is, at best, a speed bump.

Categorize your levels of paranoia appropriately.

<comment><USER13> I really wonder if intelligence services are paid to demoralize user groups when I see posts like this.

If you do all these things, your resistance to even NSA-level incriminating evidence goes WAY down, and your vulnerability to local LEO and hackers goes to near-zero.

This is, at best, a brick wall, through which an adversary would have to bulldoze.

<comment><USER12> > I really wonder if intelligence services are paid to demoralize user groups > when I see posts like this.

Bluntly, if you want to tangle with the pros playing like an amateur and not calculating the risks, you're going to be demoralized in your jail cell or worse.

Understand, in _depth_ , opsec before playing with the pros. Understand, understand, understand. Don't just grab random blog posts and mindless implement them. Understand specific details of what you're giving up and the tradeoffs.

Activists have been doing amateur hour opsec for forty years and most of have been cracked like a crab constantly. Pay attention to history, folks!

<comment><USER14> At its core its about economics. The NSA wants to do mass survailance, and if masses of people adopt even small amounts of improved security it has an effect. People dont have to understand Signal, just use it, just as https.

If everybody did all the things in this blogpost, we would be better of.

</comment></comment></comment></comment><comment><USER15> > In a single sitting, you can make great strides toward securing your > privacy.

There's no such thing as privacy when using proprietary software.

If the goal is to secure your privacy, there no need to argue beyond that.

<comment><USER16> That was my thought when he suggested using Signal.

Sure it might be secure now but we have no clue if / when the app is infiltrated or even worse, could be spoofed and have a bad app pushed to our phones.

(Don't hang me. Just off the cuff idea, I have no clue if it is completely possible to do such a thing but it seems within the realm of possibilities)

EDIT: On second thought, don't you have to sign apps with a private key? I assume that raises the bar a bit, as long as the devs can keep those keys private which seems reasonable enough for such an app.

<comment><USER17> Actually, Signal is one of the few apps where you can verify that the binary is produced by the source you have: [https://whispersystems.org/blog/reproducible- android/](https://whispersystems.org/blog/reproducible-android/)

</comment></comment></comment><comment><USER18> Be careful with 2 factot authentication. A Telegram user was hacked by the police in Russia. The government can receive your SMSes. Use non-SMS 2-factor.

<comment><USER19> What else can TFA fall back on. I know steam uses email and iOS tells you're other devices, but is there another option.

<comment><USER20> TOTP[1] is a common one. I use the FreeOTP[2] Android app but there are plenty of other options.

[1]: [https://en.wikipedia.org/wiki/Time-based_One- time_Password_A...](https://en.wikipedia.org/wiki/Time-based_One- time_Password_Algorithm)

[2]: [https://freeotp.github.io/](https://freeotp.github.io/)

</comment></comment></comment><comment><USER21> I would also suggest using an actually encrypted email like:

[https://protonmail.com/](https://protonmail.com/)

</comment><comment><USER22> Question: Given that gmail can be compromised, even 2 factor auth. Why aren't there any extensions that would make it easier to use a public key while keeping the gmail data encrypted? Yes, I understand that gmail is not eager to encrypt the emails but users would be will to do it if there was a simple extension in chrome or firefox. Using an extension would have saved many from email hacks in the past year. Yes, it would still be available on the user's machine but it would certainly add another level of security.

</comment><comment><USER23> Better off reading JJ Luna's How to Be Invisible plus espionage non-fiction about Cold War fieldcraft. Then just stop using electronics when you really want privacy. Also, if you do crypto, make it look like HTTPS or something normal to be lost in the crowds over WiFi proxies. Signal and Tor screams "Look at me!"

Truth is, though, you wont be participating with most people online if you have very strong INFOSEC and OPSEC. The baseline is just way too low with insecurity and surveillance everywhere.

</comment><comment><USER24> How is it possible for DuckDuckGo to offer google search results legally? Aren't Bing and Google constantly sniping at each other for implementing each other's results?

<comment><USER25> It just redirects to a Google page. It doesn't host the results.

<comment><USER26> It redirects to encrypted.google.com. Here's a good overview of what that means:

[http://security.stackexchange.com/questions/32367/what-is- th...](http://security.stackexchange.com/questions/32367/what-is-the- difference-between-https-google-com-and-https-encrypted-google-c)

</comment></comment></comment><comment><USER27> I would also add another tip: create a separate email to use for financial accounts.

Don't use this email for anything else.

<comment> nommm-nommm Can you elaborate on why.

<comment><USER28> So that your shop doesn't mess your bank.

(Shops are regularly hacked with leak of email addresses and possibly compromising passwords.)

<comment><USER29> Another reason to keep them separate is that it reduces cognitive noise when dealing with spam.

I use separate addresses for banks, brokerage, etc. Because the email address associated with each isn't used elsewhere, I can almost always identify the culprit when it starts getting spammed, so I can cease business with and blacklist anyone who does it[1].

Because of that, any phishing attempts that go to the wrong address, even well done, tricky ones, are so obvious a machine can trash them with certainty.

Yet another reason is that if someone is going to try to guess/steal your password, if they don't know the email address used for that account, that's something else that can slow them down/trip them up.

[1] That is how Wells Fargo lost my business, well before they made a surprisingly strong go at proving Lenin right about capitalists.

</comment></comment></comment></comment><comment><USER30> I am not 100% sold on one particular password manager. Any hints/suggestions?

<comment><USER31> I like Keepass becuase it is not tied to any ongoing subscriptions or providers. You can use the file sync tool of your choice to distribute your file. The downside/feature is not having tight browser/app integration.

<comment><USER32> Yeah KeePass is great! I currently use KeePass2 on my Trisquel 7 machine. I use that app in conjunction with Deja Dup to back up my password database to S3. There's even an app on the fdroid store called KeePassDroid but I've yet to make it work. I think the version on the store hasn't been recently updated.

</comment></comment></comment><comment> hash-set The article didn't cover email: Get off of the freebie services like Yahoo! and Gmail and go someplace else because we already know that these companies are in big-time cahoots with the government. Also, Google was working hard to get Clinton crime cabal elected to the point of messing with search results. WE WON'T FORGET.

FastMail is a decent paid service. Or ProtonMail, Hushmail who market on privacy and security.

<comment><USER4> There is a trade-off about Gmail:

They pay a large expert security team to work hard on security all the time (including both mitigating attacks on Google's own infrastructure, and detecting sophisticated phishing attacks against Gmail users).

They pay a large expert legal team to work hard on legal issues all the time.

They're so popular that metadata analysis actually starts to get difficult a lot of the time.

They attract a lot of attention from governments. Governments have put resources into figuring out how to request data from Gmail. Gmail fights many of these requests vigorously, and ends up complying with many of them.

</comment></comment><comment><USER33> Isn't 2FA considered dangerous now? We've seen how susceptible it can be to social engineering.

On a related note, I noticed that my Windows Phone displays text message notifications even when it's locked... So adding a PIN doesn't prevent an attacker from doing 2FA if they have access to my phone.

<comment><USER34> SMS 2FA isn't safe at least, and even NIST is deprecating it. The rest depends on dumb implementations, like Paypal allowing 2FA bypass with a change of the login link, or Google allowing 2FA bypass of all of its other methods by forcing you to use a phone number as "backup", which is to 2FA what secret questions were to passwords (their Achilles's heel).

<comment> et-al Secret questions are horrible when they're predefined, and what's worse is when the options are also predefined (e.g. United Airline's website).

However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world who know and I'm comfortable with that (of course this changes with the over-publicising of our lives on social media).

But I'm digressing and agree TOTOP 2FA is great for the masses. Just be sure to have the backup codes stored in a safe space.

<comment><USER35> >However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world //

Who quite possibly can be established from either your Facebook or your friends' Facebook (eg you have your friends list set private but a friend who posts on your wall doesn't).

Taking the "I had a crush on 'snail-fridge-running-spectrum'" line reduces the number who know the answer to on average less than 1(!).</comment></comment></comment></comment>


Andy Grove on Web 2.0 and the Valley: Slackers - <AUTHOR> http://www.alleyinsider.com/2009/1/andy-grove-on-web-20-and-the-valley-slackers

<comment><USER2> This sentence made me laugh out loud:

 _"These Web 2.0 companies are surfing on the old wave. They're not creating the next one," says analyst Navi Radjou of Forrester Research_

I'm not old enough to know either way, but I wonder if attitudes are always similar to this during a recession.

<comment><USER3> I had some good laughs at the linked article, which had some "insights" on my favorite whipping boy, digg. Quoting Kevin Rose, - '"Things change in the shower in the morning," he says.'

Business week seems generally shoddy to me. This article seems a classic example - throw some random punditry together (aim for big, publicly identifiable names though settle for companies with big PR budgets) that's semi-relevant to current news, add some overdramatic narrative, and don't forget the obligatory call for new tax incentives to further advance innovation. It's a big mishmash of junk.

Watch out for the auto-starting video that further proves my point.

</comment></comment><comment><USER4> 'the U.S. ceded the market for computer batteries to Japan in the 1970s. Now it's way behind in the race to invent improved batteries for electric vehicles'

Correct me if I'm wrong but isn't A123 Systems a leader in this field?

<comment><USER5> Yea they are, don't know what this guy is thinking... maybe he doesn't count companies on the east coast?

</comment></comment><comment><USER6> You kids get off my lawn!

<comment><USER7> Go make better batteries!

</comment></comment><comment><USER8> There has always been a "get rich quick" vein to the Bay Area, ever since the gold rush. I think that's one of the reasons that it's not the most pleasant place to live. When everyone's thinking "ok, get in, make money, get out", no one's thinking much about stuff like schools, parks, infrastructure.

<comment><USER9> Silicon Valley has problems, but schools, parks, and infrastructure are not among them. In these it is among the best in the US.

<comment><USER8> I guess I'm a bit biased - I moved there the first time from Portland, Oregon, which at least in terms of parks and infrastructure, is definitely better. Where are you getting the school information from?

<comment><USER9> <http://www.openspace.org/>

[http://www.cityofpaloalto.org/depts/csd/parks_and_open_space...](http://www.cityofpaloalto.org/depts/csd/parks_and_open_space/default.asp)

<http://www.city.palo-alto.ca.us/depts/utl/default.asp>

[http://www.schooldatadirect.org/app/location/q/stid=5/llid=1...](http://www.schooldatadirect.org/app/location/q/stid=5/llid=118/stllid=319/locid=1006325/stype=/catid=-1/secid=-1/compid=-1/site=pes)

<comment><USER10> I live in SV with two young children. In the right area, the schools are superb. The problem is that you need to be able to afford to live in los gatos, saratoga, cupertino, or palo alto.

Other districts have good elementary schools, but poor middle/high schools. Or they are far enough away from the core areas that you pay a pretty huge price in commute time.

In summary, SV offers great public schools for affluent parents.

<comment><USER9> Exactly. What Davidw really meant was that Portland was cheaper, not that it was better.</comment></comment></comment></comment></comment></comment>


The Impact of MINIX (2014) [video] - vezzy-fnord https://www.youtube.com/watch?v=86_BkFsb4eI

<comment><AUTHOR> Minix have always fascinated me: how it's more modular, smaller, safer and even self-healing. It makes sense to think those are qualities all systems should have, embedded or not.

I wonder if the more popular desktop OSes are ever going to change their monolithic architectures into something similar and adopt these ideas. At this point it seems unlikely because it's all about speed and flashy features, not so much reliability and modularity.

It would be a huge amount of work to change the underlying architecture of some existing million-lines-of-code monster - and that costs a lot of money - but the benefits of having a microkernel could also outweigh that in the future.

<comment><USER2> > I wonder if the more popular desktop OSes are ever going to change their > monolithic architectures into something similar and adopt these ideas.

Windows graphics stack from Win7 (or maybe already Vista?) can recover from driver crashes. I experienced it a couple of times (VERY rarely though), and it worked. The screen blinked, all applications survived and I could just continue doing whatever I was doing. No need to reboot or even log out.

<comment><USER3> Experienced it too, I just realize how 'normal' it felt even though not long ago everything would have gone down. <notgratefulenoughme/></comment></comment></comment>


How Writing To-Do Lists Helps Your Brain - <AUTHOR> https://www.fastcompany.com/3063392/your-most-productive-self/how-writing-to-do-lists-helps-your-brain-even-when-you-dont-comple <comment><USER2> Over the years, I've tried many digital to-do lists, including one I wrote myself. Today, I just use a notebook.

The trick that I made work is to have two to-do lists: daily and quarterly.

For daily, it's simple. I have a variation of the Bullet Journal [1], but interleaved with meeting notes, ideas, etc.

But many ideas are bigger than what you can accomplish/benchmark on a daily basis. For those, I have two pages per quarter that I fill with "quarterly goals". I try to keep the list under 20-30 items and keep them high-level. Every week, I look at the same two pages and make sure that I am making progress toward them. If not, I go back to my daily notes and see if I worked on the right stuff the previous week. This is a variation on the idea that I stole from Aaron Levie [2].

For me, the tactile/tangible nature of paper note-taking, as well as its flexibility in formatting, has been incredibly useful.

[1] [http://bulletjournal.com/](http://bulletjournal.com/)

[2] [https://www.fastcompany.com/3021586/most-productive- people-b...](https://www.fastcompany.com/3021586/most-productive-people-box- aaron-levie)

<comment><USER3> The Bullet Journal looks interesting, but to me it feels much more like it _should_ be a tablet app, than in a physical notebook (mainly due to migration of items, but this is of course achievable with an erasable pen or pencil).

I say this as someone that is trying to use a physical notebook more & better, and looking for good organisational/notekeeping schemes.

<comment><USER4> An app never works for productivity stuff.

<comment><USER3> My issue is latency from _idea in head_ to adequately captured somewhere.

A book is usually open in front of me with a pen at the ready. An application.. well it depends, but best-case scenario is that it's in a easy- to-switch-to window and is natural to just get the idea down without jumping through hoops.

As an aside from a sufferer of ADHD, I think Augmented Reality tech would be a killer platform for an in-place TODO/Note/Reminder/assistant.

<comment><USER5> A small boost to that workflow is the ability to unlock and launch apps in one swipe but that still leaves the power button, optional pin, and never being quite sure what state the app will resume in. Edit: Forgot to include the animations that run slower than my hand can move.

</comment></comment></comment></comment></comment><comment><USER6> No application I've ever tried has worked for me in the sense that I felt it an indispensable part of my life. In almost all instances, after a few days, I always kept forgetting to use the application. Plus, the overhead of using applications seemed to appear significant overtime.

I am now successfully down to a good fountain pen and a clear notebook. It is also part of my strategy to break my device-addiction, which is bordering on insanity. Where I used to take in my laptop to meetings and use mind maps and others for taking down notes and ideas discussed, I only simply carry my notebook -- my pen is usually in my shirt's front pocket.

I have rediscovered the love for handwriting, which I had all through my childhood and teenage years. I had a beautiful cursive handwriting and could write fast, which I gave up when I joined university in favour of a more mechanical style, and soon thereafter, gave up on writing completely. I have started writing in cursive again, and it makes for my ability to take down notes very fast in a handwriting that looks good.

The only real grievance I have is when I want my notes to be available to others. In those cases, I do wonder if it wouldn't have been better to have typed them down in the first place (I'm a fast typist). But, it is a small price I'm happily willing to pay.

<comment><USER7> > In almost all instances, after a few days, I always kept forgetting to use > the application.

That's why the success is in building habits. It doesn't matter what medium/tool, but the initial habit building process must take place.

<comment><USER8> Wouldn't it be possible that the tool might also influence the difficulty in building said habit? If different tools require you to exert varying levels of mental effort only to remember to use them, then then medium/tool might matter.

</comment></comment></comment><comment><USER9> Over the years, I've switched between several daily TODO lists. I used a plain sticky note in the beginning where I outlined all the tasks I had to do. After that I used Steven Covey's time management matrix, but I found that I'm not using all of its quadrants and some _important and urgent_ tasks were never done on time. Currently I have a TODO list with two columns -- Making, for the long-term things I have to provide substantial amount of undivided attention to; and POSS (projects, organization, skills, social) -- for tasks which require frequent context-switching. It was greatly inspired by Paul Graham's "Maker's Schedule, Manager's Schedule" article [1].

For long-term plans, I keep a simple text file categorized by projects where I plan ahead for about one or two weeks and put deadlines for my plans. I derive these plans from my long-term goals, for which I store the big picture in various mediums (Trello, E-mails, text files, written conversations, paper, etc.)

[1] [http://www.paulgraham.com/makersschedule.html](http://www.paulgraham.com/makersschedule.html)

</comment><comment><USER10> I've found out recently that rather than being something you make or plan, TODO list is the end result of doing something else. Specifically, it's the result of taking notes about your life and your works, TODO list is just what left after you filter out all the actionable items.

For example, when I'm doing development work, I'm trying to keep a journal of what I'm doing, why I'm doing something, which step of the task I'm on, what the boss wanted to get done. With those info, when I get back to work tomorrow, it's simple to get back the "TODO item" in the task.

The difference being that a list of TODO things on its own is pretty hard to follow through and act: it's missing context (or the action is too vague), we tend to have certain routine anyway and an ordered list of everything isn't helpful since there is a limited number of tasks we can do at a certain context. There are some productivity that tries to fix the missing context problem by assigning context with a task, but they just amplify another issue when making todo list: it's not that simple to write an actionable item. At least 90% of the time I've tried, my item always ends up being broken down to several more items when I started working on them, or I'm missing the mark on planning the item. And they're always because I'm not in the mindset of a task when I'm making its TODO items -- I plan things at the start or end of week/ day, rather than when I'm actually doing the task.

I think TODO list is just a special kind of notes, and I think a lot of people would benefit from taking more notes about their lives, both for the past (journal) and future (planning). Although "past" and "future" is a bit of an unnecessary distinction here.

Don't make to-do list, just take more notes, write things down. You will notice all the bullet point in the article would apply if you change "writing to-do lists" into "taking notes".

Just a tangent, but that's also why I think org-mode is the only note- taking/to-do app that did it right: TODO item is both part of the normal notes, and well supported with multitude of features around it (all the agenda functionalities).

<comment><USER11> "I think TODO list is just a special kind of notes, and I think a lot of people would benefit from taking more notes about their lives, both for the past (journal) and future (planning)."

I think this is a really good point, in fact if I look at my TODO lists many if not most of the items get added after I complete them.

</comment></comment><comment><USER12> And you should purge it occasionally.

With Trello, I use the "card aging" feature to see which things haven't been updated or moved recently. Each week, I spend five minutes skimming through the cards, making sure there are due dates if applicable.

At the end of each month, I spend closer to 20 minutes and look at each card and ask "is this still relevant?" and give it a simple yes/no. If it's "no" I delete it immediately.

Those never-ending tasks and wish lists simply go away. It's not like I was going to do them anyway _and_ it's less junk on the list.

I do the same for meetings. _None_ of my recurring meetings/tasks extend past December 31st. After the January 1st, I double check to see which ones I really need and are still relevant and recreate those. The others are already done.

<comment><USER13> I wonder if some manual bookkeeping is necessary to develop a habit and give room for introspection/reflection?

Currently, I use Wunderlist and I have weekly lists. At the end of the week there is the manual process: create list for the next week and move everything left from this week over. Then I quickly look through the done items of the week.

I also have lists for long term and recurring items, but the process does not really work well. I forget them, they get outdated, etc.

</comment></comment><comment><USER14> This first few sentences of this article describe almost exactly how I've been feeling lately:

      For a long time, I resisted to-do lists. I wanted the flexibility. I felt that if I kept a list, it would tie me down to a particular set of tasks. Gradually, though, I came around. The busier my work life became, the more crucial it was to have some sort of running agenda on hand.

It was embarrassing after a few times when I kept forgetting important tasks, and that pushed me towards using a todo list manager at work.

Being a developer who works almost exclusively in a terminal, I settled for using TaskWarrior (TW). I can't recommend it enough for people who spend most of their time in a CLI. I tried a bunch of different options before I found TW, and my biggest problem with anything else was the added friction and mental context switch involved in switching to another app to add a task.

Now I'm looking for something more, a task manager that works everywhere. Especially for longer projects and goals, something I can use for my personal life. While TW is great for the CLI, it lacks apps for the desktop and mobile (OS X and iOS). I've settled to using Wunderlist for now, which is the best option I could find for myself, but I'd love something that works as well as TW for the desktop and mobile, which for me is just entering tasks as a single line of text and having meta data like due date, project, categorization, etc picked out automatically (which Wunderlist does for dates but not categorization).

And one very important thing I've felt a couple of days ago when I moved to Wunderlist for my personal stuff is that at least for me it makes me feel more relaxed as well. I had a bad day a while back where I was in a panic because I had a _lot_ of things to do personally and I didn't seem to be getting anywhere with any of those tasks. I sat down for about 30 minutes and just created tasks for everything. Since then I feel a lot easier. While I may not have made any progress on the tasks, just knowing they are written down somehow makes me feel better.

<comment><USER15> When I last used Wunderlist, I really disliked how inflexible it was, and how bad it was at handling recurring tasks.

I discovered Todoist shortly after, and stuck with it.

I think for me, personally, to get anything even more productive, I'd have to write it myself.

<comment><USER14> Writing something myself is an idea I have brewing in the back of my mind. But it's not something I have any clear ideas about. I have no idea how it should work, only a vague idea that it should be as seamless to my daily routine as TaskWarrior is right now.

But I'm trying to collect notes on how I use Wunderlist and TaskWarrior. Maybe in a few months I'll have a better idea of my usage patterns and then I can come up with something that I'd love to use everywhere.

Do you have any ideas on what you'd like to write yourself? I could get ideas off of you. :)

<comment><USER15> Unlimited priority levels (as opposed to just 4), more cohesive project parenting (I can parent projects, but Todoist sometimes won't list items from child projects if I ask for the parent in some areas but not others), and probably exchange Todoist's query language for straight up SQL ala JPQL-esque usage.

Other than that, Todoist gets very little wrong (and they're constantly polishing the more mundate UX parts, which is also an important part of any frequently used app).

Their team has been often very responsive to my requests, and have also been working on integrations into other services (which is often a sore spot for 'cloud' services).

</comment></comment></comment></comment><comment><USER16> Interesting that no one has mentioned Google Keep - it works for me, mostly because it's available for both Android and IOS and as a web service. I have to admit syncing is not always perfect, though. Just curious, any particular reason why others don't mention it?

<comment><USER17> I use Keep, and it's become a pretty central part of my life over the last year or so. I never stuck with any other to-do apps- either they were way too extensive (Evernote) or not flexible enough (Wanderlist, Google tasks, Any.do, etc). I like Keep because it lets me store random notes that I need access to during the year (books I want to read, workout lists), to do lists that are transient (a shopping list, recipes), and to do lists that need to stick around for a while (Personal Goals for September). Something about having all that just displayed on one scrollable screen works really well with my mindset where other apps feel tedious and unhelpful.

</comment></comment><comment><USER18> Every day before leaving work I make a todo list of what I am going to work on the next day, crossing the list as I get them done in the next day.

10 mins before leaving work I do the same.

Works really well, gives a good sense of progress, offloads thinking about work when I am home and etc.

</comment><comment><USER19> I noticed a certain point, experimenting with todo lists and productivity apps, became a thing of its own. Tweaking Omnifocus to perfection, for example.

I threw them all out and am using a reporters notebook (which is a good format, btw), with daily todos and this is the system that sticks.

I guess this is what it really boils down to: which system is naturally easy to stick to in the long run?

I guess it's the same for sports, diets, etc

</comment><comment><USER20> When I was in my 20s I could hold my daily ToDo lists entirely in my memory. This was useful for tracking coding features and bugs. Somewhat older now, I do this with a legal pad.

</comment><comment><USER21> I spent a lot of time context switching (lots of roles, go-to guy for fixing things) so lists are a key tool in keeping me sane.

I've tried many things over the years but settled on Quip. The availability of the app on many platforms (mobile, desktop) means I can pretty much take notes anywhere (except the shower; I have pen and paper for that and transfer it to Quip later).

The shared notebook functionality allows me to easily organize my thoughts and share with others as necessary. This works for both short lists and longer documents. For example, I've built a fairly extensive document on HTTPS configs and best practices over time just by filling things in as I go along.

No relationship to Quip. Just a very happy user.

<comment><USER22> My company uses Quip and I'm very happy with it as well. Thinking of moving some of my personal notes and lists from Keep over to Quip. Although I'd give Keep the leg up for simple, quick notes on mobile (and their predictive entry for grocery lists is fantastic)

</comment></comment><comment><USER23> I'd say this article accurately describes my organizing. I'll start a todo list in Evernote when I get too many tasks. I'll knock of the highest priorities and the rest get forgotten because they weren't "really" important. After a week or two I create another todo list when new "high priority" items come up.

If no one is asking for something to be done, it wasn't really that important in the first place. I have hundreds of todo lists that are unfinished and I'll never do them. But, if someone does ask me for that a year later it just goes on the new todo list.

</comment><comment><USER24> I combine this method with a LiveScribe Echo smartpen (Sky edition). This allows me to backup my notes via wireless but also keeps the human pen + paper touch to the notes.

I feel as though I remember things a lot better when I write them down versus typing.

I originally picked up one of these pens for college and it helped a ton with staying on track in class and always having a backup of the lecture that sync'd in an animation to my notes (so i could either play the notes back, or tap at a location and begin playing back from that point).

They have various versions but I would only recommend the Echo or the Sky - the version 3 in my experience only connected to the mobile apps, so on windows/mac you were not able to view your notes (very annoying). However the Sky (Echo with wifi sync) and Echo allowed me to sync the notes to a desktop app which allowed me to export pdf's. I hope they open up PC support for the 3 but after two or so years it looks as though they will never add that as a usable platform.

</comment><comment><USER25> Interesting thread.

Wondering if anyone here has tried using shorthand, a.k.a. stenography, for to-do lists?

[https://en.m.wikipedia.org/wiki/Shorthand](https://en.m.wikipedia.org/wiki/Shorthand)

I remember people using it much earlier, and it was offered in a neighborhood typing class I took as a kid. Plus, had seen books about it then.

<comment><USER26> You may be interested in Quikscript, a writing system inspired by shorthand and intended to replace the messy English writing system.

<comment><USER25> Cool! Will check it out, thanks.

</comment></comment></comment><comment><USER27> I feel like I've used it all - apps, plaintext, files+dirs, taskwarrior, ad hoc paper, bullet journal, org mode. I've used org mode many times over several years, but it only clicked for me as a system when I recently started using its capture templates and agenda views. If org-mode could be described as a system built on Emacs, it feels to me like task management with custom capture templates and custom agenda views is sort of a system built on org- mode. That probably makes it sound unnecessarily complicated, but it's actually extremely simple, fast, and reliable. I'm still using Apple's Reminders to remind me at 0900, 1245, and 1600 to actually check in with my system, but the system itself is working beautifully.

</comment><comment><USER28> My paper to-do list is only immediate things (e.g. pick up 'script, dog to vet). Everything else is on the calendar (with reminders) and gets moved to the list when it's time.

<comment><USER29> Anything non-trivial, I put on my calendar. In addition to telling me 'what' I should be doing, it also tells me 'when' I should be doing it. I've found knowing 'when' \- no matter how arbitrarily declared - is huge for preventing things from continuing to haunt me.

</comment></comment><comment><USER30>
        > To-do lists get a lot of flack,
        > but the simple act of planning
        > has some psychological and
        > productivity benefits all
        > by itself.

My problem is that TODO lists are not necessarily a solid basis for planning. Specifically, they are often only good for easy plans.

<comment><USER31> If I don't write tasks in a TODO list I get anxious I'll forget about it forever. Even if I don't plan on doing a task anytime soon I like to jot it down so I have the freedom to forget about it.

<comment><USER32> Exactly this. It has been written to disk, and now your mind is free to compute away and use as much memory as possible for new things.

</comment></comment></comment><comment><USER7> Until making To-Do lists (not to mention evaluating different software, mobile apps, techniques) is just another way to procrastinate.

The best To-Do list is the one that gets you do the thing, even if this means not ever writing/using one.

</comment><comment><USER33> I wrote a to do list manager [https://github.com/thewhitetulip/Tasks](https://github.com/thewhitetulip/Tasks)

</comment><comment><USER34> I always create a list of things I did and that somehow helps me reflect on things I may have missed or could have done better. Not exactly a todo list but it works for me.</comment>


Advice for resume/position with big VC - <AUTHOR>

Hi, Hacker News virgin here. Long story short, I have a once in a lifetime opportunity to interview at one of the big VC firms, which I find surprisingly intriguing. Problem is, I've been working on startups for the past 2-3 years and I'm not sure how to write about these experiences without looking like a total amateur/buffoon.
Here are some accomplishments I'd like to highlight, but I'm not sure how to phrase them -- or even if to include them at all...
-- the fact that I am bootstrapped (perhaps this is a bad thing?) -- I currently monetize the site through affiliate programs -- I've had over 100,000 pageviews (which sounds GREAT to me, but to a VC will sound really weak) -- my site pertains to motherhood (will this hurt my chanced because they will think I am too family oriented?)
Anyone have advice for: what to to highlight, what to omit, what do they really care about, etc?
TIA <comment><USER2> 1) Is this a job interview or a pitch opportunity? Unclear from OP. Obviously this effects things a lot.

2) In general VCs will not be impressed by numbers that are good for a bootstrapper. They're used to people spending a million dollars to get a million dollars worth of sales.

VCs over-emphasize dealmaking as a business skill, since it's what they do all day. So use statements hings like "I was responsible for negotiating affiliate deal X with partner Y".

VCs value raw growth, even on a low base. So say things like "I've been driving traffic numbers up 50%/month for the last several months".

<comment><AUTHOR> Thank you both. This question pertains to both my resume and the (hopefully) the subsequent interview. This is for an actual job with the VC, not a pitch for VC money.

Re: resume, I'm searching for how to phrase/summarize my experience and accomplishments without it looking like a bunch of fluff and/or irrelevant data.

</comment></comment><comment><USER3> I'm confused - are you writing a cover letter or actually doing an interview? Might help us give better answers.

A couple thoughts off the top of my head: in general, I think your experiences as an entrepreneur will be really valuable to working at a VC firm. You might want to emphasize your ability to evaluate and advise the founders early stage companies (because you've been there). Also, there's nothing wrong with a mother-oriented site - women spend lots of time and money on the internet and that domain knowledge will help you and the firm pick good companies and make money.

Good luck!

</comment><comment><USER4> @jboutelle makes some good points, especially wrt deal making. I'd definitely focus on that side of your past experience. Do you have any experience outside of bootstrapping?

<comment><AUTHOR> Yes, I have 7 years of experience in real estate development and finance. I have no problem characterizing these accomplishments as they are so straightforward.

Now, all of the sudden, I don't know what to say about the last 3 years of startup work, esp since these sites were in the ramen/lobster profitable realm, not the multi-million dollar I'm-on-a-boat realm....

<comment><USER5> I've never heard the term "lobster profitable." What does it mean?

<comment><USER6> If they become any less profitable, their investors have the right to boil them alive and eat them with lemon and drawn butter.</comment></comment></comment></comment>


Paul Romer: What Went Wrong - <AUTHOR> https://paulromer.net/what-went-wrong/ <comment><USER2> The premise is interesting:

> It is time for economists to "eat their own dog food." Cost-benefit analysis > is the only way to answer the question, "has the economics profession done > more harm than good?"</comment>