Front End Development Topics to Learn in 2019 - <AUTHOR> https://zendev.com/2019/01/15/frontend-development-topics-to-learn-in-2019.html <comment><USER2> This is a solid list, but front end dev has gotten a bit absurd.

I feel like I need to install 86,000 dependencies via NPM to do something that server-side frameworks already figured out. I was following a simple Vue/Vuex tutorial the other day and my node_modules directory was 200MB+.

Use yarn or npm to install XYZ.... What's the difference? Why do I have to google this as step 0?

Why do you assume I know the intricacies of Webpack? Is this tutorial for Webpack 4 or Webpack 3?

I'm exaggerating a bit but honestly, I get the same feeling of rage that I used to get trying to understand the box model during the IE 6 era.

<comment><USER3> This (or something like it) is always the top thread. I wish this was something the frontend community cheered about, not lamented. Those 200MB of node modules are developers ad-hoc cobbling together an alternative to xcode and android studio, except entirely modular and where we have complete control. Serious application development for the open web is hamstrung by limitations and definitely in an awkward growth phase, but it's marching towards a possible future of competing with native mobile apps and the two companies to which they're entirely beholden. To me, 200MB of tooling is not a sign of cruft, but of steady and imperfect progress.

Edit: and for the record, xcode is a 13.8GB install

<comment><USER4> Yep. To repeat Dan Abramov's standard reply:

> The set of dependencies that Create-React-App uses includes:

> A compiler. a bundler/linker, an optimizing minifier, a linter, a > development server with live reloading, and a test runner

All of those are isolated and scoped to that one project, and they are all build-time dependencies only. It's also important to understand that Javascript packages are effectively distributed as source, which affects the number of files on disk. (Granted, many NPM packages do include unnecessary files in the published artifacts, but Javascript itself is a major factor there.)

As you said, a full-blown IDE like XCode or Visual Studio is easily multiple gigs, and if you were to look at the actual file size on disk of any C++ compiler toolchain, that would be a minimum of dozens of MB - those are just usually preinstalled on Linux or Mac systems.

So, context is pretty important here. A couple hundred MB for a complete JS build toolchain is understandable. I don't think it's necessarily _good_, and I think it can be improved a lot (especially with upcoming tooling like NPM Tink and Yarn PnP), but it's not the catastrophe many make it out to be.

<comment><USER5> Here's an interesting observation from recent HN reactions to JS:

\+ The hardcore server folks are hating JS these days, because it requires more than dropping a single script tag.

\+ The full-stack people / JS beginners are hating JS _with a passion_ , because they think it's unneeded complexity for their deadline.

\+ Advanced JS veterans totally like how the JS ecosystem is rapidly maturing & solving its problems in interesting ways.

And there's people like you (the latter), constantly explaining the former groups that JS isn't so bad.

I'll see if I can write a blog (or a book if it has to be) on each part of JS ecosystem that has changed with detailed explanations on why it is better.

I already wrote a piece along those lines - [https://writer.zoho.com/writer/open/0y4wx08838bdbcf954b1398c...](https://writer.zoho.com/writer/open/0y4wx08838bdbcf954b1398c28f7020a3a523) but I guess I (or someone else) can do better.

<comment><USER6> I think this is all true, but one important factor is that there's currently an assumption that any serious project must necessarily use all this complexity, which makes your second point true - but not in a way that's the fault of javascript, but more the community around it.

If you're making a simple site, or even a fairly simple application, the typical modern Javascript toolchain is _absolutely_ unneeded complexity. It's not even React - many developers will turn their nose up on anything that isn't using Redux / Typescript / GraphQL / whatever flavour of the week is popular, even on sites where Javascript itself is probably not that big a requirement. As an example, we're all talking on a site that has almost no Javascript and works perfectly well - but I have no doubt that if you hired a developer to build a site like this in 2018 it would absolutely use a typical complex setup.

That isn't Javascript's fault, really - no library demands that you use it for everything, and many like Redux make it a point to push users away from using them inappropriately. But the Javascript community is currently in a phase that's probably unhealthily pushed towards the new, shiny, more complex library, regardless of how well it suits the problem.

<comment><USER7> I have to agree with you. The shiny stuff syndrome is spreading like cancer in the front-end world.

The only way to set this right is: when you create something, don't sell it as a one size fit for all solution. State the tradeoffs as loud and clear as possible. Guide the users on what point you necessarily need the library and point them to simpler alternatives when needed.

This is something I deeply respect about Dan Abramov. He did this with Redux. Now that he's in React, I see a lot of this culture in React docs as well these days.

Bottomline: The responsibility is on the creators to stop spreading this shiny stuff syndrome.

<comment><USER4> I will say that as a current Redux maintainer, I _hate_ that I seem to have to spend more time cautioning people about when it's appropriate to use Redux, than I do actually promoting its use. :( I can't think of any other lib off the top of my head where the maintainers have had to do that.

That said, yeah, we've got a Redux FAQ entry that discusses when you should use Redux [0], and some other "caveat"-type sections scattered throughout the docs.

We're currently planning a revamp of the Redux docs structure and content [1], and we'll see if we can improve some of the messaging as part of that. Would appreciate any suggestions you can offer.

[0] [https://redux.js.org/faq/general#when-should-i-use- redux](https://redux.js.org/faq/general#when-should-i-use-redux)

[1] [https://github.com/reduxjs/redux/issues/3313#issuecomment-45...](https://github.com/reduxjs/redux/issues/3313#issuecomment-450601554)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > CSS grid

> If you're still using heavy-weight grid frameworks from UI toolkits like > Bootstrap or Foundation, you are falling behind.

This is a pretty sensationalist way to word this and honestly an absurd statement as a whole. If you have a public-facing site, ignoring everything that isn't up-to-date is a luxury you can't afford and blunt statements like these show ignorance in that regard.

<comment><USER9> CSS grid is supported in all modern browsers. Depending on your audience, there is a very good chance you can use it in favor of older and much less powerful and pleasant grid layout tools.

<comment><USER10> According to CanIUse, it's supported in browsers used by 88% of users in the United States. Which means sites will fail to render properly in 12% of browsers.

Developing for a b2b or enterprise product? That percentage is going to be lower. Developing for users outside advanced industrial countries? Lower.

And it's not like you can polyfill it or use a fallback -- CSS grid is a completely new way of building layouts that isn't amendable to automatic fallbacks, so you literally have to build _an entirely different parallel way to do the same thing_ if you want those 12% to have the same experience. At that point... why bother using CSS grid at all?

The simple and sad fact is that until IE 10/11 fall totally out of use, grid is simply not worth learning for many projects.

<comment><USER9> CSS grid works in IE11 with a few restrictions. Requiring IE11+ support is quite common for websites targeting the US market at least. Unless your audience is pretty unusual it's easy to make a case for excluding older browsers than this.

<comment><USER11> You can use what is, essentially, a totally different grid layout engine which works in IE11 only, but fortunately doesn't interfere too much with the more recent grid spec since everything is vendor-prefixed.

It is _not_ just "a few restrictions"; you can't even get close to a grid- based layout that works in IE10/11 by accident.

It's doable, but practically, it might be a fairly reasonable decision to give up on giving IE the nice layout and falling back to a flat "mobile" layout, if you're doing progressive enhancement properly.

<comment><USER10> On my own personal projects where I have the authority to make broad declarations like "IE11 is marginal enough to be served the mobile version", that works. But try explaining that to a corporate executive. The cost-benefit analysis is not really in favor of jumping to grid for most mass-market products.

</comment></comment></comment></comment></comment></comment><comment><USER12> It's pretty difficult to keep up with all the new frameworks these days. That's why I created a faster way of learning. I noticed that everytime I wanted to learn a new framework or new library, I was always creating examples and modifying them to learn how they worked. So, I created a Tutorial/Example code website that combines tutorials with real working examples: [https://codeorc.com](https://codeorc.com)

By not having to set up every single example anew, I hope this saves people some time in allowing them to learn things quicker.

<comment><USER13> I've taught people coding a few times and I always start with a game, but it's hard keeping it simple enough for them to understand. This tutorial looks like a great place to start. Thanks!

</comment></comment><comment><USER14> Has anyone realized the wheels on the treadmill are spinning _toward_ the carrot? Shouldn't be tough to keep up.

<comment><USER15> ah.. perhaps the aim is for the developer to escape the carrot.

<comment><USER16> edit: you have much to learn young grasshopper

</comment></comment></comment><comment><USER17> Many comments here are concerned with the ever changing trends, downloads, and such. Frontend technologies really don't change that fast.

If being a stronger frontend developer is a priority focus on the basics. I have received some favorable feedback about this list that requires no additional downloads [https://github.com/prettydiff/wisdom/blob/master/Web_Educati...](https://github.com/prettydiff/wisdom/blob/master/Web_Education.md)

</comment><comment><USER18> Related to this topic:

What are the minimum technologies needed to get a solid front-end stack, with a nice balance between modern features without framework/library/build tool/transpiling hell?

For example, I don't want to learn TypeScript when vanilla JavaScript will suffice. I'm wary of picking up the "hot" new frameworks because they haven't stood the test of time and may get deprecated/irrelevant.

Basically, I want to have a flexible and minimalist stack, but also with a good balance of features (i.e. not just a static HTML site).

Any ideas?

<comment><USER19> I'd strongly urge you to reconsider using TypeScript. At this point there isn't much difference between TypeScript and ES6 (besides the types) and types are a gigantic maintainability booster and significantly reduces bugs. The TypeScript language server also provides high quality autocomplete and jump- to-definition functionality in your editor of choice. It's very helpful to be able to enumerate through object methods and properties for 3rd party libraries as well as your own application code.

<comment><USER18> Thanks, I'll look into TypeScript more.

</comment></comment></comment><comment><USER20> I've been away from front end for about half a year while doing Node work on the backend. It's intimidating. There are too many choices, which correspond to too many libraries to learn, which are often half baked since the ecosystem is so fragmented. Everything is a special snowflake with its own idiosyncrasies and way of doing things.

<comment><USER21> Most of those idiosyncrasies and libraries are really simple and not that deep. Read the source code of your dependencies and it will make a lot more sense.

</comment></comment><comment><USER22> Five things I will learn just in time for them to become obsolete.

</comment><comment><USER23> This is a good list. Also web development has went down some insane rathole that it needs to eventually get out of.

Let's look at it.

Typescript: Javascript, only with strong typing from OO you love

React: Use Javascript as if it were OO with IOC

Vue: Finally the web component architecture that the web itself is coming up with in another few years, only here today

CSS Grid: Miss tables yet?

GraphQL: Install your own generic data layer, because you need a generic data layer, right?

Don't get me wrong. These are all great techs. I use them daily and plan on learning more about them over the coming year. But I can't get past the feeling that web development is simply suffering from too many dang developers. Come back in 10-20 years and we'll end up having another C++ that's more of a CF than C++ is. I sure hope it doesn't turn out like that. Right now we've got a thousand ever-changing solutions looking for a problem.

<comment><USER24> >CSS Grid: Miss tables yet?

It literally makes me feel like I'm cheating or something. What used to be an hour of fiddling around with floats and percentages is now two seconds of declaring a grid layout. Thank god for the evergreen browser revolution.

<comment><USER23> Happy path on all of this tech rocks. It's quite impressive.

<comment><USER25> Besides Internet Explorer, what failure mode does CSS grid have?

</comment></comment></comment></comment><comment><USER26> I'm fairly new to web dev and using Vue.

Web dev is a complete mess, it's true.

I also think the direction of travel is good from what I've seen, we're making progress in improving it. For example, introducing types, getting away from hacks like bootstrap etc.

What I do find infuriating is that it seems most of the problems are not new and already well solved. Ultimately it looks like web dev is going to be quite similar to Android/iOS/Java Applet dev, which themselves are not particularly innovative (XML layout, MVC-variant style). Package management has been done a gazillion times but we have yet another tool, etc.

Anyone understand exactly how we got here?

I'd also be interested if more experienced people have a good idea what the endgame is, where this is all headed.

<comment><USER27> > hacks like bootstrap

Do you mean Twitter Bootstrap, the CSS framework? I've never considered it a 'hack'?

<comment><USER26> Well, I think it's a hack in that it's kinda providing functionality you need that isn't baked in, by making some opinionated decisions and then encoding them in fragments of class names (as one example). That feels like a (good) hack to me.

</comment></comment></comment><comment><USER28> Are people still using the responsive design? I feel like people stopped addressing that issue with new technologies?

<comment><USER29> Of course they are. It's just not a buzzword anymore but considered normal.

</comment></comment><comment><USER30> The top one should always be on top is "keep up with standard JS", it's rapidly approaching what could be considered a sane standard library.

Once the specification for web components is finished, standard JavaScript plus Babel (and polyfills) would be all that's needed to build 95% of web apps.

</comment><comment><USER31> 2019 may or may not be the year, but I'm sure it's coming - this inexplicably expansive land grab of web application functionality by client-side technologies is going to peak, and things will start to swing back towards the server side.

<comment><USER32> Very unlikely. You'll see more of a merger where client-side solutions are leveraged in very specific ways to address web requirements -- similar to next.js and gatsby.js.

<comment><USER33> This seems plausible. There's usually a proliferation then a consolidation phase with any period of innovation, where people invent all sorts of ways of doing things and then gradually figure out what works best together.

Why the client-side has seen such an era of fecundity in recent years is beyond me. Perhaps because there was a real problem with leaving the job to jquery. Regardless, eventually there's just going to be too many available solutions but not enough solidified and proven methods where everything you need has been packaged together neatly because trial and error and years of iteration have pulled the optimal toolchains together and left the others by the wayside.

The way everything client oriented is just sort of floating around with no real scheme to it creates a lot of possibilities but at the same time much confusion and exhaustion. Eventually, (hopefully) there will come the standards.

</comment></comment></comment><comment><USER34> Instead of techs to learn, how about resolute to build small front end apps, and along the way, learn to use whatever techs to make them happened.

BTW, GraphQL is more of a backend thing. The frontend part is simple.

</comment><comment><USER35> Uhm I... I just think it's a bit like quicksand. In a few years, things will have shifted somewhere else. A percentage of our time should be on staying current, anyone have a good strategy?

<comment><USER36> > anyone have a good strategy?

I left the industry for data science. Went back to school and fall in love with statistic. Going to try to get a biostat job. I'm trying to do side projects web app and not give a damn about the flavor flav of the month.

I don't know if that's a good strategy.. it's basically peacing out. I also move most of my tech stack to plain old stuff like a simple mvc framework and no frontend rendering.

<comment><USER35> This peacing out is sort of exactly what I've been considering. Focusing more on algorithms or big picture things. Thanks for your perspective.

</comment></comment></comment><comment><USER37> My top one is ReasonML.

<comment><USER9> I would love to see ReasonML take off too but I think it's unlikely. Typescript is pretty good and an easier conceptual leap for most developers. I think it takes a company the size of Apple forcing a language on its developers to bring an ML into the mainstream. And although I consider Swift to be a kind of ML it's made a lot of concessions to more familiar language designs.

</comment></comment><comment><USER38> Fullstack dev here, I'm still happy with jquery.

<comment><USER26> I think one problem with jquery is that it tightly couples your classes and IDs, and your layout, which your logic.

Simple example: your new dev changes layout or an ID or classname, and some code somewhere that relied on it via jquery breaks.

<comment><USER39> Yeah. Solve that with tests or a compiler.

Not using jQuery doesn't suddenly make that problem go away.

</comment></comment></comment><comment><USER40> Out of curiosity, are most companies/devs disregarding angular or is it slowly picking up?

<comment><USER41> It should be mentioned on this list but because Angular has positioned itself as the enterprise solution to web frontend it scares away novices. Great solution tho, I work with it fulltime

<comment><USER42> I'll second this. It's not very friendly to beginners, and many people dislike "batteries included" frameworks, which Angular tends to be more than React or Vue does. I use it at work in an Enterprise setting and it's worked well for us thus far and have seen great improvements between Angular 2 and 7 (latest as of writing).

</comment></comment></comment><comment><USER43> Interesting that Graphql makes the list - any frontend devs without considerable backend experience out there that have adopted it? Would be interested in your perspective on it vs rest or rpc.

<comment><USER44> Played around with it. I do see the appeal and advantage if you need to save requests and fetch lots of nested data. Haven't had an actual use case yet (as in paid work). My fear would be that companies who'd be better off with rest (because their data and entities are relatively flat and simple) adopt it anyway. But that's my fear about a lot of libraries :D

</comment></comment><comment><USER45> This article makes it sound like the grid layouts of the CSS Frameworks have a legitimate reason for updating. Is this a matter of swapping out grids?

<comment><USER46> Used by them. It is a new property added to CSS language

Edit: well, parent was a question that is now edited

<comment><USER45> sorry about that..

</comment></comment></comment><comment> more-entropy Does anyone have something for backend or even better system wide? What correlates with that "3 mos" concept.

</comment><comment><USER47> Elm

<comment><USER48> Elm will be amazing when it doesn't have to compile to Javascript.

<comment><USER47> Even Javascript has to compile to Javascript. Elm's TodoMVC, after compilation, takes less JS code than the React version. What else is needed? :)

</comment></comment></comment><comment><USER49> I need a site that tells me that something as simple as

npm install

would really be

sudo CXX=clang++ npm install --unsafe-perm

with some explanation of what really went wrong alongside the disclaimer about the negatives of using anything unsafe-perm

every framework or language has developer tool nuances like that which waste devs hours.

</comment><comment><USER49> Vue, Angular function similarly with prefixed/namespaced directives and insertion techniques

v-if

ng-if

This is more of a matter of untechnical recruiters, resume crawling bots, and technical interviewers understanding that these are the same skill sets and concepts to make the labor market slightly more efficient.

All the company's devs are going to be using the resource manual and stackoverflow either way, and most of their time will be messing around with the dev tools than figuring out the most academically efficient solution within the allotted time.</comment>


Recommendations for a Colo Datacenter in Boston area - <AUTHOR>

Please share your reviews, experiences about how you chose your datacenter colo. <comment><USER2> <http://www.ilandinternet.com/> is the way to go. They are a reseller of Level3 for smaller businesses. You go right in the Level3 data center, and it's still relatively cheap. Note that iland colos in many Level3 data centers across the US and Europe.

<comment><AUTHOR> Thanks. Did you ever use their services? Would you know anything about their customer service quality?

<comment><USER2> Yes, I have used them for many years. I found their customer service to be great. You get right through to their small and knowledgeable technical staff.</comment></comment></comment>


Ask YC - has the rating algorithm changed? - <AUTHOR>

I've noticed that comments aren't necessarily sorted by how many votes they have. As I remember it they used to be. (I could be wrong here)<p>Has the algorithm changed? And what determines when a comment with a lover score gets to be shown higher than one with a higher score? <comment><USER2> They're sorted using the same algorithm as the frontpage: score divided by a power of time. It hasn't changed.

<comment><AUTHOR> OK thanks

Just my bad memory then :-)</comment></comment>


Why I Moved To Medium Format - <AUTHOR> http://zackarias.com/for-photographers/gear-gadgets/why-i-moved-to-medium-format-phase-one-iq140-review/ <comment><USER2> any thoughts on this option vs. a red, if you're gonna drop $20K?</comment>


New York to Eliminate Cash for Tolls and Add Face Recognition at Tollbooths - <AUTHOR> http://mobile.nytimes.com/2016/10/06/nyregion/new-york-to-eliminate-cash-option-for-paying-tolls.html <comment><USER2> This will not work.

The Toll by Mail program that runs on the West Side Highway does not work well for out of state drivers that do not have ezpass

What happens is that after you drive through it, you will receive your first notice in the mail in bright orange saying its your third notice. This final notice will say that you owe $100 fine instead of the $4-$8 you would normally be charged.

EZpass provides no support for people who are not customers. You have to send a fax trying to dispute these claims. It is a real pain to use any of the recognition systems.</comment>


PSA: There is a leap second tomorrow, are your systems ready? - <AUTHOR>

Tomorrow, June 30th, a leap second will be added just before midnight UTC (5pm Pacific/8pm Eastern)
Most standard date libraries handle this edge case, but if you are doing any of your own hand rolled date/time processing, you might want to make sure you can handle this edge case (the existence of 23:59:60).
http://en.wikipedia.org/wiki/Leap_second <comment><USER2> Always useful in times like this: <http://tf.nist.gov/timefreq/general/pdf/1788.pdf> particularly the section "Dating Events in the Vicinity of a Leap Second".

</comment><comment><USER3> I've been reminding folks here for a month. Our NTP servers are locked and loaded. I'm tempted to hang a webcam in front of one of them and screencap 23:59:60 for the people here who are still confuzzled over the whole concept.</comment>


*coin all things to decentralize the web - <AUTHOR> http://ozten.com/psto/2014/02/11/coin-all-things/

<comment><USER2> See [http://twister.net.co/](http://twister.net.co/)</comment>


How to minimize dependence on Google while using Android - <AUTHOR> Not happy with neither Google's nor Apple's business practices.  Mail,Youtube, Maps, Calendar, Playstore, Translate, Gboard, Photos and so on. It is scary to be so much dependent on Google products (and give away personal data)<p>Any decent set of alternatives? <comment><USER2> This might be useful:

[https://impossiblehq.com/complete-guide-leaving- google/](https://impossiblehq.com/complete-guide-leaving-google/)</comment>


Ecosystem Rankings of 900+ cities 100+ countries - <AUTHOR> https://www.startupblink.com/?leaderboards&countries <comment><AUTHOR> will be great to get your feedback on how accurate those rankings are for your location.</comment>


What has to happen with Unix virtual memory when you have no swap space - <AUTHOR> https://utcc.utoronto.ca/~cks/space/blog/unix/NoSwapConsequence <comment><USER3> > If you can't on your particular Unix, I'd actually say that your Unix is > probably not letting you get full use out of your RAM.

What use is "full use" if your system live locks!? This is similar logic to that of overcommit--more "efficient" use of RAM in most cases, with the tiny, insignificant cost of your processes randomly[1] being killed?

What happens in practice is that people resort to over provisioning RAM anyhow. But even then that's no guarantee that your processes won't be OOM- killed. We're seeing precisely that in serious production environment--OOM killer shooting down processes even though there's plenty (e.g. >10%, tens of gigabytes) of unallocated memory because it can't evict the buffer cache quickly enough--where quickly enough is defined by some magic heuristics deep in the eviction code.

[1] And before you say that it's not random but can be controlled... you really have no idea of the depth of the problem. Non-strict, overcommit- dependent logic is baked deep into the Linux kernel. There are plenty of ways to wedge the kernel where it will end up shooting down the processes that are supposed to be the most protected, sometimes shooting down much of the system. In the many cases people simply reboot the server entirely rather than wait around to see what the wreckage looks like. This is 1990s Windows revisited-- reboot and move along, unreliability is simply the nature of computers....

<comment><USER4> > This is 1990s Windows revisited--reboot and move along, unreliability is > simply the nature of computers....

Ugh, so much this. Where I work (until the 16th) we've moved from an environment of stability, where problems are investigated and fixed and stay fixed, to our acquirer's environment where things break randomly at all times, and it's not worth investigating system problems because nothing will stay fixed anyway. #totallynotbitter

<comment><USER5> This is that part of being professional where you want to just keep working until your last day, or come in with your feet kicked up and do nothing with the "what are they going to do, fire me?" attitude. If there's severance, I'd go with the former. If everything is settled and it's just waiting out your time, try the latter?

<comment><USER6> If you're trying to be professional, the latter is never an option.

</comment></comment></comment></comment><comment><USER7> Well, the issue really is that applications are not being designed correctly.

To create reliable applications you need to design them to work within limits of memory allocated to them. Unattended applications (like RDBMS or application container) should not allocate memory dynamically based on user input.

By definition, reliable application will not fail because of external input. Allocating memory from OS cannot be done reliably unless that memory was set aside somehow. If the memory was not set aside then we say we are in overprovisioning situation and this means we accept that it might happen that a process wanting to allocate memory will fail to get it.

So the solution (the simplest but not the only one) is to allocate the memory ahead of time for the maximum load the app can experience and to make a limit on the load (number of concurrent connections, etc.) so that this limit is never exceeded.

Some systems do it halfway decently. For example Oracle will explicitly allocate all its memory spaces and then work within those.

The OS really is a big heap of compromises. It does not know anything about the processes it runs but it is somehow expected to do the right thing. We see it is not behaving gracefully when memory runs out but the truth is, OS is built for the situation where it is being used mostly correctly. If memory is running out it means the user already made a mistake in desiging their use of resources (or didn't think about it at all) and there is not really much the OS can do to help it.

<comment><USER8> The downside to this is that if your application ever needs less than the configured amount of memory then that memory cannot be used by other applications. This is a big reason why java is such a huge memory hog even if the application itself isn't demanding nearly as much memory.

<comment><USER9> I believe that Linux has all the tools to solve this in practice:

1\. When you allocate memory, but do not write into it yet, those pages not mapped in RAM and thus don't occupy actual space.

2\. When you're done with a specific page of memory, you can madvise(MADV_FREE) it, which means that the kernel can discard these pages from RAM and use it for caches and buffers. _But_ you still hold on to the virtual memory allocation, so you can just start writing into the page again when you need more memory and the kernel will map it again.

If I understand all that correctly, you can have your allocator work in such a way that it keeps a large reserve of preallocated memory pages, but the corresponding amount of RAM can be used for caches and buffers when it doesn't need everything. An interesting question would be how that scenario appears in ps(1) and top(1), i.e. whether those MADV_FREE'd pages would count towards RSS.

<comment><USER10> And 3. When kernel cannot supply you with the allocated page what happens? (Mapped but inaccessible.)

Currently, OOM killing.

</comment></comment></comment></comment><comment><USER11> I'd like to add that RHEL5 was more than tolerable in this aspect. Whatever kernel series it lived through, it seemed logical. We knew when RHEL5 systems started to swap that was our sign to A) look for long term usage growth that is beginning to bump some threshold somewhere B) someone turned a knob they shouldn't have C) a recent code change has caused a problem in the application stack

Then RHEL6 came along, and it swapped all the time. Gone was our warning. The stats shows tens of gigabytes of cache engaged. WUT? How do we have tens of gigabytes of memory doing nothing? Before you could finish that thought, OOM killer was killing off programs due to memory pressure. WTF? The system is swallowing RAM to cache I/O, but couldn't spare a drop for programs? ...I could go on, but simply put, RHEL6 was garbage. And really I mean the RHEL6 kernels and the way that Red Hat tweaked whatever they did for it.

RHEL7 was a little better, but still seeing echoes of the ugliness of RHEL6. RHEL5 was just a faded pleasant dream.

The last 3 Fedoras on the other hand, the memory management seems like we're finally digging ourselves out of the nightmare. That nightmare lasted almost a full decade.... sheesh

</comment><comment><USER12> Although I am not a fan of Apple, their Memory Pressure messages on iOS are really useful to prevent this. You get warned as a programmer to clean up your memory if possible, otherwise iOS shuts you down.

<comment><USER13> Also AIX has SIGDANGER (best signal name ever). There is also "oomd", I think like the iOS thing, for Linux, in user space. Not sure how useful any of these things really are but wondering if FreeBSD should get one...

</comment></comment><comment><USER14> What am I missing here? Why can't, as others have mentioned in other HN comments elsewhere, the OOM killer just get invoked when there's less than X amount of RAM left, and kill the highest-offending process? In my case, I would prefer that to anything else. Why does this page or that page matter?

<comment><USER15> Because you're not truly out of o memory at that point. there are still pages that can be evicted. to invoke the oomkiller sooner you have to use heuristics to determine when a request could be satisfied in theory but not practically due to page thrashing.

The oom killer only kicks in sometimes, e.g. when programs make truly egregious allocation requests.

The benefit of having swap is that it turns things into a soft degradation since it's much easier for the system to start with swapping out rarely used pages. The gradual loss of performance makes it easier for the human to intervene compared to the cliff you encounter when it starts dropping shared code pages.

<comment><USER3> > The oom killer only kicks in sometimes, e.g. when programs make truly > egregious allocation requests.

This is a myth. Allocation failures happen at least as much on small allocations as on big ones. In fact, I see OOMs every day and the vast majority of the time the trigger was a small allocation. For example, the kernel trying and failing to allocate a socket buffer.

And that's really the root of the issue. You have a giant application with a 200GB _committed_ working memory set doing important, critical work; and it gets shot down because some other process just tried to initiate an HTTP request. It's a ludicrous situation. And people defending Linux here by saying the same problem exists everywhere else are wishful apologists--the situation is absolutely not the same everywhere else.

Even setting aside the issue of strict memory accounting--which, BTW, both Windows and Solaris are perfectly capable of doing, and do by default--Linux could still do dramatically better. Clearly there's some level of unreliability people are willing to put up with for the benefits of efficiency, but Linux blew past that equilibrium long ago.

<comment><USER15> E.g. == for example, other cases are permitted. What I am saying is that it only kicks in under some circumstances, not necessarily when one wants it to.

</comment></comment></comment></comment><comment><USER16> i routinely see these days systems without or with very low swap. It is like swap has become faux pas. That is especially strange giving the SSD drives available on the machines. Gradual degradation of service vs. the service sudden disappearance and/or stall or heavy overprovisioning and still ...

Also comes to mind - while not generic swap - kind of edge case, a modern version of swap, ie. extending virtual memory space onto flash storage - Facebook replacement of some RAM with NVM [https://research.fb.com/wp- content/uploads/2018/03/reducing-...](https://research.fb.com/wp- content/uploads/2018/03/reducing-dram-footprint-with-nvm-in-facebook.pdf)

<comment><USER17> Yeah because swap on Linux doesn't really work. When it is needed your system grinds to a halt.

<comment><USER8> I didn't enable swap for the first 6 months, every time I ran out of memory the system froze. Now I use swap and only the offending applications do actually freeze. There is a small problem though, one application in particular permanently captures the damn mouse in fullscreen mode so if it freezes I can't interact with the rest of the system with the mouse but this is purely a bug in the application, not a problem with the operating system.

<comment><USER9> Well, it's more of a design problem of X11. Under Wayland, the compositor could offer a Secure Attention Key like Ctrl-Alt-Del that reclaims input focus from a fullscreen application. As far as I'm aware, such facilities do not exist in X11. When an application grabs the keyboard, it's grabbing the _entire_ keyboard.

<comment><USER18> Yes, the problem is that X11's login/lock screen is secured by grabbing the keyboard and mouse, taking away input focus from the login screen in many cases will allow you to bypass it entirely.

</comment></comment></comment></comment></comment><comment><USER19> I feel that the problem is ill-posed: "At what amount of free RAM should we start freeing RAM by killing processes?"

Maybe one should solve the problem: "At what eviction-induced latency should the OOM killer be invoked." Thanks to the infrastructure around latencytop, the latency might be available already.

Of course, the never-ending dilemma of what process to kill is still there.

<comment><USER10> Preferably none. Saner APIs like Android will call low memory signals and start swapping out applications both ahead of time and as needed. It also has a relatively smart memory manager to detect unexpected vs expected spikes as well as slow leaks.

POSIX has no such API. It was designed in a simple time.

<comment><USER19> Can you point to documentation on how Android deals with low-memory situations? My understanding is that: (A) They moved the problem to user- space. (B) Apps are supposed to constantly save the state they care about and expect to be killed whenever Android sees fit (or even at every app switch for developers).

</comment></comment></comment><comment><USER20> The particular issue of locking up a system because there are too many tabs open in Firefox or Chrome should be fixed in the browser, because the browser is the program that is taking up all of the memory and is in the best position to know how to recover a lot of memory quickly while minimizing the loss of work for the user. One of the comments suggested having the kernel send a 'memory pressure' signal to all processes, and a process could catch the signal and do garbage collection or drop other storage. But even without such a feature, a program could do polling to determine that there is memory pressure, or do a check when a user asks to open a new tab, etc.

</comment><comment><USER21> My experience for a long time has been that Linux is only usable with earlyoom. Running without it is a guaranteed way to end up having to power- cycle my system, often multiple times per day.

</comment><comment><USER22> Unlike traditional swap, Android's Memory Manager kills inactive processes to free up memory

<comment><USER10> That's because the whole Android API and ecosystem was designed to make it possible.

You cannot get away with that and POSIX applications. They have zero or bad session support. There's no global always available database to help you (Android has 4), nor event scheduling bus. (Dbus is a joke, it does not allow sending event to non-existing endpoint to be delivered later.)

Every application using the standard mechanisms will get relaunched and activated as needed if it got shut down. It will receive a Bundle with state it managed to save and with original launch Intent. It can access an sqlite database to be made available via a restartable ContentProvider. SharedPreferences are also stored. Etc.

In Linux world, there are no such de facto standards and what is most common is utterly broken. Same in Windows (only registry is persistent, it's not meant for data storage) and in OS X.

</comment></comment><comment><USER23> I managed to achieve this once, fresh from the world of Windows - <USER2> breaking out of a loop while exploring Python(?) on Ubuntu 10 or so. Had to power cycle my damn machine.</comment>


WebGL Water - <AUTHOR> http://madebyevan.com/webgl-water/ <comment><USER2> Nice. It runs on my iPhone! (Although without the keystrokes).

Well done!

<comment><USER3> I'm pretty sure this was made around 10 years ago. I remember trying to reverse engineer this open gl like syntax

<comment><USER4> Yep, 2011. [https://news.ycombinator.com/item?id=2884141](https://news.ycombinator.com/item?id=2884141)</comment></comment></comment>


OpenFloodgate: Online Publishing with Control - <AUTHOR> http://www.techcrunch.com/2007/03/29/openfloodgate-online-publishing-with-control/ <comment><AUTHOR> What do you guys think about the increase in the number of these document publishing sites. Will these morph into web based filing systems to replace the filing systems on our PCs?

What's their business model and which site will become dominant?</comment>


.net is now signed with DNSSEC - <AUTHOR> https://www.dnssec-deployment.org/index.php/2010/10/verisign-shares-dnssec-deployment-schedule-for-com-net/

<comment><AUTHOR> This is now the largest zone on the internet that is signed (until .com goes live in March 2011).</comment>


Trump names Rudy Giuliani as cybersecurity adviser - <AUTHOR> https://www.washingtonpost.com/news/powerpost/wp/2017/01/12/trump-names-rudy-giuliani-as-cybersecurity-adviser/ <comment><USER2> A better way to phase this is that Giuliani's private consulting business is a cybersecurity adviser. Giuliani himself likely has no expertise in the field at all.

Overall the US is going to keep getting successfully exploited until they actually ask subject experts how to defend themselves rather than lawyers, MBAs, and politicians.

This is something Obama did very well with the "The United States Digital Service." He cut out the useless empty suites, got in a bunch of subject experts, and accomplished things.

Can you imagine how critical the media would be if Trump's defence advisor was a lawyer? But for IT and cyber security that's just fine I guess...

<comment><USER3> What exactly did Obama accomplish with the Digital Service? It's an honest question, seems like he's more known for literally every single agency getting hacked and their inability to launch a healthcare website, what have been the accomplishments that weren't reported as much?

<comment> dj-wonk When I hear questions such as "what did person P accomplish with X?" I like to reframe them.

To assess the value of intervention X, one may want to compare the actual effect (E1) with some estimates of what would have happened (E2) if X did not happen.

If one does not use a comparison of this manner, one probably is not distinguishing between luck and causation.

<comment> dj-wonk To answer my own question, without the Digital Service, I would estimate that:

* Existing agencies would struggle to assemble a talented, motivated critical mass of software developers. Why? Attracting these kinds of developers requires cultural shifts and 'economies of people' (to riff on the term 'economies of scale'.) It also requires a concerted effort on hiring and knowing how to slot skilled technologists in government pay scales. Not all (few?) agencies have figured out to make this happen.

* Existing agencies would likely continue to procure work as before; e.g. through a maze of procurement and perhaps through some (limited, if any) internal development resources.

I would welcome a continuation of this line of thinking from those who have worked closely with and/or observed the USDS.

<comment><USER4> Well there have always been contractors but the ACA health exchanges had to work.. the first attempt did not, why because they were contractors and as one could surmise not actually effective at scale. So bring in the digital service who did things as they should have been done... This can be as simple as code to spec vs take ownership and go above and beyond. And it worked. It had to.

In the next administration Palantir is going to clean up.. why b/c of Thiel and because of current contractor ineffectiveness. The Digital 18F will survive but it's not clear that the agencies they serve will.

</comment></comment></comment></comment></comment><comment><USER5> Seems like Trump is rewarding those who support him over actual qualified individuals.

Bummer.

<comment><USER6> Did you really expect anything other than that? Are you really taking this guy seriously?

<comment><USER7> Well... we have to take him seriously. He's about to command an army and control a nuclear arsenal.

</comment></comment></comment><comment><AUTHOR> On a related note, does anyone know who and what meeting PE Trump was referring to yesterday?

"One of the things we're going to do, we have some of the greatest computer minds anywhere in the world that we've assembled. You saw just a sample of it two weeks ago up here we had the six top people in the world. They were never the same room together as a group. And we're going to put those minds together, and we're going to form a defense."

<comment><USER8> Probably this meeting

[https://www.wired.com/2016/12/trump-meeting-tech-ceos- gonna-...](https://www.wired.com/2016/12/trump-meeting-tech-ceos-gonna- awkward/)

<comment><USER9> Wow, a room full of people who know nothing about cyber security. Good job drumpf.

<comment><USER8> A room full of people advocating for tax breaks for their busniesses

</comment></comment></comment></comment><comment><USER10> Maybe it's me but I swear Trump goes out of his way to name people who's personal views are the opposite of their assigned mission.

<comment><USER11> Yes, he is doing that.

RT(Ruptly TV) news channel made a joke about it, if Trump is to nominate someone for "ministry of comedy", he'd find someone who hates comedy.

</comment></comment><comment><USER12> The person with the current role closest to this one-

[https://www.whitehouse.gov/blog/author/michael- daniel](https://www.whitehouse.gov/blog/author/michael-daniel)

<comment><USER13> It's interesting how they try to make him relatable at the end of that with the 'Rambunctious' kids and personal endeavors bit. Maybe I am just nit- picking.

</comment></comment><comment><USER14> /me grabs popcorn.

It'll be fun to watch.</comment>


Apple iPad 3 - <AUTHOR> http://www.apple.com/ipad/#

<comment><USER2> I think it's interesting that they dropped the version designator. It's just "iPad" now, with the generation being noted separately, like it is for Macs.</comment>


Bugs in trading software cost Knight Capital $440M - <AUTHOR> http://www.bloomberg.com/news/2012-08-02/knight-says-losses-from-trading-breakdown-are-440-million.html?ref

<comment><USER2> No matter how skilled you are, trading on the market is a bit like playing with fire. Not a big fire, but still a fire.

Technology is turning that fire into a flamethrower. A lot of companies are going to get burned in next five years, but many others are going to vastly succeed.</comment>


First inkjet-printed graphene computer circuit is transparent, flexible - <AUTHOR> http://www.extremetech.com/extreme/106599-first-inkjet-printed-graphene-computer-circuit-is-transparent-flexible

<comment><USER2> Why do websites do this to iPad users? the first page is only readable if you scroll to the left a bit, but you have to hold it there because if you let go it snaps back to unreadable. changing to the next page is hard too because it takes a full swipe from right to left. That's only when the page does not crash to the main screen first because of heavy JavaScript usage.

I ask website creators, what does a feature add over not adding it? In this case the only added thing is frustration.

<comment><USER3> Try this. [http://www.extremetech.com/extreme/106599-first-inkjet- print...](http://www.extremetech.com/extreme/106599-first-inkjet-printed- graphene-computer-circuit-is-transparent-flexible?print)

<comment><USER2> Thanks, but this is what I get from that: <http://imgur.com/tDt6m>

I just don't understand why some sites "enhance" mobile browsing like this and make the experience worse off than just looking at the normal page. The iPad has an excellent browser.

And, also for the record, clicking the gear at the bottom and pressing "view desktop version" does exactly nothing other than disappointing me again.

<comment><USER3> I like the "idea" of tablets, especially as represented by the iPad, but I don't have one, and this is one of the reasons. Maybe the reality of the iPad3 will be the first to get me excited enough to buy into the vision.

<comment><USER2> For just lounging in bed and going to the bathroom, the iPad is amazing. Instapaper and the web browser are quite great.

Edit. Also, email consumption on it is really good too; not great for long replies though.</comment></comment></comment></comment></comment>


Why wireless networks are slow - <AUTHOR> http://mattryall.net/blog/2011/08/why-wireless-networks-are-slow

<comment><USER2> This may be an incredibly naive question, but is there any reason wireless communication isn't directional, to mitigate some of these interference and square of distance problems? You'd obviously need some lower-bandwidth isotropic mechanism to locate other devices, and then a number of heuristics to track and predict motion.

Perhaps this is already how these things work?

<comment><AUTHOR> People have managed to achieve much greater ranges (like more than a kilometre) with 802.11 technology using "cantennas" -- directional antennas like what you're talking about.

While it's theoretically possible, I'm not sure whether this is practical for general use on a LAN. You'd probably have to have a wireless antenna poking out of your laptop, which you'd point at the access point. Seems a little bit inconvenient.

<comment><USER3> Pointing a big antenna is not how it would work.

You don't need to point the antenna at anything; you can use multiple antennas that steer the beam ("beamforming") in a desired direction. Link:

<http://en.wikipedia.org/wiki/Smart_antenna>

Basically you can have a "phased array" of N antennas (2 counts as an array, but you can think of a line of say N=8 antennas) that delay their broadcasts relative to each other in such a way that the N signals interfere constructively along some directions and destructively along other directions. This is because, from far away,

      cos(angle_from_line_of_antenna_array) = const*propagation_delay_between_antennas

<comment><AUTHOR> Ah, clever! Thanks for the link.

</comment></comment></comment></comment><comment><USER4> We are just now tapping on the spatial dimension of wireless channels; up to now we have just used frequency, time, and polarization for orthogonality. Spatial processing allows theoretically unlimited (bounded by computation, solved by Moore) channel capacity. At the same time, we are beginning to use the available channel resources more efficiently with cognitive radios, which allows much better spectrum utilization. Today, with statically allocated spectrum use, I'd guess that less than 10% of allocated spectrum and time is in active use at any time.

</comment><comment><USER5> My first thought before even reading the article was: <http://www.bufferbloat.net/>

Good to see someone else commented about it.

</comment><comment><USER6> Nice article. The collision avoidance algorithm explanation is very simple, but overall the post is interesting.

</comment><comment><USER7> Why can't we create more open spectrum?

<comment><USER8> Would it be illegal to sell firmware that uses more spectrum and boosts wifi speeds?

I'm just wondering how hard it would be to jailbreak WiFi.

<comment><USER9> It would probably not be illegal to sell the firmware - but it would definitely be illegal to use it.

</comment></comment></comment><comment><USER10> It's unfortunate there's no mention of using MIMO spatial correlation techniques to increase Performance.

<comment><USER11> check the end of the article

</comment></comment><comment><USER12> got to 3gpp.org and read up on how LTE works, many of these problems have been addressed.</comment>


Urban Prius living - <AUTHOR> http://www.rosipov.com/blog/urban-prius-living/ <comment> bro-stick Interesting. I live in an Type-2 Westfalia which has a fridge, two burner propane stove, 9 storage compartments, two air conditioners, a heater, sleeps up to four, fits in compact-width & height parking garages and has complete privacy with curtains all-around. If/when I do the trick of not curtaining the front seat area, it looks plausibly like it's has curtains up for another reason. I'd like to convert it to all-electric (Tesla) because keeping it running is a bit pricey. I rarely pop the top because that's not stealth.

<comment><AUTHOR> I'd say I'm jealous of your space, but mileage is really a problem with that thing. My little Prius gets an average of 50 mpg (30 in the city, 60 on the highway), which makes traveling a much cheaper endeavor.</comment></comment>


Protection from Electronic Harassment - <AUTHOR> https://notabug.io/t/technology/comments/fde7c8e4257a7f33a05871bf67002dade5836dc5/primer-on-through-the-wall-cameras-and-protection <comment><AUTHOR> The comments were more interesting to me than the image, especially the steel wire hack. Thought you guys might like it.</comment>


Signing an Adobe AIR application with a startssl.com certificate - <AUTHOR> http://sproutvideotech.posterous.com/misadventures-in-signing-adobe-air-applicatio

<comment><USER2> Does anyone still target AIR? They officially dropped desktop linux support.

<comment><AUTHOR> I'm considering rewriting the uploader natively for each platform at some point. AIR is pretty nice for getting something up and running though.

<comment><USER2> I wasn't criticising your work in particular, sorry if it sounded that way.

There are many other cross-platform runtimes/libraries that give developers much better terms, I'd use one of those instead: Python+Qt/Wx, Titanium Desktop, JVM, Mono.

</comment></comment></comment><comment><USER3> Ah, very useful article. Wait, this isn't 2008?</comment>


Coronavirus: Largest study suggests elderly and sick are most at risk - <AUTHOR> https://www.bbc.com/news/world-asia-china-51540981 <comment><USER2> The conclusions are of little informational value as the same is going to apply to practically any pathogen-borne disease (unless a vast group of the elderly had the chance to acquire prior immunity, as is the case with some strains of flu being similar to those from the past, in which case younger people are at a relative disadvantage).

What is more important to realize about the virus is that (1) a death rate of 2% (20 times that of flu) would still be considerable given its relatively high infectivity rate and long incubation period, and that (2) the fact that 20% of the cases require hospitalization would put a significant strain on even the best healthcare systems should it become widespread.

Separately, any data-based inferences are only as good as the underlying data, and there have been some doubts as to the completeness and veracity of data available. Even the WHO chief has effectively spoken to that effect.

<comment><USER3> What is more important to realize is that the parameters you're citing haven't been borne out outside of Hubei, and that everywhere else it has emerged, it's been...about as bad as the flu. You're also citing numbers that every _credible expert_ says are systematically inflated.

The death rate in China is very likely exaggerated, because (as you say) the hospitals are overwhelmed with panicked locals (which tends to happen when you turn a city the size of New York into a police state!) leading to systematic under-reporting of minor cases. Anthony Faucci of NIAID was quoted in the Washington Post a day or two ago, saying that the death rate will likely drop to/below 1%:

 _" experts have said the coronavirus fatality rate is likely to decline substantially as they compile a more accurate count of the people who contract the virus and survive. At the Aspen Institute presentation, Anthony S. Fauci, director of the National Institute of Allergy and Infectious Diseases, said he hoped the rate could decline toward 1 percent."_

Also from that article:

 _"The fact that there are so many mild cases is a real hallmark of this disease and makes it so different from SARS," said Jennifer Nuzzo, an epidemiologist at the Johns Hopkins Bloomberg School of Public Health's Center for Health Security. "It's also really challenging. Most of our surveillance is oriented around finding people who require medical intervention."_

 _" For those who study viruses, the large number of mild cases is reason for optimism. "This looks to be a bad, heightened cold — I think that's a rational way of thinking about it," said Matthew Frieman, a virologist at the University of Maryland School of Medicine. "Not to diminish its importance — it's in the middle between SARS and the common cold."_

 _" Many experts have said early phases of outbreaks like this one tend to have a large number of severe cases, as the sickest people flock to hospitals and come to doctors' attention. And in Wuhan, where the health-care system is overwhelmed, people have complained they cannot find a hospital to test them for the virus, let alone to treat their symptoms. So patients with milder versions may be at home, uncounted, waiting out the epidemic."_

[https://www.washingtonpost.com/health/most-coronavirus- cases...](https://www.washingtonpost.com/health/most-coronavirus-cases-are- mild-complicating-efforts-to-respond/2020/02/12/213603a4-4dc2-11ea- bf44-f5043eb3918a_story.html)

Again and again, experts keep saying the same thing: the danger of this virus is being exaggerated. But folks like you continue to spread these exaggerated numbers, leading to panic and overreaction:

 _" Health experts question the timeliness and accuracy of China's official data, saying the testing system captured only a fraction of the cases in China's hospitals, particularly those that are poorly run.

Neil Ferguson, a professor of epidemiology at Imperial College London, said only the most severe infections were being diagnosed and as few as 10 per cent of cases were being properly detected, in a video released by the university."_

[https://www.google.com/amp/s/amp.ft.com/content/bb73bd9c-4d9...](https://www.google.com/amp/s/amp.ft.com/content/bb73bd9c-4d92-11ea-95a0-43d18ec715f5)

<comment><USER4> You are probably right that the numbers out of Hubei province are inflated and less severe cases are underrepresented. Unfortunately, according to some experts, the case fatality rate of ~2% seems to hold even for cases outside of China.

Statistical modeling of the case fatality rate using only cases and deaths reported from outside China was done by Christian L. Althaus (Institute of Social and Preventive Medicine, University of Bern), this estimates the CFR for COVID-19 at 2.1% although with a high uncertainty (95% confidence interval: 0.5%-5.4%). Data and R code for his modeling are available on Github: [https://github.com/calthaus/ncov- cfr](https://github.com/calthaus/ncov-cfr)

A comment from Adam Kucharski (Associate Professor, London School of Hygiene & Tropical Medicine) on Twitter: [https://twitter.com/AdamJKucharski/status/122970801348691148...](https://twitter.com/AdamJKucharski/status/1229708013486911488)

 _"... The upshot: the widely quoted 2% fatality for China is calculated incorrectly, because it's based on data that is under-reported and doesn't account for delays. But, confusingly, these errors may actually cancel out, leading to an estimate that is right for the wrong reasons ..."_

<comment><USER3> You're citing a cherry-picked study that supports your preconceptions.

</comment></comment></comment></comment><comment><USER5> Although this seems intuitive, it's not true for all epidemics.

The 1918 flu disproportionately killed healthy young adults. Why? Their immune systems reacted more strongly to the flu. But the immune reaction (fever and phlegm) was so strong that it ultimately ended up killing the patients before the pathogens.

</comment><comment><USER6> What a revelation - who would have guessed.

<comment><USER7> Pretty much what I thought. I think any illness is more dangerous to elderly and sick people. What's the news here?

<comment><USER8> This was not the case with the Spanish flu, which disproportionately effected young adults[1].

1\. [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3734171/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3734171/)

</comment></comment></comment><comment><USER9> Is this such a shock?</comment>


Privacy Policies Are an Incomprehensible Disaster - <AUTHOR> https://www.nytimes.com/interactive/2019/06/12/opinion/facebook-google-privacy-policies.html <comment><USER3> Pretty well written piece for a an intro to this issue. Same issue with cookie acknowledgements. Some important quotes:

"These are documents created by lawyers, for lawyers. They were never created as a consumer tool," Dr. King said.

"The BBC has an unusually readable privacy policy. It's written in short, declarative sentences, using plain language. "

The BBC example shows that it is possible to write a readable policy, if a company cares to.

<comment><USER4> > These are documents created by lawyers, for lawyers. They were never created > as a consumer tool

This, I think, is the core issue. The Privacy Policy is seen as the same type of thing as the Terms of Service. Of course, this begs the question of why does there need to be two different documents.

GDPR has pretty explicitly tried to reverse this. The Terms of Service can be as legal-y as you want, but there must be a plain-language Privacy Policy for the data subject. We'll see how much that happens in practice... the regulators probably have much bigger fish to fry than unclear PP documents, but a fine for a separate issue could include "no one could understand this, so it doesn't count" as a way to side-step technical loopholes.

<comment><USER5> More importantly GDPR grants statutory rights that cannot be waived by a shrinkwrap agreement. Its only real weakness is that is does not grant a right of private enforcement, and national regulatory agencies are too understaffed to address even a small portion of abuses today.

<comment><USER6> > Its only real weakness is that is does not grant a right of private > enforcement, and national regulatory agencies are too understaffed to > address even a small portion of abuses today

Article 79, Right to an effective judicial remedy against a controller or processor

1\. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2\. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

</comment></comment></comment></comment><comment><USER7> "For comparison, here are the scores for some classic texts. Only Immanuel Kant's famously difficult "Critique of Pure Reason" registers a more challenging readability score than Facebook's privacy policy. (To calculate their reading time, I measured the first chapter of each text.) "

I'm feeling an interesting mix of laughter and sadness. How can you not laugh at the ridiculousness of a privacy policy being less legible than "Criqiue of Pure Reason"? How can you not feel a tinge of sadness at the state of the world when this is not only acceptable, but expected?

Yet, it doesn't surprise me that privacy policies are generally hot garbage. And that's sad too.

<comment><USER8> The real measuring stick of readability should be The Silmarillion :)

There are plenty of ways privacy policies are bad, but I think the reading scores NYT is using from Lexile are a bogus criticism. From a reading length and vocabulary perspective, I don't see anything in the Facebook privacy policy that I wouldn't expect a high school student to be able to comprehend.

My main criticism of privacy policies is that, after reading them, you realize that there is practically no upper bound on how your data can actually be used. You give the company a key to your house, and it is up to them to decide if they want to trash the place.

<comment><USER5> I read the Silmarillion when I was 11. It's hardly challenging reading like dense and opaque German philosophy texts tend to be (I am looking at you, Wittgenstein).

<comment><USER9> Agreed. The Silmarillion's language isn't _simple_ , but it is _lyrical_ , and is intended to evoke great epics in its style.

I think the most uncharitable thing you can say about it is that it reads somewhat like the King James Bible.

<comment><USER5> Right, and unlike those philosophy texts, there is actually a payoff for the reader.

</comment></comment></comment></comment></comment><comment><USER10> > _The BBC has an unusually readable privacy policy. It's written in short, > declarative sentences, using plain language._

This is good to know. Startups often adapt language for their own privacy policies from those of big companies (on the assumption that such policies are good/vetted).

Hopefully founders who read this article will turn to the BBC's policy when figuring out how to fashion their own.

<comment><USER11> I was pretty impressed with Basecamp's. [https://basecamp.com/about/policies/privacy](https://basecamp.com/about/policies/privacy)

</comment></comment><comment><USER12> The New York Times is as bad at privacy as anyone. Here is their policy:

[https://help.nytimes.com/hc/en- us/articles/115014892108-Priv...](https://help.nytimes.com/hc/en- us/articles/115014892108-Privacy-policy)

They make extremely illegitimate claims about "needing" to collect your personal information to provide their "services". Which is absolutely untrue since they're a newspaper you could read completely anonymously with zero degradation to experience (except where they've deliberately hobbled that option).

<comment> toby- Do you suppose the author of this opinion piece wrote the New York Times' privacy policy?

Edit: some fair counterpoints to me, below. But publishing an opinion piece does not necessarily imply endorsement, and nor does it diminish the author's point(s) one iota.

<comment><USER13> I keep hearing this. Every time the NYT writes an article on X, while being a hypocrite on X, "Do you think the guy who wrote this was also in charge of X at the NYT?"

It's a valid counterpoint. The guy who wrote about X is not, usually, in charge of X. Agreed. The criticism, however, is not about the author - it's about the organization that endorses both the action X, and the criticism of X.

The NYT is an opinionated organization, not a public wall open to whoever wants to throw things at it. They have an editorial stance. When they write criticisms of X, they are implicitly - as an organization - criticizing X. When they do X themselves, they are - as an organization - <USER2> endorsing X. When they wish to distance themselves from a criticism in an article, they explicitly point out - hey, this is an Op-Ed from such-and-such author, and doesn't represent the views of the NYT. When it's not an Op-Ed, and/or when it's not disavowed, they are saying: this article represents the views of the NYT.

The writer is not a hypocrite. The organization, however, is.

There's nothing illogical or invalid about holding the organization accountable for doing bad things, and for pointing out that the organization is trying to earn goodwill from the public by being "against X" while perpetrating the act themselves.

<comment><USER14> > The writer is not a hypocrite. The organization, however, is.

This is not how how a functioning news room works. That's not how any of this works. You don't check your individuality at the door. A good publication can and should promote well reasoned work, especially if it conflicts with the status quo or view points of other writes in the org.

<comment><USER15> Can and should, yet so didn't and still acts contrary? Sounds almost exactly like hypocrisy to me.

</comment></comment></comment></comment></comment><comment><USER16> >The vast majority of these privacy policies exceed the college reading level. And according to the most recent literacy survey conducted by the National Center for Education Statistics, over half of Americans may struggle to comprehend dense, lengthy texts. That means a significant chunk of the data collection economy is based on consenting to complicated documents that many Americans can't understand.

How is this different to law itself? If we're going to argue that it's problematic for something as (relatively) inconsequential as privacy policies to be unintelligible, shouldn't we start with something more basic?

<comment><USER17> That the legibility of the law could and should be improved is a fair point. That said, humanity isn't incapable of concurrency - there's no reason to have to wait for the law before tackling privacy policies, which while a lesser issue, are also easier to change.

</comment></comment><comment><USER18> There's an ongoing study whose early results found that even if people read and understood privacy policies (for mobile apps), those policies are incomplete, wrong, or self-contradictory a decent chunk of the time: [https://www.ieee- security.org/TC/SPW2019/ConPro/papers/okoyo...](https://www.ieee- security.org/TC/SPW2019/ConPro/papers/okoyomon-conpro19.pdf)

It's hard to see privacy policies being written in good faith. In my opinion, they're little more than declarations of "I'm going to do all these sketchy things with your data, and it's _your_ responsibility to protect yourself from me."

</comment><comment><USER19> Whether or not they are incomprehensible, I worry more that most of them seem to boil down to:

"We can do whatever we want with any data we have about you. Your only alternative is to not use our services and not use any other business or organization that uses our services."

Any privacy policy that has the usual clause saying, "We can change this policy at any time by posting an update to our website," is saying essentially the above.

I suppose it would help if they were forced simply to put their policy in those terms - then more people might push back against it.

</comment><comment><USER20> I have recently been wondering if, instead of a company having a privacy policy, they could instead use a privacy license. This way you could easily discern their stance on privacy from the name of the license. Not sure if anything like this exists or if it would be worth looking into.

<comment><USER21> This actually sounds like an interesting deal, as it would make figuring out what a company does with your data easier to understand, but I'm fearful of 2 main things: 1\. It's still a battle to explain to non-technically minded people whether an image is Creative Commons or free use or to get them to understand that there are different kinds of CC. 2\. It will mean there is less to read through, but many companies will still fit blocks together (ie. General Use+Advertising Third Party+Server Backup in Other Country) or resort to using a license that is more general than they need, but definitely includes the things they want to do.

It's a _really_ cool idea though, and I'm curious whether anyone has ever tried anything like it before.

</comment></comment><comment><USER22> Twilio does an excellent job with their Terms of Service and Privacy Policies. For example, their Terms of Service has a "plain english" version in a right hand column, along with the legalese in the right:

[https://www.twilio.com/legal/tos](https://www.twilio.com/legal/tos)

<comment><USER23> But it is still maddeningly long. Even with the plain English version, who would ever read and digest that before signing up for Twilio (other than a lawyer)?

<comment><USER24> I'd hope who is about to build their business around the service and sign a contract in the name of their business to use it could take some time to read it... if not they shouldn't be signing their company up for it.

<comment><USER23> Sure, that is the ideal. I'm more curious about the reality...

Check out this page --

[https://www.twilio.com/try-twilio](https://www.twilio.com/try-twilio)

At the bottom it says, "By clicking the button, you agree to our legal policies."

Ignoring the ambiguity of that statement, it seems that someone can't even sign up for a free trial without agreeing to the full set of terms. Does that mean a business needs to make a complete legal review of the policies before an employee can sign up to _test_ the service and decide if they want to use it? How often does that actually happen?

<comment><USER24> If it's not going to be used in production, which a free trial presumably wouldn't be, then you probably don't need a full review of the terms although it would be a good idea to take care of it.

</comment></comment></comment></comment></comment><comment><USER25> Working in healthcare, we have a privacy department that is adjunct to the legal department. It did an audit of all of my web sites last year and I was surprised to find out that they recommended that the privacy policies be removed from some of them.

The reason was simple: The sites in question didn't do any tracking. So if you're not gathering information, there's no need to warn.

<comment><USER26> I disagree with this sentiment.

If you do not track any user activity on your site, then perhaps there is not need to have a pop-up warning in your face.

But the fact that you willingly do NOT track user activity IS your privacy policy. The policy does not go away. As a user visiting a site, I would much rather have the policy accessible, even if it says that the website does not have any tracking enabled.

Edit:

And I'm surprised that a legal advisor would recommend to remove the policy entirely. Isn't it generally better to be explicit and forthcoming, rather than say nothing at all?

<comment><USER27> I agree with this. If you really don't collect data, then state it as such. That should certainly bolster confidence by the end users of the system.

</comment></comment></comment><comment><USER28> It's not that hard to read most EULAs and privacy policies, because they're usually plagarized from someone else's documents, and contain much the same clauses.

...Overreaching indemnification clause, bleah...disputes must be resolved in courts of Northern California, OK (Outer Nowhere, not so OK, offshore tax haven island, very bad) ... arbitration required under AAA consumer rules, not too bad (National Arbitration Forum was very bad) ... no class actions, all too common ... "sole discretion" termination, run away in a B2B context ... vagueness in what can be done with your data, all too common, and often where privacy rights go away ... mention of "affilates" having access, not good ... limitation of liability, common for ordinary websites but inappropriate for anybody you keep money with ....

After you read about ten of these things, a pattern emerges.

</comment><comment><USER29> This really raises the question of what it means to "consent" to something. If you don't actually understand what you are consenting too, is it legally binding?

<comment><USER30> A meeting of the minds is no longer really a requirement in American contract law. You do not have to understand what you're being legally bound to. You don't even have to understand if your human rights are being signed away either.

<comment><USER31> The idea is that you have a meeting of the minds that the document you are signing contains the terms. If you could later argue that you didn't understand it and therefore shouldn't be bound, it would make contracts impossible to uphold.

Though I do think there should be some sort of loosening of the requirements for a contract to be found unconscionable or deceptive.

</comment></comment></comment><comment><USER32> It's not only about privacy policies. Terms of service and other contracts which people use are equally incomprehensible and full of legalese.

<comment><USER32> A good example of how far the situation came is described here: [https://abovethelaw.com/2010/06/do-lawyers-actaully-read- boi...](https://abovethelaw.com/2010/06/do-lawyers-actaully-read-boilerplate- contracts-judge-richard-posner-doesnt-do-you/)

>Judge Posner at ACS panel: For my home equity loan, I got 100s of pages of documentation; I didn't read, I just signed. #ACS10 #Posner #LOL

<comment><USER33> Isn't that a more efficient use of time? The terms aren't negotiable other than walking away.

<comment><USER32> I am not so sure about it. The contract might contain something substantially adverse to you and still be enforceable. For example, in some EULAs I saw a paragraphs completely forbidding you to compete with any products of the company.

</comment></comment></comment></comment><comment><USER34> Did an analysis on Alexa's top 1000 sites and their privacy policies a few years back. A brief infographic of the high level of this [https://mashable.com/2011/01/27/the-real-reason-no-one- reads...](https://mashable.com/2011/01/27/the-real-reason-no-one-reads- privacy-policies-infographic/)

</comment><comment><USER24> I don't think it's really fair to compare a privacy policy to A Critique of Pure Reason. One is hard to read because it references laws and has a lot of boilerplate stuff that you can skip over, the other involves abstract philosophical questions that are difficult to consider in terms of the subject matter itself.

</comment><comment><USER35> All or nearly all privacy policies are incomprehensible. The main exceptions appear to be European, or non-profit's.

Does this uniform incomprehensibility come from an identifiable root cause, or is it just emergent because of a variety of factors, not all of which afflict every company?

<comment><USER4> Key quote from the article:

> These are documents created by lawyers, for lawyers. They were never created > as a consumer tool

They are generally treated as the responsibility of the legal team, so they are written as legal documents. Companies treat them as a way to pro-actively defend against lawsuits (much like the Terms of Service), and _not_ as a way to inform or educate users.

The reason why many readable privacy policies come from Europe is because GDPR makes it literally a legal requirement that they are written "using clear and plain language." Source: GDPR Article 12 [https://gdpr- info.eu/art-12-gdpr/](https://gdpr-info.eu/art-12-gdpr/)

</comment></comment><comment><USER36> I'm pretty proud of this one..... [https://www.honestrepair.net/index.php/privacy- policy/](https://www.honestrepair.net/index.php/privacy-policy/)

<comment><USER37> That _is_ shockingly comprehensible and concise; you are right to be proud!

(BTW "it's" should be "its" in the second sentence.)

</comment></comment><comment><USER38> I don't see why they can't just follow the example of open source licenses. GPL is powerful and complicated, but when you see something is GPL you know what you're getting into because you've seen it before. There are a handful of well-known policies that have varying levels of generosity, and anyone can always make up a new one -- but if they do it's a bit of a red flag and people will dig in to find out what it's about.

The problem with current policies is only partly that they're complicated, it also has a lot to do with them being snowflakes too.

</comment><comment><USER39> Built [http://www.privacyparrot.com](http://www.privacyparrot.com) which uses ML to simplify privacy policies back in 2011 and it continues to grow in usage.

Thank you HN community for the feedback back then [https://news.ycombinator.com/item?id=3222334](https://news.ycombinator.com/item?id=3222334)

</comment><comment><USER40> My preferred privacy policy is as follows:

"Privacy Policy: We will not share your private information with anyone."

<comment><USER41> Yes, but what does that mean?

What does your site define as private information? If the data got sent to you, it's no longer "private," at least in one sense of the word.

Is "selling" information considering "sharing"?

Questions like these are why the legalese of privacy policies _needs_ to be complicated - it's simply ambiguous otherwise.

<comment><USER40> _> Yes, but what does that mean?_

It means exactly what people would expect it to mean. In such cases of plain and simple language in a contract, courts go with that.

 _> What does your site define as private information?_

If a site defines what is private information that is different from a common sense understanding, the site is being dishonest and tricky.

 _> If the data got sent to you, it's no longer "private," at least in one sense of the word._

That is an absurd and disingenuous interpretation that no reasonable person would ever expect to mean to be the definition of private.

 _> Is "selling" information considering "sharing"?_

Yes, selling information is sharing it. Obviously. As any court would rule.

 _> Questions like these are why the legalese of privacy policies needs to be complicated - it's simply ambiguous otherwise._

Complicated contracts are always bullshit 10,000% of the time, designed to cheat and trick in all of the cases, without any exception ever.

The most simple language possible is needed. Complex wording hides a multitude of sins.

</comment></comment></comment><comment><USER42> Graphs done right! I can't imagine how this article could be better.

I wish they would make their privacy analysis tools available to the public. So you could plug in the URL of your favorite policy and see how it ranks.

</comment><comment><USER43> This is not exactly news, but having a NYT statement is cool.

They're obviously legalistic bullshit. So whatever privacy and rights I need, I create myself. And so I can entirely ignore ToS and privacy policies.

</comment><comment><USER44> "I agree" is the biggest lie of the information age.

</comment><comment><USER45> Meanwhile, the New York Times privacy policy is also enormously long and unreadable. It even links to the Google privacy policies, saying that by reading the NYT you also have to be aware of the Google privacy policies, because the NYT uses both Google Ads and Google Analytics.

[https://help.nytimes.com/hc/en- us/articles/115014892108-Priv...](https://help.nytimes.com/hc/en- us/articles/115014892108-Privacy-policy)

<comment><USER46> > It even links to the Google privacy policies, saying that by reading the NYT > you also have to be aware of the Google privacy policies, because the NYT > uses both Google Ads and Google Analytics.

In order to build apps on Google APIs, your end users are required to agree to Google's API terms. In this case I'm not sure they were required to do this, but it's pretty normal to have your users agree to third-party terms as part of your terms.

</comment></comment><comment><USER47> I spent a ton of time on making my site's privacy policy easy to read, while also discussing philosophy and some technical aspects, meant to be read by anyone who can understand simple English.

[https://aytwit.com/about#privacy](https://aytwit.com/about#privacy)

Feedback welcome! It's time to come up with solutions! So post yours below as well!

</comment><comment><USER48> I did a similar, deeper review of less policies for my course work in Privacy Protection and Freedom of Information with some of the same conclusions around length & required reading level. It's worse than this though; Orgs like Facebook have dozens of documents that deal with what data they collect and how they will use it. Even identifying what comprises their "privacy policy" is a huge task.

Another _massive_ issue: unilateral, largely uncommunicated changes. Stack Exchange used to have a very handy regular (read: legalese) policy and a parallel "plain language" version that I can't find anymore. They still have a relatively decent policy but that's only because the average quality is so low.

for context I was using Canada's The Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's PIPA which is a scope similar to GDPR in many ways. PIPEDA is an interesting document; it's based on a set of expectations or statements that are decidedly "non legal" in nature which makes it very different from most laws

</comment><comment><USER49> I've never used the service, but these guys have tried to standardize and automate the generation of privacy policies:

[https://www.iubenda.com/en/](https://www.iubenda.com/en/)

<comment><USER50> You need an account just to generate text?

<comment><USER49> I just recalled it existed and posted it - you can go argue with the people at the company about how their site works.

I would imagine that it's kind of vulnerable to people just ripping the text off if they're not careful.

</comment></comment></comment><comment><USER51> Creative Commons like modular privacy policies could be a solution: [https://www.achtungtechnik.de/english/2018/GDPR-statement- li...](https://www.achtungtechnik.de/english/2018/GDPR-statement-like-CC.html)

</comment><comment><USER52> My understanding of the GDPR in Europe is that these policies inform consumers but do not bind them. There is a widespread practice to let consumers sign them everywhere but this piece of paper does not change much the requirements for the company under the law.

</comment><comment><USER53> For me it was very interesting to see what GDPR did did to Googles privacy policy: it seems to have forced them to simplify and shorten it.

</comment><comment><USER54> Lawyers are awful.

</comment><comment><USER55> Luckily, these "contracts" are void in most European countries.</comment>


Balancing startup and school - with a Jolt - <AUTHOR> http://adynammic.com/blog/?p=9

<comment><USER3> I don't know. Focusing on school and a startup is sure one circus act that I'm still having trouble with, but staying up for two days straight is not a good idea. The best way to get things done is to manage your time well and get as much sleep as possible. I try to focus on working out, making my launch stay to one date, and keeping my grade above average. This requires me to get as much rest as possible, I sleep for 8 hours a day and I get a lot done.

</comment><comment><USER4> I'm a high schooler, taking 7 AP courses and 2 other courses with no lunch period (I have to eat during some classes). After school, I run 10 miles cause I'm on the distance running team. I get home, shower, dinner, and between 8pm and 7am, I have 12 hours to do a combination of sleep/homework/programming.

So from my experience (as someone who averages 3-4 hours a night), NO CAFFEINE. Caffeine ends up destroying you and making you less capable of doing things. Apples wake you up more than a cup of coffee. EXERCISE. A few pushups in the middle of the night wake you up better than anything.

 _Prioritizing_ is probably the most important. I usually go Schoolwork -> Programming -> Sleep as my priorities. On days before track workouts or races or big tests, I swap Sleep and Programming as priorities.

It really is difficult to balance school and programming, but hey if you want to pursue something you gotta give it your all. Just don't destroy yourself while you're at it. I exercise, eat, and sleep binge on weekends. Its a good life.

<comment><USER5> A stellar case of youth not being wasted on the young.

</comment></comment><comment><USER6> Remember, doing all this I-am-startup-man-stuff is very much possible when you are healthy. If you start to feel even the slightest bit sick, most if not all of it goes out the window. Feeling you are getting sick is a red flag from you that one or more variables (nutrition, stress level, amount of sleep, exercise, workload, social life) is out of whack. Better, focus on balancing your life so you don't get sick (eat right, exercise, take a break and go out with friends).

</comment><comment><USER7> I think it all depends on how one can handle small amounts of sleep. I know that I am able to go long periods of time with little sleep. I once worked landscaping for a summer and would work 15 hour shifts and consistently get 4-5 hours of sleep.

I guess to each his own though.

</comment><comment><USER8> I don't think doing something so unhealthy could possibly be worth it. There will still be startups left to be founded after you graduate. Or there will still be grad programs left to be attended after you IPO.

<comment><USER4> As long as you eat and get your exercise, foregoing sleep isn't THAT bad.

Though, admittedly it hurts your liver and slows brain development. And bad sleep patterns will follow you later into life...

but hey, we're young and we think we're invincible! Dont ruin the illusion! ;)

</comment></comment><comment><USER9> Drop out, if its what you really really want to do. I spent three years trying to do startup stuff and school. Eventually i realized that i was really happy only when i had time to focus on my projects, and that school work got in the way of actually completing something to a really high level. Its a great way to train, but if you feel that now its time to do something serious - <USER2> out.

</comment><comment><USER10> This advice would be more convincing if it was from the google founders. "We never slept because we were simultaneously going to stanford and making google. Our success is due to coffee."

Instead it is always from someone working on something lame and going to some random 2nd rate school. Most people who are good at what they are doing have time to sleep.

<comment><USER11> Wow lots of unwarranted assumptions and generalizations here.

Not gotten enough sleep? :D

</comment></comment><comment><AUTHOR> The no sleep is tough for me. Historically, I've required about eight solid hours. Lately, I've found that with a morning exercise routine I can cut about two hours out of my night's sleep and still function fine. Anything less than six hours and I start to require a power nap during the day.

</comment><comment><USER12> What goes up must come down. Don't forget, this is a marathon, not a sprint.</comment>


Side project: CloudyCharge – Get alerted when AWS usage exceeds free tier - <AUTHOR> https://cloudycharge.com
There is already AWS billing alerts, but it runs once every 6 hours, which might be too late for some people, and the user experience is also not great. So CloudyCharge.com was created. CloudyCharge notifies, via email or SMS, whenever the cloud usage breaches free tier, within 5 minutes. CloudyCharge accesses user's cloud account via a read-only role in their account with access grant to CloudyCharge's IAM user.
Planning to keep the service free forever. Currently only EC2 instance support is added, but planning to add more. Looking for early feedback. Thank you for your time! <comment><USER2> I guess it's a decent idea. But you might want to educate users when they are setting up the services so overcharging is avoided. It seems unlikely that an educated person would overcharge by that much that a 6 hour warning wouldn't work.

Prevent the problem rather than fix it.

<comment><USER3> It is not a decent idea. It is Great idea for a side project; but I am not sure how can you capitalize it.

I mean, it gives a __huge __value to the user, and __probably __there 's a market for it.

But, it's a free product to stay into the free zone...

In order to have something in return, I guess you can aggregate that information, and look at what patterns you can find. Probably to market yourself as an expert -or- working as a reseller.

Anyway it's a _good_ job (tm) and you should be proud of it.</comment></comment>


Does OSS Work for Business Users? - <AUTHOR> http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=development&articleId=9066615&taxonomyId=11&intsrc=kc_top

<comment><AUTHOR> Immediately, my head says yes. Then I think about this question and realize its not that simple.</comment>


The Rest of the Rest of Us - <AUTHOR> http://radar.oreilly.com/archives/2008/01/the_rest_of_the.html <comment><USER2> Nice article. The OLPC would probably be an ideal way to help cross our local digital divide. But the problem seems to be systemic.

Perhaps more problems could be solved if funding for school districts wasn't tied so directly to homeowners in the area (since affluent areas would concentrate the wealth to schools in their districts).

And while I'm at it, it isn't just about the money (although this would at least provide for better student teacher ratios), but the quality of teachers you can attract to poorer areas. Now that's a difficult problem to solve...</comment>


Ospari: PHP based Blogging software that can use Ghost themes - <AUTHOR> https://github.com/28h/Ospari

<comment><USER2> Quick feedback: Don't commit vendor packages to your repository, make use of Composer ([http://getcomposer.org](http://getcomposer.org)). Separate out your application core from the public folder, that way you don't need to rely on your web server for security: if someone uses nginx your set up leaves them vulnerable. Look into MVC, you have logic and display mixed together.

<comment><AUTHOR> You are right. The application does not belong to public folder. My goal is to make installation as easy as possible. Just copy the code and start to blog. Another reason is, that you can't easily run the application in subdirectory for example /blog/ if put the application code behind public folder.

Composer is a good Idea, but with first version we wanted to deliver one single package for the end users. We would use composer for the next releases.

<comment><USER2> If you absolutely cannot separate out the public portion of the application from the core -- which should be possible because even the worst shared hosts allow for folders above public_html -- then you'll need to use a PHP solution for protection the files. For example if you define a constant in index.php and then check for that constant in included files you can prevent access, eg:

        defined('BASEPATH') OR exit('No direct script access allowed');

From [https://github.com/EllisLab/CodeIgniter/blob/develop/applica...](https://github.com/EllisLab/CodeIgniter/blob/develop/application/controllers/Welcome.php)

<comment><AUTHOR> You are right again. But I will complicate the installation. The PHP files are secure, they are classes ore arrays. if you execute them nothing happens. We have an .htaccess file in core applications folder. The .htacces file rejects all requests.

We would provide security tips also for nginx users. Just to repeat all files except index.php are classes ore arrays and and they don't execute any code.

</comment></comment></comment></comment><comment><AUTHOR> By our first post on HN some users criticized us that we call Ospari open source but no one can see our code or download Ospari. We worked hard and released the first version today.

</comment><comment><USER3> Could you post few screenshots of the admin panel? A functional demo of admin panel would be even better.

<comment><AUTHOR> Here is a quick screen short [http://awesomescreenshot.com/04e2brbo81](http://awesomescreenshot.com/04e2brbo81) We a basic and clean admin interface. Ospari uses Markdown. You have a live preview as you type and everything is auto saved.

<comment><AUTHOR> Follow us on Twitter @Ospari for updates. We would post more detailed docs in the next days.

</comment></comment></comment><comment><USER4> You need to write some documentation if you want to get anyone interested.

<comment><USER5> Tests would be good, too.

<comment> ryan-allen WordPress is doing pretty well with no tests!

<comment><USER4> WP has tests, they are not perfect but they exist.

[http://unit-tests.svn.wordpress.org/trunk/](http://unit- tests.svn.wordpress.org/trunk/) [https://github.com/10up/wp_mock](https://github.com/10up/wp_mock)

</comment></comment></comment></comment><comment><USER6> Somebody explain why this is necessary. Ghost is open source. Why not just uses Ghost? It also uses Ghost themes.

<comment><USER7> To run Ghost, you need a server to host it on, and enough knowledge to set it up and manage it. You need some level of sysadmin skills just to understand the install instructions.

A PHP application can be dropped on any $2/month shared hosting account over FTP. That's the extent of the installation, and the host will support it for you. Even cheap unmanaged shared hosts will troubleshoot setting up PHP code for customers.

Ghost can only be set up by people that frequent sites like HN. A PHP app can be set up by anyone. That's why over 40 million people use WordPress where maybe 20k have used something like Jekyll.

<comment><USER8> While not quite the same as having FTP access Ghost do offer hosted blogs from only $5 per month. Anyone that can set up a WordPress.com blog should find Ghost just as easy.

<comment><USER9> Ok, but not everyone can pay Ghost hosting plan, since "$" is not the default and official currency in every country.

<comment><USER8> The Ghost Foundation is a UK organisation and I can assure you that USD is not the default currency here. If they're willing to make the effort to accept USD, I'm sure there are plenty of bloggers able to make the effort to pay using it.

Regardless, USD is the de facto standard for SAAS payments (whether this is good or bad is a discussion for another time). If you can't pay in USD then you'll find a substantial proportion of services unavailable to you.</comment></comment></comment></comment></comment>