Seventh RISC-V Workshop: Day One - <AUTHOR> http://www.lowrisc.org/blog/2017/11/seventh-risc-v-workshop-day-one/ <comment><USER2> For those not following RISC-V closely, 2018 promises to be an interesting year:

* 64 bit hardware will be available from SiFive. It'll be low-ish end, 4 application cores, but it'll run real Linux distros. SiFive are already shipping early hardware to various partners.

* Linux 4.15 will ship with RISC-V support. It's available in RC releases now. (-rc1 was 3 days ago I think)

* glibc will ship RISC-V support. That'll happen in February 2018. I think it's not appreciated how important this is. It means there will be a stable ABI to develop against, and we won't need to re-bootstrap Linux distros again.

* GCC and binutils have been upstream for a while.

* A lot of other projects have been holding off integrating RISC-V-related support and patches until RISC-V "gets real", ie. it's really available in the kernel, there's hardware. These projects are unblocked.

* Fedora and Debian bootstrapping will kick off (again). [Disclaimer: I'm the Fedora/RISC-V maintainer, but I'm also getting everything upstream and coordinating with Debian]

* There'll be finalized specs for virtualization, no hardware though.

* There should be at least a solid draft of a spec for industrial/server hardware. Of course no server-class hardware available for a while.

<comment><USER3> Has SiFive released any dates for their dev board that can run Linux? I haven't been following it to closely but would love to get one.

<comment><USER4> My reading of the blog post is that it'll be released in Q1 of 2018. Until then, they're giving a few FPGA stand in boards out. The dev board itself will also use an FPGA to implement a few SoC peripherals, like USB and HDMI.

<comment><USER2> Actually they are sampling the real chips out to some developers now. However you are correct in saying that an FPGA is used to implement the Southbridge, which is mainly for practicality of getting a board out quickly, not because of awesome self-modifying hardware(!)

</comment></comment></comment></comment><comment><USER5> And day two: [http://www.lowrisc.org/blog/2017/11/seventh-risc-v- workshop-...](http://www.lowrisc.org/blog/2017/11/seventh-risc-v-workshop-day- two/)

<comment><USER6> "Boomv2 achieves 3.92 CoreMark/MHz (on the taped out BOOM), vs 3.71 for the Cortex-A9." \- it's a bit of a letdown. I was hoping it'd be closer to x64 performance than to Cortex-A, but it's probably not achievable for RICS-V budget.

<comment><USER7> Sorry to disappoint, AllSeeingEyes. What I taped out is a fairly modest instantiation of BOOM. I was trying to reduce risk and we had a very small area to play with, so I settled for ~4 CM/MHz. One potential win here would have been to use my TAGE-based predictor, which is an easy >20% IPC improvement on Coremark. Of course, a lot more reworking would be needed to achieve x86-64 clock frequencies.

<comment><USER8> > which is an easy >20% IPC improvement on Coremark. Of course, a lot more > reworking would be needed to achieve x86-64 clock frequencies.

Maybe these should be expressed as Instructions Per Second (at peak and at the point of diminishing returns?) or something like that, rather than two independent numbers. Higher clock frequency actually seems like a _bad_ thing, all else being equal. It seems to me that throughput ought to trend toward infinity, clock frequency toward zero. ;- )

<comment><USER7> Of course it's important to always keep the "Iron Law" in mind, but it's far easier to compare ideas and talk about things in terms of IPC. For example, if a switch out one branch predictor for another, we're talking about an algorithmic change (implemented in hw) that will have an effect on IPC, and no effect on clock period (assuming we didn't screw something up).

This is particularly useful when talking about a processor _design_ , and not a specific processor in particular. As you said, there's a lot of good about slower clock frequencies, so you'll see the same ARM design being deployed at a variety of frequencies. Far easier to talk separately about a design's IPC from its achievable clock frequency (although both are important!).

</comment></comment></comment></comment></comment><comment><USER9> I've been following developments in RISC-V since I first heard about it a few months ago and I want to get involved! What can I do? I do embedded systems development as my day job and am really eager to dig into architecture and hardware design.

Can somebody associated with the project reach out to me?

<comment><USER10> The lowrisc project [1] tires to be sort like a hardware linux. They are working on a linux capable SOC and they have a number of innovative ideas you might be interested in.

Maybe listen to this maybe: [https://www.youtube.com/watch?v=it3vVtnCYiI](https://www.youtube.com/watch?v=it3vVtnCYiI)

[1] [http://www.lowrisc.org/](http://www.lowrisc.org/)

</comment></comment><comment><USER11> Practically, what's stopping someone from making a privacy-oriented ARM implementation (meaning, while I can't "make my own" ARM board due to patents, why can't I make a board which is "source-available" and doesn't contain a ME or PSP-like engine)?

Is there something in the ARM license?

<comment><USER12> A ton of ARM boards like this already exist. You can bring up most Allwinner chips with 100% open source code. The bootmask from for many have been dumped and disassembled even.

The trouble is they all suck in some slightly different way. Maybe only 1gb ram, maybe a bottleneck bus in front of your net or storage io. Graphics are the big pain point right now. Etnaviv/vivante is your only choice for free accelerated graphics, and you'll only find it in a few chips. Mali and PowerVR are all around, but have absurdly difficult to work with closed source drivers.

The nicest oss-all-the-way-down arm socs are i.MX6, which is expensive and frankly old/slow.

To be clear: riscv doesn't solve any of these concerns. That doesn't mean it isn't an amazing project.

<comment><USER11> So how will RISC-V help? Do ARM patents cost that much to license?

<comment><USER12> RISC-V doesn't directly help with _any_ of these concerns.

But it is an alternative to ARM, and has a governance model that parties interested in open standards might be more willing to join.

Right now, ARM CPUs on the low end have little standardization at the SOC level. They have a few cores from ARM, (what you think of as the main CPU, maybe a GPU, maybe a low end micro for power management, and a couple more for realtime tasks). Then you have the non-ARM IP in the form of image processors for cameras, video decoding, etc. The SoC mfg is responsible for gluing together all these parts, and every mfg has their own proprietary take on the process, meaning a different initialization sequence, different firmware layouts, etc.

The SoC mfg's goal is to ship a product. It isn't to define a standard, and since there is no standard to follow, 'anything' goes.

Because ARM costs enough that it isn't viable to do a SoC layout you aren't going to ship millions of the chip, academic research (where the seeds for standards are often planted) just doesn't happen.

<comment><USER11> >Because ARM costs enough that it isn't viable to do a SoC layout you aren't going to ship millions of the chip, academic research (where the seeds for standards are often planted) just doesn't happen.

Is it license or fab issues? I thought that license is $0.X per chip, so it shouldn't make a difference (license-wise) if you make Y chips or 100,000 * Y chips. Fab costs change by overhead, but how would RISC-V help there?

<comment><USER12> It's a mix of upfront costs and per-chip royalties, with upfront costs for the IP being in the millions.

Here's a somewhat accurate article on the topic: [https://www.anandtech.com/show/7112/the-arm-diaries- part-1-h...](https://www.anandtech.com/show/7112/the-arm-diaries-part-1-how- arms-business-model-works/2)

</comment></comment></comment></comment></comment></comment><comment><USER13> I know at least Allwinner were using OpenRISC for their embedded controller on recent chips, and it wouldn't surprise me if other companies were doing the same, so I do wonder to what extent RISC-V is replacing that rather than commercial cores for this application.

</comment><comment><USER14> These notes are wonderfully detailed and compact. Please do this for all my meetings!

<comment><USER15> I'm glad you find them useful. Really I'm indebted to the presenters for giving such clear and well explained presentations.

</comment></comment><comment><USER16> I wonder what Microsoft will do with RISC-V. Hopefully they don't think it is too risk-y.</comment>


Users as people and the participatory economy - <AUTHOR> https://sariazout.substack.com/p/check-your-pulse-50 <comment><AUTHOR> A paradoxical truth in business is that most companies spend little time focused on their customers. The beauty of the participatory economy is that it's not only about what makes sense for publishers, advertisers, creators, teachers, etc… but also listening to the people on the other side (students, fans, readers, shoppers) and honoring them as people, not users.

<comment><USER2> How do you feel about calling them "Participants" in this model instead of "People?"

</comment></comment><comment><USER3> _In many ways TikTok is the best example of a participatory network._ _As noted by Eugene Wei, "The TikTok algorithm acts as a rapid, efficient market maker, connecting videos with the audiences they're destined to delight._ _The algorithm allows this to happen without an explicit follower graph."_ _The removal of a follower graph prioritizes creativity and talent over reach, democraitizing and unlocking participation._

I'm not sure about the effects of using a recommendation algorithm over using follower graphs. Maybe it's backwards. e.g. people dislike that Twitter shows them recommended stuff, because people (users?) prefer having control over who they follow, what they see.

This did make me wonder about what would happen if users could provide their own recommendation algorithm.

</comment><comment><USER4> So many buzzwords. What the examples show are schemes where the 'fans' (their word) do more of the work for a small cut of the profits.

This is not a new idea. It's all too similar to Amway and other multi-level marketing schemes. More complicated, with more roles other than selling and building a downline. But similar in the ways the money flows.

 _" People like you helping people like us help ourselves"_

</comment><comment><USER5> I got quite excited when I thought an article on Participatory Economics as proposed by Michael Albert and Robin Hahnel has made the front page of HN.

Maybe someday...

[https://en.m.wikipedia.org/wiki/Participatory_economics](https://en.m.wikipedia.org/wiki/Participatory_economics)

<comment><USER6> An economic system based on peer evaluation sounds interesting. But there are many related problems that are far from solved. For example: online comment moderation. Or SEO-resistant search ranking. Or even democracy.

</comment></comment><comment><USER7> In reading this, I'm reminded of co-innovation platforms that rose up around 2007 and focused on R&D and product dev. As well as how companies like Threadless and Quirky used them to reward successful community creators. Throw in resellers and varying referral programs, and you've quite a spectrum of options for "community brands". It's neat to see more companies experimenting with business models where participants drive growth through financial and non-monetary incentives. It can certainly help drive "participant" acquisition and activation. Just try to keep these programs straightforward and they should be fine.

</comment><comment><USER8> I've been considering this participatory economy for a long time (longer than I think the term has existed). What blows me away is how fast companies are cropping up to fill this space. There are a dozen startups in this post that I haven't heard of before today that have some significant VC backing. It does feel like this is a space that is ready to see some growth.</comment>


Breakthrough in Synthetic Vaccine Technology Requires No Refrigeration - <AUTHOR> https://www.bristol.ac.uk/news/2019/september/synthetic-vaccine.html <comment><USER2> would this work for biologic drugs like remicade, humira and the like that require refrigeration?

<comment><USER3> My guess is no, based on this quote from the article:

> "We were working with a protein that forms a multimeric particle resembling > a virus but is completely safe, because it has no genetic material inside," > said Pascal Fender, expert virologist at CNRS. "Completely by chance, we > discovered that this particle was incredibly stable even after months, > without refrigeration."

It looks like the protein was chosen for its virus-like structure and/or its potential to be remodeled to mimic this specific virus (Chikungunya), and it only happened to be thermostable.

</comment></comment><comment><USER4> This is a huge deal.

A big issue the anti-vaccine movement latched onto was "they contain mercury!". Technically true- a compound used as a preservative has some mercury molecules in it. Never mind that it wasn't elemental mercury and was perfectly safe to ingest, or that the quantity of mercury was less than is in most fish-based diets.

The end result was a lot of third world countries naively banning vaccines containing mercury- meaning that all these vaccines no longer had preservatives that let them survive longer outside of refrigeration. It's hard to bring "must stay refrigerated" anything into rural areas in less developed parts of the world (or at least, it's a lot more expensive to do it). End result: fewer people vaccinated, and more preventable deaths, higher costs per person saved.

This kind of breakthrough, if applicable more widely, could save millions (of both lives and dollars).

<comment><USER5> I used to work for Andy Wakefield, so I have a bit of a different perspective on this issue. The important things that aren't in this are MSG, Mercury, and possibly adjuvants like aluminum, because

> Our vaccine candidate is easy to manufacture, extremely stable and elicits a > powerful immune response.

Those are what most of the intelligent anti-vaxxers worry about, except for a few people who object to fetal tissue being used in development, which is not an issue here.

I'm sure some folks will get up in arms about this, but it'll be a huge step forwards in many people's minds, and hopefully will be used as a template in the future.

To clarify: I'm not an anti-vaxxer, but I do think the testing process isn't rigorous enough, and I have seen absolutely awful medically confirmed reactions firsthand, which gives me a slightly different perspective. Vaccines are good, but I want the reaction rate in non-immunocompromised people to be zero

<comment><USER6> Meh

<comment><USER5> Yeah, that's my problem. Vaccines are oversold, so to speak. Everyone has a story about getting the flu immediately after getting the shot.

My big thing is safety and accountability. Currently, if a vaccine is harmful, the company that makes it has no liability, /and/ there's no control/test testing. The only way they're tested is by giving people the same shot with and without the viral component.

Problem is, saying anything that makes vaccines not sound like unicorn blood makes you one of "them", and you obviously want everyone to die of polio.

<comment><USER7> People do sometimes get sick with mild symptoms for a day or so after receiving the flu shot, but is nothing compared to the actual flu.

<comment><USER8> Yeah, last year was the first time I had symptoms from the shot. As someone who actually has had the flu, it felt like the final few days of the real flu, after the fever has broken, the worst is over and you are finally better and on the upswing.</comment></comment></comment></comment></comment></comment>


Study linking GM maize to rat tumours is retracted - <AUTHOR> http://www.nature.com/news/study-linking-gm-maize-to-rat-tumours-is-retracted-1.14268

<comment><USER2> Seems the main criticism is sample size - what was it?

> showed "no evidence of fraud or intentional misrepresentation of the data", > said a statement from Elsevier, which publishes the journal. But the small > number and type of animals used in the study means that "no definitive > conclusions can be reached".

The type of animal is the same as used in the compared Monsanto study, so that seems shaky.

<comment><USER3> For starters, the breed of rat used - Sprague-Dawley - is one that routinely develops cancer and tumors, and is, in fact, used in cancer research for exactly this reason. So the fact that they developed tumors is about as surprising as a sunrise, and the study in question did not have any controls or statistical compensation whatsoever for this fact. Then, of course, there's also the sample size.

<comment><USER4> [http://ac.els- cdn.com/S0278691512005637/1-s2.0-S027869151200...](http://ac.els- cdn.com/S0278691512005637/1-s2.0-S0278691512005637-main.pdf?_tid=031027b4-5914-11e3-8060-00000aab0f26&acdnat=1385743003_c29458b2a2716542f38d07dcb7c8f5c9)

I haven't read the full paper but the abstract does mention controls. I have no idea if they were for some reason inadequate or there were methodological errors but you are incorrect to say that there were no controls.

<comment><USER3> Let me rephrase: by control, what I mean is not "control group," but "statistical control." Their statistical analysis did not properly account for the immensely increased likelihood of cancers given the breed of rat they chose.

<comment><USER5> From their abstract, they don't cite the breed of mice they use, but they do cite that control groups had tumors and cites the tumor rate as compared to control in addition to absolute rates. To me that makes this a non-issue considering the target audience.

<comment><USER3> Stop reading the abstract and _go read the paper._

"but they do cite that control groups had tumors"

Yes, of course they did - they were the same breed of rat, and as I've already mentioned, they almost invariably get tumors.

"cites the tumor rate as compared to control in addition to absolute rates"

So what? The problem is that with a single trial, and such a small sample size, there is _no evidence that any differences in observed cancer rates were not simply due to random variation._

"To me that makes this a non-issue considering the target audience."

No offense, but no one really cares how it seems _to you._ The whole purpose of the scientific method is to get around individual biases. And what do you mean by "the target audience?" What does that have to do with anything? It doesn't matter who the target audience is - that doesn't excuse a poorly designed study. Seralini's study had a small sample size - one sixth the minimum recommended by accepted guidelines for studies of this type using this kind of animal. He's repeatedly refused to make his full data set publicly available. There's some evidence that rat feed may have been contaminated with GMO derived soy products, which would, of course, invalidate the results completely. There's also some question of multiplicity effects as well. In short, there are plenty of problems with this study, and your cursory examination of an abstract isn't going to dig up some smoking gun that invalidates all of the well deserved criticism.

</comment></comment></comment></comment></comment></comment><comment><USER6> Maaize… ohhhh.</comment>


The React Native Book - <AUTHOR> https://leanpub.com/thereactnativebook

<comment><USER2> The first chapter contains a basic intro to objective-c. I was hoping I not had to learn this language, but I see it's a necessity after all.

<comment><AUTHOR> Yes, the book's Objective-C code is comprehensive enough for newcommer to understand. And one should know it to know how to extend the framework itself.</comment></comment>


PyCharm 4.5 Introducing Python Profiler - <AUTHOR> http://blog.jetbrains.com/pycharm/2015/05/pycharm-4-5-eap-build-141-988-introducing-python-profiler/

<comment><USER2> I tried it it is very good. The best feature is that when you trace through code, all variables before your trace location show a gray 'ghost' with their current values, including numpy arrays.</comment>


The magic kernel - <AUTHOR> http://www.johncostella.com/magic/ <comment><USER2> When seen as a [1 3 3 1] (the 4th row of Pascal's Triangle) kernel, it is more easily revealed as a discrete Gaussian kernel, which is for example used in scale-space representations in image processing.

<comment><USER3> The same applies to {0.05, 0.25, 0.4, 0.25, 0.05} mentioned later: it's proportional to 1 5 8 5 1, which is two rows down from 1 3 3 1.

<comment><USER4> The row is 1 4 6 4 1, but these are the closest 5-cent approximations to the 1/16th that add to 1.

<comment><USER3> Thanks for the correction, and additional information.

</comment></comment></comment></comment><comment><USER5> Let me share my experience with chroma upsampling and smooth jpeg decoding.

At first, I optimized each channel, then upsampled the chroma channels using replication. This works terribly as you can see in the article.

So then I changed to linear interpolation. Briefly:

        +---+---+
        a x b y c
        +---+---+

We know the values in a and c but not b. The distance from x to a is half a pixel and the distance from x to c is one and a half pixel. Then linear interpolation gives x = a + (c - a) * (1/2 - 0) / (2 - 0) = 3/4 a + 1/4 c.

This worked decently, but it still showed fringes around sharper edges. I considered using more complicated upsampling methods like Lanczos or Mitchell, but instead went with optimizing a full size image with constraints on the downsampled image. By avoiding upsampling I got my optimized high resolution image for each channel.

But there were still fringes! As it turns out, just because each channel was optimized seperately doesn't mean that the image as a whole is optimized. So I switched to optimizing the three YCbCr channels together, not looking at the differences abs(x_{i+1} - x_i) but looking at the differences sqrt((Y_{i+1} - Y_i)^2 + (Cb_{i+1} - Cb_i)^2 + (Cr_{i+1} - Cr_i)^2). This actually eliminated the fringes.

The final result is [https://github.com/victorvde/jpeg2png](https://github.com/victorvde/jpeg2png)

</comment><comment><USER6> Sorry guys, but no magic is involved here: [http://cbloomrants.blogspot.com/2011/03/03-24-11-image- filte...](http://cbloomrants.blogspot.com/2011/03/03-24-11-image-filters-and- gradients.html)

<comment><USER7> I mostly agree. But

> _Costella shows that Lanczos and Bicubic create nasty grid artifacts. This > is not true, he simply has a bug in his upsamplers._

The good and bad part of discussions about image processing is that it's easy to compare the results. This blog post would be better with the images using the correct implementation of the filters.

(One problem is that some times just getting the images, configuring the programs and tiding the results is more time consuming than expected. So "just add the images" may be a one week project.)

<comment><USER8> For reference I get the following result with my GIMPs "Cubic" scaler:

[http://i.imgur.com/3LLNzv5.png](http://i.imgur.com/3LLNzv5.png)

<comment><AUTHOR> Notice the long-known bug, Gimp doesn't manage gamma properly, the scaled picture looks slightly darker.

</comment></comment></comment></comment><comment><USER9> I'll need to try this as an OpenGL (ES) shader in an app I work on regularly. I've been meaning to replace the default bilinear filtering with something a bit nicer-looking for ages, and this seems like it fits the bill nicely, as it avoids the usual ringing and moiré issues. (I don't need to worry about perspective correction as the app is 2D only)

</comment><comment><AUTHOR> My good friend Kyle posted his C++ port here: [https://github.com/kylegranger/ImageScaling](https://github.com/kylegranger/ImageScaling)

</comment><comment><USER10> This brings back high school memories of performing Gaussian blurring of 2-bit grayscale hand drawn sprites drawn on graphing paper. Yes, I got bored in class! I did use a calculator for assistance. :) I never knew there was such a remarkably simple kernel that provides good scaling!

<comment><USER11> The fact that you were studying Gaussian blurring in high school amazes me. Which kind of school, if I may ask? Is a standard program?

<comment><USER12> The "Yes, I got bored" part suggests that it wasn't in the program and he was studying it on his own.

</comment></comment></comment><comment><USER13> If you prefer blurry images such as the author seems to, you can use parameters to your cubic filter to add more blur than the (probably mitchell or catrom) parameters that gimp is using. I'd bet most people would find the result superior to this filter.

<comment><USER14> A good article on cubic filters: [http://entropymine.com/imageworsener/bicubic/](http://entropymine.com/imageworsener/bicubic/)

I think you mean the "B-spline" filter.

<comment><USER13> Ya, B-spline, as the article defines it: Cubic(1, 0), is an example of a very blurry cubic filter.

</comment></comment></comment><comment><USER15> What's the popular JPEG library that this is from? Why the refusal to mention it?

<comment><USER16> It's libjpeg. [http://libjpeg.sourceforge.net/](http://libjpeg.sourceforge.net/)

</comment></comment><comment><USER17> Finally all those haters who think low-pixel images cannot be zoomed in on are proven wrong... [https://www.youtube.com/watch?v=I_8ZH1Ggjk0](https://www.youtube.com/watch?v=I_8ZH1Ggjk0)

Now someone only has to find a way interpolate reflections in sunglasses, then I can die a happy man.</comment>


Sinkholed - <AUTHOR> https://susam.in/blog/sinkholed/ <comment><USER3> Hi, I am the author of this post. I had posted another link about this story a few days ago when this story was still unfolding.[1][2]

This blog post summarizes the timeline and the events that occurred to resolve the domain transfer issue. Like I have mentioned in this blog post, multiple parties such as Namecheap Support, the Shadowsecurity Foundation, and NIXI helped me in resolving this issue. Thanks to all of them and special thanks to Namecheap CEO, Richard Kirkendall, for looking into this issue on priority as soon as he became aware of it.

I wish the domain name management, in particular, and the Internet, in general, had a higher degree or decentralization, so that it were technically impossible for something like this to happen but I think there are many factors at play that are currently preventing from such an Internet to become mainstream at this time.

[1]: [https://news.ycombinator.com/item?id=21671579](https://news.ycombinator.com/item?id=21671579)

[2]: [https://twitter.com/susam/status/1200678538254393345](https://twitter.com/susam/status/1200678538254393345)

<comment><USER4> This is _great_ news!

Have you consulted a lawyer?

It seems that the Shadowsecurity Foundation did act recklessly. But you'd need to prove monetary damages.

But perhaps they'd settle to avoid the hassle.

Edit: This is an admission of guilt:

> He explained in his email that my domain name was sinkholed accidentally as > part of their Avalanche operation.

<comment><USER3> Thank you for this comment. I have not consulted a lawyer. I have not suffered any monetary loss due to this yet. I use this domain name only to run a small personal blog (the one linked to in this post) and an Exim4 MTA. The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back. The primary loss I suffered was in terms of time.

In fact, I appreciate the efforts of the Shadowserver Foundation in depriving Avalanche malware families of their command and control infrastructure by sinkholing the domain names generated by the malware domain generation algorithms. I understand false-positives like this can happen. It comes with the territory. It just sucks that the domain name I was using happened to be a false positive. In this case, it ended well because the Shadowserver Foundation (along with Namecheap) acted quickly on my issue and asked NIXI to have the domain transfer undone.

Having said that, I do believe that you make a very good point. Actions like this should be taken with a lot more care. What if it were not a personal blog but a small business? Depending on the nature of the business, an inadvertent domain transfer like this could have affected the business seriously. The Shadowsecurity Foundation did say that they are improving their processes.

I am not very concerned about this particular foundation when I talk about this. But I am concerned about the systemic issue in the domain name management system that allowed a mistake like this to occur. There could be some type of peer review before a domain transfer like this is executed. I don't think there is a general and popular solution for this problem in the near future. I am hoping that the recent work that is going on in consensus protocols based on cryptography might pave the way to a more decentralized network and more decentralized name management that also become popular and mainstream.

<comment><USER4> Yes, I get that the Shadowserver Foundation does good work. And that they acted quickly, after being pointed to your tweet.

However, if your tweet hadn't gotten traction, and if Namecheap hadn't been proactive, you'd likely have never gotten the domain back. I mean, you had the Namecheap CEO on the case! And for a business losing a domain like that, it'd probably be fatal.

I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages.

You say that "[t]he primary loss I suffered was in terms of time". But arguably your time is worth something. Such as your customary billing rate, times three.

Edit: Or just send them an invoice. At perhaps 50% over your customary billing rate, given that it was a rush job.

<comment><USER5> > I get that many think that Americans are hugely too litigious. But there is > the argument that there ought to be compensation for damages.

That point of view is rather unfortunate. Why does it have to be about damages? GP even ends his comment on a very postitive note about things that would help. Not every mistake needs to be punished. It was a false positive, and it was heartening to see that all the parties acted fast enough. Why not just move on instead of outraging over hypothetical concerns?

EDIT: I have no idea how to quote parent comments here.

<comment><USER6> I was kind heartened by how quick they reacted. However it is quite true that Americans are very litigious; however, austria, germany, israel are worse than us, and England isn't far behind.

<comment><USER7> I don't think I hear anybody from those countries talk about sueing nearly as much as any US citizen.

What is your source for that?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> As someone that deals with sinkholed malware domains everyday, I have to day I slightly disagree with the logic and approach behind it.

The basic premise is that unwitting hosts are compromised by malware,this malware is talking to a domain and in order to protect the infected users and curtail the further spreading of the malware the domain is sinkholed.

First, a random authority, regardless of legal relevance has no standing to "protect" infected hosts without explicit consent of the owners. If the infected host is causing harm to other internet hosts then it needs to be taken offline by it's network owner (e.g.: isp or datacenter operator that owns the IP AS number).

Second, in case of malware spreading (e.g.: wannacry) and DGA domains: if the domain is not registered, instead of a sinkhole, an administrative restriction on registering that domain should be placed. If the domain is registered, you want the IP infrasructure to be taken down. IP blocks an reputation damage can be very harmful. IP subnet owners are much more responsive and where that is not the case, a null route can be blaced to "sinkhole" the IP -- null routes are advertised using predefined BGP communities, this means it will be unreachable only by networks that accept that community (e.g.: FBI sinkholes an IP, american networks accept the community and block the IP while other countries might not). You have to understand why there are so many malware domains for C2 and why DGAs exist, it is more costly to become in control of an IP address than it is a domain. If you block the IP as soon as C2 is detected on it,the attacker will just change the A record to point to another IP, but they have a much more limited set of IPs and costly IP infrastructure so they'll be running out of them fast. You can use DGA and dynamic domains such as noip.org (MS famously sinkholed them taking down millions of legit hosts!) But you can't as readily come up with IP addresses. I like this approach because the IP owner is always in a position to force remediation of the C2 server or infected host, they can ban the user or work with them to remediate the infection after confirming, they can request removal from the sinkhole. Most malware operators have no more than a handful active C2 IP addresses but from experience, I see them use dozens of domains,sometimes from different malware campaigns pointing to the few few IP addresses in their control.

I am sure this has challenges but it is a cleaner way of doing it and focuses remediation on the C2. If this approach was taken, OP's IP would have been accidentally sinkholed, her webhost would contact her about it, she would show proof that the server has not hosted malicious content and work with them to lift the sinkhole. Meanwhile,the site can be moved to a different host (if it takes too long) and IP address, since the domain is not being sinkholed it would just work. Malware researchers and law enforcement can see if infected hosts continue to communicate with the new IP or if the new IP responds to C2 initial traffic to decide if it should continue to be sinkholed (costing OP hosting money if it was an attacker, it might cost them money and access to compromised hosts).

</comment><comment><USER9> Interesting. I noticed that the blog post mentions the Nymaim malware family. I read about Susam's case when it hit Twitter the other day and might have even followed a link to his URL. Then a few days later got an email from my ISP Virgin Media claiming they'd detected Nymain on my home network.

I run macOS only and as far as I can tell Nymaim is Windows only. Still, I ran an malware scan on my Macbooks and nothing popped up, so I'm pretty sure nothing infected my devices.

Still, I wonder if I ended up hitting the sinkhole, Virgin was somehow notified and this triggered their email? Or maybe it's just a complete coincidence.

Edit: Sure looks like Virgin works with Shadowserver: [https://www.ukfast.co.uk/it-security-news/virgin-media-to- in...](https://www.ukfast.co.uk/it-security-news/virgin-media-to-inform- customers-of-malware-infections.html)

<comment><USER10> That is the purpose of sinkholes. That's why you don't just change the DNS record to 127.0.0.1 (or similar) - you want to log the traffic that you're seeing so that you know who is infected and can help them.

I'm unaware of this particular international cooperation arrangement but it's great to see.

<comment><USER9> Yup. Looks like the system is working pretty well. Plus I'm pretty happy that I've got an explanation for the email I got!

</comment></comment></comment><comment><USER11> This kind of thing makes picking a personal email address a tricky decision.

Do I go with a @gmail.com or other corporate address? Then I risk losing my email if my account is suspended.

Do I go with a domain I own? Then I risk losing it if something like this happens.

Either way is serious because email is effectively a master key into all my accounts.

I'm honestly not sure what's best.

<comment><USER12> > Do I go with a domain I own?

This one, it's this one.

Losing your domain tends to require human action: from someone forgot to pay the renewal to someone messed up and sinkholed it because they thought it was a C2 server.

But because humans are in the system there tend to be layers of processes that try to prevent you from getting to this state and can get your world back to normal if you do.

 _Gmail offers nothing like this._ When the ML algorithms decide you are too many sigma in the "abnormal" category, you are done. And there is no one to talk to who can fix your problem.

<comment><USER13> Although if your using your own email address, be prepared for emails you send to end up in junk.

<comment><USER12> This is an unfortunate risk with running your own. Instead, pay someone - <USER2> Fastmail subscription is absolutely worth every penny.

If it ever becomes a problem I flip my MX record elsewhere.

</comment></comment></comment></comment><comment><USER14> Looking forward to hear from Shadowserver on a few points...

• What led to the false positive.

• What actions were taken to notify the domain owner about the actions being taken against them.

• Why there was not a comment put into the Whois entry — or in some other obvious place — saying what had been done to the domain.

<comment><USER15> I want to know why law enforcement allows a private organization to seize private property based on some algorithm.

I have heard bad things about shadowserver in the past. Now I wonder how much other collateral damage they have done over the years.

<comment> yc-kraln Domain names are not property, and this is not under the pervue of law enforcement. The country registrar (NIXI) is working together with someone to prevent abuse of their systems. When you purchase a DNS entry, you agree to this sort of thing as part of the ToS.

<comment><USER16> Right; this is essentially the same as a mail server operator relying on a DNSBL.

<comment><USER17> Exactly

</comment></comment></comment></comment></comment><comment><USER18> I don't find this surprising at all.

This can happen in any scenario where a special shortcut has been added to get around a standard process (where standard process usually involves some human review and judgement).

I imagine that in most cases, the shortcuts were created simply to speed up a process where some (perceived) harm is significant, and a rapid change would alleviate this harm. This would allow some enforcement agency to rapidly take down a child porn site, for example.

Such shortcuts can also be designed to prevent any other party from knowing what is going on - why the change is being made. This would be the case where some high level governmental agency (FBI, for example) wants to change something to prevent a situation they deem as bad or to perhaps to enable better awareness of a process/communication by inserting themselves into the middle of it.

And finally, in this case, an automated or human error resulted in this person's domain name being included on a "bad list", and the shortcut swept their domain along with the trash.

This particular situation doesn't bother me as much as the "Google/Apple/FB suddenly closed all my accounts" scenario (which is often triggered by some opaque artificial wishful-intelligence system).

Regardless of the situation, it's not ideal that our best course of action in recovering something wrongfully taken is by complaining on public forums. It's a shame that we have to hope for the attention and generosity of someone with more power to champion our case to right the wrongs.

So I say, bring the humans back into the process! :)

<comment><USER19> This is not really ok. There must be a clear contact point for the affected people (not only namecheap).

Also it was very bad on the transparency front. If they are taking down a domain, the operation is not secret anymore, so they can tell why. No telling you is bullshit.

That being a German operation, I would expect much better on the democratic handling of it. And it being an international operation, India should have complained that it was badly done too. What would happen if namecheap didn't care?

<comment><USER16> I think there _is_ a clear point of contact, and it _is_ your registrar. This is part of the reason a hierarchy of registrars exist, rather than each TLD just being one organization maintaining its own registry service: so that the people with ultimate authority (the TLD, in this case) can have personal relationships with _representatives_ of "constituencies" of domains (the registrars), rather than necessarily-impersonal relationships with a flat collective of millions of individual accounts (the domain owners).

By analogy: Google has necessarily-impersonal relationships with millions of Gmail users; but rather more personal relationships with far fewer GSuite and Google Cloud organization owners. If you were an employee of a company that uses either of those, and your service was breaking, you'd ask your GSuite organization-owner (i.e. the person Google has a personal relationship with) to contact them for you.

</comment></comment></comment><comment><USER20> It is really unbelievable that a legitimate domain can be transferred so easily without any verification or due process. Isn't there an EPP-code-based domain transfer process to prevent exactly things like this?

<comment><USER3> As mentioned in this blog post, the domain transfer was done as part of an international operation against the Avalanche botnet. As such, it was a legal action as opposed to an administrative action. Further, the action was taken at registry level as opposed to registrar level (which is one level lower than the registry). Therefore, no EPP code was necessary and the "clientTransferProhibited" domain transfer record was ignored.

<comment><USER21> It seems like there should be a notification after the fact so legitimate domain owners have a chance to reach someone who is in the know.

</comment></comment></comment><comment><USER22> Automated legal actions and takedowns like this introduce a lot of risk of collateral damage, but I wonder what the alternatives are?

The investigators would likely argue that notifying domain holders would reduce the chance that they can take down a botnet's infrastructure successfully, which seems likely.

Could there be some maximum time after which the 'rule set' for the auto- takedown code needs to be made open source / public? It must presumably be implemented as software and/or configuration files.

That would at least allow for inspection, confirmation and disputes about how it's implemented, and if this was 30 days or so, it shouldn't risk the takedown effort.

While top-tier network engineers are developing takedowns like this, presumably they'll do a good job of minimizing false positives - but as this case shows, it's not always going to be perfect - and I worry that if it becomes more common, we'll see sloppier implementations.

That could lead to connectivity and access issues for more users (again in an international context). It's great that the situation was resolved in this case but I imagine not all users would be able to raise a complaint at a similar level of technical detail and respectful tone and for it to receive the same amount of attention.

Maybe that's untrue - maybe injustices really do get amplified by social media and relying on companies to notice this 'works'. It doesn't sit particularly well with me as a remediation process though, and I'm not sure it scales.

</comment><comment><USER23> How is one supposed to get this resolved if the CEO OF NAMECHEAP doesn't see your tweet to get involved?

Is your domain just gone at that point?

Is it really that easy to lose a domain name...by someone doing an 'oopsie'?

<comment><USER24> The idea would be that the support ticket with namecheap should be enough. Though I doubt it would be, for the average person.

<comment><USER23> Doubt is an understatement. lol

</comment></comment></comment><comment><USER25> > I also wondered if a domain name under a country code top-level domain > (ccTLD) like .in is more susceptible to this kind of sinkholing than a > domain name under a generic top-level domain (gTLD) like .com. I asked > Benedict if it is worth migrating my website from .in to .com. He replied > that in his personal opinion, NIXI runs an excellent, clean registry, and > are very responsive in resolving issues when they arise.

I'm not sure that's the correct conclusion to come to from this experience. Yes, the registrant happened to get lucky in this case, in that they had significant enough reach on Twitter and HN to get the right people to pay attention and get eyes on resolving the issue. But that easily could not have been the case (and might still be the case in the future), and with a ccTLD, you have no recourse.

I think the correct lesson here is to go with a gTLD, because if worse comes to worst you will always have recourse through ICANN if necessary (since the gTLD operator is contracted with them). On a ccTLD it's not always gonna work out. Heck, the registrant was already ignored by the ccTLD operator in this case anyway; it's frankly kind of lucky that they had the CEO of their well- known registrar go to bat for them. That's not the kind of intervention you should be regularly relying on to keep and maintain your domain name!

<comment><USER26> Would the experience be any better in gTLD? The registry of .com gTLD is VeriSign Global Registry Services. Would ICANN handle a domain-related dispute themselves or would they redirect us to Verisign? Is Verisign any better than NIXI?

</comment></comment><comment><USER27> Someone less technical would likely have no idea what happened to their domain. An individual relying on their web presence for income could be massively impacted by something like this. There really does not seem to be a clear way for someone to a) know what the problem is, and b) get it resolved quickly.

<comment><USER28> Every domain has a technical contact, it's part of the WHOIS schema. A non- technical website owner hires someone to handle technicalities, just as a non- mechanical car owner hires someone to handle their cars mechanics.

Sure, if you don't pay attention to the care of your domain, it can break in incomprehensible ways, just as if you don't pay attention to the care of your car, it can break in incomprehensible ways.

<comment><USER29> In theory, sure. But according to most of my domain WHOIS records, the technical contact is somebody named firstname.lastname@example.com.

</comment></comment></comment><comment><USER30> > My website was missing. In fact, the domain name resolved to an IPv4 address > I was unfamiliar with.

Do you guys know this stuff? If my domain started resolving to a new IP address, that would be just as unfamiliar to me, as the current address.

Should I ping my domain and write the results down?

<comment><USER31> Normally, if you did any setup before pointing the domain to the host, or if you connect via ssh, then you at least have seen the ip and probably have it recorded in files like ~/.ssh/known_hosts.

But generally, the better your setup is documented, the better you can detect or diagnose when something goes awry.

</comment></comment><comment><USER32> As a small business owner, this terrifies me. Since the TTL for NS records is 48 hours, a domain takeover like this could easily bankrupt a lot of SaaS companies.

What options are there to prevent this? Would a registrar such as MarkMonitor provide at least some notice or protection?

</comment><comment><USER33> Namecheap rocks, been using them for years.

Really wish they'd pick another name: it's really hard to convince clients to take them seriously and let me choose them. If I had a dollar for every time someone insisted on GoDaddy... :-(

<comment> r-w Ah, GoDaddy: a name that is _much_ easier to take seriously.

</comment></comment><comment><USER34> What I find interesting here is the interplay and mix between private, public, and governmental concerns.

In the physical space, in the states you're free to walk out into the public park, put on a hat saying something atrocious like "I hate cats!" and peacefully petition your fellow citizens to destroy all cats or something silly.

When we moved to printed distribution, there was still a clear bit of guidance; as long as you weren't directing people towards violence, you were good. Most newspapers were locally owned and would even be happy to print your letter to the editor about cats.

But now? We've got a foundation doing something like a regex match on domain names, we've got a criminal element hijacking computers, we've got various government-condoned organizations for managing tlds, we've got registrars. All of these are different types of organizations working in different countries and established for vastly different reasons.

I am reminded of two things. First, Thomas Paine made the point that it was better to live under a dictator than a complex system that hurt you. Under a dictator, you had a guy to point to when things went wrong. It was them! They are responsible for this awful thing! Under a complex system? There's nobody. Bad things just happen, and when you try to ask about it, each party can explain to you that they were working for good reasons to the best of their ability. There was a problem, but no reasonable way to discuss, diagnose, or propose fixes to it.

The second thing was a story from the 80s about a U.S. official, Raymond Donovan. He served fairly well in public office but was accused of some serious crimes. He was destroyed in the media. Then they found out he was innocent. He asked a famous question "Which office do I go to to get my reputation back?"

I'm extremely happy this was resolved, but good grief, if I didn't know anything about the net, and my domain had just been set up instead of being in my control for 12 years, which office would I go to to get my domain back?

Either we own things or we don't. If every bit of our participation online is owned by somebody else, this should be a lot bigger deal than it is currently.

<comment><USER28> Blaming the dictator doesn't solve the problem. Sure, you could try to overthrow a dictator, but you can also try to fix a system, by talking to any of the people involved in it (or if there are no people involved, try to modify the system yourself, since there's no one to stop you).

<comment><USER16> This is the Fallacy of Gray. Just because neither option is perfect, doesn't mean that one option isn't better. It's clearly _easier_ for a bloc of concerned citizens to solve problems in dictator-land than in bureaucracy- land: in dictator-land, you just have to remove one (probably very unpopular) guy, while in bureaucracy-land, you have to... um...

<comment><USER35> In dictator-land, you _first_ have to remove the dictator. You still have to actually solve the problem after removing the dictator.

It's easy to say "the dictator is bad" but historically getting rid of dictators without a specific and concrete plan for what to do afterwards has not turned out so well.

<comment><USER34> In doctor-land, you are trying to solve a particular problem with a particular patient, the assumption being that once that problem is solved, the patient will remain self-regulating.

In political-theory-land, you assume all actors are bad, are at least will become bad at some point in the future. The question then becomes *how can we organize our political structures so that if we can't prevent dying, can we at least provide guidance to the next government that follows?"

It naturally follows that the real goal is not solving problems: it is providing problems and solutions that people can accept. If nothing else, providing problems and solutions in terms that future generations can reason about.

</comment></comment></comment></comment></comment><comment><USER36> Don't worry. It's still _definitely_ a good idea to centralize all Internet trust in a DNS-based PKI.

</comment><comment><USER37> Wow! "Accidentally?" That's inexcusable. He should be compensated, and the people who made this mistake should not be doing this sort of work anymore.

> He explained in his email that my domain name was sinkholed accidentally as > part of their Avalanche operation.

Would it hurt the people doing domain takeovers to at least try sending an email to the registrant with contact info and a case number?

</comment><comment><USER38> I feel there is an important point between the lines here: a central authority is well positioned to stop bad actors by working outside the definition of "expected behavior" of the system.

P2P systems do not get this by design. For load bearing infrastructure like DNS, escape hatches to stop bad actors putting humanity's hive mind at risk is a handy tool that has been used effectively.

There are the philosophical questions of "how do we define a bad actor" and "who gets to decide what's acting in bad faith?" But many botnets don't suffer from that ambiguity, a well deployed/utilized botnet can take down load bearing internet infrastructure.

Being able to stop future threats without requiring migrating a P2P network _seems_ like a feature, and reminds me a bit of common law. In law, we know there will be cases we can't anticipate upfront and leave the courts room to interpret. P2P seems to still be in a state where we have to identify and protect against every form of "bad actor" upfront in our game theory in order for our network to be stable moving forward.

</comment><comment><USER39> A couple of years ago we lost our domain [1] due to a registrar (that we were not a customer of) erroneously issuing a suspension. The amount of honor system involved in the whole process, particularly in ccTLDs without as much oversight, was really surprising.

[1]: [https://medium.com/thisiscala/the-duct-tape-holding-the- inte...](https://medium.com/thisiscala/the-duct-tape-holding-the-internet- together-12118be60ff1)

<comment><USER40> That's worth resubmitting to HN.

<comment><USER3> Done. [https://news.ycombinator.com/item?id=21705976](https://news.ycombinator.com/item?id=21705976).

</comment></comment></comment><comment><USER41> This is so bad. This process needs transparency and notifications! It shouldn't be possible to sinkhole a website without the owner being aware.

</comment><comment><USER42> So, did a court just order a domain to be taken down based on erroneous information from a private entity?

<comment><USER43> I don't see any mention of a court; the TLD manager (NIXI) probably took the initiative based on said erroneous information.

<comment><USER44> NIXI is subject to the jusrisdiction of CERT-IN (Indian Computer Emergency Response Team - [https://cert-in.org.in/](https://cert-in.org.in/)), which in turn was one of the participants of the Avalanche takedown program.

A legal request originating from Germany would have been approved by CERT-IN and NIXI would have had to comply.

[https://www.cyberswachhtakendra.gov.in/alerts/avalanche.html](https://www.cyberswachhtakendra.gov.in/alerts/avalanche.html)

<comment><USER45> Who said it was a _legal_ request? I got the sense that Shadowserver has some monitoring software running, which triggered a warning for NIXI who sinkholed the domain.

<comment><USER44> most likely interagency request. NIXI as an Indian govt operator is subject to RTI queries (Right to Information) and court action.

However NIXI is subject to CERT-IN authority which is clearly part of the anti-botnet collective.

</comment></comment></comment></comment></comment><comment><USER46> With all the domain buying out and weirdness, it is my fervent hope people seriously begin reconsidering what it means to have a domain name and to implement other structures to serve out names as opposed to the now, obviously bought and sold, DNS.

</comment><comment><USER47> The server is down it seems

[https://github.com/susam/susam.in/commit/91405150ff3f44fd094...](https://github.com/susam/susam.in/commit/91405150ff3f44fd094e4e8d7671be12bc574922)

<comment><USER3> The server is up. However, it is possible that at your end "susam.in" is still resolving to a sinkhole address. I have created a mirror of the blog on GitHub Pages for you. Visit [https://susam.github.io/blog/sinkholed/](https://susam.github.io/blog/sinkholed/) to read the mirrored blog post.

</comment></comment><comment><USER48> > for some perceived violation

This is the fundamental problem with this sort of crowdsourced censorship - there's no accountability on the reporters and no repercussions for bad faith.

</comment><comment><USER49> I still don't get it, what exactly was flagged that caused the domain to get noticed by... Who exactly? Did it have anything to do with the owner logging into his server? What is the sequence of events in bullet point format? I know the author tried to be clear but I'm confused as to what actually happened.

<comment><USER50> A particular malware contacted its command and control servers via procedurally generated domain names (to make it difficult to shut down just a single domain that controlled it).

Malware researchers reversed a sample of the malware and started blackholing domains that matched the pattern to get ahead of the malware by preventing it from communicating with the domain du jour.

It just so happens that the authors domain pattern-matched domains that would be contacted by the malware.

<comment><USER49> Thank you. So it was just a coincidence that this person logged into his server at the same time as the domain was taken down? It was simply a suspicious looking domain name?

</comment></comment></comment><comment><USER51> tldr; Collateral damage from law enforcement taking down a botnet, resolved reasonably fast.

<comment><USER52> It wasn't law enforcement taking the domain name, it also was only solved fast because of intervention from the Namecheap CEO.

<comment><USER51> I didn't say it was law enforcement directly taking down the domain name, I said that it was collateral damage from law enforcement operation against botnet.

As the original operation was run by interpol, europol etc i think this was a fairly accurate description, especially in context of a tldr; which gives some constitutional rights to simplify things :)

</comment></comment></comment><comment><USER53> Wow, so a German entity can just go around and confiscate internet domain names, without a warrant? That's really dangerous.

</comment><comment><USER54> This is horrifying.</comment>


365 RFCs: a 50th anniversary dive with one RFC blog post per day - <AUTHOR> https://write.as/365-rfcs/table-of-contents <comment><AUTHOR> This is Darius Kazemi's new year-long project to blog one RFC daily in chronological order.

Quoting Darius:

April 7th, 2019 is going to be the 50 year anniversary of the first ever Request for Comments, known as an RFC. These documents started out in 1969 as a way for ARPANET engineers to keep track of notes and discussions on their project. (ARPANET was run by the US Department of Defense and is considered the primary precursor to the modern internet.) I'll go more into what these documents are as we encounter them over the course of the year. But basically: they're just slightly formal documents attempting to formalize some knowledge about a project, like an internal page on a company wiki, that kind of thing.

In honor of this anniversary, I figured I would read one RFC each day of 2019, starting with RFC 1 and ending with RFC 365. I'll offer brief commentary on each RFC. I'm interested in computer history and how organizations communicate so I think this should prove pretty interesting even though RFCs themselves can be legendarily dry reading (the occasional engineering humor RFC notwithstanding).

I can only promise I'll cover all 365 RFCs in a year. I may post anywhere between 0 and 3 of these a day.</comment>


Google to ban 'stalkerware' apps that secretly transmit people's location, info - <AUTHOR> https://www.businessinsider.com/google-to-ban-stalkerware-apps-that-secretly-snoop-on-people-2020-9 <comment><USER2> So they're going to delete their location transmitting and tracking app Maps?

<comment><AUTHOR> Killing the competition in the name of privacy :)</comment></comment>


Ask HN: Are Client side JavaScript loaders really worth the hassle? - <AUTHOR>

I've gone from using multiple script tags, to basic uglification, to AMD/Require.JS to Browserify+Grunt. I can definitely some advantages as you explicitly import things, however, every time I find a new library, I have to ponder what things I'm going to have to do in order to get it to actually work with this rather heavyweight system. I mean, if I could get it down to simply being a CoffeeScript watch with some sort of minification process (plus support for Bower packages, of course), it might make my life a whole lot simpler. Currently I'm using AngularJS, d3, CoffeScript and a bunch of other libraries (e.g. Bootstrap/Angularstrap).
What is your ideal JavaScript/CoffeeScript workflow?
How do you get bower packages working?
How easy is it to integrate other packages that aren't made properly (or broken bower packages that browserify+debowerify cannot find)?
What advantages does browserify actually give you?
How do you change things between debug and production? <comment><USER2> I like this question. I think AngularJS' latest presentation echoes some of your issues with the complexity of adding in multiple javascript packages with different loading mechanisms.</comment>


The Strange Tectonic Coincidence of Mexico's September Earthquakes - <AUTHOR> https://www.newyorker.com/tech/elements/the-strange-tectonic-coincidence-of-mexicos-september-earthquakes <comment><USER2> The New Yorker could be that much better if they would occasionally include technical graphics. In this case, how about a rendering of the plate mechanics that are the subject of the article?

They are quite happy to print line drawings, comics, and full-page photos, so it's not like they're scared of non-text content. Yet I've seen them devote multiple paragraphs to describing a scatterplot that stunned some scientist they were profiling.

</comment><comment><USER3> There is another one today - 6.2 [https://www.theguardian.com/world/2017/sep/23/mexico-new- ear...](https://www.theguardian.com/world/2017/sep/23/mexico-new-earthquake- oaxaca)

</comment><comment><USER4> Summary: the epicenters of the two quakes were far apart. Correlation does not equal causation.

<comment><USER5> To be pedantic, it's more that there isn't enough data to even say that there's any correlation to begin with, and also that our understanding of the origin of the two quakes refutes a shared cause.

A usage note: the phrase "correlation does not equal causation" is usually reserved for the case where two variables A and B have a correlation in the data that isn't just due to sampling accident, and hence _are_ causally connected, but just not in the _naive_ sense of A causing B. It may be that B causes A or that a third variable C causes both. But a true correlation in the underlying process always has _some_ causal explanation.

<comment><USER6> >"But a true correlation in the underlying process always has some causal explanation."

In the vast majority of cases, A really is correlated with B to some extent. People have done this with large social science datasets since at least the 1960s, they find everything is correlated with everything else.

So, whether a correlation merely exists is not interesting to begin with (there are some exceptions in physics where theory really predicts zero correlation). Yes, this means all the people currently plugging away at checking for the mere existence of correlations are wasting their time and (probably) taxpayer money.

<comment><USER5> True. A more useful phrase might be something like, "magnitude (and direction) of correlation may differ substantially from magnitude (and direction) of causation".

</comment></comment></comment></comment><comment><USER7> Illuminati confirmed! Obviously this is some sort of earthquake weapon made to do... uh, what exactly? Cause, you know, earthquakes and aftershocks are not naturally occurring things near tectonic plates... so we need to attribute it to some dark god^H^H^H government conspiracy in order to explain this.

The article is actually a pretty good piece on skepticism. But the title is just bait for stupid people to feed into their fears. If the attempt was to make it clickbaity for people to click on it in order to debunk any notions people might have they failed. Stupid people only read headlines not articles.</comment>


Show HN: Snapchan - the Snapchat-only image board - <AUTHOR> http://snapchan.com

<comment><USER2> If only 4chan had a POST API.

<comment><AUTHOR> If only! That's where I was hoping to go with this. Instead I just stole /r/4chan's stylesheet and posted to a subreddit.

<comment><USER3> No need for an official API, just create a post request with the right parameters.

<comment><USER4> Can't. All posts require reCAPTCHA.

</comment></comment></comment></comment><comment><USER5> so a snapchat account posts to a subreddit?

I expected an actual imageboard format, but maybe that's the nostalgia speaking

<comment><USER6> I think you thought that because it ends with chan. A name like SnapLeReddit may be much more appropriate, considering that all other chans that I've seen use the imageboard format, and don't just link to a subreddit.

</comment></comment><comment><USER7> This guy demoed the hack at hackNY. Really well done. I think he's also the same guy who hacked vine too.

<comment><USER8> Different guy.

(Source: I'm the guy who "hacked" Vine [@ws])

</comment></comment><comment><USER9> Uses [https://github.com/tlack/snaphax](https://github.com/tlack/snaphax), I assume?

<comment><AUTHOR> Nope, [https://github.com/nykac/node-snapchat/](https://github.com/nykac/node- snapchat/)

</comment></comment><comment><USER10> Awesome dude, very innovative, could become something, maybe an own app, I dont know.</comment>


Kino.to Raided In Massive Police Operation, Admins Arrested - <AUTHOR> http://torrentfreak.com/kino-to-raided-in-massive-police-operation-admins-arrested-110608/

<comment><AUTHOR> Kino.to was short showing the following after the raid.

<http://smblogger.de/wp-content/uploads/2011/06/kino.to_.png>

So the police (or someone else) defaced the site, before taking it offline. I wonder, if they recorded IP addresses at that time or record IP addresses of visitors currently.

<comment><USER2> That announcement also makes it clear that everyone who ever used the services of the website, should expect measures taken against him/her.

</comment></comment><comment><USER2> _"professional copyright infringement"_

Excuse me, but 'professional' could mean anything. Some people use it to mean that they're following standard industry practices; others use it because they're always dressed in suits. Another definition separates 'professionals' from 'amateurs' in a way that 'professionals' earn their money with their trade, and amateurs are just messing about; there is much jealousie-de-metier here.

This vagueness of the term 'professional' causes me to immediately ask what it really entails if somebody pitches to me that their services are 'professional'.

<comment><AUTHOR> the original text (see the png of my posting below) says, "gewerbsmaessige Begehung von Urheberrechtsverletzung", so the professional in the torrentfreaks translation refers to earning money.</comment></comment>


Google Forces Developers to Stop Using PHP IMAP Extension - <AUTHOR> https://medium.com/@freescout/google-forces-developers-to-stop-using-php-imap-extension-ea935feb1770 <comment><AUTHOR> [https://gsuiteupdates.googleblog.com/2019/12/less-secure- app...](https://gsuiteupdates.googleblog.com/2019/12/less-secure-apps-oauth- google-username-password-incorrect.html?m=1)

"Scanners and other devices - No change is required for scanners or other devices using simple mail transfer protocol (SMTP) or LSAs to send emails."

What does that mean?

Isn't SMTP also uses password for authentication? Or are they referring to SMTP relay which relies of Static IP?

</comment><comment><USER2> > Starting February 15, 2021, G Suite accounts will only allow access to apps > using OAuth.

Mostly just the author complaining that their preferred PHP module for email doesn't support Oauth.

¿Apparently, Google should wait to enforce better security until open source libraries are updated?</comment>


Show HN: Drapache - serve a dynamic website from your dropbox - <AUTHOR> https://github.com/louissobel/Drapache

<comment><USER2> Stop with the misleading titles, people! I thought this meant you'd somehow make Dropbox run the website for you, which, while a pretty silly idea, would be interesting. But no, it's just a server that pulls files off Dropbox.

</comment><comment><USER3> Why not just call it "mod_depeche"? Sexier, more pronouncable name, and punful as well.

<comment><USER4> Until I saw this comment, I'd been pronouncing it "drop-ache" in my head, and scratching my head wondering whether it was a reference to dropbears or not. Now I see the light. Maybe instead of rebranding, make a logo that sets the "apache" part in a different color or font?

<comment><USER5> I don't follow your (or your parent post's) line of thinking. Apparently "dépêche means dispatch (or update, message or news)," and has a connotation of "fast." I don't see how this really applies to Drapache, which I thought of as "dr'apache," a portmanteau of "drop(box)" and "apache." I'm a Depeche Mode fan, but don't see how it relates.

Where's the pun? :)

<comment><USER6> Depeche Mode is the name of band from the 80s. <http://en.wikipedia.org/wiki/Depeche_Mode>

<comment><USER5> I know, and mentioned the band in my post. But that's not a pun, that's just a reference. For it to be a good name, doesn't _depeche_ have to have _something_ to do with Dropbox?

<comment><USER3> you are very much right :-)

</comment></comment></comment></comment></comment></comment><comment><USER7> How is this different than using Uniform Server, XAMP, sharing on OSX or even SimpleHTTPServer, serving from the Dropbox folder? Setup looks more involved than any of those.

<comment><USER8> Don't those (at least sharing on OS X) necessitate your machine running?

<comment><USER9> So does this (or some machine somewhere, anyway)

</comment></comment></comment><comment><USER10> Having used it to build a bad link shortner, I suggest people give this a shot. It's a ton of fun to just edit a file in your dropbox with no setup and it's reflected online before you can refresh the page. it's definitely just a hack, for now but don't be surprised if this becomes something useful in te future

Link to what I built <http://shorty.drapache.com/shorty/>

</comment><comment><USER11> Does this violate Dropbox TOS?

</comment><comment><USER9> It starts a thread per (dynamic) request, with 25 second timeouts?

I can't imagine Dropbox will be too pleased running that on their servers (Although it is possible I'm misunderstand how it works - the explanation is vague, but I never knew Dropbox had the ability to run Python(!?))

<comment><USER12> Dropbox can't run anything, this is meant to be run on your own hardware/vps/ec2.

<comment><USER9> Mm yeah, that makes sense.

It also makes this incredibly bad. Not only do you have to run your own server, you have to pay for bandwidth twice - once from your server, and once from Dropbox (files are served from your Dropbox to the server, then to the client)

<comment><USER13> Except Dropbox doesn't charge you for bandwidth. Imagine someone offering a service running this - plenty of other Dropbox hosting in the cloud services exist (such as to give you your own domain name tied to the Dropbox public folder)

<comment><USER14> Dropbox might not charge you for your bandwidth, but your server host will. Using something like this results in twice the bandwidth for every page served. You will be using your servers bandwidth to transfer the file from Dropbox to your server, and then from your server to the client.

</comment></comment></comment></comment></comment><comment><USER5> I have had some encoding issues with Dropbox public files — namely, I'll create a UTF-8 .html file and use special characters like "educated quotes" without encoding them as HTML entities (as I should be allowed to do, in a properly encoded file). I'll use the right meta tag. And yet sometimes, at least in Chrome, they'll show up incorrectly.

Would Drapache be susceptible to this, or could it it perhaps remedy it?

<comment><USER15> You say "at least in Chrome," but have you tried other browsers? This phrase leads me to believe it may be a browser problem and not a Dropbox problem.

</comment></comment><comment><USER16> I'm trying to share my folder with some classmates so we have some collaboration without having to share our own server passwords. However, when I try to share the drapache folder I'm not allowed to share since it's in the Apps folder. I can't share the Apps folder either. Trying to move the drapache folder elsewhere has broken my drapache site. How can I share with classmates, and fix the broken site?

</comment><comment><USER17> I don't think it's a good idea if you target developers :

1- Trading expensive bandwidth for a cheap storage isn't economically logical.

2- Any web developer should understand how web works and he should be comfortable with ftp, apache/nginx/iis, git(/mercurial), etc...

<comment><USER15> "It will not be particularly useful to a developer..."

Right there on the project page.

<comment><USER17> Full sentence : "It will not be particularly useful to a developer who is comfortable with git, heroku, ftp, or another method of hosting a website."

But the thing is, drapache is for the programmers [1], if you read full readme you will notice, to use drapache you need to understand basics of programming ( maybe js for static pages and python for dynamic pages).

Now, i understand "It's c00l" but the coolness != useful

[1]Readme/.dbpy : Although far from finished, the dbpy framework is enough for beginning programmers to get started building dynamic websites.

</comment></comment></comment><comment><USER18> Question: does dropbox know about this? What about latency and performance issues?

</comment><comment><USER19> this also exists if you're looking for something that is compatible with wsgi and supports intelligent http caching <https://github.com/dropbox/dropboxwsgi></comment>


$100 Trillion - <AUTHOR> https://multicoin.capital/2018/10/09/100-trillion/ <comment><USER2> There are some mostly untrue assertions on the essay. Most cryptocurrencies are not fungible. Cryptocurrencies are not taxed at large YET, but they will. Most cryptocurrencies in use today are extremely volatile, so they can be used by speculative investors, but right now, they are very risky as stores of value.

That said, I believe cryptocurrencies are the future of money, as those issues are resolved by better technology and new cryptocurrencies, just it might not be the ones existing today, especially not BTC.</comment>


The Top Javascript MVC Frameworks Reviewed - <AUTHOR> http://codebrief.com/2012/01/the-top-10-javascript-mvc-frameworks-reviewed/ <comment><USER2> This article was last updated January 14, 2012. Since then, a number of real- time JavaScript frameworks have been released, like Meteor, Derby, and Firebase. You can't have a complete picture of the JS framework landscape without these newcomers.

<http://meteor.com/> <http://derbyjs.com/> <http://firebase.com/>

<comment><USER3> And Joosy, if you'd like integration with Rails. <http://joosy.ws/>

<comment><USER4> Woah, thanks. Seems like what I want. And unlike Batman, it isn't broken.

</comment></comment></comment><comment><USER5> It's pretty weird that this piece goes over 12 frameworks and barely describes its declared winner, or the reasons why it's declared Ember.js the winner.

<comment><USER6> This is common with people that don't know anything else. So they build biased metrics to put one framework in the spotlight and satisfy their want for using the framework vs learning more about others or building the knowledge to roll their own.

Sure, use a framework, let's not reinvent the wheel. But my biggest peev is when I look at a project with every framework imaginable, using a small portion of it's functionality. I guess this is where the "plays nicely with others" metric is important for these individuals. "It doesn't matter if we load 10 frameworks in the DOM as long as everything works" -Retarded Developer

</comment></comment><comment><USER7> Used this article before and he completely misrepresents SpineJS. Asynchronous UIs do not need an algorithm such as operation transform (the technology behind Google Wave). OT is about collaboration in a federated network. SpineJS does not, in a typical case, deal with such scenarios and thus the asynchronous UI can and is handled by a simple queuing system.

</comment><comment><USER8> The categories here are vague, without much explanation of what they mean or how they were evaluated. For example, I would argue that Backbone has both "UI Bindings" and "Composed Views", and in fact wouldn't be very useful otherwise.

</comment><comment><USER9> The criticism of AngularJS is a little vague to me - "codebase appears to be fairly sprawling and not very modular. Views are not modular enough (will address this in more detail in the cons of Batman.js)." I'm not sure how it isn't "modular" or how views/components aren't reusable.

AngularJS is possibly best-of-breed in the engineering aspect in my unqualified opinion, and I expect to properly use and deploy it once its documentation and cookbook are fully beefed up.

</comment><comment><USER10> So what performance issues were encountered when converting backbone.js to ember.js? Why isn't that an important factor? How difficult is it to overcome the inherit drawbacks of a simple framework?

I'd say personally that behind simplicity, performance is the most important factor for an app (JS-enhanced sites may benefit far less). The challenges that I've seen while using backbone mostly consist of unifying the views, models, collections, and helper objects (or for lack of a better term "Services") together. So far some of that overhead involves adding a "_super" function and abstracting out instantiation so that it is sane. I'll write up about the experience afterwards, but backbone.js is a pleasant treat after leaving JMVC.

</comment><comment><USER11> Good one, but for comparing frameworks & libraries in detail, I like html5libs. A very useful resource.

<http://www.html5libs.com/grids/g/mvc-client/>

</comment><comment><USER4> The views in Batman is the only reason I am using it. I advocate logic-less views.

Edit; will probably move over to <http://guides.joosy.ws/> as it's better documented and isn't broken like Batman.js

I can't believe in this day and age, master branches are undocumented and broken. Seriously, if you're pushing code to Master, at least have it documented. If not, let it be in dev branch.

</comment><comment><USER12> I think Meteor and YUI3 deserved a place in there. Their exclusions slightly makes it not-so-credible review.

</comment><comment><USER13> this article was super valuable to me. clearly not in depth enough to convince a believer to change allegiances, but good enough for the uninitiated.

</comment><comment><USER14> Do we really need more frameworks?

</comment><comment><USER15> Interesting read, thanks

</comment><comment><USER16> One recently open-sourced contender that emphasizes CoffeeScript is: <https://github.com/uberVU/mozaic>

<comment><USER17> Their website is not very usable to me: <http://ubervu.github.com/mozaic/#/bored></comment></comment>


Tell HN:  Hayabusa asteroid mission returns thanks to engineering hacks - <AUTHOR>

The general news today has been a quick note about the return of the Hayabusa spacecraft: http://www.spaceref.com/news/viewnews.html?id=1402
But I've not yet come across any mainstream articles which discuss the contortions and hacks the engineering team have gone through to bring this machine home.
The mission's page: http://www.isas.jaxa.jp/e/enterp/missions/hayabusa/index.shtml
gives an overview of the spacecraft.  It has been limping home on one strained engine for the past five years, as described here: http://www.aviationweek.com/aw/jsp_includes/articlePrint.jsp?storyID=news/japa042507.xml&headLine=Asteroid
Successfully returning that spacecraft home, asteroid samples or none, seems a hack worthy of recognition. <comment><AUTHOR> Clickable links for article on return: <http://www.spaceref.com/news/viewnews.html?id=1402>

Mission homepage: [http://www.isas.jaxa.jp/e/enterp/missions/hayabusa/index.sht...](http://www.isas.jaxa.jp/e/enterp/missions/hayabusa/index.shtml)

The rescue plan as of 2007: [http://www.aviationweek.com/aw/jsp_includes/articlePrint.jsp...](http://www.aviationweek.com/aw/jsp_includes/articlePrint.jsp?storyID=news/japa042507.xml&headLine=Asteroid)</comment>


World's First 3-D Porno: Coming Soon to a Theater Near You - <AUTHOR> http://www.theatlantic.com/culture/archive/2010/08/worlds-first-3-d-porno-coming-soon-to-a-theater-near-you/61216/ <comment><USER2> There are some things I don't want to see coming flying towards me across a darkened theater.</comment>


HTTP/2 comes to Firebase Hosting - <AUTHOR> https://firebase.googleblog.com/2016/09/http2-comes-to-firebase-hosting.html <comment><USER2> Firebase is really good to start with and easily scalable. The easy integration in applications is the best part. And with http/2, the whole ecosystem will benefit. website on Http/2 with ssl.

</comment><comment><USER3> The best part of Firebase hosting is the free custom domain support + CDN + SSL cert. HTTP/2 is icing on the cake. Nice job!

(Disclosure: I work for Google)

<comment><USER4> This is true, but at the moment Firbase hosting only supports a single subdomain across all projects account wide... so it's not possible to have two projects on two subdomains.</comment></comment>


Apey Eye – An Object-Resource Mapping Node.js REST Framework - <AUTHOR> https://github.com/glazedSolutions/apey-eye

<comment><AUTHOR> Apey Eye is an Object-Resource Mapping Node.js API framework that uses next- generation JS features that can be used today, like Classes, Decorators and async/await for maximum expressiveness. It can work as a BAAS out-of-the-box, respecting REST and HATEOAS conventions, or be easily configured to match most API needs.

ApeyEye is still in early preview, but we would like to share and validate our progress with the JavaScript community. Any feedback would be great!

npm: [https://www.npmjs.com/package/apey- eye](https://www.npmjs.com/package/apey-eye) GitHub: [https://github.com/glazedSolutions/apey- eye](https://github.com/glazedSolutions/apey-eye)

"Object-Resource Mapping? Do you mean a ORM?" It's common having an object relational mapping to interact with relational database content in an object oriented way. Likewise, Apey Eye also offers an object oriented approach to manage data in entire flow of requests handling, from Models (our DB/ORM classes) to Resources (in the REST sense), through an object-resource mapping where objects have methods that map to get, post, put, patch and delete methods, for a resource/ or resource/:id/ url. Generally speaking, static methods correspond to HTTP methods you'd call on "resource/" and instance methods correspond to HTTP methods you'd call on "resource/:id". Furthermore, this object oriented approach allow entities like Model and Resource to have be used imperatively, making it easier to use them in other contexts, like unit testing.</comment>


Deface My Site; Get $20 - <AUTHOR> http://www.toarca.com/deface

<comment><USER2> Send his ISP a DMCA takedown notice? That looks like it would meet the terms of the challenge.

<comment><USER3> "You must leave the navigation bar and the instructions intact, and in the same positions."

<comment><USER2> Ooo, good point.</comment></comment></comment>


Google, NASA: Our quantum computer is 100M times faster than normal PC - <AUTHOR> http://arstechnica.com/information-technology/2015/12/google-nasa-our-quantum-computer-is-100-million-times-faster-than-normal-pc/ <comment><USER2> pdf of the research paper for the curious

[http://arxiv.org/pdf/1512.02206v1.pdf](http://arxiv.org/pdf/1512.02206v1.pdf)</comment>


Engineers develop world's smallest fuel cell - <AUTHOR> http://www.ecofriend.org/entry/eco-tech-american-engineers-develop-world-s-smallest-fuel-cell/

<comment><AUTHOR> > Presently the [9mm^3] cell generates 0.7 volts and a current of 0.1 > milliamps for about 30 hours.

So the energy density there is 1.1e10 J/m^3... how does that compare to the best batteries?</comment>


IE still reinvents its own standard - doesn't support TouchEvents - <AUTHOR> http://blogs.msdn.com/b/ie/archive/2011/10/19/handling-multi-touch-and-mouse-input-in-all-browsers.aspx

<comment><AUTHOR> Safari, Chrome, and Firefox mobile all support TouchEvents. IE only supports its own invention, PointerEvents, which combines MouseEvents and TouchEvents into a single event model.

I'd have to play with it to see if this is a more sane way of doing things, but it's incredibly frustrating to have them reinvent another wheel (and ignore the consensus) when developers already have so many other expensive devices/platforms to test for. (There's not even an IE10 VirtualPC image yet.)

IE 10, you were supposed to be better than this.</comment>


In China it's difficult for non-Chinese to pay - <AUTHOR> - doesn't accept btc - doesn't accept usd - doesn't accept credit cards
- doesn't accept chinese fiat
Only accepts wechat pay. And you can only order with their wechat mini app.
It has been very hard to pay for things without wechat pay. Incredible how much things have changed since last here.
And wechat pay is only available to people that connect a Chinese bank card. The country runs on a fully KYC digital payment rail.
a few more data points:
- plenty of places accept cash but virtually every time they have asked can we use wechat instead? - some accept cash so infrequently they are literally carrying no cash to make change. had to run to a store to make change for my cab driver <comment><USER2> Imagine how much control Tencent (company behind WeChat) could have over someone's life in such a system. If you live in China and your account gets closed, tough luck.</comment>


Twitter Axes Vine Video Service - <AUTHOR> http://www.bbc.com/news/technology-37788052 <comment><USER2> Established discussion: [https://news.ycombinator.com/item?id=12806324](https://news.ycombinator.com/item?id=12806324)

</comment><comment><USER3> I couldn't find the main thread either at first, had to search.</comment>


Ask HN: One time fee for web application - <AUTHOR>

Many shareware developers charge one time fee for their software. Is it a good idea to charge one time fee for a not too complex web application? <comment><USER2> Patrick at Bingo Card Creator does this. If you search his blog ( <http://www.kalzumeus.com/> ) you find the entries where he discusses it.

For me it depends on what is the lifetime value for a customer. Very easy to determine if its a one time fee. And what is the lifetime expense of a customer. If the expenses (server cost, _support_ , etc.) grow over time, then you are bound to lose money. If your application is one would only be used a few times, say wedding planning, or related to being pregnant, then I can see it.

The big downside I see, is how do you handle upgrades. With a SaaS subscription model, they are continuously paying for the upgrades. With a web app with a one time fee, you would either have to give them the upgrade for free, force them to pay for the upgrade or maintain multiple versions. With desktop apps, it seems that you get a big boost in sales with an upgrade and I feel like you miss that with a one time fee for a web app.

</comment><comment><USER3> _Many shareware developers charge one time fee for their software_

Remember that most desktop software run as standalone programs, so there isn't an ongoing expense of servers and bandwidth. It is also much easier to charge these users for upgrades later on (at a discount, usually).

With web apps there is an expectation that the product will continually be upgraded even when they're free (think Gmail or Google Docs), so it's harder to justify charging for upgrades.

You also have to consider that some users might only use the app for a few months, and others for a few years. Should I pay the same if I just need your app for a short time?

</comment><comment><USER4> In general it's probably not a good idea, but it probably depends on the product. I have a web app that I charge a one-time fee for, but it only lasts for one year, so it's essentially a one-year non-renewing fee. It works because it fits naturally with how people use the product (it's for fantasy football so it lasts for one NFL season).

Most web apps, like project management software, fit nicely into recurring monthly/yearly payments. Unless yours is very different from that then it's probably better to do recurring. You'll have recurring expenses to pay to keep the site running, so you'll need recurring revenue to cover those.

</comment><comment><USER5> Interesting idea. I don't see why not. Consider recurring lifetime costs per user and see if you can set a fee that covers that. Remember that from that point on you depend on new customers (as your paying customers will never pay you again). You might want to look at a one time fee for a year's use of the service, or something like that.

</comment><comment><USER6> I do it (<http://www.forescoregolfstats.com>) for a very simple little web app that I developed a few years ago. I only suggest the one-time fee method if your app requires little maintenance and support. I receive a support request once or twice a month at most and the app runs on lightweight web hosting.

I don't actively push new updates. This month I set aside a few days to rework the interface a bit but other than that the feature base has been pretty static since launch.

<comment><USER7> Do you mind sharing revenue numbers?

<comment><USER6> I won't share dollar amounts but I'll tell you my accounts convert from free trials to paid at an 11.33% rate as of today.

<comment><USER7> Cool, thanks!

</comment></comment></comment></comment><comment><USER8> If customer acquisition cost is low enough to make your one time pricing make sense, then by all means, go for it.

I would guess that it would only make sense for software so cheap that recurring billing didn't make sense. ($10-20 total lifetime value of a customer).

The trouble is that getting customers that cheaply is difficult, and even harder to scale. Upselling existing customers with recurring revenue can be much easier than getting new customers.

</comment><comment><USER9> I like the idea. As a developer, it's certainly a more tempting business model than worrying about selling ads. The only web app I know of that does this is pinboard.in. They charge a one-time signup fee, and that fee slowly increases as the amount of users increase, so the earlier you sign up, the cheaper it is (<http://pinboard.in/signup/>). I don't know if it's sustainable in the long term though.

</comment><comment><USER10> "Lifetime" sounds like a huge can of worms to me. Just offer a 2-year plan if you don't feel like implementing a (relatively) complex subscription system right now.

</comment><comment><USER11> You may want to offer a both, a one-time-fee as well as a monthly cost, and let users decide.</comment>


Attention Arbitrage - <AUTHOR> http://nateberkopec.me/post/30752551695/attention-arbitrage <comment><USER2> If you didn't click through to Andrew Chen piece, I recommend reading it before jumping to conclusions. "Outsource you monetization" struck me as daft - until I read what Chen meant. The examples he cites are are about leveraging existing services instead of building your own:

      - There's 200+ ad networks to plug into
      - Payment providers like Paypal, Amazon, Stripe
      - "Offer walls" like Trialpay
      - Mobile payment solutions like Boku
      - and new services coming out all the time (Kickstarter)

</comment><comment><USER3> Basically, supply and demand. Let's look at advertising, since it's still the major way for publication-oriented websites and consumer webapps to make money.

1\. Demand as in demand for advertising.

This is actually a proxy for the ultimate consumer. Advertising demand is driven by the amount of money that can be made from the viewers of the advertising.

But this changes relatively slowly. With 2 billion internet users we've either reached or are fast approaching the inflection in whatever sigmoid function describes the growth in users. After that taps out growth will rely entirely population growth -- ie, internet businesses will be constrained to the same dynamics as everyone else.

2\. Supply as in the supply of "inventory".

Inventory is just ... a box where you put your add. Inventory does not require 9 months to create followed by >10 years to raise. It is being created fantastically quickly.

So if supply is expanding exponentially, but demand only sigmoidally ... well it's not pretty for anyone outside the top few percentiles.

</comment><comment><USER4> _"Outsourcing monetization" has got to be the worst oxymoron I've ever heard. The purpose of a business is to make money, and it doesn't take a business school degree to know that you outsource to reduce costs, not to raise revenue._

\--While this is true to some extent, a few counterexamples are worth noting. Namely, transactions services. These are of a real business that scale. Think: paypal, visa, etc. There is also a class of services that are pre-transaction: like amazon referral fees. These services all monetize through external sales, but represent real-value-added services. They are _orthogonal_ to attention, in that the make life easier, simpler, less complex.

</comment><comment><USER5> This is a great piece.

Building and scaling a business model is just as difficult and important as building and scaling your technical platform. I think that people often talk in general terms about how they plan to monetise, but miss the details. It's one thing to have an overall plan (e.g. advertising) but as we start to get more detailed these plans tend to fall over.

Advertising --> Types of advertising (Banners? Sponsored Results/Posts? etc) --> Precise details (Where are you going to put the banner? How big is it going to be? How are you going to source your inventory?)

Bubble 2.0 was built by having big web 'properties' value themselves the same way they did 10 years ago. But as the article validly points out, the competition for attention isn't what it used to be, so the valuations don't correlate.

New hot startups are no longer 'properties' in the traditional sense and actually build businesses with technology as an enabling factor rather than an all-consuming strategy. I'm looking forward to seeing how these turn out!

</comment><comment><USER6> > The problem with a "just build a great product" strategy is that it assumes > that all created value can be captured.

Well, really it assumes that _enough_ created value can be captured.</comment>