Ask HN: Will distributed social network work? Are they late? - <AUTHOR>

Diaspora and tent.io try to create a distributed social network. Are they late in the game? Will they gain momentum?
I see a huge potential here. For e.g. XMPP is a successful protocol (atleast google adopted). I don't like monopoly, i don't want facebook the only option which everyone must choose (Because its centralized).
Whats your opinion? <comment><USER2> XMPP is not usually peer-to-peer. At least where I've seen it used there is a third party middle man (centralization). Fire up an AWS instance, put your own XMPP server on it, and start your own network with your friends. Just keep polishing it and making it more user friendly. Keep it very simple. Give it some functionality, something simple which everyone wants, that Facebook _does not have_. Facebook won't disappear overnight, but people do want to try alternatives. People are curious. If you make something really easy to use that offers some useful functionality (think of how simple Instagram is), you will get users who will want to at least try it. You can coexist with Facebook. Facebook will not remain popular forever.

Do this project because you want it for yourself. Because you want decentralization. Scratch your itch. Then share your creation with users.

</comment><comment><USER3> We are not late with distributed social networks, because the normal user does not care how the system works, just that it works and is easy to use. If you want to beat Facebook you need to beat the user experience of Facebook instead of thinking how to make the internals of social network better. Distributed social network does offer good privacy, but privacy is not enough to compete with Facebook and you can have good privacy settings with centralized social network.

Personally I recently decided to delete my Facebook account because everything was getting annoying to use in Facebook like messages not getting sent, five clicks to remove a friend and other annoying stuff. The Facebook security policy or the ads were not the reason why I left Facebook, but the bad user experience. I felt that I had to do too much stuff to do some simple task like sending a message to a friend.

</comment><comment><USER4> The problem is that users don't care whether a social network is distributed or not. The overwhelming majority of users don't know what XMPP is, or why they should care.

Also, the lack of a choice is sometimes a good thing. Personally, I don't want my friends to be on 10 different social networks. Facebook isn't perfect, but I like the fact that it is uniform.

<comment><AUTHOR> It's like email. It should not matter in which social network our friends are, we should be able to communicate with each other.

Imagine that today you can only send email from gmail to gmail account. If that is the state today, won't we think of decentralizing email now?

Having a choice is a good thing, and one size would not fit all.

</comment></comment><comment><USER5> Spreading your personal data across many vendors is bad idea and average user is aware of this problem. How hard it is to remove data from centralized facebook? It will be a nightmare in case of decentralised networks.</comment>


Finfisher Verklagen ("Sue FinFisher") [video] - <AUTHOR> https://media.ccc.de/v/36c3-11217-finfisher_verklagen/ <comment><AUTHOR> English audio track is available in the video. Just download the file and change audio to English (the web-based player doesn't offer language selection unfortunately).

OUTLINE:

 _> Together with Reporter Without Borders (ROG), the European Center for Constitutional and Human Rights (ECCHR) and netzpolitik.org, the GFF has filed criminal charges against the managing directors of FinFisher GmbH, FinFisher Labs GmbH and Elaman GmbH.

> There is urgent evidence that the Munich company conglomerate sold the spy > software FinSpy to the Turkish government without the approval of the German > government and thus contributed to the surveillance of opposition figures > and journalists in Turkey._

Netzpolitik did an article but retracted it after investigation started, still available on Archive: [https://web.archive.org/web/20190906134907/https://netzpolit...](https://web.archive.org/web/20190906134907/https://netzpolitik.org/2019/we- filed-a-criminal-complaint-prosecutor-launches-investigation-into-finfisher- for-illegal-export-of-state-spyware/)

The CCC needs your help:

 _> 28 samples of government malware still awaiting further scrutiny. We ask the international community to challenge, verify and extend our analysis._ (see [https://twitter.com/Linuzifer/status/1210860587636461569](https://twitter.com/Linuzifer/status/1210860587636461569))

if you can please fork the repo and help analyze the samples

</comment><comment><USER2> Can you change the title to english and add a "[video]" suffix?

<comment><AUTHOR> done</comment></comment>


HN Postmortem: Hacker Gets Sent a Tax Bill by Association with Google on Xmas - <AUTHOR> http://cameronkeng.com/category/case-study/

<comment><USER2> find a really good accountant and talk to them. If you are treated as a business then there are these things called deductions. Taxes are assessed on profit not revenue. It sounds like the irs is assuming that all revenue is profit, get someone to file forms otherwise. They may end up owing you money.

<comment><AUTHOR> He amended his returns to take into consideration the business deductions and received a refund as a result of the re-filed returns. Although, I didn't help him file the returns I walked him through the process because he'd be required to continue to file his future tax returns under the business classification.

Finding an accountant is often expensive and considering his income from the website, it was significant enough to justify the additional cost of hiring a professional.</comment></comment>


Ask HN: How to safely buy a domain? - <AUTHOR>

I have contacted a domain owner through his registered email, and offered him a certain amount of money for the domain. He accepted, and instructed me to pass the amount to his Paypal account, in exchange he will transfer the domain on my name. I was wondering whether there is some sort of middleman to ensure the domain transfer? Maybe Paypal can insure the deal? I know they take a lot of measures against frauds.<p>Thanks for any suggestion. <comment><USER2> Use an escrow service, most of the big registrars will offer to do that for a fee.

The only time when it doesn't make sense is when the amount is less than the fee for the escrow.

If the amount is large enough you may want to use a notary public or a big legal office to handle the escrow bit.

here is a short list:

<http://www.moniker.com/aftermarket/domain-escrow.jsp>

<http://www.afternic.com/buy.php?p=4>

There are plenty more.

beware of escrow scammers!!

<comment><AUTHOR> Thanks for the tips, I hope the deal gets through.

</comment></comment><comment><USER3> escrow.com -- that's what it's specifically made for.

</comment><comment><USER4> escrow services exist that do this. example:

<http://www.sedo.com/services/s_escrow.php></comment>


Why No IPv6? - <AUTHOR> https://whynoipv6.com/ <comment><USER2> This scenario: I have my website on v4 and v6, v6 uplink goes off, v6 users are cut off. No monitoring. I see dropping user number of users in my analytics, being unable to determine what the problem is because the website is running fine.

<comment><USER3> That's a straightforward engineering problem: website monitoring services should watch both IPv4 and IPv6 by default.</comment></comment>


How we handle time off - <AUTHOR> http://mindsense.co/blog/how-we-handle-time-off/

<comment><USER3> "Unlimited time off" is the new open office plan. An idea that seems liberating, but will be despised 10 years on.

These policies are BS, what they really are is the unlimited right to negotiate for vacation time. They are also frequently chosen because they mean employers don't need to cut employees a check for vacation time not taken when they leave. When I left my last job which had this policy I asked for a check for vacation not taken, and was told that one reason they chose that policy was that they wouldn't have to cut such checks.

Any reasonable employer can make exceptions to a fixed vacation policy for things like sick leave, if an employee gets layed up for a month after a car wreck they can choose to pay them despite the policy.

Either type of policy can be interpreted generously or not, but with fixed vacation policies there are at least limits on how poorly you can be treated, and you know it up front.

<comment><USER4> > They are also frequently chosen because they mean employers don't need to > cut employees a check for vacation time not taken when they leave.

Ding ding ding! This is a big reason that doesn't occur to most people but saves the employer stacks of money.

<comment><USER5> Yep. It saves them money and in most environments no one takes off significantly more time than they would otherwise.

</comment></comment></comment><comment><USER6> I agree that strictly regimented sick/vacation time is something a lot of us suffer under. My organization goes as far as to call the combined sick/vacation pool "Earned Time". As though you have to work in order to earn the right to rest at home when you are sick or want to take a day off.

Unfortunately, there's another side of the coin. I have worked alongside a couple of groups with a "take whatever you need when you need it" vacation/sick day policy. Either by choice or by necessity, they're disgusting workaholics without exception who routinely grind for 10-12 hours a day, every day, for months, fearing the work that will accumulate if they are home sick for a day or away for vacation for any period of time. They don't get paid more for working late. When I asked, they seem to each take one 5 day vacation once per year.

The saddest part of it all is their personal lives-- the wife of the boss of that group refuses to vacation to anywhere with any kind of internet access because she knows her husband will work instead of be mentally there with her. The other employees are single and friendless outside of work.

I'd very much prefer a more relaxed and less exploitative vacation/sick day system, but I think that a large cultural change has to happen in the US first. We don't have the luxury of the philosophical position that work is an intrinsic good-- the real consequences of this position are pretty brutal, and evident everywhere. Once we accept that work is value-neutral, we can start to be more relaxed about how much we actually have to work, and when we actually work. And we might just be a bit more relaxed about staying home when we're sick, provided that we understand our work is rarely more important than our health.

</comment><comment><USER7> I'm a big fan of vacation policies that lean this way, and have been working at a shop that has a "no vacation policy, policy" for almost four years. That said, I'd echo what I've heard a number of people [1] say about this strategy... that your new challenge is making sure that people take enough time off and don't feel guilty about it. This is the hidden _upside_ to commoditizing PTO, no one sweats using it. It's sort of perceived as a liquidized resource. In an environment without any rules or even vocabulary around time off, it can be a little bit discomforting to take a two week trip or go through with long-weekend plans in a crunch time, etc.

That said, I vastly prefer it to the alternative.. Just want to encourage teams that go down this road to not use these vacation policies as an accidental excuse not to pay attention to and discuss time off and whether it's working out for everyone as well as you'd hope or expect!

[1] My first exposure to this sentiment: [http://www.amazon.com/Up- Organization-Corporation-Stifling-S...](http://www.amazon.com/Up-Organization- Corporation-Stifling-Strangling/dp/0787987751)

[Edit - Just feel the need to plug harder - Seriously, go read Townsend's book. Published in 1970 and it (unfortunately) still reads incredibly forward thinking. It's basically Rework , written 35 years ago (with only respect to JF and DHH, I really enjoyed Rework as well).]

<comment><USER8> Indeed. I was talking to my lawyer about having a no vacation policy policy, and he said I would need to set a mandatory _minimum_ vacation, and make sure employees take a certain number of days off.

His case in point example was me. He pointed out that I work all the time and never take proper vacations (I just had my first one in over two years, and even that was half devoted to a startup conference).

<comment><USER7> Please don't take this the wrong way, but until we stop humblebragging about not taking vacation the problem of equating hours to output won't go away. Not that it's even intentional, it's just the cultural norm lately to give lip service to the idea that overworking is a bad thing but I don't see evidence that most of us _mean_ it... it's all "Gosh, I'm the _worst_ , I never take time off."

<comment><USER9> I didn't take the comment as bragging. At least I hope it wasn't meant that way. If the boss doesn't take vacations it makes the employees feel like they shouldn't take (many) either.

<comment><USER8> Exactly. I realize that as the founder/CEO, I set an example for employees. I don't want it to be a bad example. And this is a problem in part because crazed workaholic is kind of wrapped up with the founder mindset, but it's a rotten trait for employees.

</comment></comment></comment></comment></comment><comment><USER10> I've worked at a shop with 'unlimited time off'. Do you know how much time off I took in the 5 months I was there? 2 hours. That made me the slacker, as the only non-management developer to take any at all.

Focusing on 'what needs to be accomplished' is a great idea, in theory. But in practice, only management has any reasonable way to _compare_ how much people are actually getting done. Those being managed cannot take any time off without at every step wondering 'Am I taking too much time off? Did I get everything done they wanted done?'

I have no doubt that it's possible to create a culture in which unlimited vacation time can work well, but the _rule_ is not the solution, and the _culture_ would work with or without it.

<comment><USER11> That's my big beef with "unlimited" time off. I think it will pressure people in taking as less time off than the rest to not look like you are slacking.

I have 5 weeks off a year, and any days I don't use expire (most of them, I can take one week to next year). I can't have them paid out, unless I have a big deadline and can prove I wasn't able to take time off. This way everybody takes up (more) than enough holidays.

</comment></comment><comment><USER12> As much as I loved wowing my corporate friends with the "unlimited vacation" perk of my previous job, I always struggled because there was always work to be done so I always felt some sort of pressure because using my vacation meant I was inherently saying "yeah, I know there's still work but you guys can handle it, I'm going to play." I get that this isn't a perfect mindset since that's part of being on a team and you have to expect people to share responsibility but that's how I felt and in talking to others and reading about unlimited vacation policies, I don't think I'm alone.

When I left my first job that had a generous but still limited vacation policy, I got a nice sized check paying me back for my unused vacation. I never felt like I was restricted from taking vacation and I definitely liked the money that actually ended up paying for the week off I took between jobs.

</comment><comment><USER13> Having a flexible system is great, but what speaks louder than the corporate policy is the corporate culture. Unless you have a culture of people taking vacation days, then an unlimited vacation policy will degenerate into a tacit understanding that nobody is free to take time off.

At my previous employer, we had a four week vacation policy, and everybody took their four weeks, and the more senior people made a point of it. To a great degree, this culture has to be instilled from the top. If the guy with the corner office isn't taking his vacation days, nobody will feel comfortable doing so.

</comment><comment><USER14> This is ridiculous.

Vacation times aren't mandated in order to manage employees - they are are mandated in order to give them authority and to require their managers to manage around their employees vacation time. By providing the employees express, written authority to override their managers, they force vacation time to be addressed.

So, yes, this is kindergarten, and yes, be happy that the overall system is set up to mandate vacations. Otherwise, there will be no vacations.

</comment><comment><USER9> The nice thing about having a set number of vacation days is that there is an expectation that you'll use them. Having "unlimited" means you're expected to use them when you've gotten your work done and there is a lull. Except in many jobs, startups in particular, there is never a lull. So any time you take off you aren't "getting stuff done" and potentially look bad. The result, in my experience, is more frequent, shorter vacations like long weekends.

</comment><comment><USER15> I'd like to plug the policy my friend's startup is using. Unlimited vacation _plus_ mandatory vacation. [https://sourcegraph.com/blog/mandatory- vacation](https://sourcegraph.com/blog/mandatory-vacation)

I think this strikes a good balance of establishing a culture of taking vacation while allowing people to take off the time they need.

</comment><comment><USER16> The response to "we have unlimited vacation" in an interview should always be "how much did YOU take last year?". You'll almost always get an uncomfortable silence and then "oh I don't know, I didn't really keep track..."

</comment><comment><USER17> Only ten days off per year? Damn! We have 45-54 days of paid vacation or one can have 30-36 days off + take the rest (15-18) vacation days in cash. On the other hand Finnish SW developer's salary is lower than US SW dev's.

</comment><comment><USER18> I think there are certain workplaces which have the culture where this would work as intended but in most, it would probably end with people taking less time, and feeling bitter and resentful about it. If anything, there should be a vacation day minimum. You can give people flexibility in how much time they take off and when, but they should take at least X days off per year. That way there is a standard set that it is okay to take the time off when you need it.

</comment><comment><USER19> Some people are uncomfortable talking about money. Others are uncomfortable talking about vacation time. I think it helps to have some sort of loose policy, because people are so different. I watched a situation where there were 3 people doing the same role. One had seniority, took a lot of time off to travel (some of this unpaid) and the other two were left dealing with the extra workload.

It's hard to have a non-policy policy because people are so different.

I do agree with the article though, because I feel like the 8 hours a day, 5 days a week "norm" for knowledge workers is kind of silly. You're probably getting 5 hours a day of really productive time. The other 3 hours they are banking/scheduling/handling the business of life or taking a mental break.

Factory shift work is probably better suited to the structure described, but that work is quickly becoming extinct.

The key point in the article is that you have to talk about it openly, and don't shame people in to not taking time off.

Sometimes (especially with client facing roles) sound judgement is the most important characteristic of an employee. If they don't get mental breaks every few months, they might show poor judgement.

</comment><comment><USER20> The article's comparison of work vs college vacation/attendance policies is flawed from the start. The overlooked difference is that in college, you are paying the school. Of course they don't care if you come to class.

The fact that pre-college schooling has attendance rules is irrelevant; in that situation, pupils are minors and therefore the school is (in the USA at least) legally responsible for them during the school day (in loco parentis).

With work, the company is paying you in exchange for your time. You've agreed to come to work every day, and the company pays you a salary in return. A vacation policy is a negotiable benefit for the employee, just like anything else in your compensation and benefits package. If you have a no-policy vacation policy, you are basically at the whim of your employer (some handle these non-policies well, others not), but if you have a real policy, you are entitled to take those days, just like your health care, paycheck, retirement contributions, etc.

</comment><comment><USER21> [http://www.businessinsider.com/pros-and-cons-of-unlimited- va...](http://www.businessinsider.com/pros-and-cons-of-unlimited- vacation-2013-12)

[http://www.huffingtonpost.com/2013/11/01/unlimited- vacation-...](http://www.huffingtonpost.com/2013/11/01/unlimited-vacation- _n_4174974.html)

We have "unlimited" sick time, but the manager gets to decide when too much is too much. When the manager decides you used too much then it is unpaid leave. It works ok most of the time, but the company will force you to short term disability after being out a week.

I am a bigger fan of PTO. Lump all vacation, sick and holiday into one big number and let me deal with it as I see fit. That way I know everyone is getting a fair shake.

</comment><comment><USER22> I prefer to call it "unmetered" vacation, not "unlimited".

I've been working with "unmetered" vacation for 3 years now and I've taken more time off than I ever did when I was earning 30 days a year of PTO.

<comment><USER23> But when you're taking time off, are you truly unplugged?

I'm almost finished with the hiring cycle for an SF startup with unlimited vacation policy and where all work is remote; my current butt-in-seat job gives me 5 weeks/year off. How am I going to know if I can truly take 5 weeks/year off (or more) at the new place until I get there? I'd rather have the ability to travel but still be working most of the time than have limited time off but have to be in a fixed location constantly.

</comment></comment><comment><USER24> How do you guys differentiate between "per-hour" consultancies and product dev companies? For those who have worked in both environments with a "free vacation" policy, what is your experience?

EDIT: The reason I ask is I'm curious to know if the pressure to bill by the hour is as powerful as working to "build the next feature" for a product. The _customer_ is different in each case. Does this make a difference?

</comment><comment><USER25> If you're building a startup that you hope might get acquired, it's worthwhile to establish and document a more traditional PTO plan. When a company is acquired, the hours that you've accrued are typically credited to your balance in the acquiring company's plan, so if you have zero accrued hours at the time of acquisition, you're going to end up with a zero balance post-acquisition, too.

</comment><comment><USER26> I looked on LinkedIn to see how many employees Mindsense has; the answer was 1-10 (perhaps that's right, perhaps it's wrong, but it's probably in the right ballpark). I'm sure their policy of "0 vacation days. 0 sick days. 0 holidays" works at that scale, where everyone is some sort of lynchpin product manager with a vested interest in the business, but the reality is that, in a larger organisation, there will inevitably be people who are not massively focused on the work at hand, and who treat their job, really, as a means to an end - <USER2> way of passing some time between the hours of 9am and 5pm in order to generate enough money to pay their bills and save up for some holidays that they actually enjoy.

For a significant portion of those people, offering that kind of flexibility would be a disaster, because they would see it as carte blanche to do as little as they could possibly get away with doing, with as many days sick or on holiday/vacation as they liked. These people aren't motivated by the work they're doing, in any meaningful sense, and they would just as well not be doing it at all if that option were presented to them.

Sure, you could say "don't hire those people", but larger organisations need lots of bodies to fill often quite dull jobs, and you can't really afford to treat those people "as adults", whatever that means.

</comment><comment><USER27> > you're told exactly where to be and when

Um, no. This is not universally required. I once answered an email about an impromptu afternoon meeting from a beach in Mexico - a quick phone call sorted out the one pressing detail, and the meeting was just rescheduled.

We work in a pretty great industry, so might as well optimize for it.

</comment><comment><USER28> _Then, you graduate, enter what they call "the real world" with "a real job" and you're told exactly where to be and when. Exactly what days you will have off. How much you're allowed to get sick. How the game of accruing time off works_

It's pretty amazing to me that people tolerate the evolutionary step backward between college and the travails of an entry-level grunt in "the real world".

One really disgusting trend that's coming along is pooling sick days into vacation, which is of course never advertised when people take the job. So they think they're getting 3-4 weeks of vacation but they're actually getting less. I worked at a company that pulled that bullshit once, and because no one took sick days, the result was that _everyone_ had a constant cold for 5 months out of the year.

</comment><comment><USER29> I'm all for flexible vacation / time off - that's how my department works, and it's been great. Flexible hours are highly dependent on the nature of your employees' work, though. Some jobs require you to be in the office when everyone else is in the office for calls, meetings, emails, etc. My wife's employer technically allows flexible work hours, but most people gravitate toward 9-6 because they usually need to be available to each other.

</comment><comment><USER30> It really is interesting when you think of it that way, you have a lot of rules in school. Then college you have nothing, then onto the real world where you have a job and all of the sudden you have a lot of rules again. It would be interesting for larger companies to see if their productivity increases if they follow a structure like this or something similar, or if productivity takes a dive once you allow people more freedom.

<comment><USER31> I think the difference is that you're paying (a lot) to be in college, while you're being paid (hopefully a lot) to do your job. So it's not realistic to expect to be treated the same way in both situations.

</comment></comment><comment><USER32> At my company we switched to a 0 sick day policy. Within 3 months we were back to the allotted 1 week of sick days.

It turns out we quintupled the number of sick days for the same period as the year before. Draw your own conclusion, but I say workers cannot be trusted to manage this themselves.

It might work in a shop of 5 - 20 folks but at we are and over 10 times that, it is untenable.

<comment><USER22> If you have metered vacation days but unlimited sick days, of course that is going to happen. You have to unmeter both or it doesn't work.

</comment></comment><comment><USER33> Or how about you just get paid for hours worked? Like a contractor. You want holiday, sure take as much as you want and don't feel guilty.</comment>


Ask HN: What's the most comfortable bed you've ever slept on? - <AUTHOR> I'm in the market for a new mattress and I'm finding that nearly all online reviews are fake (it's seriously depressing). I figured I'd try HN and make a thread that everyone can refer to next time they need a mattress.
So far I've tried both a Casper and a Nest Alexander Hybrid Medium. The Casper was just ok comfort-wise, but slept hot to the point that I would wake up covered in sweat. I currently have the Nest and while it does sleep cooler, I wake up every morning with a backache.
I noticed when traveling through Italy and Portugal that the mattresses I slept on were extremely comfortable. I slept so well. I can't seem to find this type of mattress in the US: thin, foam (I think?), and firm yet pressure-relieving. Does anyone know what I'm talking about?
What's the most comfortable mattress you've slept on? <comment><USER2> Try latex foam. Not cheap, but firm yet soft, durable, and sleeps very cool.

There's an old-school outfit in NYC called Dixie Foam[1] that sells amazing firm latex mattresses and toppers. (They also sell less expensive polyurethane mattresses, which have a slightly different feel, and are warmer, but come in both softer and even firmer modes. You might combine a poly mattress with a latex topper.)

And I really like the latex foam pillows from Talatech/Latex International, which I could only find online at one place[2].

[1] [https://dixiefoam.com](https://dixiefoam.com) [2] [http://www.sleeplikeabear.com](http://www.sleeplikeabear.com)

<comment><AUTHOR> I just tried an all-latex mattress today at Dixie Foam on your suggestion and it felt great! Do you have one?

<comment><USER2> I do. It's spoiled me for other beds.

<comment><AUTHOR> I'm about to pull the trigger on one. Which firmness did you get? Do you sleep on your side? Thanks!

<comment><USER2> The model I got doesn't seem to be on their website any more. It was basically an extra-firm, without the 3-zone thing.

I sleep about 1/3 on my side, 2/3 on my back, and occasionally on my stomach (at least on this mattress -- can't stomach sleep at all on innersprings or memory foam). For side sleeping on this thing, I strongly recommend a good thick pillow. For more reference points, I'm a fairly small and light person, and grew up sleeping on foam mattresses that most people would consider rock hard, so this is reasonably soft by my standards.

That said, in the 5 years I've had it, it's converted two boyfriends (both of whom weigh at least 50% more than me) to foam mattresses. One bought the same mattress but added a soft 2" latex topper (which is great for side sleeping but was too soft for me for back sleeping); the other got a Casper (which I found soft and saggy and a little sludgy by comparison, but is still waaaay better than innersprings). Both swore they were never going back to innerspring mattresses.

If you do get a foam mattress, make sure to put it on a platform or slatted bed rather than a box spring.

Whatever you decide, good luck, and sleep well!

<comment><AUTHOR> Thanks for the reply! I used the Casper for several years and found it hot and "mushy," for lack of a better word. I thought an innerspring mattress would solve the problem, but nope. You really can't go back to springs after you've used foam for a while.

I'm probably in the category of "weighs >50% more than you" but even so, the 6" latex mattress I tried at Dixie Foam felt amazing. It was the medium-firm model. I too noticed that they're offering the 3-zone thing, but I think the one I tried was just a slab of regular Talalay latex.

To add to that, the guy who helped me really knew his stuff, was friendly, and seemed like the antithesis of bullshit. If this ends up being as comfortable as it felt in the showroom, I owe you a serious internet hug. Thank you!

<comment><USER2> My pleasure - can't help spreading the foam gospel! ;-)

If you do get one, I'd love to hear how it works out for you.

<comment><AUTHOR> Ordered. Will let you know how it is when I get it next week. :-)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> I sleep in a hammock... Basically one of these [https://www.amazon.com/Hammock-Sky-Brazilian-Double- Backyard...](https://www.amazon.com/Hammock-Sky-Brazilian-Double- Backyard/dp/B00O3YNZME?th=1) with a stand like this [https://www.amazon.com/Best-ChoiceProducts-Hammock- Portable-...](https://www.amazon.com/Best-ChoiceProducts-Hammock-Portable- Carrying/dp/B00WFH3TIG/) It's worked out for me for the last few years. Previously I slept on a cot, before that it was an air mattress / floor when I was too lazy to reinflate the mattress, and a regular double-size mattress or a couch before then. Occasionally I'll travel to San Francisco or Vancouver for work and haven't slept on anything amazing, in fact it sometimes takes me some time to get used to sleeping on a bed again since I'd rather have my hammock.

If you have a SO though I've no data on how well it would work out. :'(

<comment><USER4> Aren't hammock's real bad for your back over longer periods of time? This is just something I've heard and not researched but I had the impression you needed your back mostly "straight" when sleeping.

<comment><USER3> They're pretty popular in South America... I've got Northern European ancestry but no back problems, and I sleep well. You can actually get pretty straight in a hammock, I think a lot of people overestimate the curvature. I think this blog has some good pictures to show what it's like: [http://www.treklightgear.com/treklife/hammock- angle/](http://www.treklightgear.com/treklife/hammock-angle/)

</comment></comment></comment><comment><USER5> A great resource I used when purchasing my last mattress: [http://www.sleeplikethedead.com/](http://www.sleeplikethedead.com/)

My wife and I ended up with a foam mattress, which we really like. Our only complaint is that it's noticeably warmer in the summer than our previous regular mattress.

</comment><comment><USER6> I sleep on this [0] and occasionally the foam that is recommended as a "Others also buy this item".

After a trip to Japan I found sleeping on a futon was the best sleep I've ever had. After returning home, the first thing I did was buy a roll-out futon. Been sleeping on it ever since. It's cheap, I can store it during the day to "reclaim" space in my room.

I'd probably do just as fine on a firm mattress - but the futon is cheaper than a mattress. I can also roll it up and take it with me when visiting friends or relatives who do not have the luxury of having a "guest room".

[0] [https://www.amazon.com/Futon-Furniture-Traditional- Japanese-...](https://www.amazon.com/Futon-Furniture-Traditional-Japanese- Mattresses/dp/B003VQNM2I)

</comment><comment><USER7> My favourite type of mattress is pocket sprung (with mostly or all natural layers). They supportive, comfy, breathable, bouncier than foam (wink) and will last a long time treated well.

In the UK you can find smaller companies hand making them with only natural layers (and telling you what each layer is made of!) offering 10 year guarantees. They're not cheap though, you're looking at minimum $1,500 and easily $3,000 for a larger size.

I've also slept on an expensive latex mattress and it gave me shoulder and lower back ache. Initially it felt great but the pain started after a couple of nights.

[http://www.sleeplikethedead.com/bed-mattress-review- home.htm...](http://www.sleeplikethedead.com/bed-mattress-review-home.html) might be useful

</comment><comment><USER8> If you're waking up with a backache, you need to be looking not just at the brands, but the firmness. I can actually sleep fantastically on concrete with a book for a pillow, but put me on a too soft mattress and I may sleep well but I will have to spend my first hour in the morning relearning how to stand up straight and stretch out my back.

My present mattress is a firm Tempur Pedic mattress. I probably could've gone with anything of similar firmness. I live in a one-bedroom apartment. I give up my bed for (most) company and sleep on the couch, I got a softer topper for it (can't remember the brand) that some people prefer to the firmness of my bed.

</comment><comment><USER9> One thing to consider when you're looking at mattresses is whether you are intrinsically hot or cold when you sleep?

Then consider how the technology actually works.

Me, I'm hot. So, a Tempurpedic mattress would be a really bad idea, since they use body heat as a way to alter the viscosity of the material, and thus also reflect that body heat back at you. I tried one briefly at a store, and after just a few minutes, I was burning up.

My wife has always been intrinsically cold, so for her a Tempurpedic mattress would be perfect.

But we weren't just buying a mattress for just one or the other of us. We had to find one that worked for us both.

</comment><comment><USER10> Best Blog for real answers from an industry expert: [https://themattressexpert.com/qa-blog/](https://themattressexpert.com/qa- blog/)

There was a more recent version, but it seems to be down.

Best sleep ever was on a king size mattress at a high end Marriott before they switched to foam toppers. Avoid "memory" foam at all costs if possible.

Invest in a high quality latex mattress topper and pillows. As long as you don't have an allergy it will change your life. If you have lots of money to spend, full latex mattresses are amazing.

<comment><AUTHOR> I found this full latex mattress that looks great, but I'm not sure if I want to bite the bullet and buy, as there's no option for free returns. [https://spindlemattress.com/](https://spindlemattress.com/)

</comment></comment><comment><USER11> > when travelling through Italy and Portugal

Do you have an email record of your booking confirmations? Why not ask the hostel/hotel/bnb operators?

</comment><comment><USER12> A counter-suggestion here: my girlfriend and I just tried the Leesa.

It's an amazing piece of materials science, and it _feels_ luxurious as hell, but it was waaaaay too soft for both of us. She woke up in considerable pain. Also, it was pretty hot.

Fortunately, the Leesa customer service people were awesome, and they immediately took it away again and refunded us.

</comment><comment><USER13> I asked the same question a few months ago here [1] and ended up with a Cocoon mattress which I like, but not love. My wife, on the other hand, really loves it.

[1] [https://news.ycombinator.com/item?id=13001791](https://news.ycombinator.com/item?id=13001791)

</comment><comment><USER14> Foam is more for the convenience of shipping compressed, they are not going to be the highest quality mattress. Saatva is pretty good I think for the price. No idea about the expensive ones.

You need to figure out whether you prefer a soft mattress or firm. You could go demo a Sleep Number in their store and see which level is best.

</comment><comment><USER15> The mattress market is heating up and most companies offer deferred payments and free pickup/refund after three months. You could try all the popular mattresses for three months each on their free trials!

This was once my plan.... a year later I was still sleeping on the first one I bought. :P

</comment><comment><USER16> I like a SleepNumber bed. I've tried setting it to 60 to 75. What's interesting is that I can move a kink up and down my back by adjusting the number. More recently, I've been running it at 100. That seems to work pretty well for me.

</comment><comment><USER17> Memory foam might be what you slept on in Europe. [https://en.wikipedia.org/wiki/Memory_foam](https://en.wikipedia.org/wiki/Memory_foam)

</comment><comment><USER18> I've been sleeping on the floor for more than a year.

I don't miss my bed.

</comment><comment><USER19> Shifman. Try avoiding synthetic materials. I'm told they tend not to breathe. (Organic) Fleece mattress toppers can also make a huge difference.

</comment><comment><USER20> Tempur hands down. It's also the most expensive bed you could probably find, but also worth it. Should be at least 20 cm thick though.

</comment><comment><USER21> I had a latex matress and got an Asian-style floor mat due to size constraints. I haven't noticed much of a difference.

</comment><comment><USER22> Latex mattresses off gas. I personally had no idea that this was a thing until I ended up sleeping on one.</comment>


Why Antidepressants Don't Live Up to the Hype - <AUTHOR> http://www.time.com/time/health/article/0,8599,1895672,00.html <comment><USER2> Actually, it is because research on antidepressants which _unambiguously make you feel better_ \- namely, dopamine reuptake inhibitors - was outlawed.

What we're left with are the ones that only work in a mild, sometimes-sort of way. And don't buy the notion that the purpose of an antidepressant is to "correct chemical imbalances." No such imbalances have __ever __been identified:

<http://www.etfrc.com/ChemicalImbalances.htm>

 _"How are the chemical imbalances which are the supposed basis for the prescription of "antidepressants" diagnosed? Is exploratory neurosurgery performed, using some technique that allows the surgeon to quantify synaptic transmitter levels? No, the very idea is absurd. Is a spinal tap, then, done to at least measure, on a gross scale, the distribution of neurotransmitter metabolites? Of course not – how many people have undergone spinal taps before receiving a prescription for Effexor®? Is blood at least drawn, to test something? No. This diagnosis – the diagnosis of the most subtle of chemical disorders in the most complex organ in the body – is made on the basis of the patient's report of feeling sad and lethargic. Try to imagine a hematologist diagnosing leukemia this way to get a sense of just how ridiculous this idea is."_

 _"The principal reason for rejecting biopsychiatry (aside from the fact that intellectual honesty demands its rejection) is that it locates the cause of psychic suffering in people's "bad brains," and excludes the conditions of modern life, or anything else, from consideration as the cause of such pain."_

The purpose of an antidepressant is to improve mood. No more, no less. And the degree of doublespeak doctors find necessary to dance around our society's puritanical views on pleasure just to be permitted to market the current, wimpy antidepressants - is staggering.

<comment><USER3> AFTER EDIT:

 _research on antidepressants which unambiguously make you feel better - namely, dopamine reuptake inhibitors - was outlawed_

Do you have a citation for a law or policy statement that shows that there is indeed such an outlawing? I see Google Scholar citations that suggest that research is ongoing, and there is more planned.

[http://www.ajp.psychiatryonline.org/cgi/content/abstract/163...](http://www.ajp.psychiatryonline.org/cgi/content/abstract/163/9/1594)

/AFTER EDIT

There are more than 100 countries in the world, and they would have to be united in banning a certain direction of research for there to be no research on that subject. But dopamine reuptake inhibitors, based on ongoing research in various places, are a risky approach to treating major mood disorders.

"DRIs are notorious for their high abuse potential and ability to cause addiction and dependence. Pure DRIs such as cocaine and combination releasers such as amphetamine and methamphetamine are widely abused throughout the world."

<http://en.wikipedia.org/wiki/Dopamine_reuptake_inhibitor>

"NDRIs approved to treat depression

"Here is the only NDRI that has been approved by the Food and Drug Administration specifically to treat depression, with its generic, or chemical, name followed by available brand names in parentheses:

        * Bupropion (Wellbutrin, Wellbutrin SR, Wellbutrin XL)"

. . . .

"Safety concerns with NDRIs

"Bupropion can increase blood pressure in some people, so regular monitoring is important. The risk of developing high blood pressure may increase if you also use nicotine replacement therapy, such as a nicotine patch, to help you stop smoking.

"There's a small chance that taking bupropion can cause a seizure if you've had previous seizures, a head injury or a nervous system tumor, or if you've had an eating disorder, such as bulimia or anorexia. Because of that, don't take this medication if you have a history of seizures or eating disorders or if you're abruptly discontinuing use of alcohol or sedatives. Be sure to tell your doctor about your past medical issues.

"Also, because of potentially dangerous medication interactions, be sure your doctor knows about any current or previous use of monoamine oxidase inhibitors (MAOIs). Tell your doctor also if you have severe liver cirrhosis, because Wellbutrin can cause liver problems. In addition, don't take Zyban while you're being treated with any form of Wellbutrin."

<http://www.mayoclinic.com/health/antidepressants/MH00068>

<comment><USER2> Notice how Wellbutrin - the _1970s state of the art_ \- is what we're stuck with. Precisely because research has been curtailed - yes, internationally. Progress stands still.

Also compare the side effects you listed with those of the wildly popular SSRIs.

And yes, any hypothetical drug which _reliably_ makes you feel better will be addictive in some sense of the word. Deal with it, and move on with life. Addiction is only the bugaboo it is claimed to be when the thing you are addicted to is _actually harmful._ Most people don't consider themselves "drug addicts" for using caffeine, for example.

The focus should be on developing drugs which do the mood-lifting job, don't produce tolerance, and don't damage your internal organs. There is no evil spirit which manipulates the universe to make this goal impossible. It is simply considered undesirable by our Puritan rulers (and the outposts they have built inside our own heads.)

 _Reply to Edit:_

> Do you have a citation for a law or policy statement that shows that there > is indeed such an outlawing? I see Google Scholar citations that suggest > that research is ongoing, and there is more planned.

Check out the Federal Analogues Act (US) and its foreign equivalents. Any drug which is chemically similar (with a very liberal definition of "chemically similar" that provokes howls of laughter from chemists) to a currently banned drug is instantly placed into "Schedule I" - "no medicinal use" - and is outlawed, in such a way as to make research nearly impossible and certainly unprofitable. But the real problem lies with our society's perception that a drug which gives you pleasure is an unambiguous and unmitigated evil all in itself, regardless of whether it has harmful side effects. Few of the research drugs in the papers you've seen will be permitted on the market, for this reason. Certainly none of the ones which _actually work_ will be.

By deliberately marketing antidepressants which only work subtly and _sometimes_ , the pharmaceutical industry continues to uphold the ruse that they are actually treating an ordinary disease, like leukemia. But _we know how to build antidepressants which work on everyone_. It isn't being done because if it were, the smoke would clear, and we would be forced to admit that we are actually treating unhappiness. Unhappiness caused by stimuli which _ought to_ make a sane person unhappy.

<comment><USER3> _But we know how to build antidepressants which work on everyone._

It took me a while in my offline personal life for the very evident counterexample to come to mind. In fact, it is well known that human mood can go wrong in two ways: by being too low (depression) but also by being too high (mania). To date, there isn't any medication that reliably raises the mood of individuals in normal mood states without subjecting some of those individuals to severe risk of psychotic mania. Anyone proposing policy reform as to this issue should be aware of this fact. Here are some reading references for HN participants who would like to know more about the medical research on mood disorders:

Depression: Causes and Treatment, 2nd Edition

[http://www.amazon.com/Depression-Treatment-Aaron-T- Beck/dp/0...](http://www.amazon.com/Depression-Treatment-Aaron-T- Beck/dp/0812219643)

(a very recent book, by the inventor of cognitive therapy)

or

[http://www.amazon.com/Manic-Depressive-Illness-Disorders- Rec...](http://www.amazon.com/Manic-Depressive-Illness-Disorders-Recurrent- Depression/dp/0195135792/)

(a very authoritative textbook with extensive references to primary research literature).

</comment></comment></comment></comment><comment><USER3> This is an important article following up on the many studies of serotonin- specific reuptake inhibitors (SSRIs) from the 1990s. It turns out, as usual, that the drug companies were quick to publish studies favorable to their products, and slower to publish studies unfavorable to their products. See the excellent article by Peter Norvig, director of research at Google, on how to interpret scientific research,

<http://norvig.com/experiment-design.html>

for more on this problem of publication bias.

There is a good body of research now suggesting that most patients with depressed mood and related symptoms can be helped by cognitive therapy.

<http://www.aafp.org/afp/20060101/83.html>

<http://www.apa.org/divisions/div12/rev_est/cog_depr.html>

For many persons suffering from depression to the degree that it interferes with work or with family relationships, the best approach will be to combine medical treatment, possibly with the new first-line drugs (SSRIs) or possibly with other drugs, and cognitive therapy to learn new patterns of thinking.

</comment><comment><USER4> Summary: company funded studies claim drugs help X% of the population. More rigorous federal studies show they might only help 2/3 * X%. The main difference in the groups was including drug abusers in the federal group.

So what? A drug either helps you or it doesn't. If it helps you, you don't care what fraction of other people it helps.

The value of X mainly determines how many drugs you'll need to try. If they work for 50%, you'll have to try 2 drugs on average before finding one that works. So you want to start with drugs with large values of X, but whether it's 60% or 40% isn't a huge deal.

Furthermore, clever doctors can often guess right and prescribe different drugs for different people. Studies that insist on giving the same drug to everyone with depression are stupid, because they're administered much more intelligently in the real world.

</comment><comment><USER5> What's interesting is that antidepressants such as Prozac have a few established, proven and well-documented side-effects, one of which is orgasm inhibition:

<http://en.wikipedia.org/wiki/Ssri#Sexual_side_effects>

So I'd imagine that the men who are prescribed antidepressants for things like premature ejaculation find that they very much do live up to (a different kind of) hype.

<comment><USER6> From personal experience, I can say that the compulsion (to have sex) remains but the pleasure doesn't, resulting in a lot of frustration. I prefer the mood swings. I'm pretty skeptical of this as a therapeutic option for p.e..

</comment></comment><comment><USER7> I've taken an interest in body chemistry and especially neurotransmitters over the past year or so. One thing that I've noticed is that every drug I've come across that acts as a neurotransmitter reuptake inhibitor has bizarre and highly undesirable side effects not directly related (as far as anybody knows) to increasing the levels of the neurotransmitter in question. I think very few people should take drugs in this class, and they should be used as a last resort, not the primary treatment for any condition.

If it is desirable to raise the level of a given neurotransmitter, I think supplementation with precursors is a more favorable approach. For treating depression, it is likely that raising serotonin and dopamine levels simultaneously will have the desired effect. The appropriate precursors are 5-HTP and levodopa. To aid in production, it may be helpful to take vitamin B-6. To help cause production in the brain instead of the rest of the body, it is advisable to take an aromatic L-amino acid decarboxylase inhibitor that does not cross the blood-brain barrier. EGCG (green tea extract) is effective for this purpose, and may restore proper brain chemistry on its own.

This is not medical advice, and while all the chemicals I've mentioned are available as dietary supplements, they have significant biological effects, including the possibility of harmful side effects. Do your research, and don't rely on advice from the health food store by itself. Wikipedia is a good starting point (though, obviously, it shouldn't be the only source you consult).

<comment><USER2> A good outline of the process:

<http://yarchive.net/med/5-htp.html>

<comment><USER7> This is the first time I've seen the claim that B6 will significantly increase serotonin production outside the brain when taken in combination with 5-HTP and an AAAD inhibitor. It certainly does without the AAAD inhibitor, and it seems possible that it would even with.

This backs up my previous point though - _do your research_ if you're considering self-medication.

</comment></comment></comment><comment><USER8> Whatever the effect, the withdrawal symptoms associated with addiction to big brands like Effexor make beginning to take them something one should seriously consider. I was on Effexor for 2 years and, while it did have a slight positive net effect on me, in the end weaning myself off of it was difficult and very uncomfortable. The addiction is so strong that even a doctor supervised, long term (2 months) withdrawal regimen was a bad experience.

</comment><comment><USER9> I think this blog post (linked from the original article) is more interesting than the article itself:

 _Antidepressants, Placebos and the Failure of Psychiatry_

[http://neuroskeptic.blogspot.com/2009/03/antidepressants- pla...](http://neuroskeptic.blogspot.com/2009/03/antidepressants-placebos-and- failure-of.html)</comment>


Opus Magnum by Zachtronics - <AUTHOR> http://store.steampowered.com/app/558990/Opus_Magnum/ <comment><USER2> I feel like his previous work was better, but still a great game. If you haven't heard of this man you definitely need to check him out. [http://www.zachtronics.com](http://www.zachtronics.com)</comment>


Survey of popular Node.js packages reveals credential leaks - <AUTHOR> https://github.com/ChALkeR/notes/blob/master/Do-not-underestimate-credentials-leaks.md <comment><USER2> Many thanks to ChALkeR for responsibly disclosing this to npm and giving us time to notify people and clean up as much as possible. We were very busy, and ChALkeR was incredibly patient with us :-)

In response to this disclosure, we have set up a continuously-running scanner for credential leakages of various kinds. It's not foolproof, but it's made things a lot better. We'll be writing a proper blog post about this at some point, but we've been really busy!

</comment><comment><USER3> I published a tiny script that makes mass grabbing of files from Github easy ([https://github.com/cortesi/ghrabber](https://github.com/cortesi/ghrabber)), and wrote about some of the interesting things one could find with it. For example, there are hundreds of complete browser profiles on Github, including cookies, browsing history, etc:

[http://corte.si/posts/hacks/github- browserstate](http://corte.si/posts/hacks/github-browserstate)

I've also written about some less security critical things, like shell history ([http://corte.si/posts/hacks/github- shhistory](http://corte.si/posts/hacks/github-shhistory)) custom aspell dictionaries ([http://corte.si/posts/hacks/github- spellingdicts](http://corte.si/posts/hacks/github-spellingdicts)), and seeing if one could come up with ideas for command-line tools by looking at common pipe chains from shell histories ([http://corte.si/posts/hacks/github- pipechains](http://corte.si/posts/hacks/github-pipechains)).

I've held back on some of the more damaging leaks that are easy to exploit en- masse with a tool like this (some are discussed in the linked post, but there are many more), because there's just no way to counteract this effectively without co-operation from Github. I've reported this to Github with concrete suggestions for improving things, but have never received a response.

<comment><USER4> If looking at the common pipe chains from shell histories tells me anything, it is that people are not very familiar with the tools at their disposal.

Just look at some of these chains:

        ps | grep
        cat | grep
        find | grep
        find | xargs
        grep | wc
        ls | grep
        echo | grep
        grep | grep

The legitimate uses for those pipe chains (while they do exist) are few and far between...

A particularly odd one on the list was `type | head`. Does anyone know the purpose of this?

<comment><USER5> This isn't "shell golf". This idea that we _shouldn 't_ use small focused tools in a chain, but rather we should find as many arcane arguments and switches as we can to shorten the chain, is contraindicated by the Unix philosophy. I don't know why this nitpick comes up so often. There are many "human factor" reasons why a longer chain with simpler commands is desirable.

<comment><USER4> Is it really so arcane to `grep PATTERN FILE` or `grep PATTERN` <kbd>Alt .</kbd> (if the previous command was `cat FILE`)? Is it also arcane to `pgrep PATTERN` instead of `ps aux | grep PATTERN`? Is it also arcane to `egrep 'PATTERN|PATTERN'` instead of `grep PATTERN | grep PATTERN`? Personally I prefer the "correctness" of this sort of approach, but the tools are just a means to an end and understandably people have varying preferences. Ironically "legitimate" was probably not an accurate choice of words.

<comment><USER6> > `egrep 'PATTERN|PATTERN'` instead of `grep PATTERN | grep PATTERN`

Oops? Ironically (assuming two distinct values of PATTERN) I think you just answered your own question. (They are different: first is disjunction of patterns, second is conjunction).

Your point has merit for scripts (performance) but for data exploration at the prompt it's almost always irrelevant: the simplicity of pipe composition outweighs anything else.

<comment><USER4> Whoops you've got me there. Yes for that example, the grep alternative is not very elegant. Anyways I wasn't making an argument against composition, just particular types of composition (such as useless use of cat, parsing ls, grepping ps) for which there are side-effects or there is a simpler or more appropriate alternative.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm sure I've done this in the past haha, the npm workflow isn't great at times in this regard. If you have something (to test etc) that is not checked into Git, but still in the directory, it can still make its way into a publish. That's definitely what I'd advise people to be most careful of, use npm-link and use credentials elsewhere etc.

Koa I'm curious of, I've seen almost every pull-request go in there, anyway nice post.

<comment><USER8> Npm package "irish-pub" has definitely saved my ass a few times. (It shows a dry run of "npm publish".)

</comment></comment><comment><USER9> There's an easy way to prevent credential leakage when publishing to npm => Explicitly list the files to include in the package through the `files` property in package.json.

Docs: [https://docs.npmjs.com/files/package.json#files](https://docs.npmjs.com/files/package.json#files)

Example: [https://github.com/sindresorhus/got/blob/2f5d5ba94d625802880...](https://github.com/sindresorhus/got/blob/2f5d5ba94d625802880b3c793c3c1aa7798d0533/package.json#L29-L31)

<comment><USER10> I have taken to this route. It also clears out the cruft to bring dependency directory size down. Your module doesn't need .editorconfig or README.md and other stuff to run, remove it from the published stuff.

</comment></comment><comment><USER11> One of the things that worries me about nodejs is the huge chain of dependencies. I'm not an expert on these things so it would be amazing if someone could correct me if I'm wrong.

It's enough for one of the packages down the line to break compatibility and don't change the version correctly (i.e. bump up major version number bit), or have a slightly too loose version requirements and everything breaks down the line. Ok, if something gets broken it's relatively easy to notice given the test coverage is good enough.

However, it's much much harder when it comes to security breaches (like the one described in the linked article), you might not notice it for a long long time.

Anecdotal data but I tried to teach the interns to use yeoman when they were working on a small angularjs project and it just didn't work, because some dependency somewhere was broken. Happened to me as well and the solution was to try to update it a few days later (should have opened an issue, I know).

I'm using npm shrinkwrap to avoid surprises but still.. It just doesn't feel right. I shouldn't be risking to break the project just by updating the dependencies, unless I've decided to update one of the dependencies to a new major version.

<comment><USER12> Yes, you should use npm shrinkwrap. It baffles me that automatically update your dependencies is considering the right thing to do.

Practically that means that you can push a semicolon fix, your CI server will fetch a different (newer) version of a dependency and break something completely unrelated.

<comment><USER10> > It baffles me that automatically update your dependencies is considering the > right thing to do.

The idea is to rely on semver. If you do ~1.3.4 in your dependency then if that dependency follows semver properly, you'll get 1.3.5 if it's out, and your stuff will still work, but you're getting bug fixes and patches without having to keep an eye on the sometimes hundreds of dependencies. Luckily tools like greenkeeper.io are around now.

The drawback is many people don't follow semver, so I opt to appending --save- exact to all npm installs (actually have npm config set save-exact true)

<comment><USER11> Exactly. In ideal world, semver would solve this issue really easily (probably not completely but to a large extent). However, there are so many dependencies in a typical nodejs project that I have hard time trusting that devs will follow semvar :)

</comment></comment></comment></comment><comment><AUTHOR> I actually found out about this because the guy that created this project contacted me with respect to a package I had uploaded that contained my .npmrc. I was totally blown away, as I'd just followed instructions for creating an npm package I found online. When he contacted me -- prior to publishing this work, which leaves me in awe of his coolness -- panic ran through my veins, because I'm usually paranoid about this kind of thing. Through talking with him, I discovered that I'd published my .npmrc inadvertently, and I got pretty mad at npm that it was even possible. When the npm people contacted me (I'm assuming they had acted on ChALkeR's contacting them), they were very receptive to the obvious feedback of checking for this kind of thing when publishing.

<comment><USER13> It really depends what's in the .npmrc. For example, you might have one containing only a setting to use absolute versions when installing packages and saving them. It's also worth noting that it's a good idea (although I always forget) to use the files field of package.json to act as a whitelist.

Edit: the author notes that these are excluded by npm anyway these days. The documentation does not reflect this.

<comment><USER14> [https://github.com/npm/npm/releases/tag/v2.14.1](https://github.com/npm/npm/releases/tag/v2.14.1)

> npm will no longer include .npmrc when packing tarballs.

<comment><USER13> Thanks! I just took a quick look at [https://docs.npmjs.com/files/package.json](https://docs.npmjs.com/files/package.json)

If I remember in the morning, I'll send them a PR to update their docs.

<comment><USER14> It's listed here: [https://docs.npmjs.com/misc/developers#keeping-files-out- of-...](https://docs.npmjs.com/misc/developers#keeping-files-out-of-your- package)

</comment></comment></comment></comment></comment><comment><USER15> "Please, don't re-use the same password to «fool» the robot while restoring your password — this will result in your account being vulnerable. Yes, several people have done that."

Wow, this is the scariest part. You already have your details leaked, get notified about it and still decide that resetting the token/login to the original value would be the best thing to do.

<comment><USER16> Exposing these developers would be reasonable, so people can avoid their software.

</comment></comment><comment><USER17> Github and bitbucket etc really should offer an opt-out scan-on-push service that looks for the most common mistakes and reject the push with an URL explaining what's going on in the server echo.

<comment><USER18> I wonder what kind of load that'd place on Github's Git daemons, though? Might be difficult to do for free.

<comment><USER19> No too much load, really. We (Bitbucket) already have pre-receive hooks for a handful of other things. The trick would be defining the rules properly to have a reasonably low false negative rate while avoiding work inhibiting false positives (or allow for a mechanism to override it with, say, a force push).

Of course, 93% of our repositories are private so this feature may not be exceedingly useful to our customers vs other things we could be spending our time on.

Edit: I shouldn't have said not useful, rather, comparatively there may be more value in us pursuing other work first. E.g., provide a mechanism for 3rd party pre-receive hooks via our add-on system.

<comment><USER18> Interesting to see that percentage of repos is private.

Is BitBucket separate from Atlassian? Are you hiring? ;)

<comment><USER19> We're very focused on professional teams working on private projects -- but you can't see that because they're all private. Bitbucket is sort of like an iceberg: 1. you can only see a small percentage of the of the total mass; 2. it is blue.

Yes, we're part of Atlassian and we're hiring in San Francisco.

<comment><USER18> Can't afford to move to SFO unfortunately - any plans to expand remote work?

</comment></comment></comment></comment></comment></comment><comment><USER20> What worries me is that this is possible at all. npm stores npmjs.org credentials in a repository-local dotfile, and this is how packages are submitted?!

PHP's package repository, Packagist, doesn't have this problem because it's in the browser. You never enter or store any credentials on the command-line, you click a button on the Packagist site and it tracks your already-published GitHub repository.

<comment><USER21> Like most dotfiles it starts in the current directory and works its way up. Unless npm as changed, the default location for .npmrc is your home directory. You have to actively store the file in the repo.

<comment><USER22> This is what I'm not understanding about this. How in the world do you make the mistake of storing credential files in a repo? And this seems to be beyond people not making template files for configs. Then again, I don't know anything about NodeJS packaging.

</comment></comment></comment><comment><USER23> While the author is down on automatic file name scans, I see nothing wrong in using tools to catch easy mistakes. How many people do regular code / package reviews? Did not think so. I recommend: \- [https://github.com/jandre/safe- commit-hook](https://github.com/jandre/safe-commit-hook) \- my fork of the above for NPM js workflow [https://github.com/bahmutov/ban-sensitive- files](https://github.com/bahmutov/ban-sensitive-files) \- NPM checklist that includes sensitive file reviews [https://github.com/bahmutov/npm-module- checklist](https://github.com/bahmutov/npm-module-checklist)

Finally, if GitHub can automate some of the simple checks, so can we, for different tools and environments of course.

</comment><comment><USER24> A reminder that while you shouldn't rely on them, tools like [https://github.com/jandre/safe-commit-hook](https://github.com/jandre/safe- commit-hook) can help protect you from mistakenly committing secrets to git repositories.

<comment><USER14> Sigh… Yet another mention of an automatic tool. I guess that I will update the Q/A section to reflect my opinion on such automatic tools.

Edit: done.

<comment><USER25> To everyone downvoting: ChALkeR is the author of the linked document.

</comment></comment></comment><comment><USER26> Has anyone looked into leaked credentials in images on the Docker Hub? I can't count how many times I've forgotten to add .env to my .dockerignore file before building.

</comment><comment><USER27> Title is a bit misleading. Actual content title is 'Do not underestimate credentials leaks.'

The article states that many popular Node.js packages have had leaks (in the past). Also, this article was not the source of many of these leaks (example: bower's github oauth token was expired by github itself when it was posted to the website).

<comment><USER14> While it was not me who posted this to the Hacker News (so don't blame me for the title here), I can assure you that all mentioned credentials were active at the time when I found them.

<comment><USER18> Hey, are you accepting pull requests for spelling/grammar?

<comment><USER14> For spelling/grammar — yes.

</comment></comment></comment></comment><comment><USER28> [Shameless plug] Just released the tool that helps avoid logs leak on npm publish: [https://github.com/inikulin/publish- please](https://github.com/inikulin/publish-please)

</comment><comment><USER29> Are there any tools that can scan all the users of an org for such credential leaks?

<comment><USER14> You should not trust automatic tools to do that. They will inevitably be subject to both false negatives and false positives, and will most probably just give you a false sense of security but will not protect you from the actual leak.

You should better review stuff that you publish. That includes commit review, package contents review before publishing them, config files review, logs review before sharing them.

If you have an org — it would better to educate your devs more and make each commit go through an independent review. Also, don't forget about checking package contents.

<comment><USER30> While you should do everything you said I don't see the harm in an extra safety net where an automated tool may catch something you miss. Automated tools won't be as good as s human but humans are not perfect either and are bound to make a mistake; if there are tools that can assist I'm all for it.

<comment><USER31> The problem is the false sense of security. The idea that "something is better than nothing" does _not_ necessarily hold true in security, and additional layers can _weaken_ your security rather than strengthen it.

<comment><USER30> I don't think sanity checks are a form of false sense of security. Ideally the way you develop software those types of credentials would never even be in your project but maybe you're testing something and they're temporarily in there (because we've all done that); a warning could let you know you're about to screw up.

Naturally anyone can become dependent on anything designed to assist them. I'm not really passionated about either direction really.

</comment></comment></comment></comment></comment><comment><USER32> It would be nice if there was an interactive publish option, something like `npm publish --confirm`, which would print a list of the files to be uploaded and wait for you to type "y" to confirm.

</comment><comment><USER33> Have other languages with package managers a similar problem? (Ruby, Lua, Go, Python, PHP, etc)

<comment><USER34> Ruby will but it's an API key not creds directly. Python probably will, IIRC it's not auto-created but is general pratice to put creds in a dot file for PyPI. Go doesn't really have a widely used package manager in that sense, people use github repos (and go get) from what I've seen. Not too sure about PHP and Lua...

</comment></comment><comment><USER35> I wonder how many does code review on node packages, have an apparmor profile on node etc?</comment>


Show HN: I built a service to help companies save on their AWS bills - <AUTHOR> Hey HN: I'm Kaveh, the founder of Usage (https://www.usage.ai/)
We help companies drive down AWS costs. Why? Because the way it's done now is a pain. Stakeholders, especially engineers, are required to spend unnecessary time manually finding underutilized or overly expensive EC2s. We believe the optimization process should be done automatically through a series of sophisticated algorithms. At the moment, there are over 70,000 AWS EC2 prices - doing that manually just won't scale at most organizations. My background is in software engineering.
Previous to founding Usage, I worked on high-performance computing research at JP Morgan Chase and as a software engineer at a number of smaller startups.
Here's how it works: We are typically hired by the head of engineering. Usage makes its initial analysis of your organization's AWS usage, then it's passed to a human that manually verifies each recommendation for correctness. The human in the loop may reach out to if they are unsure about a particular recommendation.
We make money off of a monthly subscription to manage all of your organization's AWS spend management. Our fee is based on your organization's size and ranges from $2.5k-$10k/month. Happy to chat directly firstname.lastname@example.com
Have you experienced any issues with managing your company or organization's AWS expenses? We'd love to hear your feedback and ideas! <comment><USER2> Related reading: _Ask HN: How did you significantly reduce your AWS cost?_ (2017) [0]

The top comment is great. Two easy wins:

* Putting an S3 endpoint in your VPC gives any traffic to S3 its own internal route, so it's not billed like public traffic. (It's curious that this isn't the default.)

* Auto-shutdown your test servers overnight and on the weekends

[0] [https://news.ycombinator.com/item?id=15587627](https://news.ycombinator.com/item?id=15587627)

</comment><comment><USER3> For an (offline) alternative, check out → [https://github.com/similarweb/finala](https://github.com/similarweb/finala) _(written in Go)_

I started using Finala a couple of months ago out of experimentation, it works well, but you need to tweak the configuration a lot to help the tool understand your infrastructure, spending habits and normal usage. My colleagues are very happy with the results, we started saving ±1.8k per month, which is pocket change for our scale but is still money that we can spend on other things.

<comment><USER4> pretty cool! did you guys (or anyone) posted anything somewhere so we can check out about the usability/deploy/etc...?

</comment></comment><comment><USER5> Maybe I'm missing the point, but why wouldn't a company hire a contractor to do the same thing you do for a one-off fee? I just don't see why this is a subscription model.

Of course, a company's usage will change over time, but I don't see how that's worth the monthly fees advertised.

> optimization process should be done automatically through a series of > sophisticated algorithms

> ...then it's passed to a human that manually verifies each recommendation > for correctness

So how much of the heavy lifting is actually done by the algorithms?

<comment><USER6> I guess many companies just have so much room to save on their AWS bills. So the service quickly pays for itself. It's fine to keep the subscription at least for a while and maybe later switch to periodically model if the only feature it offers is saving.

But usually it's also about visibility. Services like CloudHealth give you much better billing overview than what AWS gives you. Without that data you may have a lot of blind spots and budget management is much harder. I think the long term value is billing visibility even for companies with good AWS experts.

I think the math behind saving algorithms isn't too complicated. It's just hard to get it around your head specially when you have too many resources. So it's not practical to do it without these tools.

You will be surprised how much inefficiency developers can produce. Especially with infrastructure as code it's just too easy to create oversized resources and forget about them.

Many companies also have a lot of inefficiency with their architecture. So it makes sense to outsource savings on EC2 instances to a service like this and let your internal talents to focus on architecture optimizations where you can probably even save more money.

<comment><AUTHOR> You hit it right on the head, stunt!

</comment></comment></comment><comment><USER7> Doesn't AWS compute optimizer does the same? What's the difference?

<comment><AUTHOR> Hi emersonrsantos,

Good question!

With Usage, every enterprise customer gets their own fine-tuned model. AWS compute optimizer throws the same standardized model to all of their users. I can't compare our models to the ones AWS compute optimizer uses - but I can tell you that we've never had a complaint about a customer taking a recommendation and regretting it later on.

Additionally, we have humans look over every recommendation to ensure quality. Typically we have an understanding of a customer's cloud infrastructure before they sign up for Usage - and the human in the loop uses that information to grade recommendations produced by Usage's models.

</comment></comment><comment><USER8> [DISCLAIMER] software engineer @ AWS, not working on billing.

Interesting project! This product can unlock a lot of customer savings, and wishing you all the best.

I have a couple of questions:

\- Are you focusing on EC2 compute costs or are you focusing on other AWS offerings as well? Curious to see how the savings compare to EC2 compute optimizer [1].

\- How is your churn rate? What is the value of your product once a customer optimized their AWS bill?

\- Do you have a screencast of your product?

[1] [https://aws.amazon.com/compute- optimizer/](https://aws.amazon.com/compute-optimizer/)

<comment><AUTHOR> 1\. We're currently focused on EC2s (it's been the largest line item for our first few customers).

2\. Rightsizing and spot fleet management keep our users coming back - but our customers get the most value the first month. Almost all of our customers have renewed their subscriptions after the first month so far.

3\. I don't know how well the computer optimizer model performs, but we haven't had a customer take a recommendation and regret it later on. For our enterprise plan, we fine-tune our models to a company's historical usage (rather than throw a standardized model at all of our users).

Happy to share a screencast! Feel free to email me if you'd like.

</comment></comment><comment><USER9> How do you compare to CloudHealth?

I do cost optimisations for living and though there are a lot of tools, most of them are niche and doesn't scale well. For generic purpose I tend to use CloudHealth, but still we write a lot of scripts to do some custom managment.

<comment><AUTHOR> AFAIK, CloudHealth is mostly about cost management and analytics. Usage takes it a step further and also shows recommendations.

I would be interested in hearing about your experience with cost optimization. My email is email@example.com if you'd like to reach out.

</comment></comment><comment><USER10> This is very much needed. I started to create something similar a few years back in case it's helpful. [https://github.com/crizCraig/benjamin/blob/master/benjamin.p...](https://github.com/crizCraig/benjamin/blob/master/benjamin.py) Mostly it dealt with recommending reservations.

</comment><comment><USER11> I like this. What a great idea for a consultancy. There must be so many organisations that are paying way more than they need by not tweaking each aws service they are using. Anything from using the wrong S3 storage type to using ECS when they could switch to Fargate.

<comment><AUTHOR> You're exactly right. We've even seen very small pre-seed companies (with just a handful of EC2s) throwing away a few thousand dollars annually in extra charges to AWS. The problem becomes even bigger at large companies.

<comment><USER11> If you could somehow automate this and provide a tool that did analysis of a companies aws stack usage over a month and suggest configuration changes that would be a big thing.

<comment><AUTHOR> That's what Usage does - we aren't a consultancy to be clear. We automate all of our recommendations (and occasionally add a human layer above it)

</comment></comment></comment></comment><comment><USER12> as far as i can tell from the website this is mostly about converting workflows to RIs. what about right sizing or underutilized instances? do you need read permissions from cloudwatch to look at CPU/memory utilization or just the cost and usage report?

I work at a company that started from cost optimization but now offers a platform to manage the customers cloud operations and i only have 1 suggestion - be very upfront about the permissions/data needed for Usage to do it's job. you don't want to start a demo with a big/enterprise client only to find out your permission needs are way beyond what is allowed in that company for outside services

<comment><AUTHOR> Hi Thristle,

We're more than just RIs. We also offer Savings Plans, Rightsizing, and Spot Fleet management.

Our permissions include CPU, network, and memory logs. We can scale permissions back on a customer-by-customer basis, though (as we have in the past).

</comment></comment><comment><USER13> Think this is a growing problem.

Related:

[https://segment.com/blog/the-10m-engineering- problem/](https://segment.com/blog/the-10m-engineering-problem/)

</comment><comment><USER14> Looks like the calculator needs a little tweaking!

[https://i.imgur.com/Lp8B62n.png](https://i.imgur.com/Lp8B62n.png)

<comment><AUTHOR> Oops, thanks!

</comment></comment><comment><USER15> Check out cloudchecker (spelled it wrong purposely, the 2nd e should be removed) it may give you insight for pricing and features.

</comment><comment><USER16> For enterprises (Fortune 500), Tangoe does this and integrates with your accounts payable. Even does the payment processing.

</comment><comment><USER17> If it works then I would expect Amazon to acquire it so they can break it.

<comment><USER18> That's not the experience I have with AWS. They are really trying to help you get the most out of their platform - including costs.

I'm not saying their pricing is not confusing, but the account managers and sales engineers I've worked with always did a good job navigating us through it - and being honest when something can be achieved a lot cheaper.

Better have a customer optimize their usage, pay less, be happy, and stick with AWS than switching to a different platform.</comment></comment>


SEC Proposes Ban on Magnetar-Like Deals - <AUTHOR> https://www.propublica.org/blog/item/sec-proposes-ban-on-magnetar-like-deals/ <comment><USER2> these regulations are nothing new. After the crash at the beginning of the century regulations very similar to this were instituted. Even after they were lifted, no one but financial institutions could take advantage of the new lax financial regulations, all lack thereof. What's even more perplexing is the fact that after the meltdown these regulations are nowhere near as strict as the ones from the 1930s. And with small relatively minor fines levied against these huge firms there is little incentive to discontinue their dangerous although profitable behaviors.</comment>


Web Of Trust lands $1.3m in funding to make the web a safer place - <AUTHOR> http://thenextweb.com/2012/11/26/web-of-trust-lands-1-3m-in-funding-to-make-the-web-a-safer-place/?utm_source=Twitter&utm_campaign=social%20media&utm_medium=Spreadus&awesm=tnw.to_l0XeG

<comment><AUTHOR> With abuse apparently rampant in "crowd based" efforts, can we trust their trust? Especially if this enables them to scale beyond their "50 million downloads" to the point where they become a target of those looking to cause mischief? Imagine teams of users giving rival sites we can normally trust, a slew of negative ratings.</comment>


Google's "Pi" In The Face - <AUTHOR> http://techcrunch.com/2011/07/02/3-point-14159265/

<comment><USER2> From this and other stories, I get the impression Google went up to about $4 billion before dropping out. I don't see how bidding mathematically amusing amounts along the way indicates they weren't serious.

I expect that at those points in the auction everyone knew it was going to go much higher than the current bids, so Google and everyone else knew that their bids at that point were just formalities. Why not play around a bit?

</comment><comment><USER3> This article is silly. The reason Google lost the auction is because they weren't willing to spend more then 4 billion dollars, but others were. The amounts they bid along the way have absolutely nothing to do with the outcome of the auction. Nothing. It has nothing to do with overconfidence or anything like that, it's a simple numbers game. Google apparently didn't think that the patents were worth what they sold for, so they stopped bidding. It's similar to an eBay action -- something that's a good deal at $50 may not be such a good deal at $500.

-1 Flamebait.

</comment><comment><USER4> I think they can't find the next magic number closer to PI.</comment>


Project Loon balloons over Peru - <AUTHOR> https://www.flightradar24.com/HBAL582/214ba902 <comment><USER2> Part of Google's Project Loon [https://en.wikipedia.org/wiki/Loon_(company)](https://en.wikipedia.org/wiki/Loon_\(company\)) [https://loon.com](https://loon.com)

</comment><comment><USER3> [https://en.wikipedia.org/wiki/Electronic_colonialism](https://en.wikipedia.org/wiki/Electronic_colonialism)

<comment><USER4> Overuse of "colonialism" is so tiring. At least they didn't name it "electronic nazism" to drive the point home.

<comment><USER5> What would be your preferred term ?

To put things in perspective, Australia or Hong Kong for instance were colonies that overall benefited from the relation with England, so I don't really get the parallel you draw with nazism.

<comment><USER6> The word colonialism is a pejorative. The tone of the word in modern language is extremely negative. The point being made is that the word is so negative that the commenter had to go as far as nazis to find another word that is worse.

<comment><USER7> Colonialism is negative for the aborigines.

It is a form of totalitarianism.

It is not a positive thing, unless you actually are a 'colonialist' and thus privileged to its advances - not to be confused with the lesser 'colonist', which are more often than not the ones chopping all the lumber, i.e. doing the work of it.

There are certain religious groups for which the colony is everything...

</comment></comment></comment></comment></comment><comment><USER8> Here is one wandering over Souix Falls: [https://www.flightradar24.com/HBAL0296/214e375c](https://www.flightradar24.com/HBAL0296/214e375c)

</comment><comment><USER9> Did they resolve lawsuit over stealing tech after NDA demonstrations? lets google ... [https://news.bloomberglaw.com/ip-law/google-loses-bid-to- del...](https://news.bloomberglaw.com/ip-law/google-loses-bid-to-delay- lawsuit-in-project-loon-patent-fight-1) guess not

</comment><comment><USER10> More info at [https://www.flightradar24.com/blog/keep-your-eye-on-the- hbal...](https://www.flightradar24.com/blog/keep-your-eye-on-the-hbal- tracking-project-loon-balloons/) (2016)

</comment><comment><USER11> This is a joint effort between our government and the biggest telcom Telefónica (and project Loom), in response to a series of floods that affected last year (mainly) the northern parts of the country due to El Niño phenomenon.</comment>


Show HN: Hawk 2.0 is released (Web interface for Pacemaker clusters) - <AUTHOR> http://hawk-ui.github.io/ <comment><USER2> Looks awesome, kudos!</comment>


Tabula Scripta: A spreadsheet for small data-driven apps - <AUTHOR> https://www.junglecoder.com/blog/tabulaScriptaFirstThoughts <comment><USER3> > The thing is, there isn't currently, to my knowledge, an actual Access-lite > webapp.

AirTable

<comment><USER4> Odoo Studio: [https://www.odoo.com/page/studio](https://www.odoo.com/page/studio)

</comment></comment><comment><USER5> Instead of your own language, I suggest using the Red language. It's similar enough and has a history of being used in RAD/spreadsheet software.

<comment><USER6> I discovered Red (and its predecessor Rebol) a few months ago and was really excited about it - very interesting blend of ideas that seems to hit a sweet spot for GUI scripting. Then I discovered it doesn't have 64-bit support and it seems the community is debating about whether it even should, as it would require a significant overhaul. This makes it a no-go at least for Mac users unfortunately.

Anyone know how likely this is to change [soon]?

<comment><USER7> > and it seems the community is debating about whether it even should as it > would require a significant overhaul

It's true that Red supports 32-bit platforms only, but porting toolchain to 64-bit is a planned transition, which was never "debated about"; Catalina just forced this issue on most developers, including the Red team, and the actual question was if addressing it should come before all the other priorities, to the detriment of overall speed of development and release of major features.

<comment><USER6> Thanks for clarifying. I certainly didn't mean to disparage Red at all - <USER2> language seems interesting and the project admirable. I'm really eager to dive in and explore, but I'm on Catalina so I can't yet.

The debate thing was just the impression I came away with. Things like this post[0] from late 2018 saying

> We are currently 32-bit only, and need to decide the best path for adding > 64-bit support, should we elect to do so.

(and some other back-and-forth I can't find at the moment) left me thinking it was an open question. I'm glad to hear it's on the roadmap.

[0] [https://www.red-lang.org/2018/?m=1](https://www.red-lang.org/2018/?m=1)

<comment><USER7> IIRC it was said in the context of the next major release (0.6.5), i.e. concentrate on 64-bit support ASAP or instead focus on the planned milestones that were already in the pipes. As you said, there was back-and-worth discussion in community chat, where the team tried to gather some feedback from macOS developers and gain a perspective on how urgent this issue is.

Really unfortunate that you cannot give Red a try, but I think it's still worth checking out in a VM of your choice. Drop by one of the Gitter rooms if you need help to get started:

[https://gitter.im/red/red/welcome](https://gitter.im/red/red/welcome)

</comment></comment></comment></comment></comment><comment><USER8> I would use google apis for sheets, tasks and keep. Comes with a nice UI out of the box.

Why do most hack the itch projects start from scratch and not use and build on best in class apis?

<comment><USER9> Should anyone build a product around Google APIs in 2020, given their record here?

<comment><USER10> What's their record abandoning actually used products? Sheets is literally 13 years old and is heavily used internally and externally. The odds of it going away are very small.

This "Google cancels everything" is pretty much a viewpoint I hear only on HN. I don't know what reality some people are living in.

<comment><USER11> So you're a Google fanboi. We get it.

</comment></comment></comment></comment><comment><USER12> I haven't used it, but isn't this what [https://airtable.com/](https://airtable.com/) is for?

<comment><USER13> Can you self-host it and keep your data to yourself ?

<comment><USER14> no</comment></comment></comment>


Fremont(CA) PD considering Teslas for police patrol vehicles - <AUTHOR> https://www.mercurynews.com/2019/01/23/in-fremont-that-silent-car-with-flashing-lights-behind-you-could-be-a-tesla/ <comment><AUTHOR> Privacy and data security issues?

Who has access to and ownership of data? Tesla can collects an awful amount of data. How easy/tough would it be to hack into that?

</comment><comment><USER2> At least they don't catch fire when rear-ended like Crown Vic's do...</comment>


Should You Get a Tesla Home Battery? Let Physics Explain - <AUTHOR> http://www.wired.com/2015/05/get-tesla-home-battery-let-physics-explain/

<comment><USER2> Rumor is the DC -> AC inverter is built in.</comment>


Battle of the simple, privacy-focused analytics products - <AUTHOR> https://usefathom.com/blog/fathom-vs-competition <comment><USER2> The competition being (non-exhaustive list, comment if you know of others I might have missed):

SimpleAnalytics.com, Plausible.io, Matomo.org, GoatCounter.com, and (shameless plug but WIP) Chiffre.io.

However, while there is a competition to gain users and market share, ultimately these platforms are in competition against Google Analytics and other giants of the surveillance industry. The only risk if one of them grows too fast is that it becomes the new giant. Google used to say "don't be evil", after all.

<comment><USER3> I think self-hosting is the solution. This way, there is no company that will store centralized user data, which is the biggest privacy issue for analytics.

I have been building a self-hosted platform [0], and I always get pressured into offering it as a SaaS. I am strongly against it and try to make it work by teaching people that self-hosting is really easy and it's the way of the future.

[0]: [https://www.usertrack.net](https://www.usertrack.net)

<comment><USER4> > I think self-hosting is the solution. This way, there is no company that > will store centralized user data, which is the biggest privacy issue for > analytics.

Your opinion will change in time. It all comes down to the principles of the company and who has control of it. That's why Fathom hasn't taken venture capital. As soon as you bring in people who don't share the same values as you, things start going downhill. You do not need to store centralized user data to run a sustainable competitor to Google Analytics

<comment><USER3> I am slightly confused by your comment. Why do you say my opiniong will change in time? It has been the same over 8 years now and it just seems to get stronger and stronger.

"You do not need to store centralized user data to run a sustainable competitor to Google Analytics." That was exactly my point, right? Any platform that is hosted stores centralized user data (as they control all the servers), so self-hosting is the only way to decentralize the data. Am I missing anything?

<comment><USER4> You replied to a comment talking about:

> Fathom, SimpleAnalytics.com, Plausible.io, Matomo.org, GoatCounter.com, and > (shameless plug but WIP) Chiffre.io

and you said :

> I think self-hosting is the solution. This way, there is no company that > will store centralized user data, which is the biggest privacy issue for > analytics.".

Your premise was that these companies store centralized user data. That is absolutely not true. So you presented a fake problem (that doesn't exist amongst privacy-focused analytics solutions) and gave a solution.

<comment><USER3> The company has access to all the data, thus it's centralized where one entity has full control over it. Can you further elaborate how those companies don't have access to their data? In case of an aquisition, how safe is all the data stored on all the servers that the company controls? What exactly is not true?

<comment><USER4> You shouldn't keep centralized user data. I'm done here as it's taking us both too much energy to explain our points. Because I run Fathom, I know about the data I keep, and there's nothing user specific. Even in our queue, we never store user data...</comment></comment></comment></comment></comment></comment></comment>


Looking for Co-Founder - <AUTHOR> Looking for co-founder for my AI based startup <comment><USER2> More details would probably be helpful for all parties involved. :)

</comment><comment><USER3> Looking for a technical co-founder?

Email me @ firstname.lastname@example.com</comment>