FreeBSD – A lesson in poor defaults - <AUTHOR> https://vez.mrsk.me/freebsd-defaults.html <comment><USER2> Previously:

\- [https://news.ycombinator.com/item?id=11318508](https://news.ycombinator.com/item?id=11318508)

\- [https://news.ycombinator.com/item?id=12484248](https://news.ycombinator.com/item?id=12484248)

\- [https://news.ycombinator.com/item?id=16008688](https://news.ycombinator.com/item?id=16008688)

Note that updates to this post are listed as addendums at the bottom, rather than removing sections that are no longer true in current versions of FreeBSD.

<comment><USER3> Why is liking these a thing: everyone has the "past" button, right?

</comment></comment><comment><USER4> There are kernels of truth in this document that circle around a politics/bureaucracy issue in FreeBSD that has existed forever. But the overall motif about security is laughable diatribes of a typical OpenBSD fan that understands little about kernel work while flailing around about how secure their pet uniprocessor operating system is.. yes, uniprocessor. It is trivial to DoS an OpenBSD machine accidentally on any kind of modern hardware because the locking model is state of the art circa 1980. Security! The only real facepalm this document describes accurately is that FreeBSD still bundles sendmail. The rest of this is basically a slanted view of things that don't matter when running a high scale internet service with FreeBSD -- I know because I did so.

<comment><USER5> Can you detail how the views presented provided are 'slanted' and 'don't matter'?

<comment><USER6> Sure, say you configure a Linux, OpenBSD, and FreeBSD machine to provide some useful service. A "stack" as they call it these days. None of these OSes are going to have a large attack surface outside that "stack", and that is the primary liability in running an internet service. There are relatively rare occurrences like the TCP SACK bug that affected Linux and Netflix' non-default FreeBSD RACK TCP stack. Every UNIX-like written in C without formal verification is subject to incidents like that from time to time. Every other security concern is addressed in an OS-agnostic fashion with failure domains, limits of scope/networking, access controls, monitoring, and operations procedures.

Now what Linux, and to a lesser degree FreeBSD, can do is survive real world usage at scale. OpenBSD cannot. It would fall over or require magnitude more machine count to do the same workloads that people use Linux and FreeBSD to run. So all the exploit mitigation diatribe and "great defaults" and pet projects are cute but funny when you try and throw shade onto others with them. As I said, there are some kernels of truth that pertain less about security and more about overall health in FreeBSD this doc accidentally hits on, but running some hobby software like opensmtpd on openbsd isn't going to save the world from real cybersecurity issues.

<comment><USER7> Among those "cute pet projects" are OpenSSH, LibreSSL, OpenNTPD, and PF. The internet at large, and even FreeBSD itself, would be all the poorer for not having these projects available.

As someone who has run web servers with both FreeBSD and OpenBSD, I think some of your criticism in this thread is valid, but you really crossed the line into blatant fanboyism with that one at the least.

<comment><USER8> Only really OpenSSH from your list applies though.

LibreSSL isn't really in widespread usage outside of OpenBSD and has still been vulnerable to some of recent the OpenSSL exploits.

OpenNTPD is more widely used but lots of people still go for other alternatives and frankly I'm not convinced OpenNTPD offers anything significant over the competition anyway.

pf is barely used outside of OpenBSD and frankly why should it be when Linux has iptables (which does the job well) and FreeBSD has ipfw (which also does the job well). pf is also a decent firewall but it's also a crowded market with lots of really decent alternatives written by their respective platform hosts.

I do actually quite like OpenBSD though. But outside of OpenSSH, OpenBSD is slowly becoming less relevant to the wider industry as other platforms catch up on security and even over take in terms of enterprise features.

<comment><USER9> pf is shipped on macOS and iOS as well.

</comment></comment></comment></comment></comment></comment><comment><USER10> HardenedBSD fixes several of these issues.

<comment><USER11> No, it doesn't. HardenedBSD is one guy who became sore when FreeBSD rejected his patches due to complete lack of design, simple and common C programming errors and overall extremely poor code quality. Despite being provided with the usual review and suggestions he kept submitting them like that and at some point FreeBSD devs became bored with his attitude and moved on. And that's how HardenedBSD came to life.

<comment><USER12> It would be nice if you provided sources when making such harsh accusations.

<comment><USER13> Whole HardenedBSD single man PR campaign started here: [https://reviews.freebsd.org/D473](https://reviews.freebsd.org/D473)

Author thought that having ASLR is absolutely must (hint: it's not[1].) HardenedBSD is poorly reviewed ASLR implementation by a person who didn't take criticism well + recommended new defaults from subj.

Later hBSD added neat things like different update mechanism (hint: it's the same minus delta patches), retpoline enabled by default a little earlier than FreeBSD and probably still haven't disabled it.

It's a fact that FreeBSD had poor defaults for ages and only recently (last couple of years) started cleaning things up. That said I never seen FreeBSD user running default system settings. Many not even running GENERIC kernel, me included.

I think FreeBSD has a lot of issues, but 90% are political bullshit.

[1]: [https://arstechnica.com/information- technology/2017/02/new-a...](https://arstechnica.com/information- technology/2017/02/new-aslr-busting-javascript-is-about-to-make-drive-by- exploits-much-nastier/)

</comment></comment></comment></comment><comment><USER14> I remember this from previous rounds of hn discussions, but I didn't catch last time that the author actually claims that having a code of conduct is distracting FreeBSD from adopting his favorite sysctl and rc.conf defaults. Kind of apples and oranges. Does not paint the author in a good light.

</comment><comment><USER15> My main complaint about FreeBSD is basically an extension of the issue of poor defaults. They import features and third party software without planing out how it should fit into the system as a whole.

By far the worst offender i ZFS. Having ZFS as an option on FreeBSD (or Linux) is wonderful, but it's extremely clear where ZFS has its origin. ZFS feels like it was just bolted into FreeBSD and no one has a plan for making it feel like it belongs.

OpenBSD has been incredible successful in building a base system that feels like everything belongs together and working in a similar fashoin

<comment><USER16> I am not getting the part why ZFS felt bolt on? And worst offender?

I think we are missing some context here?

<comment><USER15> I was thinking about the command line tools. It's extremely clear that they came from Solaris and there has been no effort made to make them feel more like they belong in a BSD system.

</comment></comment></comment><comment><USER17> How exactly is having 3 Firewalls in base system "poor defaults"?

The author never explains how 3 firewalls are bad. It seems this is probably some Linux hack trying to slander FreeBSD.

<comment><USER18> The Zen of Python (PEP 20, aka "import this") comes to mind.

"There should be one-- and preferably only one --obvious way to do it."

<comment><USER19> That's a lovely sentiment, and a great one to base a language that has an emphasis on instruction and readability on.

But unless you also wish to argue that "there should be preferably only one programming language", it also follows that there are other sentiments upon which to base languages.

Here's one that seems to fit the continuing analogy: TMTOWTDI.

[https://en.wikipedia.org/wiki/There's_more_than_one_way_to_d...](https://en.wikipedia.org/wiki/There's_more_than_one_way_to_do_it)

Now, you may not like that one, and that's fair. I frankly like Python less the more I use it, but it still has its place in my toolkit.

<comment><USER18> The world has room for multiple philosophies, and that's a good thing. I happen to prefer PEP20 to TMTOWTDI, and Python to Perl, as might be expected.

I wasn't trying to say that there should only be one programming language, and I don't think it follows from the statement I quoted. I take it more like this: You use the correct tool for the job, and if there are inferior tools then just get rid of them.

In the context of the discussion, I happen to think that one packet filter/firewall in an OS is the correct number, unless each has significantly different uses. Such is not the case in FreeBSD.

</comment></comment></comment></comment><comment> rvp-x I can't connect to this website, is it geo-blocking?

</comment><comment><USER20> Uh oh. I was planning to set up my new home server with FreeBSD next week, but after reading this I'm a bit concerned...

It would have been interesting to have some more info on this part too:

>It does not go in depth about changing FreeBSD's more serious low-level problems that require code changes.

Does anyone have any resources to read up on this? I've been reading "The design and implementation of the FreeBSD operating system" by the way.

<comment><USER21> It seems to mostly be a philosophical issue. FreeBSD security is certainly a lot better than it was, just expect that the defaults probably aren't what you're looking for.

OpenBSD developers almost always change features for security reasons. They aren't afraid of writing their own utilities or maintaining entire projects to do things in a cleaner way. This can lead to compatibility and/or performance issues, but at the same time you get a very nicely integrated base system.

I know less about FreeBSD, but they seem to place more responsibility on the user for building a system using their primitives. The choices they make with regards to backwards compatibility and defaults make sense in this context. FreeBSD is also usually the first stop for ex-Linux users who have become disenchanted by systemd or other changes to the system.

Linux as a whole doesn't really have to choose a side because distributions have their own opinions and there's enough eyes across popular packages to have decent security while maintaining a huge number of features.

</comment></comment><comment><USER22> Out of curiosity, does OpenBSD have anywhere near this many security issues?

<comment><USER23> There is no definitive way of knowing how many security issues are present in a piece of software or a collection of software. You can only look at history and attitudes for a project (and perhaps other factors such as language used) and extrapolate from there.

<comment><USER24> >and perhaps other factors such as language used) and extrapolate from there.

I'm curious about this statement. Which languages do you think indicate greater security, which ones tend to indicate the opposite?

<comment><USER23> Languages with a garbage collector will be able to avoid some of the worst memory errors.

<comment><USER14> Usually people say it's bounds checking and preventing use after free rather than GC. It's possible to have both without GC.

</comment></comment></comment></comment></comment><comment><USER25> I was really interested in FreeBSD a while back. Guess I should look elsewhere after reading this since I'm kind of a newbie and it would've taken me a while to figure all this out on my own.

<comment><USER26> Not really, this guy is kinda missing the point of FreeBSD - which is stability not security. Many of these problems are overstated or non-issues for desktop systems. If you do have a need for any of the changes this guy is talking about, then you can make the change. If you just want max security, OpenBSD is a thing. But this list of complaints probably isn't much worse than many linux distros.

<comment><USER27> I don't see the security concerns regarding package tools being non-issues, nor the weirdness regarding OpenSSH patches.

</comment></comment></comment><comment><USER28> Looks that I was wrong about the all BSDs are more secure that a typical Ubuntu or Debian GNU/Linux install.

<comment><USER29> I take issue with you treating yourself more harshly than the OP's author treats his machine. Just to hit one point as the OP has all kinds of non- disputable other points, I'd wager no typical linux distribution ships with swap encryption enabled, do you know if any of them do?

<comment><USER30> Once you're setting up a BSD, you've signed up for lots of post install configuration. The installers just aren't meant to be as "batteries included" as a Linux installer.

I'd go so far as to say that you shouldn't touch a FreeBSD or OpenBSD install unless you've already done and maintained a gentoo, arch, or LFS install.

<comment><USER31> OpenBSD is _much_ easier to install and get working than any of the Linux distros you mentioned. Post install configuration might take all of an hour, and it's secure by default, unlike those mentioned.

And by "post install configuration," I mean adding XFCE or other DE or WM, along with whatever apps you like. No tweaking needed to close security holes.

<comment><USER21> There's a bit of silliness with resource limits (that I think should be configured to match the user's hardware or at least mentioned in the installer), but overall I agree completely. The base system includes a couple of window managers, including CWM which is quite nice. On a laptop you have to enable APM, but after that you're just about done.

I'd say it's about equivalent to a simple Arch install on easy hardware, although OpenBSD comes with quite a bit more security stuff pre-configured.</comment></comment></comment></comment></comment>


The language of capitalism isn't just annoying, it's dangerous - <AUTHOR> https://theoutline.com/post/6739/keywords-book-review-language-of-capitalism <comment><USER2> > _Because we are lied to all the time, in ways so routine they are beneath > conscious notice, even the most direct lies are losing their power to shock > us._

\-- Charles Eisenstein [http://charleseisenstein.net/the-ubiquitous-matrix-of- lies/](http://charleseisenstein.net/the-ubiquitous-matrix-of-lies/)

> _The complexity of the so-called individual that's been praised for decades > in America somehow has narrowed itself to the 'me'. When I was a young girl > we were called citizens – American citizens. We were second-class citizens, > but that was the word. In the 50s and 60s they started calling us consumers. > So we did – consume. Now they don't use those words any more – it's the > American taxpayer and those are different attitudes._

\-- Toni Morrison [http://www.theguardian.com/books/2015/oct/05/toni- morrison-w...](http://www.theguardian.com/books/2015/oct/05/toni-morrison- writing-race-media-new-yorker-festival)</comment>


Entrepreneurs Beware? The Convertible Debt Provision You Need To Know About - <AUTHOR> http://www.projectmeadow.com/earlyconversion

<comment><USER2> Never occurred to me. An especially helpful heads up for student entrapreneurs who are looking for quick cash to get off the ground</comment>


Beware self-funded Startups: failure can haunt you for a long time - <AUTHOR> After years of success and decline, I'm stuck with over $150k in debt when we didn't bring our expenses down as fast as our income dropped. It didn't help that not everyone on the team was exposed equitably to our debt instruments (all personally guaranteed, such is the only way in a new company). I had better credit, and even though I own a smaller part of the company, my credit lines were the ones that got expanded (which I didn't even know was happening).
After stripping expenses to the bone, the business might slowly pay off it's bills, say after ten years or so. It does have millions of users after all. Which means that this debt will haunt for years, and I can't just leave it all behind, I'll have to deal with maintenance, etc, for the foreseeable future.
My business partners bought homes at the peak, so between the business and home, bankruptcy is looking like their option (I was not so, uh, unlucky in my timing and have equity). Either way sucks.
And now I'm looking to do something new. And while failure might be rite of passage in startupland, hiring someone with such unrelenting financial pressure is not really likely, is it? And the credit report problems (business cards get switched to personal cards when not paid on time, and guess which ones of them all didn't get paid on time? Yeah those with my SSN) will cause problems with a corporate job, as credit reports are such a big thing in hiring these days.
Lesson learned: get investors; share the wealth, share the risk.
So HN: what on earth do I do now? <comment><USER3> With all due respect, I don't think those are the correct lessons to be learnt.

The lesson is: don't take on debt. Get investors. If you can't get investors, bootstrap, do some gigs on the side, and use that money to run the company. Then, get investors. If you can't get investors, well, repeat until...

If you do this for a long enough time, and the idea, product, company, team and timing is right, you will be able to get investors. If not, that's the world telling you that it's not such a hot idea, product, company, or whatever. Take the hint.

This is exactly what we did, and are still doing. Unless you hit gold, it's slow as heck. But still, I'd never take on personal debt for my startup.

<comment><USER4> Don't take on debt secured by you personally. Your business should take on the debt. I know it's easier said than done, because no one will loan anything to a business with no revenue.

By agreeing to personal debt, you pledged personal money that you didn't have. I guess different people have varying levels of risk, but I don't invest money I don't have.

<comment><AUTHOR> Another lesson: you may think it is a business card (it is), but surprise! They can convert to personal (read the fine print).

<comment><USER3> Use debit cards. It will only allow you to spend money you have.

</comment></comment></comment></comment><comment><USER5> "millions of users" - is that serious, or sarcastic? I couldn't tell. If you have millions of users, I'd suspect you can find a way to monetize them a bit more than what you already are to get that $150k debt down faster - <USER2> even a direct appeal ala Wikipedia.

While credit checking for hiring does happen, it doesn't happen everywhere, and you can likely explain your situation reasonably such that it doesn't become an automatic strike against you. There may be some jobs that are not available to you now - you might not get a defense contracting gig - there are others.

Is the $150k split between the 3 of you ($50k each roughly), or is _your share_ of the debt $150k (as in it was $450k)? The rest of the team probably won't want to voluntarily take on more debt, but they might be willing to help you pay down some of yours voluntarily, assuming that they don't have their own $150k chunks to attack.

What are your skills? It's not uncommon for a sr-level programmer with in- demand skills to be able to pull in $100k+ doing freelance or contract work, and even with other expenses, you can probably have this $150k taken care of in 3-4 years.

Also, have you talked to your creditors to see if any will forgive some of the debt? They may 1099 you for the difference in some cases, but paying _tax_ on, say, $10k of forgiven debt is different than having to pay $10k.

I feel for you - I've been in that situation, just without so many zeros. :/

<comment><AUTHOR> I wasn't being sarcastic. It is just not an easily monitizable space.

It is $150 total, but the way credit was signed up, almost all of it is guaranteed by me. I am looking into consolidation (and partial forgiveness), that might make it entirely mine and that might just be worth it. Take full responsibility and take full action.

<comment><USER5> While taking it all on might suck, it's totally under your control at that point. Having your credit info impacted by the decisions and actions of others can be painful.re: sarcastic - just wasn't sure how to read what you'd written.

re: monetizing - wikipedia isn't easy to monetize either - which is why they do the appeals. Without knowing your situation, I can't presume to tell you what to do, but you may find a sizeable chunk of people willing to help donate to offset your debts, perhaps in exchange for a guarantee of continued service.

re: 150k - I hope you're able to get that reduced (via forgiveness, consolidation, whatever) quickly - perhaps to $100k soon. There are a number of stories of people getting through debt quickly on various personal finance blogs. Perhaps some of those may serve as motivation from outside the tech-o- sphere.

Best wishes to you on that difficult journey.

</comment></comment></comment><comment><USER6> Wow, this is a tough read. I know things look bleak right now, but I think you need to step back and realize that things are going to be fine.

First off, start looking for a job. I know that you are worried about credit reports, etc, but if you are good, someone will hire you. Don't assume that you will fail to find a job because of this.

Second, consult someone knowledgeable about bankruptcy. I don't believe your house will be at risk and you will be able to start fresh without the debts weighing you down. Bankruptcy isn't a personal failure (this is possibly a controversial statement but I strongly believe it).

In short, don't give up, don't assume that job search is hopeless before you start looking, and just try to make progress a little bit every day. In a few years this will be distant memory.

Good luck.

<comment><AUTHOR> Thanks for those words. :)

</comment></comment><comment><USER7> If you have some money, you can negotiate your credit cards down to almost nothing (eg $30k = $4k payoff). Call the credit card company, tell them you have $X (X being about 10-15% of your balance) and you are calling all of your creditors to see who will take it as payment in full. $X is all you have...and if they will accept it, you will send it to them...otherwise you are sending it to the next card on the list.

It will be a little scary making that first call and making such a low-ball offer, but it is where you want to start and you will be amazed at the results...I guarantee it. Be sure to get the accepted deal in writing before sending any money.

This is a tough thing to go through. As an entrepreneur, you have to be able to compartmentalize these types of problems. Put these problems in a box, put the box on a shelf, and continue to build things and solve problems. Don't forget about the box, but set it aside and refocus on kicking ass. This is just a wall. You will run into a lot of walls on your journey. Walls are not there to keep us out, they are there to keep those who do not want it bad enough out.

tl;dr It's not over until you quit. Never quit.

</comment><comment><USER8> Sounds like you need cut bait and run and to declare personal bankruptcy.

In 3 years of reasonable payments you will have all your debt gone (or if you have no assets outside a house and cheap car, chapter 7 even, with your debt gone near instantly).

Chapter 13 doesn't last a long time, and was designed for your case. The point is not to take a productive citizen and hang upon a yoke of debt for much of their life.

In either case, with 150k of debt, you're going to be in the credit crapper for much longer by NOT declaring bankruptcy.

Random google page on the difference between the two: [http://www.creditinfocenter.com/bankruptcy/chapter13BK.shtml...](http://www.creditinfocenter.com/bankruptcy/chapter13BK.shtml#2)

I've known a couple people who went through bankruptcy, and all of them have felt _much_ better afterwords, both immediately and years later.

<comment><USER9> They went through pre-Bush bankruptcy-law bankruptcy or post?

[http://msnbcmedia4.msn.com/j/msnbc/Components/Photos/050420/...](http://msnbcmedia4.msn.com/j/msnbc/Components/Photos/050420/050420_bush_bankrupt_vmed.grid-4x2.jpg)

<comment><AUTHOR> The answer to that can make a big difference.

<comment><USER8> Talk to a bankruptcy lawyer. Initial consultations are free with almost all lawyers. Bring tax returns, summaries of your income, etc.

I honestly don't know about the other two. I know one of them was pre-2005 law.

</comment></comment></comment></comment><comment><USER10> You asked us, "what on earth do I do now?". I recommend you start another post and change your question to "how do I monetize millions of users?".

Give us a description of your market without revealing your business of course, customer profile (age, income, etc) , how much information you have on them (do you have emails? location? interests etc), and how much time they spend on your site.

I'm sure you'll get much more practical and useful advice from that thread on solving the problem rather than the commisseration here on your bad situation.

<comment><AUTHOR> Very true! I will wait a week and gather those thoughts for a post next Sunday.

Of course, it's not that we haven't thought of things, but how much good time do I want to throw after bad?

But how insular I have been to not think first of posting that question. Thanks!

<comment><USER11> You may very well be able to sell the company simply for the user base...

</comment></comment></comment><comment><USER12> There are plenty of startup founders that got their credit ruined before like Max Levchin. It got to the point where "a ruined credit history prevented him from buying a car, getting a cell phone, and renting an apartment." However, "Levchin kept going without much downtime." Levchin says: "Every time I had torn up my certificate of incorporation… the delay between that and registering a new company was typically no more than 24 hours."

[http://gigaom.com/2010/08/06/max-levchin-says-embracing- fail...](http://gigaom.com/2010/08/06/max-levchin-says-embracing-failure-is- dumb/)

Levchin's 24 hours might be extreme to follow, but we can definitely learn from his relentlessness. As for $150k in debt, creditors nowadays are pretty used to arranging settlements. You might be able to arrange some payment plan with them and reduce the debt to under $70k. A big part of it is interest and fees that they tackle on so they would rather remove that and work with you than watch you default. So given you get a job (startup jobs don't check your credit as much) you might be able to fix it in 1-2 years without declaring bankruptcy.

I know how demoralizing it can feel but you are definitely not the only one and will emerge stronger after you get over it. Look forward to seeing blog posts/interviews about how you struggled and overcame your debt when you rise again.

</comment><comment><USER13> How did your credit line get expanded without you knowing it?

A key detail I was not aware of is 'business cards get switched to personal cards when not pain on time'. That's a bit one that we should all be aware of (though I don't have a business card yet, good to know).

<comment><USER4> This is not how it works. When you open your business credit card, make sure it's not a personal credit card in disguise. The credit card needs to really be linked to the business. Then, iy cannot be switched to personal, ever.

The trick is that many credit card companies will be happy to extend credit to you personally (your SSN), and agree to print a fancy "company name" on the card, so it makes you feel important. Wrong approach.

It's simple to tell: if you provide your SSN, you lose. If you only provide your company's EIN, fine (and read the small print).

<comment><AUTHOR> Yes, good to know. They kept things under the EIN until it went unpaid, then they switched to my SSN. That got my attention, of course, and I've learned a lot since then.

</comment></comment></comment><comment><USER14> You firstly need to realize that mood is like the weather, it's never permanent.

You have some real practical problems to deal with, but no more than lots of people, no more than lots of people who you admire have dealt with.

You need to talk to the organisations you owe money to, you need to negotiate a payment plan you can actually afford.

You need to listen to this interview with Rand Fishkin, <http://mixergy.com/seomoz-rand-fishkin-interview/> in which he talks about being in debt.

Look yourself in the mirror, are you really exhausted and out of ideas ? I don't think so, I think you're just getting started.

<comment><AUTHOR> Thanks! It took longer to accept the situation I'm in, than it will be to start doing new things, I hope.

</comment></comment><comment><USER15> Can you raise investment or sell the company outright ? - if you've got millions of users then it might be viable route.

<comment><AUTHOR> Sell might be an option. One of those things where there was an offer a while back, perhaps they will take it for a song. But otherwise, how to go about it?

<comment><USER15> It's hard to say without knowing more about the business, but assuming you know who your most likely acquirers are get a contact within those businesses and approach them directly.

Who do you primarily owe money to ? - if a significant chunk is to a supplier then you might want to see if you can negotiate a deal with the supplier writing off the debt in exchange for equity in the company.

<comment><AUTHOR> Banks!

</comment></comment></comment></comment><comment><USER16> What you have been through sounds terrible. I can imagine you a feeling very burnt out.

However, once the smoke has subsided I'm sure you take positives from this. If you need a salaried job, I suggest you look for a medium sized company that would value your experience, rather than a large corporate.

<comment><AUTHOR> Yeah. Funny thing though, in all my life I've never had a resume, always things found me. It doesn't feel like it will be that way now, but I Aldo understand that I'm having some very strong feelings at the moment. I'm not much of one to hold on to them too long though. perhaps to a fault. I'll be refreshed by new year, but want to burn through all the dark parts now and leave as much behind as I can.

</comment></comment><comment><USER17> As others have written: I've been there, I survived, I learned a lot.

Carefully look at the debts and your resources and prioritize. (Secured debts and bills on active accounts (like current utilities that could get shut off) have to be paid first.) Then do what you can to whittle away the debt. Read up on debt collection tactics and law so you can tell who can really hurt you and who is just bluffing.

Then just hang on for a long ride. Eventually you will have deals with all the creditors and hopefully no new surprises will show up. [The possibility of new surprises showing up was a lingering fear for me - one extra unknown "debt" showed up almost a year later, but fortunately I was able to convince them that I was no longer guaranteeing the account when the charges were made. Which was true.]

As a backup, I had looked into bankruptcy options and positioned myself to protect myself (as much as is possible) while going through it.

IMPORTANT: set up an extra bank account at a different bank and use it to pay debts. You do not want the creditors to know where your money is. When you are negotiating a deal and/or a payment plan and then following it, you do not want them to be able to see if you have more money (even though it is not legal, it is still easy to find out how much money someone has in their bank account.) If the creditors have already been paid from your current accounts, then open new accounts at a new bank for your personal use and use the old one for debt paying. Only load the debt paying account with what is needed.

[Important - make sure the account does not have ANY overdraft protection - any overdraft should be rejected. Many creditors will accelerate the payments (and claim you agreed to it) to try to grab more before other creditors get it - this happened to a friend of mine; they agreed to a series of payments and the creditor simply submitted the whole batch each month to see how many would clear.]

When negotiating, make your starting "debt" for negotiation the actual amount owed. The creditors will use an inflated amount (including a LOT of interest and penalties) as the starting point so you will have to get 25 to 50% reduction just to get the the original debt amount.

<comment><USER18> "When negotiating, make your starting "debt" for negotiation the actual amount owed. The creditors will use an inflated amount (including a LOT of interest and penalties) as the starting point so you will have to get 25 to 50% reduction just to get the the original debt amount."

Can you explain this a bit more? I'm not sure I follow it.

</comment></comment><comment><USER19> You need to share more info. What do you think about the business in general? How your co-founders feel about it. Are you all at a point of wanting to call it quit because you don't believe in it anymore, or is it simply the debt that makes is all seem like a bad movie.

You need to be honest about the business. Selling a business when all founders want to get out is HARD if not impossible. If however, at least some of you want to keep at it, you might consider selling your shares (or part of it) rather than the entire business.

<comment><AUTHOR> One of the three would go with it if he wanted, or it were possible. But with two bailing for sure...

</comment></comment><comment><USER20> How do you define millions of users? Daily visits, daily hits, monthly hits, hits ever, db user entries, active sessions....

If you have millions of active users, and can share some information about how active they actually are, the users here may have some good ideas on how to monetize better.

If OTOH you have had millions of visits over some very long period (and not repeat users), perhaps a chapter 13 makes sense.

~ $15k/yr income is not enough to justify maintaining any but the most minimal of web applications; how much do you pay yourself?

<comment><AUTHOR> Millions of visitors a month, and millions of registered users (not the same set, only a fraction of the visitors in a given month are registered). Freemium model. I'll post another question next Sunday on how to monetize, as now I see that perhaps that should have been the first question. Not that we haven't worked over the issue a million times, but we haven't had fresh perspectives at all.

Getting paid? Hahaha. Not now.

</comment></comment><comment><AUTHOR> Thanks to everyone commenting on this, even though it is a few pages back on "new" and not on the home page. You all rock!

</comment><comment><USER21> Have you thought about getting investors now?

If you don't think the business is attractive enough for investors, then the bad decision wasn't that you didn't get investors, it was that you picked the wrong business.

<comment><AUTHOR> Too late for investors I think. And it wasn't so much the wrong business per se, we didn't shift when the market did, and later we didn't give up when we should have.

</comment></comment><comment><USER22> > Lesson learned: get investors; share the wealth, share the risk.

Or go to a 3rd word country and live happily with $0 of debt like me ;)

</comment><comment><USER23> Try again?

<comment><AUTHOR> Eventually, thus the StartingOver handle. :)

</comment></comment><comment><USER24> Been there. Destroyed my credit right out of the gate when I tried to run a web development firm in 1997 on student credit cards. Was threatened with eviction twice, and eventually was forced to move. Was fired and subsequently sued for $millions from/by a dot com in 1999 at a time when I literally had a negative account balance. I had dropped out of school to pursue my ambitions, so I had no degree to fall back on in order to secure a well-paying "job".

Disclaimer: the following is intended to be inspirational, not boastful.

13 years later, I am partner in a profitable ecommerce enterprise, after having put a startup success notch in my belt in 2004. My credit score is pushing 800, and I no longer even think about money.

My point is, your life isn't over, no matter how much it seems that way. It doesn't take long to bounce back.

<comment><AUTHOR> It is because of my 800 credit score that the cards in my name were upped automatically. Too much of a good thing! It is now 590.

Thanks for the inspiration! Just knowing recovery is possible is half of the mental battle. I look forward to making such encouraging words myself at some point in the future.

</comment></comment><comment><USER25> Take out equity loan against house, pay off your credit card. Be ready to walk away from your house if you have to.

<comment><USER4> Bad advice: trade a non-secured debt (credit card) by a secured one, so that indeed, you may lose your house, whereas before you weren't actually losing anything (bad credit is annoying, but doesn't force you to become homeless).

<comment><USER25> Housing prices will fall 50% in the next year or two.</comment></comment></comment>


Show HN: Our weekend project – Daily doses of inspiration - <AUTHOR> http://www.getinspired365.com

<comment><USER2> It is a nice idea

But reading text that subtly moves towards you on a full-screen browser makes me a bit seasick, and the maximized images make things feel a little wonky to me.

</comment><comment><USER3> Despite the poignant quote, seeing Abraham Lincoln's face slowly coming towards me was uncomfortable.

<comment><AUTHOR> That was a little touch we put in at the end but can quite easily remove if people don't like it..

<comment><USER4> I thought the same. Still cool site though.

</comment></comment></comment><comment><USER5> Where's the email signup? Kinda cool, but I'm not going to check this site every day unless you email me.

</comment><comment><USER6> Pretty cool. Once tiny design hitch would be the flash that accompanies scrolling through the quotes. Each time the screen flashes a few times which is off putting.

A side note on that: There are people from non-profit photosensitive epilepsy foundations that scour the net for that kind of stuff. I've gotten emails about it before...it was an interesting discussion about such design features.

</comment><comment><USER7> Nice site/idea. I would try to get some better images (the low resolution when stretched to my screen isn't too nice). Overall though, very cool.

<comment><AUTHOR> Will have a look, thanks. Any pictures in particular or is it the majority?

</comment></comment><comment><USER8> I like it. Could we get it emailed to us every day?

<comment><AUTHOR> Cool, thanks! Yes so we were thinking of having that feature - where you could get it mailed each day/each week depending on your preference. We will look to build that in. thanks!

</comment></comment><comment><USER9> I'm afraid that quote is bogus. Abraham Lincoln didn't say things that sound like Hallmark Cards, because no one in the 19th century did.

<http://quoteinvestigator.com/2012/07/14/life-years-count/>

<comment><AUTHOR> Give one of the other quotes a go...

<comment><USER9> Edit: this was pointless and is better deleted.

<comment><AUTHOR> If the quotes are winding you up, give the videos a go..

</comment></comment></comment></comment><comment><USER10> Yeah, this is not working for me. I have far better inspiration sources online. Notes from Universe or something is pretty awesome, there are others.

<http://www.tut.com/>

</comment><comment><USER11> This is really nice.

How can I make sure I check it every day?

<comment><AUTHOR> The million dollar question! It's a good point - so we thought about asking people if they wanted daily reminders via email? If we offered that type of option would that be of interest? We also wondered if we could make it easy for you to change your homepage to our site. Any other ways/ideas you can think of? Thanks

<comment><USER12> A daily email newsletter would be a great easy place to start. Lots of people would sign up if you made it frictionless. Bear in mind that, with a daily email, lots of people will ignore it or delete it unread if they are busy (as opposed to unsubscribing), so don't trust your subscription numbers, but lots of people will get value out of it too.

The other option that comes to mind would be a background app that changes your wallpaper to your image (with quotation) daily. Or maybe a browser extension that changes your homepage/speed dial background to this periodically.

If you want to try mobile, you could make an app that changes the phone's lock screen each day. But promoting the app would be difficult.

</comment></comment></comment><comment><USER13> Great execution. This had roughly been my plan for Motivately.com but I moved on to other projects. Nice work!

</comment><comment><USER14> Pretty cool. I like the video-as-background. Good front end UI.

I agree with the email every day idea.

</comment><comment><USER15> I think this would be much better as an email newsletter.

(You could also place adds on it that way)

</comment><comment><USER16> How are all of the pages generated? Are they all curated user submissions?

<comment><AUTHOR> So my friend and I have added 365 bits of inspiration - one for each day. We then have a separate part of the site where a user can press 'submit' (bottom right corner) and submit their own inspiration. This can then be viewed by clicking 'shared inspiration' - again bottom right. So the site has two parts to it - a social type of part and then a daily dose part.

</comment></comment><comment><USER17> Quite similar to changemakrs.com in layout and intention. I like it.

<comment><AUTHOR> Cool, thanks. Never seen this site - will check it out.

</comment></comment><comment><USER18> Thank you. You've made the world a little bit better.</comment>


Confidential Microsoft brief: 'We're toast if we fight Google on price' - <AUTHOR> http://www.channelregister.co.uk/2013/07/15/microsoft_office365_versus_google/ <comment><USER2> _We all know from experience … with Google Apps you can often have to add a lot of different third party appliances just to get to parity with the experience and then all of a sudden you 've got lots of vendors to manage and all of a sudden it's very different to that low cost price point that Google initially positioned to the customer._

This is an old story; shades of every high-end vedor that's ever been wiped out by a low-cost player. As a hardware guy, it reminds me of the response you'd hear from POWER, PA-RISC, Alpha, SPARC, etc. vendors when you mentioned x86 workstations.

At the time, my response was, sure, maybe you've got a better product now, but what fundamental advantage do you have that keeps Intel from using their large, and growing, userbase and economies of scale to crush your R&D spending and pull ahead?

Software doesn't have such high fixed costs, and MS has a ton of money to spend on R&D. But, this still sounds like a lame defense.

<comment><USER3> Vendor management comes with a real cost (typically in terms of time).

This might be more contentious, but I believe that people that are still using Windows Server (and Microsoft offerings other than AD) are doing so because it's easier to use/more familiar than Linux/open-source alternatives: Throw Joe-Linux on Acme-Cloud-Provider and use Weekly-Flavor-Config-Management? Sounds hard. Click some buttons and fudge your way through group policy? Now we're talking something I can do to pay off a mortgage.

<comment><USER4> Microsoft's tooling is easier to use and they've got a massive training/certification programme.

Because it's so easy, there are a factor more Microsoft admins around than there are Linux admins. And they're fairly productive.

Plus, Microsoft software works really well together. Windows + Windows Server + SQL Server. Works great.

Linux is great if you have highly skilled technicians to support it. There's way more tweaking involved than with Windows; this makes it ideal for anyone running a centralised model where they're deploying thousands of identical machines (like the web). It's not so great for corporate environments where there's a high level of variance..

It's basically the Ford vs Ferrari argument: Microsoft enables companies to employ average quality labour to produce a "good enough" result. Ferrari employ top engineers to produce an extremely high quality result.

Ford scales, Ferrari doesn't.

<comment><USER5> I think it's the other way around if a protect has less than 100 servers MS may be cheaper if you have 10,000 then Linux is probably cheaper.

<comment><USER6> The problem is that some of MS products have really nonsense license costs. I just say: MSQL server.

<comment><USER4> Compared to MySQL, sure. But that's like comparing a spade to digger: both can make a hole in the ground, but you'll want the digger to do some real work.

It doesn't compare as well to Postgres - but the better tooling may well make it worth the $10k in licence fees. That's a month of engineer time in maintenance.

SQL Server's cheap for what you get when compared to the commercial competition. Informix is pretty much dead (and had horrible tooling). Oracle is even more expensive. And compared to Oracle, Microsoft look like angels. Ingres is a bit of a joke.

The big expensive MSSQL licences also include some pretty nifty BI tools, including decent implementations of data mining algorithms.

</comment></comment></comment></comment></comment></comment><comment><USER7> This is the death of complete Microsoft dominance, not the company. Cloud email represents a relatively small portion (25-30%) of the total enterprise market, and Microsoft owns the on-premise market.

Google is maturing as an enterprise vendor, and the simplicity of the licensing model and lack of client side software is appealing to the "new economy" companies: small businesses, businesses using Macs/BYOD and businesses using lots of freelancers/temps.

For the traditional enterprise shops, Google can be a real pain. You need to buy 3rd party stuff for things like identity federation, for example.

At the end of the day, it's called competition, and it's great. Instead of Ballmer & Co. coming down off the mountain and letting us know what we're going to do for the next 5 years, we have a real marketplace and can say no.

<comment><USER8> The question now is, can Microsoft compete in a world where they are no longer a monopoly?

They make almost all of their still-quite-impressive profit from the markets that they still completely dominate, like enterprise productivity software. They are probably losing money on products like Windows Phone and Surface.

So what happens when Microsoft has credible competition in every market it sells to? That will soon be the case (if for no other reason than the fact that Google is actively trying to kill them), and I'm not sure even Microsoft is confident that Microsoft can compete and stay profitable in that environment. I see a lot of belt-tightening in their future.

I don't really think a company can get--or stay--as big as Microsoft is, without the rent-seeking ability afforded by near-total monopoly of a major market.

<comment><USER7> Good question. History (IBM) suggests that they can probably muddle through.

You can ask the same question of Google. Enterprise with Google is a grown up hobby project that isn't a big earnings generator. Will google apps stay cheap if googles golden goose (advertising) declines?

<comment><USER8> _Good question. History (IBM) suggests that they can probably muddle through._

IBM just laid off over 3,000 people last month. To quote pg, "Consulting is where product companies go to die. IBM is the most famous example." [http://paulgraham.com/startupfunding.html](http://paulgraham.com/startupfunding.html)

 _Will google apps stay cheap if googles golden goose (advertising) declines?_

No.

Nothing lasts forever. No matter how much we want to think that major corporations are permanent institutions, they have a lifecycle, and when they lose control of their market they may continue along for quite a while in a zombie-like state, but eventually they will wither away and die. Someone outside of Google will eventually figure out a better way to do online advertising, and Google will find itself in the position that Microsoft is in today.

Microsoft is trying really hard to get a new lease on life through a product pivot, but I'm just not sure it's even possible at this point. Their products are generally more expensive and not convincingly better than the competition's.

<comment><AUTHOR> IBM has 400k plus people according to Wikipedia, so 3000 is really a drop in the bucket.

Stock chart doesn't suggest imminent death either.

[http://finance.yahoo.com/echarts?s=IBM+Interactive#symbol=ib...](http://finance.yahoo.com/echarts?s=IBM+Interactive#symbol=ibm;range=my;compare=;indicator=volume;charttype=area;crosshair=on;ohlcvalues=0;logscale=off;source=undefined;)

</comment></comment></comment></comment></comment><comment><USER9> Is this "revelation" really that interesting? Everyone knows that Microsoft can't fight anyone based on price. Every salesperson in the same situation knows that the only way to fight low price is by selling based on perceived value. "Oracle is expensive, but if you compare its value, it's much cheaper." BMW can't compete vs a Hyundai based on price, they need to compete based on perceived value. For me Hyundai is more than adequate, because I only look at my car as a way to transport myself, not as a status symbol or an extension of my being. For those that do, good for them, and they will find value in a BMW.

Same goes for MSFT vs Linux or GOOG, etc. There's nothing new here.

</comment><comment><USER10> Office suite is still the Adobe Photoshop of business software. Office is still deeply entrenched in businesses and holding on because it still offers the most features.

For example, Excel vs. Google docs: you can do basic charts and graphs in Google docs, but clearly Excel has many more features, such as data analysis tools, and when you connect Excel to Microsoft SQL server you have reporting + data mart, where Google Apps offers nothing similar (not without a lot development work needed to set it up)

Google Apps is good but often you still find businesses also need Office suite. If Google were to say, directly connect Google docs to a data warehouse tool such as Dremel, the add a lot of advanced data analysis features to Google docs, then things would start to get interesting.

<comment><USER11> Excel has vastly more features than Google Docs.

At all the companies where I've worked at, I've never seen anyone use anything more advanced than a few basic functions.

The _vast_ majority of users in a corporate environment use: 1> Font changes (color, size etc) 2> Images 3> Hyperlinks, ToC and other forms or document organization.

It is silly to buy 1000 Desktop or Office 365 Excel licenses, when only 20 people will use a substantial amount of its features.

More importantly, people are not emailing each other Office documents. I've seen companies who do _have_ google docs do it.

<comment><USER12> Sure the vast number of users use only a tiny fraction of the functionality, but many of them also [sometimes] need to open important files that someone has spent hours painstakingly making impossible to open in anything other than Excel.

If I wasn't being emailed Office documents on a daily basis I'd assume my colleagues and clients didn't like me any more!

</comment></comment></comment><comment><USER13> It's quite instructive to talk to big (>10000 employees) companies who tried to migrate to Google Mail/Apps. There are nice disaster stories around.

<comment><USER14> There will be disaster stories around for any big migration. I can't say I'm particularly enjoying my university's migration to Microsoft's email offering.

<comment><USER15> Exactly. There's a tendency to throw around bullets points of advantage (It's open! It's not big-bad Microsoft, but a company you can TRUST! etc) as if the things are enabled by flipping a switch or the ethics involved are far more important than bottom lines.

</comment></comment></comment><comment><USER16> If companies, especially non-US ones, had any sanity, they'd "toast" both of them after the NSA revelations.

<comment><USER17> Why? A medium business running in Romania has much more to worry from Romanian government/tax authorities than US security agency overreach.

And even if they do - where to go? A lot of non it companies don't have even real ops ... hosting your own email and servers is expensive in that case. And potentially dangerous a modest string of bad luck could wipe you.

<comment><USER16> You don't need to use Gmail as a business. There are a _ton_ of alternatives, from all places.

And _precisely_ because a company like Microsoft or Google would do this, you need to fear them, because they would do this with other governments, too, _including_ the Romanian one. It's not just NSA you have to fear. If the laws allow it, the Romanian government could get all your secret documents from Skydrive or Gmail, just as easily.

</comment></comment></comment><comment><USER18> There's something to be said about simplifying your product line. I guess msft's approach is: if we can't beat them on price, confuse the hell out of them?

<comment><USER19> It's two different business models: Simplicity versus Total Solution. Starting from scratch simplicity usually seems better, but as companies grow they (for good financial reasons) wind up doing a lot of 1 off solutions in the name of flexibility and being customer-centric.

</comment></comment><comment><USER20> Apple is the most valued (market cap) platform company because it owns the affluence market and commands high margins across the board. Google has gone after the "next billion" users, people who don't have that kind of money. MS might be trapped in the middle, neither sexy enough to be Apple nor cheap enough to be Google.

<comment><USER21> Your comments only really apply to the consumer market.

Microsoft's position in enterprise is extremely strong. Apple is not making any serious attempt to challenge that (and probably never will), but Google (and Linux) pose a real threat to Microsoft in the long run.

<comment><USER20> Yes. I was thinking in terms of the three as consumer platform companies.

</comment></comment></comment><comment><USER22> Or said another way: 'We're TOAST'.

</comment><comment><USER23> *'We're TOAST if we fight Google on price'

Assuming the offering is just the same, but for many it may be good enough

</comment><comment><USER24> MS: "Let's fight them instead by giving as much user data to the government as possible, grab some more contracts. We need something reliable and easy to use. Does anyone know how to install Linux?"

<comment><USER24> HN: "We are NOT going to tolerate jokes here, this is Internet a.k.a. SERIOUS BUSINESS. Now let me tell you about my disruptive verticals."

<comment><USER25> We tolerate jokes. Just not bad ones.

<comment><USER24> Thanks for your humor advice, I will cherish it always.</comment></comment></comment></comment>


SocialAds Implications: Facebook will Acquire iLike and Flixster - <AUTHOR> http://www.25hoursaday.com/weblog/2007/11/11/SocialAdsImplicationsFacebookWillAcquireILikeAndFlixster.aspx

<comment><AUTHOR> "Both iLike and Flixster are looking to exit somewhere in the hundreds of millions of dollars range. Given that Facebook has around half a billion dollars in cash, it would be feasible to acquire these companies but is it worth investing close to 50% of their available cash?" [http://www.allfacebook.com/2007/11/facebook-to-acquire- ilike...](http://www.allfacebook.com/2007/11/facebook-to-acquire-ilike-and- flixster/)</comment>


Twitter Plans Company Wide Layoffs Next Week - <AUTHOR> http://recode.net/2015/10/09/twitter-is-planning-company-wide-layoffs-for-next-week/ <comment><USER2> What's interesting is they've had a lot of leaks...a leak like this comes from someone high up so that's a problem they need to fix. Moments leaks, Jack as CEO leaked...big old bucket there.

If it's actually engineering I'm sure they'll all have jobs in a week but it's still hard to find talent so why wouldn't they just move people around?

<comment><USER3> _" a leak like this comes from someone high up..."_

Not necessarily. This information could have come from some low-level employee who happened to overhear a conversation between two managers.

The CEO and his inner circle of executives can't just lay off hundreds of employees on their own. They need to involve lots of lower-level managers in this planning, since upper management generally has no idea what each employee is doing and how essential they are to the company. So they ask each of their direct reports to make a list. And once dozens of people know that layoffs are coming, it's difficult to keep it a secret.

</comment></comment><comment><USER4> Couldn't help notice this is currently #85 on my HN front page with 58 points in 5 hours … at #16 is something with 22 points in 6 hours … wondering if it's a bug, or some kind of penalty box for this story.

see image, nos. 76 and 81 also seem odd to rank higher - [http://imgur.com/gNXJsoy](http://imgur.com/gNXJsoy)

<comment><USER5> Ranking on HN isn't purely votes and time, but includes user flags, flame detection, and probably some other stuff.

<comment><USER4> got it, maybe those Re/code guys were spamming or something…

interesting because their earlier version of the story has a lot more mentions in my Twitter timeline than the Times story, which was later and has more background.

</comment></comment></comment><comment><USER6> That explains why their recruiter stopped responding to me a few weeks ago.

</comment><comment><USER7> Not completely unexpected, but still somewhat of a surprise.

Twitter have been taking on staff faster than their userbase has been growing since their IPO. I guess the question now is how many they are going to layoff - 4,200 employees is a lot of people for something like Twitter.

<comment><USER2> It's not about user base, it's about revenue. I think their revenue per employee is still ~$500k which is pretty good.

</comment></comment><comment><USER8> > It reported roughly 4,200 employees last quarter

Wow - what do all these people do?

<comment><USER9> According to the Twitter Careers page: Software Engineering, Design & UX Research, Sales & Revenue, Product Management, Infrastructure Operations, Media & BizDev, Trust & Safety, User Services, Legal, Finance, Workplace & Admin, Marketing & Communications, HR & Recruiting.

As far as engineering, take a look: [https://about.twitter.com/careers/teams/software- engineering](https://about.twitter.com/careers/teams/software-engineering)

Many companies are much more complex than you might imagine from the outside. Also, a lot of it is meta-headcount: managers, facilities, food service, payroll, benefits, recruiters, lawyers, HR people, etc. all scale at least partially with headcount.

You'll notice many of the jobs are with companies Twitter has acquired or various platform-level projects, like Fabric, Vine, TellApart, Finagle, etc.

<comment><USER2> With almost 50 (17 in the last two years) acquisitions most of the growth is from that.

[https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio...](https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Twitter)</comment></comment></comment>


Panama Papers – Tweet their hash, now - <AUTHOR> https://twitter.com/joantune/status/717083848153108480<p>I think that this is the only way to make sure that in the future there won't be any omissions from the leak. <comment><USER2> Are you asking for tweets?</comment>


NYC Mayor Bloomberg reportedly threatens to 'fucking destroy' the taxi industry - <AUTHOR> http://theverge.com/2013/5/24/4363522/mayor-bloomberg-threatens-to-fucking-destroy-taxi-industry

<comment><USER2> Amen. I wish he could do it here in Paris, too.</comment>


Avatar producer explains how to market to kids despite PG-13 rating - <AUTHOR> http://arstechnica.com/media/news/2010/10/avatars-jon-landau-on-marketing-pg-13-entertainment-directly-to-children.ars

<comment><USER2> I don't see the moral problem this article hints at. The film is rated PG-13, not the concept of Avatar or the merchandise.

And given the comments about True Lies any subversion of the rating system sounds like a great thing. Obviously otherwise excellent movies are being made into mediocre crap so that they can reach a wider audience and rake in more money.

</comment><comment><USER3> The rating system is defacto government censorship. It was created in response to congress's threat to pass laws censoring movies. A better strategy might have been to let congress pass those laws, so fewer americans would be under the illusion that government doesn't control the media.

But the only proper response, I think, is to say FoRK THE MPAA!

Watching "This movie is not yet rated" is a good way to spend an evening--- streaming on netflix last I looked.</comment>


Reasons to Say "No" to Cloud Computing - <AUTHOR> http://www.getapp.com/blog/reasons-no-cloud-computing/

<comment><USER2> "The IT capability or service you are considering moving is a mission critical aspect of your business." Really? That would seem like one of the main reasons to switch to cloud computing, as it's much easier to handle different amounts of load and guarantee data integrity.

Otherwise not a bad checklist, I guess. I especially like "Your IT organization has not sufficient maturity to govern the additional complexity of managing additional processes and outside contracts brought by Cloud Computing" :-)

</comment><comment><USER3> "7) You run "big data" applications (i.e., financial) that require extremely low latency and/ or extreme disk I/O requirements."

I am currently having _exactly_ this problem, and although my preference is to try to stay on the cloud, more and more it looks like a losing fight.

</comment><comment><USER4> _1) You drive a competitive advantage from the IT capabilities you are considering migrating_

Don't!

<http://fashionablygeek.com/t-shirts/never-drink-and-derive/></comment>


Defensive BASH programming - <AUTHOR> http://www.kfirlavi.com/blog/2012/11/14/defensive-bash-programming <comment><USER2> The only thing in this post that can be accurately called defensive is the use of "local" and "readonly". The rest is all just style preferences, which are rather subjective, and none of which are very appealing to me.

Three real defensive bash programming tips are:

\- Quote all uses of variables

\- set -o nounset

\- set -o errexit

And many others can be found in and around [http://mywiki.wooledge.org/BashFAQ](http://mywiki.wooledge.org/BashFAQ)

<comment><USER3> While not as common as nounset and errexit, pipefail is a useful option as well (set -o pipefail).

Using pipefail, if _any_ program in a pipeline fails (i.e. exit code != 0), then the exit code for the pipeline will be != 0.

E.g. pipefail can be useful to ensure `curl does-not-exist-aaaaaaa.com | wc -c` doesn't exit with exit code 0..!

<comment><USER4> You can set all three of them in a single line. Set up your Bash template with this today:

        set -o nounset -o pipefail -o errexit

<comment><USER5> I usually shorten this to:

        set -eu -o pipefail

<comment><USER4> I used to do that but the long versions are more understandable by other people who will look at the script.

</comment></comment></comment></comment></comment><comment><USER6> Very interesting article and I agree with most of the points. One point I strongly disagree is what is called "Code clarity" where the author replaces conditional expressions ([https://www.gnu.org/software/bash/manual/html_node/Bash- Cond...](https://www.gnu.org/software/bash/manual/html_node/Bash-Conditional- Expressions.html#Bash-Conditional-Expressions)) by function calls.

I agree that the function call introduces a better name. The problem is that this name is specific to the author of the script. It replaces a reusable tricky knowledge of the language by a simple knowledge of the author usages.

If we take into account the increased verbosity, increased typing, increased number of lines, there is a clear loss in using these functions.

For me, adding a comment would be far enough and far less annoying.

<comment><USER7> I disagreed with that too, but mostly because those tests are a core part of Bash programming. If you don't know what they mean by reading them, then you just need to learn.

It'd be like defining an "and" function and writing

        if ( and(conditionA, conditionB) ) {
            //do something
        }

because "&&" is too confusing. It's just syntax. Learn it.

And on the subject of &&, it's interesting that in his example about clarity he chooses to use short-circuit and for brevity instead of the more readable if block.

</comment></comment><comment><USER8> A guy publishing a guide for "defensive bash programming", who, in the process, provides this listing as an example for anything, is not fit for publishing said guide in the first place:

      main() {
          local files=$(ls /tmp | grep pid | grep -v daemon)
      }

<comment><USER9> You might have been better off reading the text after the code example that came _after_ the code you quoted.

The text read:

\- Second example is much better. Finding files is the problem of temporary_files() and not of main()'s. This code is also testable, by unit testing of temporary_files().

\- If you try to test the first example, you will mish mash finding temporary files with main algorithm.

<comment><USER10> The problem isn't where it is - using "ls" to find files is never a good idea from my understanding. I think it's because of ls garbling file names but I might be mistaken there.

That the author is using that to find files is reasonable enough to me to disregard the rest of the blog.

edit: take that back...looked through rest of blog but don't see anything useful. I hate his idea for functions for builtins, using local is ok, please don't break up shell pipelines over N lines for simple stuff

<comment><USER7> Google also mandates that you shouldn't assign to a local var at declaration, because the exit code of the function producing the value is overwritten by the exit code to `local`.

[https://google.github.io/styleguide/shell.xml?showone=Use_Lo...](https://google.github.io/styleguide/shell.xml?showone=Use_Local_Variables#Use_Local_Variables)

</comment></comment></comment></comment><comment><USER11> It's said that all the example was missing quoting variables. It made all others defensive things useless.

</comment><comment><USER12> Slightly off-topic but maybe some people will find it useful:

I used to write my various glue-things-together scripts in bash, but this quickly becomes a nightmare as the script grows, due to bash's corner cases, syntax, portability issues etc.

Recently I wrote my massive glue-things-together script with nodejs (since I already use node for many things) and it's much more maintainable and I couldn't be more happy. Node 0.12 has execSync which was the missing piece for making node the proper shell scripting platform.

If you are interested, you may want to check shelljs [1] and my snippets for robust `exec()` and `cd()` in node.

[1] [https://github.com/shelljs/shelljs](https://github.com/shelljs/shelljs) [2] [https://gist.github.com/jakub-g/a128174fc135eb773631](https://gist.github.com/jakub-g/a128174fc135eb773631)

<comment><USER13> Is it really a 'script' if you need to add a dir full of modules? I've always thought of 'scripts' as all-in-ones.

<comment><USER12> Well, you're right, it's a tradeoff. The 'script' is not standalone anymore, but it's a (script + package.json) and needs `npm install` to work properly. I still use bash for simple things, but if it grows too much and logic starts getting non-trivial, IMO it's a valid use case to switch.

</comment></comment></comment><comment><USER14> Does anyone know if these ideas conflict with [http://mywiki.wooledge.org/BashFAQ](http://mywiki.wooledge.org/BashFAQ) or [http://mywiki.wooledge.org/BashGuide](http://mywiki.wooledge.org/BashGuide)? These are the resources that are drummed into you on #bash on Freenode, with the strong suggestion that All Other Resources Are Bad And You Should Feel Bad

<comment><USER15> The #bash users on freenode are right on that one. Everything in the wiki you linked to is documented and everything is explained clearly.

Another very good resource is the O'Reilly book: [http://shop.oreilly.com/product/9780596009656.do](http://shop.oreilly.com/product/9780596009656.do)

</comment></comment><comment><USER16> At some point, "defense" against a language's faults should translate to "use the right language for the job".

Any sufficiently-complex shell script can usually be written clearly as a Python or Perl program for instance, without having to worry about how the code might be misinterpreted.

Yes, I write shell scripts sometimes. I just make sure they're doing something pretty straightforward.

</comment><comment><USER17> I think the best "defensive" piece of advice you left out that everyone abuses is never pipe `find` results to `xargs.` One should always do `find ... -print0` to a read-while loop because of filenames with whitespace.

<comment><USER18> avoid read-while loop... there are problems with filenames starting/ending with spaces... better use

        find ... -print0 | xargs -0 ... [eventually with -n1]

<comment><USER11> And you need non-standard feature `-print0` and `xargs -0` there. Better way should be `find ... -exec cmd {} +`.

<comment><USER10> Is there a place you can use `-exec cmd {} +` but not `print0`? My experience has been I can use both or I can use none (Solaris 10 boxes).

<comment><USER19> Systems with a non-GNU find, including the default one in Solaris 10 (I've just double-checked). Perhaps you were using the GNU find in Solaris?

By the way, there are systems where 'print0' is a recognized parameter for the default find, but not '+'. RHEL 4.x comes to mind.

<comment><USER10> Sorry I think we're saying same thing. On systems with non-GNU find do either `-exec cmd {} +` or `print0` work? My exp was both did NOT work. So either both work or both don't.

But if I understand you correctly on RHEL 4.X `print0` works but `-exec cmd {} +` doesn't.

Which is to say I disagree with op that it's better to rely on `exec cmd {} +` when it seems you're more likely to have `print0 and xargs -0` then that.

</comment></comment></comment></comment></comment></comment><comment><USER20> The sloshes are redundant after a pipe symbol. i.e.

        ls $dir \
            | grep something

is the same as

        ls $dir |
            grep something

<comment><USER21> However, the author argues that the pipe symbol should be moved to be beginning of the next line, so the backslash isn't optional.

</comment></comment><comment><USER22> All these recommendation are excellent (except omitting the necessary obsessive quoting of all variables everywhere (just in case they contain a space).

I've been enjoying BATS [0] for my bash testing.

[1] [https://github.com/sstephenson/bats](https://github.com/sstephenson/bats)

<comment><USER23> Why BATS? Why not something *unit-like? Example: [https://github.com/vlisivka/bash- modules/blob/master/main/ba...](https://github.com/vlisivka/bash- modules/blob/master/main/bash-modules/test/test_arguments.sh) .

<comment><USER22> TAP output is killer, plus I prefer to write my tests in bash -e, not Java thanks.

</comment></comment></comment><comment><USER24> I have always tried to avoid using functions in my bash scripts. That said, it's always nice to other people's bash programming techniques and style. This one had the biggest impact for me, although I can't imagine it's news to any of you on here: [http://redsymbol.net/articles/unofficial-bash-strict- mode/](http://redsymbol.net/articles/unofficial-bash-strict-mode/)

</comment><comment><USER25> Remembering best practices for BASH might be hard. I recommend using [http://www.shellcheck.net/](http://www.shellcheck.net/). I use with vim and syntastic. This article talks more about it: [http://jezenthomas.com/shell- script-static-analysis-in-vim/](http://jezenthomas.com/shell-script-static- analysis-in-vim/)

</comment><comment><USER26> Content from so long ago, posted here on HN less than two weeks ago... here are some recent reddit comments about the post: [https://www.reddit.com/r/bash/comments/3w354v/defensive_bash...](https://www.reddit.com/r/bash/comments/3w354v/defensive_bash_programming/)

</comment><comment><USER23> IMHO, it is much easier to parse arguments using bash_modules args module (disclosure: I am author).

</comment><comment><USER27> I'm not sure if scripting can be consider programming. Excessive scripting means lack of software architecture, no to mention the least efficient way to work with the FS

<comment><USER28> Depends on how you define scripting vs programming. I'd argue that you can "program" in a shell language; bash is Turing-complete after all.

Whether doing so or not is a good idea is another question entirely..

</comment></comment><comment><USER29> Discussed last year: [https://news.ycombinator.com/item?id=7815190](https://news.ycombinator.com/item?id=7815190).

</comment><comment><USER30> I find this useful [https://github.com/progrium/bashstyle](https://github.com/progrium/bashstyle)

</comment><comment><USER15> This guide is all but ready for prime time. Make it go down, as it is a pile of bad habits. Sure, there are one or two good ideas, but nothing revolutionnary.

<comment><USER15> Use www.shellcheck.net as a complement

</comment></comment><comment><USER31> Step 1: Choose a better language. Almost anything will do.

</comment><comment><USER20> I quite like

        set -u
        set -e

with

        trap 'echo $0 internal error at $LINENO' ERR

</comment><comment><USER32> I kind of like that BASH allows you to make unconventional programs.

</comment><comment><USER33> Yes, I applied some of these in my bash program.

</comment><comment><USER34> To me, BASH is very offensive</comment>


Coding a Tetris AI using a Genetic Algorithm - <AUTHOR> http://luckytoilet.wordpress.com/2011/05/27/coding-a-tetris-ai-using-a-genetic-algorithm/

<comment><USER2> Similar story...

My senior year in high school I got hooked on an online multiplayer Tetris game called TetriNET. I eventually created a pretty sophisticated bot to play for me, which absolutely crushed the games. A friend recommended I submit it for consideration in the regional science fair, where I wound up taking first in the computer science category.

Lots of details on the blog [1], including screenshots, source code, and details of the algorithms used.

[1] <http://www.mattmazur.com/2009/05/creating-a-tetrinet-bot/>

</comment><comment><USER3> I would be interested to see whether a genetic algorithm performs better than a hill-climbing one in this context. By hill-climbing I mean searching for a vector in the seven-dimensional space you've defined which makes the biggest improvement in the fitness function. I tend to think hill climbing would converge faster than evolution among random mutations.

<comment><USER4> Yes, a comparison with hill climbing or with simulated annealing would be nice

</comment></comment><comment><USER5> I hate to be "that guy", but I'm somewhat confused why everyone online seems to be so obsessed with genetic algorithms. What they are is a kind of optimization technique, and one of the worst ones at that. (Genetic algorithms are what you resort to in the rare cases when no other optimization technique will work.)

As 'lincolnq said, standard hill-climbing would probably work much better for this kind of problem.

Still, cool results, I guess.

<comment><USER6> In my experience (I worked on convergence analysis of some early GAs), genetic algorithms suffer from a combination of extremely easy implementation, a "cool" factor that plagued neural-networks-as-classifiers research in the early 90s, and a belief that biological "analogies" would perform better than decades of research in stochastic optimization.

Still, they have pedagogical value because they are easy to implement, and for many students, are their first real soup-to-nuts "AI" algorithm implementation. I've seen them serve as the gateway for students to get into CS research, but IMO aspects such as the last resort principle, no free lunch theorem, and principles of stochastic optimization are generally under- stressed, which leads to some abhorrent research papers along the lines of "Problem X using GAs".

</comment></comment><comment><USER7> Population size of 16 is _way_ too low : it's not surprising that he's getting premature convergence. Also, his mutation is huge : so his overall process is more like a directed random walk.

More reasonable parameters would be 100-1000 for the initial population, and +/- 2% on a parameter for mutations.

</comment><comment><USER8> [http://www.ryanheise.com/tetris/tetris_artificial_intelligen...](http://www.ryanheise.com/tetris/tetris_artificial_intelligence.html) here's one using Google's pagerank algorithm

</comment><comment><USER9> That is very impressive for a 16 year old.</comment>


South Fork Fishing and Hunting Club - <AUTHOR> http://en.wikipedia.org/wiki/South_Fork_Fishing_and_Hunting_Club

<comment><USER2> I'm not asking along the lines of the usual "this isn't tech" \- It's just nothing jumps out at me about the article. Can someone explain the significance?

<comment><USER3> Wow. I'm not OP but I'm really amazed to see a story about the Johnstown Flood on the front page of Hacker News. I'm originally from the area and I even wrote a large research paper about this when I was in college.

The short story is that many of the rich elite of the late 1880s would vacation near a man made dam in South Fork PA. The hills of the Alleghenies are ominous with a water migration route that leads straight into downtown Johnstown, which was then a bustling steel town. On May 31, 1889 a historic rain caused the dam to fail. This caused a wall of water to crash upon Johnstown, leading to 2209 deaths and what was effectively the destruction of the city. It was one of the first big stories in the post-antebellum nation and also was one of the first disasters which the American Red Cross and Clara Barton were onsite to help with.

The common story and moral derived from said story is that the rich patrons that owned the South Fork Fishing and Hunting Club did not maintain the dam which caused the dam to fail which was responsible for the fatalities caused by the flood. Lawsuits were dismissed as the flood was thought to have been an "act of God". It could be seen today (and was when now-famous historian David McCullough wrote his book about this 1968) as being indicative of how rich and the 1% lead to the direct damage and destruction of the lower class.

As someone who has researched it, there is far more to it than that. But, kinda cool to see it posted here.

<comment><USER4> I live up in Boalsburg (near State College) and have visited both the museum and the remains of the dam. The article really doesn't do the scope of the destruction justice. Many of the pictures show an entire small city reduced to matchsticks ... except the individual matchsticks are 2x4s.

I have to believe the guy that salvaged the drain-pipes is the most likely criminal in the whole affair. You _do_ have to wonder about rich people who buy a dam that's been leaking during its entire existence.

</comment></comment></comment><comment><USER5> There is a big deal made of this in "The Men Who Built America" [1] which I started watching because it came up on Netflix. Maybe it is new there and people have started watching it

[1] [http://www.imdb.com/title/tt2167393/](http://www.imdb.com/title/tt2167393/)</comment>


The Web Struggling To Keep Up With The Stock Market Crash/Bounce - <AUTHOR> http://techcrunch.com/2010/05/06/stock-market-crash-web/ <comment><USER2> When the news broke, our traffic doubled almost instantly.

Fortunately, our auto-scaling groups just fired up a bunch of new servers to compensate and our response time never took a hit. Chalk one up for EC2.</comment>


Bothersome Bystanders and Self Driving Cars – Rodney Brooks - <AUTHOR> http://rodneybrooks.com/bothersome-bystanders-and-self-driving-cars/ <comment><USER2> >Drive.AI founder Andrew Ng... "In other words, we can make roads safe for the cars instead of the other way around."

Yes, sure. People should not "provoke" these cars on purpose (although you know malicious intent will come ala Russian car insurance scams) but you have to think of all the unpredictable edge cases: drunks, kids, people who get pushed, fall, etc. It's impossible for them to "act nice" even if they wanted to.

That said, this is better suited for scenarios where predictable routes are the norm, for example, campuses and the like. Still, it puts the onus on people.</comment>


How the Times Covers the First 12 Hours of the Brussels Bombings - <AUTHOR> http://www.nytimes.com/interactive/2016/04/01/insider/how-the-times-covers-breaking-news.html <comment><USER2> > Chris Stanford, a digital editor in London, creates the system architecture > so The Times can run a blog.

Huh?</comment>


Ask HN: Twitter ads support disaster, what to do? - <AUTHOR> A few weeks ago, I got an email from Twitter ad services saying they couldn't bill my credit card. I figured the expiration date needed updating but was so panicing wondering why they were trying to bill me.
Checking my account, I saw an ad campaign had been created three days previous and it was attached to some random reply I had made to a friend.
I was rather mystified by this for three reasons:
- I never saw an ad campaign prompt - I never saw a confirmation for starting a campaign - I never received so much as an email from Twitter that a campaign had been started
I immediately deleted everything related to the campaign and contacted support.
At first, it was clear they were just following a pointless support script explaining to me they were billing me for an ad service (quick promote) which I had never used before as far as I know and I don't even know where it is in the interface.
When I asked them to explain how it was done, they just kept repeating the same details of the service.
I repeatedly stated this was not authorized by me and explained that I never saw a prompt for this service nor did I ever receive a notification until the billing failed.
They then responded that they verified that their billing system was correct, but they still could not explain how the request was made.
When I pressed them about how to prevent this error from happening again, their only suggestion was to remove my billing info entirely.
At this point, I feel like I'm at my wit's end. I'm using 2fa and good passwords. I'm convinced this is some sort of fault or poor ux in their web or mobile client.
I don't know how to get this fixed or who can help.
Twitter seems to only have robots with email addresses for support.
Please, can anyone here help me? <comment><AUTHOR> I don't know if someone here had something to do with it, but Twitter support had a sudden change of heart the day after I posted this.

They decided to credit my account in full, but still did not explain how this happened to begin with.

While I applaud them for doing the right thing, I'm wary of letting them ever have my payment information again.

If someone here was responsible for their change of heart, you have my gratitude. Regardless, thanks to any who read this.</comment>


Russia Orders Major VPN Providers to Block 'Banned' Sites - <AUTHOR> https://torrentfreak.com/russia-orders-major-vpn-providers-to-block-banned-sites-or-face-blocking-themselves-190328/ <comment><AUTHOR> PIA removed their servers from Russia, but still allows Russians to access non-Russian servers: [https://www.privateinternetaccess.com/blog/2019/03/russias-r...](https://www.privateinternetaccess.com/blog/2019/03/russias- roskomnadzor-orders-vpns-to-censor-banned-sites/)</comment>


CS183 Notes - Traffic So Far - <AUTHOR> http://blakemasters.tumblr.com/post/22783549322/cs183-notes-traffic-so-far <comment><AUTHOR> Blake, you've done an immensely valuable job with these class notes. I think 2 minutes average visit duration is pretty good for any blog. I think I personally didn't read any of these notes from the site as they are quite long, but instead stored them to Kippt and read later on Instapaper.</comment>


Chinese government censors ruling lines through Australian books - <AUTHOR> https://www.smh.com.au/entertainment/books/chinese-government-censors-ruling-lines-through-australian-books-20190222-p50zpn.html <comment><USER2> Hopefully this will help local printers get more work</comment>


Surgeons remove healthy kidney through donor's vagina - <AUTHOR> http://www.hopkinsmedicine.org/Press_releases/2009/02_02_09.html

<comment><USER2> In theory it should be fine, but let's see how that kidney and its recipient do before declaring success on this one. And I'm sure the organ traders in less regulated parts of the world will be ecstatic at the possiblity of covering their tracks better.

<comment><USER3> Article states that they're both doing great

</comment></comment><comment><USER4> wtf? Vagina hacking?</comment>


Monty Hall strategies - <AUTHOR> https://gist.github.com/cedricbellet/c07136ecdb3524ab802a679c916f5bb6 <comment><AUTHOR> Very simple script, and only confirms what has been posted several times here.

However interesting scenario when the game master reveals a door with a goat, and the player does not know if the game master consciously decided to remove that particular door. In this scenario, probability of winning swings from 0.33 to 0.67.</comment>


Intel admits 'tight' supply for cheap PC chips, focuses on high-end - <AUTHOR> https://www.engadget.com/2018/09/28/intel-supply-problems-core-xeon-cpu-10nm/ <comment><USER2> Intel is not having the best of time for this year and a bit of last year. AMD is on too of their game, intel's process shrink is not work as hoped, and meltdown a more severe form of spectre. Plus now supply issues.</comment>


On representing some real numbers exactly - <AUTHOR> http://blog.sigfpe.com/2010/04/on-representing-some-real-numbers.html

<comment><USER2> Continued fractions provide an interesting representation. See, for example, Mencer's _Precision of Semi-Exact Redundant Continued Fraction Arithmetic for VLSI_ , <http://portal.acm.org/citation.cfm?id=892637> . See also, Mark Jason Dominus's article, <http://perl.plover.com/yak/cftalk/> .</comment>


How to make a billion dollars in a couple of years - <AUTHOR> http://www.kanneganti.com/technical/how-to-make-a-billion-dollars-in-a-couple-of-years/

<comment><USER2> Although interesting facts, the title is very misleading. It should be more like "the infrastructure of a billion dollar startup"</comment>


The Inevitable Crash Is Coming - <AUTHOR> https://medium.com/dialogue-and-discourse/the-inevitable-crash-is-coming-5fac8561e0f9 <comment><USER2> A rather shallow article, starting with the truism in the headline...

The criticism of stock buybacks is bound to be fairly popular. But as far as I can tell, buybacks are close to identical to paying dividends, except for their tax treatment? I'd love to see higher taxation of capital gains and corporate profits, but the specific practice doesn't strike me as quite as dangerous and/or amoral as the article makes it out.

It's not like corporations would really decide to "pay their workers more" as the article suggests. That's the same blatantly flawed logic that led Republicans to suggest the tax cut would be used to raise wages.</comment>


macOS 10.14.4 Mail Client Has Broken Gmail Access for Some Users - <AUTHOR> https://apple.slashdot.org/story/19/03/29/173216/macos-10144-mail-client-has-broken-gmail-access-for-some-users <comment><USER2> I can confirm this. Since 14.4 my two Gmail Accounts randomly show as offline until I click the icon next to the account and it reconnects.</comment>