Jb's story about how he nearly lost his Twitter handle - <AUTHOR> http://d.pr/n/KUMK <comment><USER2> It amazes me that this type of social hack still works so successfully, I can understand Kevin Mitnick's success back when he was a hacker but surely the industry should have learnt by now. Resetting a users credentials should be treated like changing all the locks on their houses. If the user cannot verify their account credentials and is crying over the phone at least implement a 7 day delay and grace period before the reset takes effect, send emails which notifies the current email etc, or even send a pin to their postal address. I know these are not ideal security either but at least there would be some grace period.

<comment><USER3> Phone companies really have learned from Mitnick. For example, if you call an operator, they absolutely will not tell you what number you called from.

<comment><USER4> That's not completely true.

If you're in an old Ameritech area in Ohio, pick up the phone, dial '0' and when the Operator comes on, say:

"OBT-125, please read number on display."

You'll get the NPA-NXX-XXXX read out to you and she'll tell you to have a good day. As of three years ago, you could call any of the embarq/sprint area operators in Ohio/Kentucky and just say, "ID Me."

Phone phreaking is still alive, but, it's not as common as it once was.

<comment><USER5> What does 'OBT-125' signify/mean?

<comment><USER4> OBT stands for Ohio Bell Telephone, and "125" is the job/billing code for a line splicing/Frame/Switch person.

</comment></comment></comment></comment></comment><comment><USER6> I think a lot of it comes down to this:

"4\. Some of the biggest companies in the world have security that is only as good as a minimum-wage phone support worker who has the power to reset your account. And they have valid business reasons for giving them this power."

<comment><USER7> It could be greatly mitigated by automating that power more.

E.g., "No problem, I can reset your password! The system will automatically contact your registered phone number and email address -- if you confirm both, it resets now, and if you can't, it will send the reset to your new email 3 days from now."

<comment><USER8> Now all an attacker has to do is wait for me to go on a cruise, or camping trip, or basically take any action which means I'm out of communication for a week or more.

<comment><USER9> It's a change from near-zero security like now, to having to know your routine, travel, and communication plans. Perfect? No, but what is?

</comment></comment></comment></comment><comment><USER10> > _He then called Amazon with what little information he had gained and cried > that he had lost his password and didn't have access to that email address > anymore. The representative caved and reset the password over the phone > giving him full access to my Amazon account. His plan was to then gain as > much information he could with Amazon (last four of credit card numbers, > current and previous addresses, etc…) and use that as ammunition to do the > same thing with Apple. And it worked. He had an email in his gmail inbox > with instructions on how to reset my iCloud account._

Whatever you think of the state of cybersecurity in terms of encryption, implementation, and user-interface (including 2-factor authentication)...it doesn't seem that the protections against social engineering have developed at the same pace as the increasing ease of accessing public records

<comment><USER11> >Whatever you think of the state of cybersecurity in terms of encryption, implementation, and user-interface (including 2-factor authentication)...it doesn't seem that the protections against social engineering have developed at the same pace as the increasing ease of accessing public records

Yep. Around the same time I started using a randomly generated 24 digit alphanumeric password generated with an offline computer, I noticed a twin person who looked nearly the same as me nearly started living in my apartment, and asking an awful lot of questions about our supposedly shared childhood, wanting to "catch up".

It was certainly nice suddenly having a twin, but it wasn't until he suddenly disappeared three years later that I realized I should have been just as wary about social engineering as I was about my encryption.

<comment><USER12> I am not sure I get this....

Did your brother move into your apartment? Did you imagine a friend? Are you being sarcastic in a way I have missed?

<comment><USER11> third (sarcasm). I don't think the bar with social engineering has moved NEARLY as much as cyber security has. It's practically impossible to keep a computer secure, but very easy not to be duped by strangers on a social level.

<comment><USER13> What if the people getting duped to give away your account are minimum wage call centre workers who'd probably like you off the phone ASAP? You're a genius who'd never get scammed like this, fine, but you're not the weakest link here.

</comment></comment></comment></comment></comment><comment><USER14> another bad habit are those "security questions". For me, the only proper way to deal with this is to have your mother maiden or pet name be cy4nEp7UtNsz and save that (along with the question title) in your (properly backed up!) password safe.

<comment><USER15> > and save that (along with the question title) in your (properly backed up!) > password safe.

To be fair, this could render the security question useless. If you lose the password (by losing the password safe), you've also lost the answer to the security question. So a properly backed up password safe renders a security question pointless (or the answers to the security question should be stored in a separate, equally secure, location).

<comment><USER16> Security questions are already useless. What's my first pet's name? Depending on the day, I might have any of three or four answers; I'm unlikely to remember which pet was first, 30-35 years ago, _even if I think I can_ , since if you ask me in a month, I might be just as confident the other way! Given the uncertainty, I might well decide that the best answer is a later pet I remember better, but then which one is that?

I remember the names of exactly two teachers from high school, today, but only because I was discussing something about them with someone else who remembered over Christmas. My mother's maiden name is spelled differently on her birth certificate and death certificate, so I can't tell which one future me might use after forgetting a password.

Recently, I've noticed a trend of having 6 or 8 fixed security questions to choose 2 or 3 from, _none of which actually apply to me in a reliable way_.

There's really no other solution but to treat them as an additional password field.

<comment><USER17> Strictly speaking, they do have one benefit. If someone steals your password, there is really no way to know. If they reset your account with a security question, you'll know as soon as you access.

Still pretty terrible, though.

</comment></comment></comment></comment><comment><USER18> The problem is that different companies have different protocols on what information they use to identify users, etc, and hackers are getting smart enough to connect various partial information to get full information on a user.

Every single customer-facing company needs to have STANDARDIZED security/information protocols. This includes taking in same information, and only giving out the same information. This should solve this problem.

<comment><USER19> Even with standardized security protocols, you will still have issues with undertrained/underpaid customer support agents working to "help" one very smooth talking hacker using social engineer tactics.

<comment><USER18> Social engineering is always a problem, and I think first-level support should NEVER have the ability to see any information or have the ability to make changes to accounts. This should get escalated to second level support.

But regardless, a single account may get compromised, but at least you can't feed partial data from one social engineering attempt into another company, which is what apparently is happening more and more because of impedance mismatches with what everyone uses.

</comment></comment></comment><comment><USER20> Why are all these attacks targeting Twitter usernames? Do these really have particularly significant resale value? It seems like much greater profit could be made with access to someone's Amazon account, but these seem to be used as merely a proxy in these attacks.

<comment><USER21> I'd imagine that the illegality of fraudulently using an Amazon account would be more clearcut and easier to prosecute.

</comment></comment><comment><USER22> It seems that now you should not only use different passwords anywhere, but also different logins and emails, different credit cards and may be even different names, addresses and phone numbers. Just to be sure.

<comment><USER23> I use different emails, for everything. I manage my own domain(s), so I have anything @mydomain.tld. I'll usually give unique email addresses that identify, to me, the organization or service that gets the address. Occasionally an address becomes the target of spam, and I just kill off that address.

<comment><USER24> That wouldn't really helped you in this case, would it? The attacker got the account reset simply by phoning the customer service and making them send a password reset link to a new email.

Also how do you manage said X number of emails? Do you log onto each one of them, or do you forward all emails to one "master email"? If so, the master email is still the single point of failure.

</comment></comment></comment><comment><USER25> We are going to have to learn to -- effectively -- use compartmentalization, ourselves. (Us technophiles, certainly, but also the "greater masses".)

\- Separate, low-balance checking or similar bank account for "routine payments". Larger balances held in other accounts that cannot be accessed / drawn from through normal channels.

\- Separate contact address(es) for distinct and more public interfaces. E.g. I and some friends already have P.O. boxes for this purpose.

\- There are other instances/examples, but this is enough while keeping this comment brief.

AND HERE IS AN IMPORTANT POINT: Companies that _won 't_ let us do this, or even just make it hard, will become anathema to our own best interests.

THERE ARE LEGITIMATE REASONS I _don 't_ want all my services and access consolidated under a single user ID and password or other authentication.

Services that push towards "one true name" and "all services lumped together", are -- from this security perspective -- _not in my best interest._

I learned years ago about the value of compartmentalization. It seems that many companies have yet to learn that this is a legitimate concern and feature for their customers.

In the age of electronic recordkeeping and processing, it really is a minimal burden upon a business to support more than one account per customer. Customers have legitimate reasons for doing this. Get over it, and give them what they want and need.

</comment><comment><USER26> Why the hell can customer support agents see the credit card number? Why don't they just have a box to type in and verify the four digits?

</comment><comment><USER27> Here's what you do. Get a lawyer and sue them for all they're worth. Not just for you, but for every other person their pathetic security has and may cause problems for them in the future.

<comment><USER28> No problem - got a spare €100,000 to pay for my lawyers?

<comment><USER29> I don't know exactly where you are, but back home lawyers with pretty good chances of winning a case like this would be jumping at this with a no-win no fee.

<comment> brown9-2 How much damages do you expect to win for loss of a twitter username?

<comment><USER27> Depends. Is your name Ashton Kutcher?

</comment></comment></comment></comment></comment><comment><USER30> Amazon customer service folks should ask a caller to name some of items he/she has purchased last few weeks or so.

</comment><comment><USER31> Had this exact experience happen to one of my coworkers.

We started embedding a secondary "password" in some of our email addresses, by leveraging googles username+tag feature. So something like firstname.lastname@example.com becomes firstname.lastname@example.com

One less piece of guessable info.

</comment><comment> at-fates-hands One thing I've found handy is just to have little or no bio information on your accounts. If you absolutely must have bio info on your account, make all the information different from account to account.

This way, if a hacker gets your LinkedIn profile, the information there is different than your Facebook info, which is different than your Twitter info, which is different from your. .

Imagine a hacker with a handful of accounts and all the information is completely inconsistent. How does he decide which one is real and which one's are fake? It's essentially a dead end and will hopefully get them to move on to an easier target.

<comment><USER32> Have you been the target of hacking attempts? This sounds the opposite of handy, so I'd be interested to know how well it actually works. Not sure how well it would pay but I'd be interested in a service that attempts to steal your identity in this way, and then tells you what you can do to plug the vulnerabilities.

<comment> at-fates-hands I have not been targeted, I just tend to think like a hacker so I take a lot of precautions to protect my identity.

</comment></comment></comment><comment><USER33> I thought I'd post to let some people know how I BELIEVE this is being done.

Kevin Mitnick always talks about how social engineering is the key usually, ans it is. he used to make phone calls after dumpster diving and gaining employee names. There's no need for that now, we have all our information on the internet.

let me explain a little better. Take your facebook for example. Most people have the email they use on their for everyone to see, same with linked in. Now once a hacker finds who they want to target, just start googling the person and collect as much data as possible through comments made by and towards them. usually they'll comment on their pets name and all the other info they usually use to reset passwords. adding the person on a fake account acting like one of their friends with a new account is typical.

once they have all this info and the emails you use, time to take over what emails they can with your information. security questions are usually the route they go. once they have an email account, time to grab the others that are usually linked to each other for password resets. once those emails are taken over... it's all downhill from there.

best thing to do is make everything private and don't use the same username or handle on everything because that makes it easier to link to you.

just my thought about how this is done. pretty simple if you have some time to invest

</comment><comment><USER34> I would _love_ for there to be some regular program of independent security auditing of major web companies focusing on social engineering attacks. It can be government-funded or privately-funded (companies would pay to be audited in order to be included in a certified registry). I'm not 100% sure how the details would work (they'd have to maintain a huge number of dummy accounts all over the place), but the value of such an effort would be tremendous.

The idea that these companies would rather cater to individuals who are careless with their accounts than uphold the sanctity of the majority of their users' identities is deeply troubling. The thought of a dispensable, minimum wage worker being all that stands between me and total calamity is terrifying.

</comment><comment><USER35> These stories are starting to scare me...

I've already started using 1Password but I'm now considering closed some accounts and calling some of these services to ensure they never give out my information for password resets and such... Scary stuff...

<comment><AUTHOR> It's worth setting up two-factor authentication on any service that supports it: Google, Facebook and Github spring to mind.

<comment><USER14> Dropbox and app.net also do 2FA.

If the service you're using doesn't support it, ask them to implement it. If enough people did it..

<comment><USER36> I'm currently building a framework agnostic Authentication module for PHP/Composer, that has 2FA baked in. I want to give everyone who's building web apps in PHP no excuse for not having it. It's painful, but worth it IMO.

</comment></comment></comment></comment><comment><USER37> Damn, my passwords are crap (some are written in OneNote because forums make me change them every half a year), but then again I don't have any precious online properties besides some websites that I use stronger passwords for. Not like it matters since it looks like social engineering is alive and kicking (as they say, humans are always the weakest link in security).

These articles really make me want to set up an automated system that would monitor any password reset events (and other suspicious activity) and automatically change those passwords itself and/or notify me by sms...

<comment><USER38> It really is worth it. It is a pain to first set up and change every password to some random string (which most vaults will generate for you), but after that it's smooth sailing more or less. I recommend LastPass, it's free (unless you want the Android app, but even then the premium account is super cheap).

</comment></comment><comment><USER39> I'm gonna put an identity audit on my TODO list.

</comment><comment><USER40> 2 factor auth anywhere that matters. Google and Amazon for me. It is occasionally annoying, but worth it.

</comment><comment> brown9-2 It would be useful if a date was given for this story.

<comment><USER41> At the bottom in tiny text it says: "Published January 29, 2014"

Also, in the source:

      <meta property="article:published_time" content="2014-01-29T01:49:03.309Z">

<comment> brown9-2 That is when it was published, but the text gives no indication if the events happened yesterday or 12 months ago. It's useful to know if these abysmal practices are still current or not at Apple/Amazon/etc.

<comment><USER41> oh right, i just assumed it happened recently

</comment></comment></comment></comment><comment><USER41> Jesus fucking christ. Stop making websites accept anything other than a username+password/token for authentication, and this kind of retarded shit would never happen. It's somehow still the status quo to make backdoors to recover your account incase you lock yourself out, which is why things like this happen all the time. You get what you deserve.

<comment><USER7> This is great in theory, but in practice your regular customers are going to lose/mix up their usernames and passwords all the time.

They need _some_ kind of back door to recover their access (because honestly, even for the responsible _and_ tech-savvy users, sometimes sh!t happens... e.g., my password manager generated a new password but my laptop crashed before I could save it), and they assume there will be a way to restore their account.

I'm sure you _could_ tell your customers "you get what you deserve", but not if you want them to remain customers.

<comment><USER41> Gee, you're going to have a hard time with bitcoin, hidden tor services, etc.

A) Customers locking themselves out of accounts

B) Accounts being stolen by identity theft

Pick one.

> I'm sure you could tell your customers "you get what you deserve", but not > if you want them to remain customers.

I kill people for a living. You can tell me I could stop killing people for a living but then I'd stop having customers. Thus it's impractical to stop killing people.

<comment><USER41> Oh wait, I forgot this is HN, where conforming to retarded dogma is the only way to be cool.

<comment><USER42> Please impart more wisdom in your lovely obnoxious raging nerd idealist way. It's very unusual to find in tech circles!

<comment><USER41> Ironically, HN itself so happens to do it right - it permits you to have only a user/password. Reddit is the same, so is github, stackoverflow. I've never heard of pervasive problems on either of these sites. I don't submit my email to these sites, and they work fine.

Please continue to call common fucking sense idealism. Look how shit any other site besides the 4 (and others like them) I mentioned are with their fancy policies. How can anyone not rage when such stupidity is forced upon us?

<comment><USER42> Even if customers are scatterbrained and unwilling to accept responsibility for themselves, it's still better to keep them on board and making money than trying to teach them a lesson out of principle that probably won't even stick.

How well any policies are actually thought through is another matter.

<comment><USER41> Yes, because users would hate so much to be told explicitly that all they need to remember is a password. They much rather have 20 different pieces of information, some combinations of which if they share, people can take over their accounts on various services. </sarcasm>

The problem is not so much that the systems suck, the problem is there's no way for people like me to take on the responsibility and "risk" of just having a simple way to authenticate myself.

For example, in my bank I would opt into having all "suspicious transaction" types of protections turned off, but if I went to my local branch and asked for that, they'd just get confused and think I'm trying to commit fraud.

> it's still better to keep them on board and making money

Maybe better for you, assuming there would be a net loss from turning off the bullshit policy. Definitely not better for customers, as it enables theft, which has the same consequence as forgetting a password.

<comment><USER42> It doesn't have to be a mess of ill-thought-out questions. Just a traditional password reset email is a good facility, as opposed to "forgotten password? your account is forever locked, you cretin. don't even think about contacting us".

I have a good backup system so it's not that I use such stuff personally either.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Best way to become a front end developer? - <AUTHOR> Okay I just read this great guide that was written for jQuery fanboys on why React.js is superior and I'm sold!
http://reactfordesigners.com/labs/reactjs-introduction-for-people-who-know-just-enough-jquery-to-get-by/
Part of my growing horror is the 4k line of jQuery + javascript mashup it's harder and harder to make changes and I just get plain lost on how I can add another developer without incurring huge costs.
anyways I want to get started I have dealt with meteor.js so I'm interested to know how flux or reflux.js seems to fit in with react.js
I'm also going to need some guide to get a huge array of acronyms and tools like bower, SASS (not SaaS), LESS and all these arguments about io.js, node.js. <comment><USER2> > on why React.js is superior and I'm sold

That's a one way road to disaster. Not because of React (React is a good tool) but because you get sold to hype that easily.

\- Easily succumbing to hype makes you think everything moves very fast.

\- When thinking things move very fast, you think you're slow.

\- When you think you're slow, you then think you're behind.

\- When you think you're behind, you give up.

The web scene is a very fast and very unforgiving platform. The right thing today, might be the worst mistake tomorrow (like Crockford having wanted Object.create, but now despises it).

> Part of my growing horror is the 4k line of jQuery + javascript mashup it's > harder and harder to make changes and I just get plain lost on how I can add > another developer without incurring huge costs.

Learn dependency management and split up your code. There's a lot of implementations, as well as the standard ES6 modules. 4k is nothing to the horrors I have gone through.

> anyways I want to get started I have dealt with meteor.js

Oh, you know meteor? Why not stick to it? It's, IMO, the fastest way to prototype apps when you already know JS. Why not master it?

> I'm interested to know how flux or reflux.js seems to fit in with react.js

You don't really need React with Flux. In fact, I have used the Flux pattern on several different frameworks, even Angular and just Vanilla JS.

> I'm also going to need some guide to get a huge array of acronyms and tools > like bower, SASS (not SaaS), LESS and all these arguments about io.js, > node.js.

Stick to one that's used commonly. Again, don't be hype-driven. Just take your pace.</comment>


Cellular network location data used to track holiday population shifts in France - <AUTHOR> https://www.youtube.com/watch?v=0SMRcUvF28w

<comment><AUTHOR> The study from which this video has been produced: [http://www.pnas.org/content/early/2014/10/23/1408439111](http://www.pnas.org/content/early/2014/10/23/1408439111)</comment>


Ask HN: Why do Hacker News, Reddit, not show the users that voted? - <AUTHOR>

i was wondering why we are not allowed to see the people are voting on posts, is this like a technical issue, or a political one(conflict), i dont get it thanks <comment><USER2> It's a social choice. It wouldn't be difficult technically. Historically the origin of the custom may be slashdot.

<comment><USER3> Complementing pg's answer here about "social choice".

It places the focus squarely on the news content and not on the users involved. There's no following and there's no cronyism this way.

In many services, such as twitter and quora, I've noticed that there is some degree of reciprocity that occurs even if it is neither expressed or implied that you should reciprocate. In fact, in most cases there is nothing written or unwritten culturally that says you should reciprocate, yet people do anyways.

By eliminating this you eliminate this falsely perceived social expectation of reciprocity, thus placing 100% of voting motivation on content. This is the right approach if you want stories and comments to make it to the front page based on quality of content alone.

</comment></comment><comment><USER4> Anonymous voting reduces _quid pro quo_ , vendettas and other sorts of unproductive behaviour.

<comment><AUTHOR> "quid pro quo" i didnt know what it means, but it sounded pretty kool, just checked it on wiki, it sounds so british, im a londoner myself, fantasttic use of words @brudgers

<comment><USER5> You could also use google translate from latin, although this particular phrase is somewhat special :)

</comment></comment></comment><comment><USER6> May be they want to keep things simple.

You anyways don't know other users unlike facebook where most of the people liking and commenting on your status are your fiends.

More features they have, more complex it is for users and developers have to maintain it.

</comment><comment><USER7> Occasionally, a single comment can get over 100 points. The site may not want to keep track of that many links to a single post. (Not that I know why it works the way it does, but this seems like a good technical reason for it.)

<comment><USER5> It still needs to keep track of it for purposes of stopping double voting.

</comment></comment><comment><USER8> It would seem like the default option to me. Why would it show you who voted up and down? What would you do with that information?</comment>


Elm – functional reactive language for interactive applications - <AUTHOR> http://elm-lang.org/

<comment><USER2> I think Elm is very interesting and inspiring. The time travel debugger especially is very impressive.

However, can someone please tell me why Elm needs two kinds of values? There are simple values and then there are "signals". I don't understand why you need to make the distinction.

If you want to apply a function to a signal, you need to use "lift". From the Elm documentation:

 _" The lift functions are used to apply a normal function like sqrt to a signal of values such as Mouse.x. So the expression (lift sqrt Mouse.x) evaluates to a signal in which the current value is equal to the square root of the current x-coordinate of the mouse."_

Why can't you eliminate "lift" and just have all values be signals? Then "lift sqrt Mouse.x" would become "sqrt Mouse.x". (Which makes a lot more sense, if you ask me...)

<comment><USER3> >However, can someone please tell me why Elm needs two kinds of values?

Because not all values depend on/change with time. A euclidean distance function is the same no matter when in time it exists. But, the distance between a player and an enemy is something that changes with time. So, you'd want to lift the euclidean distance function onto a signal like 'lift2 distance playerPos enemyPos'. I don't actually program in Haskell or Elm, so I don't know if that is the correct syntax, but you get the idea.

<comment><USER2> But why not make the "lifting" implicit? If you put a signal into "distance", you get a signal back.

<comment> pseudonom- That sort of unprincipled, implicit conversion is generally frowned upon (by Elm, Haskell, ML, &c.). It reduces type safety.

If all you want is syntactic sugar, Elm has infix lift operators so:

        let p = lift2 (+) Mouse.x Mouse.y

becomes:

        let p = (+) <~ Mouse.x ~ Mouse.y

If you don't like that, Haskell has `do` notation. If Elm also had it, you could do:

        let p = do
          x <- Mouse.x
          y <- Mouse.y
          return (x + y)

</comment></comment></comment></comment><comment><USER4> Curious why the Mario demo is running at ~24FPS, and jumps to 45FPS when the keyboard is active. Is it throttling frames on purpose? Why can't it hit 60FPS for such a simple demo? It doesn't inspire much confidence for a language targeting interactive media.

[http://elm-lang.org/edit/examples/Intermediate/Mario.elm](http://elm- lang.org/edit/examples/Intermediate/Mario.elm)

Otherwise it looks great. :)

<comment><USER5> The code for the Mario demo has a signal every 1/25th of a second due to the (fps 25) function call in it.

I'm not entirely sure why its updating more on keyboard, I just started using Elm but it could be related to the demo combining fps and key events into a single pipe and reacting on it. So by hitting keys you may be emitting extra events it needs to react to.</comment></comment>


Analyzing Best Hacker News Posts - <AUTHOR> https://programmerbackpack.com/analyzing-best-hacker-news-posts/ <comment><USER2> > " ... the most interesting fact for me is that none of the best stories were > submitted on Tuesday or Wednesday."

Certainly interesting. Anyone have any ideas/suggestions about why this is so?

<comment><AUTHOR> Disclaimer: I am no Statistics master but I'm passionate about Statistics, I'll try my 2 cents on this.

In hindsight, I think I should have reordered the values on the horizontal axis by weekdays, Mon-Sun. If I did so, we would have seen that diagram as some sort of distribution looking like the Gaussian distribution, with the center on Friday. With that in mind, I'd say it's natural that people spend more time on HN during the weekend and that it's only natural that people are inclined to post here on those days. So my opinion is that more posts appear on HN during the weekend, so the probability that a popular post appears on these days is greater than any other day. Still, that's just my rambling and I'd be super happy to hear some other opinions.</comment></comment>


Ask HN: Is Facebook truly a monopoly? - <AUTHOR> <comment><USER2> No, of course not. The service that they sell - access to an audience for advertising - can be bought from many other companies, such as Google, TV networks, the New York Times, etc.

<comment><USER3> That not what it's means to be a monopoly.

<comment><USER2> This is the definition of a monopoly from Wikipedia:

 _" A monopoly exists when a specific person or enterprise is the only supplier of a particular commodity. ... Monopolies are thus characterized by a lack of economic competition to produce the good or service, a lack of viable substitute goods, and the possibility of a high monopoly price well above the seller's marginal cost that leads to a high monopoly profit."_[1]

What's your definition?

[1] [https://en.wikipedia.org/wiki/Monopoly](https://en.wikipedia.org/wiki/Monopoly)</comment></comment></comment>


Can you use a Raspberry Pi 4 as a desktop machine? - <AUTHOR> https://hackaday.com/2019/09/09/can-you-really-use-the-raspberry-pi-4-as-a-desktop-machine/ <comment><USER2> I was using Raspberry Pi 3 as my desktop (even though I have a significantly more powerful desktop "workhorse" upstairs) and it suited me just fine in most ways except when it comes to video streaming.

The Pi4 with 4G of Ram gets past that problem. And the dual monitor is great. Sure there are a lot faster systems on the planet, but I tend to use GUI as a convenient way to lay out more TUI, so the fact that there are systems with quadrupal the cores and whatever percent more speed isn't as interesting to me.

When I need more horsepower than the Pi can give, I just ssh into my Mac and thar she blows. For most of what I do, I can't really tell the speed difference despite the world of difference between them in terms of _capability_. The rpi boots up and logs in wayyy faster than my significantly faster (and way more memory, HD space, etc) than my Mac ever could. I feel little to no latency on startups. Obviously I can run a lot more on the Mac at one time, but we're talking about general desktop use, and I spend way more of my time on the Raspberry Pi in the living room than I do on my Mac in the den.

It's nice to have the greater resources, but it is utterly meaningless for a lot of use cases.</comment>


Open Core is over - <AUTHOR> http://www.h-online.com/open/features/Guest-commentary-Open-Core-is-over-1097073.html

<comment><USER2> Careful. The author of this article believes he's made an observation about which open source model is more effective, but he hasn't. Rather, he's observing that there are price-insensitive markets where it doesn't make sense to hold back components, because you'll get paid either way.

A (niche) counterexample to this is Nessus, the most popular open source security scanner. Until a few years ago, Nessus was entirely GPL with a commercially-licensed counterpart product. But a huge chunk of Nessus' market isn't F-500 companies with big IT budgets, but consultants, who are _very_ price sensitive. Tenable had to retreat from GPL altogether in later versions because the market was free-riding.

It is not always the case that "the most open" product wins.

When you're selling mostly to big companies, IT managers will pay almost no matter what; it's actually easier for them to sign a PO than it is to drive adoption of a free offering, because IT organizations are organized around purchasing-centric projects. So it makes sense that Red Hat would keep everything maximally free, to capitalize on the marketing benefit of a thriving community.

</comment><comment><USER3> RedHat has always been a very cool case. They've managed to build on the Service model everyone was trying back in the 90s and succeed.

They've had to focus on the enterprise because of this while many have tried to do so for the desktop and failed Ubuntu is the last one I can think off which is attempting to do this for the desktop. Ubuntu One is an interesting attempt.

<comment><USER4> I love the RedHat model. You _only_ pay for the value they provide. Otherwise, you can run Fedora. Same with Jboss.</comment></comment>


Sears Randomly Has Awesome Zombie Catalog - <AUTHOR> http://www.chris-moody.com/blog/marketing/out-of-the-blue-sears-has-an-incredible-zombie-catalog-for-halloween/

<comment><USER2> the people at the Sears by me (the shoppers and the workers) look like this everyday.

i remember the time I bought four tires and the guy who sold them to me was struggling with the cash register. he only charged me for one tire and argued vociferously when I pointed out his mistake -- i'm honest but i'm not all that assertive so in the end I got three tires free.

of course, the manager of the auto center at that Sears also always had his Camaro jacked up and was working on it whenever he had free time.</comment>


1000W LED on a Drone [video] - <AUTHOR> https://www.youtube.com/watch?v=Gl1xYyGom1g <comment><USER2> $17k for a drone with 10min flight time? Ok, it can carry up to 20lbs which is quite impressive. [1]

[1] [http://store.freeflysystems.com/products/freefly- alta8](http://store.freeflysystems.com/products/freefly-alta8)

<comment><USER3> By the way, the flight time to lift ratio of LiIon battery powered drones are one of the reasons I know all those stories about Amazon using drones to deliver are absurd. The drones would have power for two or three deliveries at most. LiIon batteries don't have that long of a lifetime and they are expensive. Not gonna happen with today's technology.

<comment><USER4> Last mile delivery is really expencive, if the drone uses 1$ worth of battery life per delivery that's still reasonable costs. It's getting everything else to work that's the problem.

Consider a golf course that can deliver cold beer out to the green via drones. 8 ice cold beers at ~10lb in a few minutes via cellphone app. A drone could probably do that 5 times on a single charge, and swapping battery's is easy. Charge 2$ extra per beer and it's both rather profitable and for now a unique experience.

<comment><USER5> Exactly. What is it worth to have a fleet of these deliver all packages in a multi block radius all within a few minutes? You can swap batteries quickly on the base truck (and probably automate how that swap is done) and move on to the next zone.

Saves massively on gas and people time (especially when self driving trucks are mainstream) and in theory are the main way you might deliver packages in a fully autonomous delivery setup.

</comment></comment></comment></comment><comment><USER6> I'm starting to get really intrigued by the idea of programming quadcopters, especially with this demo. I think I could impress the people I am teaching programming with this type of projects.

I'd like to learn how to program a quadcopter and be able to fix the hardware just in case something goes wrong.

However, my main problem is that I don't know where to start. I do not have a hardware background.

Does anyone know some good resource? I'd prefer if it had nothing to do with the scratch language

<comment><USER7> The best (feature-wise) open-source quadcopter platforms are:

      * PX4,
      * ArduCopter (actually uses parts of PX4),
      * PaparazziUAV.

These pack a lot of functionality: really advanced sensor fusion algorithms, position hold, waypoint/mission functionality, API for external control. At least PX4 has (working) integration with physics simulator (very useful for testing).

All of them are great starting points if you want to develop additional useful functionality (e.g. package drop, autonomous mapping/patrol)- implementing even the bare minimum pitch/roll/yaw stabilization functionality takes a lot of effort.

The easier way to enter this domain is using an on-board/companion computer (typically RaspberryPi/Odroid) to control the autopilot using high-level commands (e.g. fly to these coordinates, activate that output etc).

Background: I have spent ~2 years working on (sadly) unreleased products in this domain.

<comment><USER8> I'm intrigued, are you able to say what kind of product did you work on?

Who's doing these kind of products? I've done some things with the PX4 and I love it, the guys doing it are super smart. I've worked on some indoors navigation stuff but I wasn't very experienced at the time and the project turned into a mess.

<comment><USER7> Sorry, I don't think I can give you a lot of details. Let's say that one of my previous employers did a project which was supposed to be indoor quadcopter for consumers.

Regarding PX4- completely agree. People working on it definitely have high standards for software engineering practices and sense of responsibility. ArduPilot guys are also doing very good job, especially regarding state estimation (sensor fusion).

Indoor navigation is sadly not fully solved problem, at least for open-source solutions. I have not tried it, but IMO the best option at the moment seems to be Qualcomm's drone platform, as that has high-resolution, wide angle camera and enough processing oomph for image processing.

PX4Flow did work on some surfaces, but did not work too well on highly repetitive textures (e.g. office carpets). The image sensor, although is very good (global shutter, large, sensitive pixels) had limited resolution and even more limited was processor doing image processing.

The fusion of flow data was also quite unstable for ArduCopter and PX4 (they both shared the state estimation code at that point). Some of the problems were implementation issues (e.g. a few bad measurements caused the rest of (now valid) measurements to be ignored) but some were fundamental ones. The algorithms in use relied on constant distance between camera and objects on scene (required for calculating velocity in uniform units) which was unrealistic assumption indoors (e.g. flying near walls, over tables, etc).

<comment><USER8> My experience mirrors yours, but I only worked on this for @ 5 months give or take and didn't really have a big tech team to back me up.

The Qualcomm platform, as far as my understanding goes, still uses the PX4Flow. I don't know what packages they have for vision but it uses ROS so I assumed it had some ROS package powering it.

Px4Flow on its own is insufficient, but I was under the impression that it is able to calculate velocity even with variable distance camera-to-surface, they do have the ultrasonic sensor there and apparently, adding a lidar greatly improves performance.

<comment><USER7> Qualcomm platform has different camera and is directly connected to SoC, so I doubt they share anything with PX4Flow.

PX4Flow can calculate velocity when camera-to-surface distance varies, no doubt about it. The problem is when single frame contains features at various distances (e.g. lidar/sonar measures distance to ground, but half of the frame also sees table which is a lot higher).

</comment></comment></comment></comment></comment></comment><comment><USER9> I think someone seeing this from the ground, not understanding what it is, might think it's a UFO

<comment><USER10> If you can't identify what the flying object is, doesnt that make it a UFO by definition? ;)

<comment> david-given I see UFOs all the time; I should really learn more about ornithology.

</comment></comment></comment><comment><USER11> This is so cool. I would love to see a version of this with the ability to follow you and avoid obstacles on it's own. Basically a kickass outdoor robot flashlight. Probably not possible with current tech, but bonus points if it can perch on a tree or something when you're staying in one area to act as a fixed spotlight.

<comment><USER12> With the advent of nanowire-in-gel batteries, flight time might increase tenfold.

</comment></comment><comment><USER13> This is great for search and rescue.

<comment><USER14> I expect a drone with a low light and/or thermal camera to be immensely more useful for SAR.

<comment><USER15> That also reminds me of an interesting research paper last year about a "Machine Learning Approach to Visual Perception of Forest Trails for Mobile Robots".

( [http://robohub.org/drones-recognise-and-follow-forest- trails...](http://robohub.org/drones-recognise-and-follow-forest-trails-in- search-of-lost-people/) or directly [http://ieeexplore.ieee.org/document/7358076/](http://ieeexplore.ieee.org/document/7358076/) and probably available on sci-hub )

<comment><USER16> Imagine "smart" thermal-imaging goggles that don't just show you what they're filming, but rather spray light out and capture _that_ image—along with the angle it and position was shot at—then send it to a server, where it gets photo-stitched together with what everyone _else 's_ goggles are filming to create a globally illuminated 3D model—which is then what gets sent back and shown in each person's goggles. Anytime a person—or drone—"saw" part of the landscape, it have an effect for everyone else analogous to removing fog of war in an RTS game.

</comment></comment></comment></comment><comment><USER17> Really nice project showing a combination of technology and artistry. I wonder if it's the same guy doing the drone customization, and also producing and directing the film.

</comment><comment><USER18> A shot with fixed aperture turning the light on would have been nice. Preferably with some street light for comparison.

</comment><comment><USER19> I like the videos. Did he ever mention what drone he was using?

<comment><USER20> Yes, at the beginning.

[http://freeflysystems.com/alta-8](http://freeflysystems.com/alta-8)

<comment><USER21> He must work for them because this video was half an ad.

</comment></comment></comment><comment><USER22> I have seen RC helicopter powered by 2-stroke gasoline engine. I wonder why there isn't any Drone use that engine, it basically provide more fly time, more lift power and short "charge" hours.

<comment><USER23> Balancing and maneuvering a multirotor requires fast, precise control of power output. It's difficult to get that from a gasoline engine.

<comment><USER8> Simple, add a variable pitch propeller. There are people that did it.

<comment><USER24> If you think adding variable pitch propellers to a multirotor is "simple," you're sorely mistaken :-)

<comment><USER20> There's not much point in debating what "simple" means, but it has certainly been done. There are collective pitch multirotors that are mass produced, marketed and sold to recreational customers, and quite stable. Granted, most of these still use electric motors. The point is for 3D flying, not the potential longevity of a combustion engine.

The first commercially available one I know of (no longer produced):

[http://www.curtisyoungblood.com/legacy-product-support- curti...](http://www.curtisyoungblood.com/legacy-product-support-curtis- youngblood/attachment/stingray-500/)

A knock-off of the Stingray:

[http://www.hobbyking.com/hobbyking/store/__77122__Assault_Re...](http://www.hobbyking.com/hobbyking/store/__77122__Assault_Reaper_500_Collective_Pitch_3D_Quadcopter_Mode_2_Ready_to_Fly_EU_Warehouse_.html)

A big exception: this thing is massive and works with nitro and 2-stroke engines:

[http://www.curtisyoungblood.com/legacy-product-support- curti...](http://www.curtisyoungblood.com/legacy-product-support-curtis- youngblood/attachment/stingray-500/)

</comment></comment></comment></comment></comment><comment><USER25> One could use a bicycle lamp easily enough and I suspect it would be smaller and lighter than the DIY setup shown.

[http://www.lumicycle.com/mountain-bike-lights/summit- range/s...](http://www.lumicycle.com/mountain-bike-lights/summit- range/summit-2016.html)

That lamp is 1,100 lumens on standard high power, lasts over 4 and a half hours at that brightness. And if needed, there is a boost mode that gets you 1,650 lumens but only for a couple of hours.

This is for the smallest battery, a 2.6ah that weighs 220gms.

And if you're wondering, yes my bicycle has insane lights. 2 of those and then a 605 lumen dynamolamp giving 3,905 lumens on a bicycle. Yes,I chose tight beam and aim at the ground about 10m ahead, unless I leave the city when I put one wide beam lamp on and raise it a little.

<comment><USER26> 1k lumen need about 10W electricity if produced by white LEDs. This drone has about 50-100k lumen

<comment><USER15> On a side note, it might not be a good idea to directly glare at powerful LEDs.

French Agency for Food, Environmental and Occupational Health & Safety noted [1] some points that might not be photo-biologicaly safe, the main points being:

> spectral imbalance (significant proportion of blue light in white LEDs);

> high levels of radiance (high brightness density per surface unit emitted by > these very small sources)

In the french version of their report, they refer to luminance [2] rather than radiance.

The spectral imbalance photochemical risk seems linked with cumulative dose of blue light, so there is also a risk with low but long exposure light LED screens. It also perturbs circadian cycle (flux or redshift might help in that case).

See also a previous HN discussion about a warning from the American Medical Association about the spectral imbalance in LED streetlights [3].

\--

[1] [https://www.anses.fr/en/content/led-%E2%80%93-light- emitting...](https://www.anses.fr/en/content/led-%E2%80%93-light-emitting- diodes)

[2] [https://en.wikipedia.org/wiki/Luminance#Health_effects](https://en.wikipedia.org/wiki/Luminance#Health_effects)

[3] [https://news.ycombinator.com/item?id=11992946](https://news.ycombinator.com/item?id=11992946)

</comment></comment></comment><comment><USER27> What is its size and weight? How long does it fly?

Edit: I watched the video without sound.

<comment><USER28> Both drone and lights last for about 10 minutes, according to the voice on the video (about 35 seconds in)

</comment></comment><comment><USER29> wait, do you mean 1000 lumens?

</comment><comment><USER30> A Servo ? Some reason for why a relay wasn't used ?

<comment><USER31> The only time I used a servo to flip a switch was because I was too lazy to modify a completed set-up.

</comment></comment><comment><USER24> Hate to say it, but the narrator's sticky, overly glossal voice is painful to listen to.

</comment><comment><USER32> Brilliant work, just awesome amount of skill and attitude in action. Mind the app for LED control interface.</comment>


Linus Torvalds Interview for LinuxFR - <AUTHOR> https://linuxfr.org/nodes/85904/comments/1230981

<comment><USER2> I think Linus's pragmatism has a lot to do with Linux's success. He's out to make Linux the best it can be, and he's not worried about what MS is doing or what BSD thinks or whatever. He doesn't have the political agenda of the FSF or the commercial agenda of say Apple or Sun. Hardware companies can open, or not open, their hardware - developers can build open, or closed, source programs on Linux.

His approach to licenses is the same - he uses what works for him, and lets others decide for themselves what works for them.

It makes Linux attractive as a platform at all levels because you never feel like you're making some grand statement, or locking into someone's master plan. I have Linux servers in the office, but also Windows desktops. I program code for embedded devices (running Linux). We use the right tool for the job, and if a better tool comes along we can switch. We're not married to the computers, we just use them.

To some extent this makes the whole "Linux on the desktop" issue a non-issue. Maybe it'll be on the desktop one day. Maybe it won't be. Either way it doesn't seem like this matters much to Linus - as he said Linux competes with itself.

I like pragmatism. It gets stuff done.

</comment><comment><USER3> _So the first and the very negative answer is that I absolutely despise the people who try to push the GPL as being about "ethics". I think that's absolute bullshit. Why? Because ethics are to me something private. Whenever you use it as an argument for why somebody_else should do something, you're no longer being ethical, you're just being a sanctimonious dick-head._

Good lord, so we're supposed to take an interest in ethics privately but never speak about it publicly? Almost everything I believe about ethics comes from processing other people's ethical ideas, and the same is true for Linus, I'm sure. I personally don't think less of anybody who uses an MIT or BSD license instead of the GPL, but I do think less of Linus for declaring ethics to be an unsuitable topic for public conversation, simply because he can't stand to hear people disagree with him or disapprove of him.

Not to mention he is a brazen hypocrite. He broadcasts his opinions about other people's behavior, calls them dickheads, and says he despises them, _because_ it's inappropriate for them to talk about how other people should behave. Sorry, Linus, it's hard to be more of a sanctimonious dickhead than when you're calling someone else a sanctimonious dickhead.

<comment><USER4> Has Linus ever claimed to not be a dickhead? Quite the opposite I believe....

Gotta say though, I do agree with his point. People who cram their ethical systems down other peoples throats are dickheads. Am I automatically a dickhead myself for calling people out on this? So be it, I can live with being a dickhead to that degree.

<comment><USER3> The perception of "cramming" is Linus's problem. The concrete complaint he makes (before his blanket statement that ethics should never be discussed publicly) is that people "push" the GPL as being "about 'ethics.'" Well, that is nothing about Linus, it is about the GPL, so he can't even claim it's personal. Plus, it's a reasonable opinion to have, especially since the person wrote the GPL did so to promote certain ethical considerations. It is Linus's fault that he is so sensitive that he can't abide somebody having an opinion that the GPL has an ethical side to it.

Then he goes on to say, "I really want to point out that it's not that the license is somehow ethical per se." So it's okay for _him_ to have and express an opinion on that question. The hypocrisy is really thick there.

And here's the question that prompted that response: "Do you agree that there is an ethical content in the GPL?" Hardly a pushy question, and the interviewer practically apologizes before he asks the question. So no, there is no cramming, there is just a person who is extremely sensitive on an issue and responds to a polite question with an insulting rant about civility. There is nothing cool about that. He isn't dropping his brilliant technical judgment on an unsuspecting noob who will be better for it in the long run. It's just unpleasant behavior to no useful end.

<comment><USER4> There are _undeniably_ people who do what can only be realisticly described as "cramming" their ethics systems. I'm guilty of it myself on occasion (with regards to the GPL even!) and I'm sure that if you honestly look at yourself, you'll find you are too.

All this said, he's literally just saying that people who cram the GPL onto other people because it's more "ethical" are dickheads. As far as I can tell, he's not doing that himself, and he's not attempting to imply that the questioner was doing it either. Rather, he just isn't kidding himself, and recognizes that the reason the question is being asked is because there are certain "high profile" people who have made it a full time hobby to do such cramming. He wishes to make it clear that his reasons for using the GPL are purely pragmatic, not quasi-religious.

To be honest, at this point it really just seems like you are attempting to be contrarian.

<comment><USER3> Not, not really, I just accept that there are people out there expressing opinions about how I should live and that there's no way for me to shut them up. "How many times do I have to express my opinion before those dickheads stop expressing theirs?" is a natural feeling when a controversy drags on longer than one feels it should, but it is counterproductive to express that feeling as if it were an argument. (Also, personally, I don't think the free software ethic is something that ought to go away, even if I don't follow it myself.)

 _There are undeniably people who do what can only be realisticly described as "cramming" their ethics systems._

Most controversies include some number of unpleasant people. If we let that affect how we respond to polite questions from polite people, we become part of the problem. If you said something to me about the U.S. occupation in Iraq, would it be constructive for me to respond by complaining about the conduct of various people who have expressed similar opinions?

</comment></comment></comment></comment></comment><comment><USER5> Almost all browsers will show a warning about the certificate… Link without https : <http://linuxfr.org/nodes/85904/comments/1230981>

<comment><USER6> Off-topic, but does anyone know why browsers go crazy about self signed certs?

It's not as good as one signed by an ostensibly trusted CA, but it's strictly better than plain HTTP (no sniffing, harder MITM, etc) - so why not present it to the user the same way that plain HTTP is?

The conspiracy theorist in me wonders if trusted CAs 'lobby' browser vendors to make it so?

<comment><USER7> Self-signed certificates _don't_ prevent MITM attacks on connecting unless you've transmitted the certificate securely out-of-band and installed it in the client's browser. (which practically never happens with sites on the open internet) They only prevent tampering with the connection once it's established.

The browser _should_ jump up and down when encountering such a certificate as it's exactly how an attempted MITM attack would look.

<comment><USER6> Granted, it doesn't provide as much protection as a cert signed by a trusted CA - but it's still far more protection than plain HTTP, right? e.g, Firesheep wouldn't work

I don't know if browsers do this, but in principle they could even notify the user on certificate change, so the MITM would have to be on the first connection to a site.

<comment><USER8> Introducing a "third state" for the SSL indicator, usability-wise, is very difficult. A lot of browser users don't understand SSL, and those that do have a binary understanding of the protocol: it can be used to either confirm or refute the identity of a website. It's very difficult to implement a UI for the regular users that says: "this might be a MITM attack since I cannot confirm the identity of the site but at least I can confirm that it's the same with the one that you connected with the first time".

</comment></comment></comment></comment></comment><comment><USER9> _Because ethics are to me something private. Whenever you use it as an argument for why somebody_else should do something, you're no longer being ethical, you're just being a sanctimonious dick-head._

For someone who is not a native English speaker, Linus really has an awesome way with words.

<comment><USER10> At least it's clear what he's saying, but I was surprised at this -- it puts Linus well and truly in the postmodern camp. He says ethics are completely relative and personal. (Which of course is not the case: if I try to kill someone, the cops aren't being "sanctimonious dick-heads" when they stop me.) Anyway, all this is off topic, but I was just surprised at Linus's relativism when he seems so "absolutist" about many other things, for example, how much C++ sucks.

Edit: OTOH, Linus is talking in the context of software licenses -- I agree with him that it can get holier-than-thou the way some folks push the GPL (not least its original author).

<comment><USER11> To reiterate, even if murder is universally considered as being wrong, other issues such as property, copyright, profit and a lot of other things are treated extremely differently in different cultures.

So it's as easy to find something we all mostly agree on (murder) than something we all mostly disagree on (property).

Also taking the murder example is quite dishonest. Linus wasn't talking about murder issues. He was talking about intellectual property issues. Do you claim there is objective right and wrong in this domain ? Do you claim to know what it is ?

EDIT : Didn't see your edit, so correction about the "dishonest argument" part :)

<comment><USER12> FWIW, even killing people is/was considered acceptable: if the victims have property X where X varies between having the wrong race, being the firs born girl, being physically impaired, being sentenced to death, being a sacrificial offer and plenty more.

</comment></comment></comment></comment><comment><USER13> I'm always struck by how down-to-earth and pragmatic Linus is, compared to a lot of the Linux peanut gallery. One thing in particular made me very happy: He sees Linux as a Unix, and not some "Unix-like" operating system.

(Yes, let the lawyers and marketing droids point out that "UNIX" is a trademark of the Open System Group and that no Linux distribution has been registered as comformant to the Single Unix Specification, but that doesn't change the reality that Linux is a Unix.)

</comment><comment><USER14> The interviewer states, citing Lennart Poettering:

 _"Linux is the focal point of all Free Software development"_

...which is of course bullshit (pardonnez-le-mot ;-). Look at all the open source applications and servers that are developed nowadays. Look at the BSD projects! Free (as in Freedom) Software is not confined to the linuxsphere.

</comment><comment><AUTHOR> May 3 9PM according to the headline, it's very recent.

<comment><USER15> I thought that was when the copy was submitted, not the date of the interview.

It has to be fairly recent, since it talks of the upcoming anniversary and the site considered it newsworthy, but ...

</comment></comment><comment><USER15> Where and when were this interview conducted?

<comment><USER16> It was done by email last week.

<comment><USER15> Thanks.</comment></comment></comment>


How I write and time-manage - <AUTHOR> http://www.marco.org/691438863

<comment><USER3> Marco's really hit the trifecta as far as I -- and I'd assume a lot of other HNers -- am concerned:

1) dayjob with a small, impressive startup

2) smart, original side-project that has passionate users and an income stream

3) thoughtful, well-written essays on his personal blog

<comment><USER4> I just read that and had an interesting moment of self-realization. Wow.

Of course, I'm not quite there yet. But yeah. You've summed it up.

</comment></comment><comment><USER5> Very interesting, and good link to the Gruber/Mann talk. I'll have to listen to that.

I find it really hard to find the time to write (even though I really deeply enjoy it), in part because I know that once I get started, I don't stop. But I have a start-up to run, so I can't spend all my energy blogging.

Really, my problem with blogging isn't time-management, it's energy- management. At the moment, my energy is directed towards my start-up rather than towards my writing. I don't really know what the right answer is to this choice.

<comment><USER6> Here is how I fixed the energy problem: I had two kids in two years.

Sounds funny, I know, but what I realized is that I shouldn't be working harder, I should be working smarter. I also learned that people with lots of time on their hands always complain about not having enough time/energy, which I now know isn't the case.

Now, its fair to say that I may not be making great things, but I feel better about what I am making, and I am happy with my throughput.

Maybe, you don't need to have kids, but you do need to find some kind of full filling activity, outside of start ups. It will help you focus when you aren't doing that activity.

</comment></comment><comment><USER7> One of the best time-management/productivity tips I ever came across was suggested by Jonathan Mead over at the blog Zen Habits.

He suggests creating a "to-stop" list - a list of all the things that are sucking away your energy and are wasting your time. He suggests figuring out which of those things is having the biggest negative impact on you doing the stuff you really want to do and tackling that thing head on each day.

<comment><USER8> Ack! Reading Hacker News might be at the top of mine.

</comment></comment><comment><USER9> I like to imagine someone critical reading my code when I'm programming.

      If 10 years from now, when you are doing something quick
      and dirty, you suddenly visualize that I am looking over
      your shoulders and say to yourself: 'Dijkstra would not
      have liked this', well that would be enough immortality for me.
      - <USER2>

</comment><comment><USER10> "Own every pixel of what you're making" stuck with me.

</comment><comment><USER11> Ah, I wish the laptop designers/manufacturers would read this so they'll have a fear that Jobs is going to review their design before it goes to market.

<comment><USER12> Some certainly do. Namely, Jony Ive and company.

</comment></comment><comment><USER13> Thanks for this, I needed this today.

</comment><comment><USER14> Advanced common sense?</comment>


Ask HN: How not to tire of a personal project? - <AUTHOR> I have read several stories about personal projects turning into something big or at least big enough to make a living out of it.
Working an hour or two every day would take months to have a minimum viable product.
Were people who completed a large-scale project simply having a great deal of discipline and did not get tired of the project? If so, how to develop such discipline?
Or did they have the opportunity to quit their job to accelerate development? <comment><USER2> I usually build an MVP all at once. I'll have a plan on Friday and start working first thing Saturday morning. Typically I work until the MVP is finished; 8 to 12 hours later. I believe an MVP should be as simple as possible and I'm no prefectionist. Some really poor quality software and websites are popular. If it feels a real need, I assume people will use it.

I haven't built anything terribly successful, however, because I often build the wrong idea or lack the marketing chops to get people interested. My next MVP will be a simple marketing page with a "coming soon" sign up box to see if people even care before I build it.</comment>