Modify your Gmail address to apply custom filters - <AUTHOR> http://andrebluehs.net/blog/2010/05/gmail-and-tips-and-tricks/

<comment><USER2> Sadly, there is software and websites out there that does not recognize the plus character as a valid character in e-mail addresses.

<comment><USER3> Every time I've tried to use this trick the email validation rejected the + sign.

<comment><USER4> I use this pattern religiously (I've learned some interesting things about who gives my email address to whom), and the problem has become a lot less prevalent over the last year or two, but it's still an issue in some places. Until recently, even Facebook and Dice.com wouldn't accept a '+', and while bn.com would accept it, the Barnes and Noble e-reader iPhone application wouldn't (which they've since fixed; I'm still absolutely floored by the amazing customer service experience I had with B&N as a result, compared to what I expected).

I've reached the point where, if your email validation is that badly broken, I'm probably not going to trust you with anything more important than that. It's made for an excellent trust litmus test.

<comment><USER4> (And, I was wrong about Dice fixing it; I just switched back to using this address pattern, which they appeared to accept, but my daily email listed my email address as "userext@", not "user+ext@". They silently removed a character from my email address. Awesome.)

</comment></comment></comment></comment><comment><USER5> I use a few of these all the time, but I wonder how long until services get smart and start ignoring the dots or removing anything after a + in all gmail addresses they get coming in.

</comment><comment><USER6> Looks good to avoid some spam with signing up to newsletters.

</comment><comment><USER7> there's always ...@googlemail.com, if the + method fails.</comment>


Monty Hall Problem Explained in Video - <AUTHOR> http://www.youtube.com/watch?v=mhlc7peGlGg

<comment><AUTHOR> We watched this video in class this semester. I had already heard of the problem from reading Marilyn Vos Savant's articles in high school about it. <http://math.ucsd.edu/~crypto/Monty/montybg.html></comment>


Security Flaw in Estonian National ID Card - <AUTHOR> https://www.schneier.com/blog/archives/2017/09/security_flaw_i.html <comment><USER2> I wonder what the bug is. Could it be a timing or electrical/power-usage side channel attack on the chip making it possible to extract its private/secret key? The linked page near the bottom of the article seems to hint on that: "powerful and expensive computing power to calculate the secret key and special custom-made software for signing are also needed."</comment>


Show HN: An distributed key-value store using hashicorp/raft and dgraph-io/badger - shabab-ayub https://github.com/s4ayub/huffleraft <comment> shabab-ayub Relatively new to Go and distributed systems in general, any suggestions are welcome!</comment>


Larry Flynt Offers $1M Reward for Mitt Romney Tax Returns - <AUTHOR> http://www.adweek.com/news/press/larry-flynt-offers-1m-reward-mitt-romney-tax-returns-143474

<comment><USER2> Sorry, I don't see how this has anything to do with HN, so flagged.

<comment><USER3> Because it's hackers who can acquire them. duh!!!</comment></comment>


Remote access to production infrastructure (death to the VPN) - <AUTHOR> https://mattslifebytes.com/2020/02/29/remote-access-to-production-infrastructure-death-to-the-vpn/?hn=1 <comment><USER2> In my experience, the best way to eliminate the VPN is to expose your various internal business services as websites w/ TLS1.2 & multi-factor authentication.

Obviously, this isn't practical for everything. But, if the thing you were using VPN for is already a web application, you are basically halfway there. Ideally, you just directly expose a secure web application to clients, but in some cases (i.e. very old legacy systems) you probably want to put an nginx box in front and then put the authentication at that level.

Web access has a huge range of benefits. Users are scoped directly to the system of concern rather than an entire network of hosts. You can take security to the next level with server-side rendering of web content in order to avoid additional required channels of communication or revealing of implementation secrets to the client (e.g. SPA client source).

We are at a point of placing our actual application servers directly on the public internet (with TLS1.2/MFA/ACLs/etc). Hiding behind VPNs or layers of reverse proxies seems to cause more harm than good.

<comment><USER3> I want this, but with a twist.

1) I want the websites to do certificate verification on the certs I'm using on my desktop.

2) Then on top of that my website should use usb security key verification as well.

Easy enough to do #2, but I want #1 to be ubiquitous as well.

... So basically my HTTPS server will use my public key as my identity, not my username/email and password.

<comment><USER4> you can do that with mutual TLS (client side authentication)

<comment><USER3> Thanks for pointing that out. I definitely get that it's possible, but as far as I know in the open source world there isn't much in terms of infrastructure to implement these types of solutions in web applications.

Happy to be proven wrong, I'm just unaware if any popular open source HTTPS servers offer this as an integrated solution.

Or better yet, I'd like raw access to the certificate info FROM the application layer on server-side so I can manage that as needed.

<comment><USER5> You don't implement it at the Application level. You implement mutual TLS on your proxy and then each application can keep its own auth.

Disclaimer: I haven't don't this myself (yet), but have read about it a bit.

<comment><USER3> Right. I may have done a poor job explaining. Imagine if the HTTPS server did all its verification / etc at the protocol level, but then EXPOSED the public key, used by the client, to the application I wrote. This way I can (at the application level) do app-related stuff like reject users if (for example) they've provided a public key not in my white-listed public keys. This would also make it seamless to build tooling around the application, such as what github (and others) do when they ask you to maintain public keys you may use when pushing / pulling to/from a repo.

But in this case users could provide public keys they will use when accessing the website from internet (as opposed to intranet).

</comment></comment></comment></comment></comment></comment><comment><USER6> Authenticating the source IP address on the fly (as detected from the browser) is definitely not the way to go for many reasons:

1\. With NAT and metropolitan area networks, hundreds of thousands of devices could share the same public IP.

2\. Large networks with many devices often connect to the public network through trunking (load balance the connections through multiple routers), so the HTTP connection between OKTA and my browser can VERY well originate from a different IP address than my SSH session, and I would never be able to connect.

3\. Many devices are mobile, and they can change their IP address when they pass from WiFi to LTE for example. This would force an unnecessary re-auth.

<comment><USER7> NAT and single IP adresses for multiple users are going away with IPv6 ?

<comment><USER8> Eventually, for now v4 CGNAT exists too though.

</comment></comment></comment><comment><USER9> Pure Zero Trust is just as ridiculous as using Pure-VPN-around-a-garden. The first gives an attacker unlimited retries, and the second gives an attacker full system access once they breach the outer wall.

The correct solution is somewhere in the middle: block everything by default to get you to an inner courtyard, where the zero trust model is deployed... (which ironically he suggests by deploying port knocking (port knocking is a bad idea (TCP/UDP ports are sent in the clear and the "key" is never rotated)))

The best model is probably "block everything" by default, then allow access to the inner courtyard via a VPN, where then the Zero Trust model is deployed. You remove the ability for an attacker to have unlimited retries, but access to resources still requires individual authentication.

<comment><USER10> Why does pure zero trust give unlimited retries? If you use rate limiting, good password policy, and strong 2FA then most motivated attackers are going to seek a different entrance.

<comment><USER11> The vulnerability in your stack may be before your limits/policies are checked.

</comment></comment></comment><comment><USER12> Any suggestions for a good inexpensive or open source zero trust auth solution that supports both HTTP and SSH? I considered Cloudflare Access, but you need to pay extra for Argo Tunnel if you want it to work with SSH.

The main open source option I'm aware of now with support is Pritunl Zero. Was going to actually stand that up today before I read the article.

<comment><USER13> I love Pritunl. Have been using it for 5 years. It's super easy to setup, maybe takes an hour the first time and like 15 minutes once you have done it.

</comment></comment><comment><USER14> If you're in GCP, then you can use their Identity Aware Proxy to achieve most of this. ([https://cloud.google.com/iap/docs](https://cloud.google.com/iap/docs))

IAP supports HTTP and TCP connections, so you can put it in front of your website (say an internal admin webapp), or use it to tunnel SSH onto a machine that doesn't have a public IP, using your IAM roles.

If you're running Kubernetes in GKE, you can also wire IAP up to an Ingress, to protect any TCP/HTTP services you have in your k8s cluster. This one is a bit tricky to configure, but is very nice once you have it up and running.

</comment><comment><USER15> Hey Matt. I appreciate images in articles, but GIFs are very distracting while trying to read. May I suggest static images next time?

<comment><AUTHOR> Thanks all for your feedback. I have removed the images to improve readability, especially for mobile users. The post was originally written for an internal blog where we have a GIF-heavy communication culture, and I probably should have cleaned it up a bit more for general public consumption.

</comment></comment><comment><USER16> The critique against VPNs is exactly right, they're such garbage compared to the standard we otherwise hold SSH, TLS etc to, and the access granularity is too wide, and there's no transparency on how wide the access is configured from VPNs. And they're very often on the wrong side of the it dept vs devops responsibility split so often misconfigured.

<comment><USER17> The biggest issue I have with replacing VPNs is in server management, but not the way the author is talking. My job entails doing software development for over 1000 devices that are all fielded behind enterprise firewalls, and the PCI compliance requirements dictate that no unnecessary access be provided into those firewalls. What this means in practice is that no connections may be established which originate from a device on the internet to a device behind the firewall. We don't control the firewall as it is under the control of our customers.

What we used VPN for is allowing us to establish SSH connections to the equipment. I would really, really like a low-resource mechanism to replace this but everyone wants to deploy their solution in a 90+ megabyte Docker container, or a Snap, which is about 1.5 times as large as the entire Linux system image for our oldest equipment. So these are great solutions for when you control the entire network path from the server(or when you are using a server!) to the Internet including the firewall, but they suck terribly for eliminating VPN in cases where you can't just open an inbound port on the firewall.

As it is I'm trying to figure out how to configure an OpenSSH client to punch out through the firewall to an OpenSSH server, then immediately turn around and provide a shell to the server. This seems to be entirely contradictory to how OpenSSH is designed, but I'm hopeful I can hack something together.

<comment><USER18> Are you just looking for "ssh -fNT -R 10022:127.0.0.1:22 remote"?

If so, then that's not as much a hack as a pretty standard reverse ssh.

</comment></comment></comment><comment><USER19> If you are interested in BeyondCorp-style access, I put together a collection of curated resources.

[https://github.com/pomerium/awesome-zero- trust](https://github.com/pomerium/awesome-zero-trust)

PRs welcome.

</comment><comment><USER20> Pardon my ignorance, so this updates a security group (or multiple) which presumably have access to several internal things? One wonders if you can take it a step further and for web-based services (i.e. doesn't apply to SSH access), at the conclusion of the authentication, it updates the security group for just that webapp. With how e.g. oauth2 SSO automatically auths via redirects, if the update to the security group is atomic/fast, access can be given one webapp a time.

Also, are there any concerns about IP timeout vs explicit VPN disconnect? Obviously the latter works better in shared environments (e.g. shared terminals, wifi's that reuse IPs frequently, large NATs that have many devices behind a single IP).

<comment><AUTHOR> There is one network entry point per deployment of our app infrastructure (eg. US and EU deploys), so the lambda does go and update both security groups simultaneously to allow the requestor's IP to hit either if they would like. If you wanted to, you could certainly make it more fine-grained than that, but the goal was simply to cut off the majority of the Internet from these mechanisms as an extra protection layer. There are all the other protection mechanisms (e.g. the mutual certs) to actually protect and authenticate the connection itself.

For web apps, we simply front using an OAuth2-aware proxy. Back in the day, we used this: [https://mattslifebytes.com/2018/08/07/protecting-internal- ap...](https://mattslifebytes.com/2018/08/07/protecting-internal-applications- with-a-saml-aware-reverse-proxy-a-tutorial/) Now, we utilize Kubernetes for hosting most production internal apps, so we run the oauth2-proxy Helm chart ([https://github.com/helm/charts/tree/master/stable/oauth2-pro...](https://github.com/helm/charts/tree/master/stable/oauth2-proxy)) to handle verification of identity before sending traffic back to its destination service. Conceptually similar, as auth has to be completed before the request is sent to the back-end.

</comment></comment><comment><USER21> > One of my biggest pet peeves about VPNs is that they hijack all your network > traffic. They can be configured not to, but our customers and security > controls like NIST 800-53 SC-7(7) typically require that they do.

VPN is dead because some customers want you to route the internet interfaces of all machines through the VPN server.

How does this even make any sense?

<comment><USER22> Split tunneling is the answer here. Many folks configure their VPN solutions that way. That's exactly what I do at my present employer... traffic meant for VPN goes over VPN, and everything else gets routed through the client's internet connection.

<comment><AUTHOR> The control I listed, NIST 800-53 SC-7(7) [which is a part of the FedRAMP Moderate suite of controls], specifically requires you implement a technical control such that your users _cannot_ split tunnel.

<comment><USER22> Apologies... didn't read into the NIST requirement. Out of curiosity, what do you normally implement that meets that requirement? Forcing all traffic when there is no security benefit (what is the advantage of getting to [https://news.ycombinator.com](https://news.ycombinator.com) through the VPN?) seems ripe for a compensating control.

<comment><USER23> It could have to deal with monitoring what is coming and going from the VPN'ed machine. If malware can escape the VPN tunnel, it is less likely to be detected than if it is forced to go through a firewall that is already looking for suspicious traffic. Rather than let a user pick and choose what goes through the VPN and possibly letting the malware make the decision for them, don't let them choose at all. I've worked at places that force you to use the VPN if you aren't connected to the office network. Security of the VPN client aside, it's not a bad idea to force any remote machine to be totally protected from the raw internet.

<comment><USER24> If the malware (or the user) has root it can hairpin tunnel anything it wants out the default gateway by manipulating the routing tables. It may not even require root but I'd have to tinker with it which I'm too lazy to do.

Split tunnel vs not split tunnel means nothing if the client doesn't want it to mean something.

<comment> o-__-o The rule of thumb is if you must vpn then you have a controlled system where root is limited. Think bank or government systems

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Meh, this sounds like it's paid for by okta. It also doesn't cover the real use case scenario of vpns - non-technical folks need to access internal services. What's presented is a reasonable approach for ssh control. Oh, and I'm pretty sure Cloud Passage has a port-knocking based solution in the real world which also gives 2fa access for ssh.

<comment><AUTHOR> I have no way to prove to you that I am not some paid shill :) , but I have no relationship with Okta outside of being a customer through my employer, and I was not compensated or gifted anything for the creation of my post.

I blog about things that I encounter at work and find interesting. That happens to often be a cross-section of infrastructure and identity!

<comment><USER25> I can verify that he isn't an Okta shill but he also glosses over some of the problems and limitations that I've experienced with the ScaleFT product compared to our co-existing OpenVPN solution.

We have used multiple OpenVPN servers with password protected cerificates and TOTP. Even if someone were to obtain access to my credentials and certs, they wouldn't be able to access the production services without also obtaining access to the authenticator device. Once your machine is enrolled in ScaleFT and while you're authenticated with your identity provider, malware or just a malicious coworker could access the production services with a single command line.

There are upsides to ScaleFT as well, though. As long as you're all in on Okta or can federate with it, user management is a no brainer. And having the IdP integration is much more user (and malware) friendly and is likely more reliable for server to server use compared to OpenVPN. Limiting access to particular services is likely easier, too.

Downsides with this product include having all sorts of reoccuring configuration problems where a server just disappears from the list of available services, which requires ops involement to restore access. If you're using macOS and RDP (I just outed myself to Matt...) you have to use the sub- par FreeRDP client. And ultimately you're tunnelling TCP over TCP, which works ok in the office but which might not always work as well in mobile or higher latency network situations.

<comment><AUTHOR> Yes, the RDP story is very painful.

To the best of my ability, my goal was to make the post more about the network architecture (esp around the concept of SSH bastions) and less about the actual OASA product itself. I think there are a number of fungible solutions which would be just as effective (though I think the integration with Okta is a key product feature). What I find interesting and novel is more what we can do to only open ports to authenticated IP addresses, and to address connections between a single source and a single destination. To me, that's where the real power lies.

</comment></comment></comment></comment><comment><USER26> This is an apples to orange comparison. Most network admins are lazy and just provide full L3 access so they don't have deal with any access issues. Most users use VPNs as an access mechanism rather than to secure anything. Most vendors you mentioned in the article can also control access at application level like ssh.

</comment><comment><USER27> I work in this space who has a commercial offering. Ill just leave this CSA spec here for reference. Please also look up SPA - newer than port knocking, but based on same premise. [https://downloads.cloudsecurityalliance.org/initiatives/sdp/...](https://downloads.cloudsecurityalliance.org/initiatives/sdp/SDP_Specification_1.0.pdf)

<comment><USER16> This talks about air-gapped networks?

</comment></comment><comment><USER28> > Amazon Linux 2-based EC2 instances, meaning the attack surface is > extraordinarily small

WHAT?

</comment><comment><USER29> Mainly this is a poor idea because of the whole allowing-an-IP-thing. Do not rely on IPs or ports for security, ever. Ever. Evereverevereverever. They are not secure. They do not contribute to security. Do not make your security dependent on them. Ever. Ok? Thanks.

AWS already has a vastly superior solution for this, called AWS Systems Manager Session Manager (it's quite a mouthful). You create a session with AWS using a federated login service (SAML-based SSO) and then craft IAM policies to allow a single user to ssh into a single server, over the AWS API. Not only will this be more secure, you don't have to maintain a wacky custom solution.

Logging into servers is an anti-pattern, and wherever possible you should be running away from it. Get metrics out of the server and analyze them, run commands remotely using some kind of persistent system agent, stop storing state on your servers. I know this is not the point of the article, but I want to remind people of it so they can can avoid the ssh trap early.

</comment><comment><USER30> If you wanted to do this "enterprise port knocking" on OpenBSD, you could use pf to do this.

[https://www.openbsd.org/faq/pf/authpf.html](https://www.openbsd.org/faq/pf/authpf.html)

The FAQ entry is about building an authenticated gateway, but the same technique can be applied to open individual ports.

</comment><comment><USER31> I've recently started using socks proxies via ssh and I was surprised about how far you can go with such solution.

Unless you want permanent connection with routing and everything, ssh socks proxy work awesomely.

Point a firefox profile to use it and you can really act as if you were in a different subnet: it can proxy dns resolution too.

</comment><comment><USER32> AWS Systems Manager provides a neat solution to do this [0], permission would be managed via IAM.

[0] [https://github.com/elpy1/ssh-over-ssm](https://github.com/elpy1/ssh-over- ssm) <\-- not made by me, but a good example

</comment><comment><USER22> This doesn't make any sense. The people that make Okta ASA (formerly ScaleFT) -- Okta themselves -- must VPN into production. I wouldn't use ASA or the like without VPN if the people that make it won't even do that. Besides... it's an extra layer of security. Don't have the requisite certificate, username- password combo, and additional factor? Then you can't even get to port 22 to start with.

<comment><USER33> How do you know they don't use it for production?

</comment></comment><comment><USER34> Interesting read! A couple of days ago I setup a Cloudflare's access with argotunnels and a CA. A very cool beyondcorp service which looks similar to okta.

</comment><comment><USER35> TLDR: Use a complicated SSH proxy instead of a VPN.

This has some serious downsides for non-SSH applications. For example, to connect to a production database cluster, one would need to ssh through the proxy to a bastion host, and then set up port forwarding from the bastion host to the database. Setting up a simple database connection now requires shell access to a production server. This is less secure and more complex than using a traditional VPN.

<comment><AUTHOR> A great point. It does depend on your use case, and your dependence on manual operations. For our organization, almost all database interactions and maintenance are performed in code; if somebody is connecting manually, something pretty bad has happened. So for us, we are not really impacted by having to perform port forwarding like this on rare occasion. I completely agree that it could be much more impactful to other organizations.

I'm curious: why is utilizing port forwarding over these mutually authenticated SSH tunnels less secure than employing a VPN? From my perspective, port forwarding still adds a level of intentionality which reduces the likelihood of an incident/accident.

<comment><USER35> Good VPNs are mutually authenticated. Intentionality is good, but in your example it comes at a cost of complexity. Simplicity is paramount for security.

If intentionality is desired, one can use per-server VPNs.

</comment></comment></comment><comment><USER36> I'm surprised to see no mention of Mutual TLS (MTLS), PIV cards, or the like

<comment><USER37> I believe in this case he's talking about MTLS:

> OASA also protects these hops by issuing client certificates with 10-minute > expirations after first verifying your identity through our single sign-on > provider, and then also verifying you are on a pre-enrolled (and approved) > trusted company device.

<comment><AUTHOR> Basically. Since we are focusing on SSH in this post (and keep in mind that SSH is its own protocol, separate from TLS), it's conceptually the same: client has a certificate and a key, signed by a trusted certificate authority, and the client is also in possession of the server certificate authority. So then you have a bi-directional trust established. The certificates are short- lived, and issued after a successful authentication + dial request to the OASA service.

</comment></comment></comment><comment><USER38> Does anyone happen to know what this costs? They're predictably quiet about it.

</comment><comment><USER39> Agree on VPNs. They need to die.

Let elect ZeroTier to be the president of remote, secure access :)

<comment><USER40> Nebula is very nice too, licensed MIT and has DNS support, something ZeroTier still hasn't added outside of the ztdns server that someone wrote that I never did get to work properly...

hopefully ZeroTier makes some strides in 2.0.

<comment><USER41> Oh my god, thank you for mentioning this project. I just deployed ZeroTier for some local infra, but in doing investigation, I was desparately trying to find the Nebula project name and GitHub. I was looking for "beacon", "lighthouse", "bastion", "ZeroTier compete" and everything in between. I even knew it created at some prominent tech company (kept thinking Netflix, of course it was Slack). I was starting to think that I'd concocted a false memory and it didn't really exist.

So now I gotta go decide if I want to rip out all my existing ZT infra or not.

</comment></comment></comment><comment><USER7> Hmm, static IP suffixes are a thing of the past anyway with IPv6 ? "Tens of millions" ? More like quintillions, and that's for a single IP prefix more typical of a home connection !

<comment><AUTHOR> Sorry, the tens of millions of IP addresses is referencing the IP space of AWS (one of which these network access points occupies at any given point in time).

</comment></comment><comment><USER42> No, no, no. The whole point of a VPN or SSH jumpbox is to airgap critical infrastructure with unknown vulnerabilities behind a hardened point of access. Putting production infrastructure on the public internet is beyond idiotic and regressive, and an invitation to be hacked by an unlimited and unknown number of exploits. It took forever to get departmental firewalls at a big name university where I worked because systems put in before my time like nutrition/meal planner, housing lottery draw, facilities management system and retail POS systems were getting owned left-and-right by remote malware.

I'll keep using fwknop-protected OpenSSH on OpenBSD and WireGuard, others can do whatever they want without thinking about the security vs. convenience.

<comment><USER43> So, they have drawn their lines of defense in a position you are not used to, and therefore they are beyond idiotic and regressive?

Really?

<comment><USER42> Yeap. There is a night and day difference in attack surfaces between isolating access to a single (or HA pair) jumpbox and N boxes on the internet with no real DMZ or private admin network. Feelings and fashions don't make stupid configurations better. If you have a problem with honest opinions from someone with 25 years of experience, I think you need thicker skin or I can choose to simply not comment and let stupid fashions propagate.

<comment><USER44> Yep. Putting everything directly on the public Internet is 90's style. I remember it well. Whole offices with public IP addresses. No firewall. It's amazing anyone ever considered this sane, but it was a different time.

<comment><USER45> Better bust out the JNCO jeans and Offspring CDs because IPv6 is on it's way and you can bet some deployments will have everything accessible to everything.

<comment><USER44> Yes. That's what firewalls are for!

</comment></comment></comment></comment></comment></comment><comment><USER46> In 99.95% of cases, VPNs are set up to:

Bridge a network device – such as a laptop or even another server … into a larger network of servers – such as in the cloud or on-prem … across the Internet – protected with an additional layer of encryption</comment>


Open source is illegal? - <AUTHOR> http://opensource.com/government/11/8/open-source-illegal

<comment><USER2> It doesn't seem to obviously be limited to open source software? The article suggests the illegality comes from the lack of a signed contract, which you don't get with any software under a proprietary EULA either. I assume this just gets ignored though...

Most of the rest of the article seems to be about this Romanian tender business, but excluding free software from that wouldn't actually make that software illegal, so it's apparently not really relevant to the title.

<comment><USER3> See <http://opensource.com/comment/reply/3850/7515>

</comment></comment><comment><USER4> It's not called the "Slovak Republic", but rather just Slovakia. The proper name of the neighbouring Czech Republic is just that instead of something like "Czechia", but this is not true for Slovakia.

<comment><USER3> Slovakia is a shorted name for Slovak Republic. Both are acceptable.

<comment><USER4> Sure, but it's like writing "United Kingdom of Great Britain and Northern Ireland" instead of "United Kingdom".

</comment></comment></comment><comment><USER5> I'm a romanian and I knew nothing about it. It seems to be illegal only for governmental use because of the lack of accountability. If you think about it, it make sense. "WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE" doesn't sound promising or fit for governmental critical systems.

<comment><USER6>
        On page 64 of the 'Specifications', in a paragraph
        highlighted in yellow, the ministry writes:
        "All versions of software that are part of the offer
        may not be published under a 'free software license'
        - GPL or similar."

When you licence your solution to the government, you do so under a commercial licence. The 'Specifications' were asking you not to have any parts of your software under a free license (to/from third parties).

Of course this move is to limit competitiveness since EU explicitly favors open software: <http://www.osor.eu/eupl/introduction-to-the-eupl-project>

This limits the little guys that try to cut costs by using open software as building blocks for the solution, so only the giants vendoring expensive "enterprise" solutions can participate. And rest assured, open solutions are many times of better quality.

<comment><USER7> "Free software license" is a tricky term. Doesn't Windows still have BSD copyright notices embedded in it?

</comment></comment></comment><comment><USER8> Interesting, I visited Slovakia + Czech Republic a few years ago and when I was there noticed that the overwhelming majority of computers there (Internet Cafe / POS in shops/bars / Booking systems in hotels) appeared to be running some form of Linux.

</comment><comment><USER9> Isn't there a big difference between 'illegal' and 'not recognized/accepted'?? This doesn't prevent anyone anywhere from making and using open source software if they please.

<comment><USER10> You could be sued by the copyright holder if you redistribute it. So it's illegal.

<comment><USER9> I don't get what you're saying. If the copyright holder releases something under an open source license, then he is not going to sue you for doing precisely what the license is mean to facilitate.

It would only be "illegal" if if it's against the law to write a program and reveal its source code, and that would simply be non-sensical.

<comment><USER3> Any of the thousands of linux contributors has the every right to sue you if you are redistributing his code without his written permission (remember, GPL is invalid in law regards in SVK). I don't think it's very sane to trust the copyright holders' good mood to not sue you when you are infringing his copyrights - and yes, you are infringing it if you don't have his _signed_ agreement, that's the law and no matter you write and call a license you cannot out-rule that.

In addition, corporations are owning part of that copyright too - if you look at software patents war, it clearly shows what tools are to be used against the competition.

I'm not sure if I understand your last sentence.

</comment></comment></comment></comment><comment><USER11> The GPL binds your hands.

What if you put your code in the public domain? No clauses, no contract required, no problem?

"Open source with obligations" is a better nomenclature for the GPL. Avoid it where you can.

<comment><USER9> No it does not. The license only applies to other people. As the copyright holder the choice of license does not bind you in anyway; this is why it is possible to release something under multiple licenses (say GPL & BSD), provided that you fully own the copyright. The GPL does bind the behavior of others, but only to assure reciprocity. It assures that corporations cannot freeload off your efforts without contributing back.</comment></comment>


Who owns software vulnerabilities? The hacker or the company who owns the code? - <AUTHOR> Who owns software vulnerabilities?
The hacker who discovered the vulnerability, the company who owns the code/hardware, or if its open source then the maintainers?
Is this written in law anywhere? <comment><USER2> Intel (the chipmaker) uses the linux kernel to fix flaws found in the hardware. see if you can identify who would want the ownership around that.

[https://www.kernel.org/doc/html/latest/x86/microcode.html](https://www.kernel.org/doc/html/latest/x86/microcode.html)

Look at the specification. If something does not behave as expected, that entity is the owner. In case of Intel processor vulnerabilities and other ones, the hardware is the fault as per my understanding.

Since you are asking about software vulnerabilities and since a vulnerability is supposed to be fixed, the onus is on the provider to fix it, but the IP could be owned by the hacker. Its a vulnerability if its known the company. If not, its an exploit the hacker can use.

</comment><comment><USER3> My 2 cents. Vulnerability is a "side effect" of existing code. So if you consider the vulnerable code, it belongs to the owner of the rest of the program. If you write an article about it, you can cite the code and own the article. If you write an exploit, the exploit code is yours. And you can't patent the vulnerable code because it already is existing previous work.

Just like a poem can contain figures of speech like metaphors, you don't generically actually own "metaphors" but you can own an actual metaphor if it's written as part of your poem. Maybe the metaphor is too small and you cannot protect its rights, but if you are the legitimate creator, it's still your metaphor.

</comment><comment> md- a software vulnerability itself is information about a vulnerability. Information itself is not copyrighted, nobody can own it.

A researcher however can own code he/her wrote, e.g. exploit code</comment>


The Stack That Helped Opendoor Buy and Sell Over $1B in Homes - <AUTHOR> https://stackshare.io/opendoor/the-stack-that-helped-opendoor-buy-and-sell-over-$1b-in-homes <comment><USER2> Just as interesting to me as the tech stack is the business stack. There have to be some really tightly-managed pipelines of deals because Opendoor is fronting capital to buy up the houses. Interesting scaling challenges there on the capital side.

If Opendoor works out how to quickly vacate the newly-bought property, then automate much of the project coordination activity that is done to flip the property by automatically scheduling and bringing in contractors and inspectors, that could lead to some really interesting returns. Even if the sprucing up is not to flip for huge amounts, just the usual repairs and freshening changes, combined with an empty house to show, could easily lead to semi-automation of a buy-low sell-high, high-volume business of conveniently buying a lived-in house, and selling a nice-looking, nice-smelling, high-curb- appeal house for much higher than the original property owners could bring. Automate the scheduling of staging and unstaging, and goose the numbers even more. I can see all sorts of other follow-on monetization streams from this simple change in the process you guys introduced, thanks for the thought- provoking write up, I look forward to reading much more about your successes in the future.

<comment><USER3> But it basically is flipping isn't it? Maybe they can work out how to flip a little cheaper with technology but this model only works because flipping is so hot right now.

[http://www.housingwire.com/articles/39523-home-flipping- hits...](http://www.housingwire.com/articles/39523-home-flipping-hits-10-year- high-in-2016)

<comment><USER4> It looks similar, but we're actually very different than flippers.

House flipping is about finding underpriced houses (either by having a sharp eye, or by buying distressed houses), and then optimizing the amount of money invested vs. the return.

Opendoor is much more focused on the customer experience, trying to give fair offers to every home - everyday homes, not distressed ones. We typically don't spend very long renovating our homes. We'd rather reinvent the buying and selling experience itself, and do a larger number of transactions.

More info: [https://www.opendoor.com/blog/flipping-the-real-estate- indus...](https://www.opendoor.com/blog/flipping-the-real-estate-industry-on- its-head)

<comment><USER3> That's defining it a bit narrowly isn't it? You guys buy homes, do a (little) work on them and then sell them for more, all in a short time frame. Maybe your innovation is in doing lots of small flips but it still seems like flipping to me.

<comment><USER5> I'm going to speak for OpenDoor here so someone from them can probably jump in, but the company I started and shut down was around financing house flippers and I have a background in both capital raising and real estate.

There are many types of 'house flipping' and most of the differences are just various shades of grey.

For illustration purposes:

At one extreme: Focus on buying dramatically undervalued assets, putting in minimum work and reselling. (Do this using lots of people labor in looking for deals.) - IMO, this is the only way to make money consistently flipping

At the other extreme: Buy houses, put dollars in to them and acheive an ROI (lots of people labor in rehab). This is what you see on "house flippers" or other TV based flipping shows. Typically these systems work when the market is appreciating, but the value the 'flipper' puts in is really questionable vs the market appreciation. Most of the people that do this strategy eventually end up getting hammered in a downturn.

Opendoor is basically disrupting the first group. They are using a quantitative process (automated valuation models), then overlaying a fundamental process on top (having someone look at the data to make sure it makes sense.) That is how they make sure they are buying undervalued assets.

The disruption happens because they are eliminating the huge amount of man hours it takes to find undervalued deals, by paying slightly more, and building a good brand and well as fine tuning their marketing channel.

At the end of the day, a certain percentage of people need to sell their house very, very quickly and OpenDoor will be able to pay more than flippers in the first extreme so they will gain a ridiculous amount of market share.

Downside risk: The risk is that they need to scale their operation so large to get economies of scale that when a downturn happens, they are too top heavy and end up getting financial destroyed. Many people may also assume that they could systematically missprice houses (pay too much), but I doubt that is a real risk.

<comment><USER3> It seems to me that they actually disagree with you, see the comment further up this thread.

>Opendoor is much more focused on the customer experience, trying to give fair offers to every home - everyday homes, not distressed ones.

So do you think that this response is being a bit coy and they are in fact buying deeply discounted homes?

Also, I guess I don't understand where they actually make money. If someone is unable to sell a home for a long period of time and then sells it to OpenDoor, why are they able to then turn around and sell it for more? In this very thread they attest that they're not flippers because they're not adding much real value to the home.

<comment><USER5> It is a nuance.

Opendoor: Targets sellers that want to sell quickly without any hassle.

Flippers: Targets sellers that want to sell quickly without any hassle. Some of them are distressed. Some of them are just in a hurry.

There really is no real distinction. How they make money is clearly laid out on their website. They buy for low, sell for higher than the bought. I believe they also cut out realtors.

<comment><USER6> There's inherently wrong with wanting to sell quickly. If grandma died, leaving me her house 3,000 miles away from where I live, the last thing I'd want to be saddled with is trying to sell it. I know nothing about selling (or owning) a house, the real estate market in that area, etc. A fair enough price ASAP is what I'd be looking for.

<comment><USER7> Why not make one call to a local agent and have it sold for 5% more money?

I'm all for paying $2 for convenience if coffee on the run. Not sure I would pay $20k to save a few hours work around selling a house.

<comment><USER8> Agents are not free! Around where I live, you can expect to pay 3% to each of the two agents involved. Selling the house for 5% more doesn't help you if you have to give 6% of the sales price to the agents. I wonder how much of what Opendoor is trying to achieve involves removing or reducing the agent involvement.

<comment><USER7> I never said they were free.

If getting an agent on your own cost 5%-6%, and opendoor is charging 12%... you are losing 6-7% by using opendoor. That is a LOT of money.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> the business model is fascinating. the capital requirements make opendoor seem crazy on the surface, but it is not at all insane if you dig deeper.

the short term model is predicated on managing inventory like a retailer and diversifying holdings like a trader. mastering both functions, let alone one, is very challenging, but far from impossible. if opendoor can acquire data and predict transactions better than competitors, the mountain top becomes eminently more climbable. from a portfolio perspective, the early stages are actually the least risky because opendoor can cherrypick the best real estate markets, and within those markets, cherrypick the best homes, where "best" means the properties most likely to sell quickly and profitably.

the long term vision has not been articulated, but it seems like opendoor could grow into a platform for homes much like amazon is a platform for consumer goods. opendoor would provide the buyers, product guarantees (e.g., home inspections passed), the open house experience, and predictive analytics (e.g., home X has a 80% chance of turning over in 30 days if priced at $1M) while others manage financing and inventory risk. if this conjecture is right, look for opendoor to (a) lower prices and (b) streamline real estate transactions with automation where possible and where not possible, to empower untrained (i.e., cheap) individuals with computer vision and smart software to perform tasks like certified professionals. if neither happens, consider the conjecture wrong. :)

<comment><USER4> Thanks for the comment -- and it's very accurate in terms of where we'd like to go.

On a tangential note: empowering untrained individuals is important, but we often do the opposite too. Many of our internal tools are designed to make trained professionals/experts as efficient as possible.

For more speculation on Opendoor's business and where we might take it, I think Stratechery has a good writeup. [https://stratechery.com/2016/opendoor- a-startup-worth-emulat...](https://stratechery.com/2016/opendoor-a-startup- worth-emulating/)

<comment><USER9> yup, i also wrote a deeper analysis after someone posted about opendoor in december.

what will be super interesting to watch is how the market size (i.e., annual real estate transactions) changes in response to reduced friction. historically, disruptive technology like uber widens the market substantially because it unlocks all this demand artificially suppressed by friction. because of opendoor and similar startups, will transaction volume increase by 10%? 50%? 200%?

opendoor is the classic VC investment: huge upside with controllable, sane risks.

<comment><USER10> It would be great to move as a home owner and be able to avoid the 5-6% realtor cost on both ends (10-12% total). This could enable millions of people choose better living arrangements. Unfortunately for people in California, Prop 13 will still create huge costs to moving.

</comment></comment></comment></comment><comment><USER11> It would be more interesting to know why this stack helped the business.

Otherwise it's just a list that doesn't have much connection to the $1B part in the title.

<comment><USER4> I'd say the main direct effects were (1) we were able to iterate very fast on our internal tools, which are used by internal operators to manage each transaction; and (2) our data science setup has allowed us to price homes incredibly accurately. Many companies have estimates of a home's value, but Opendoor puts its money where its mouth is ;)

Happy to answer any more questions about it.

<comment><USER12> I am actually building a business on real estate appraisal in Argentina (reva.com.ar), building many of the tools you mention to get the most accurate representation of values of homes. Im quite surprised you got it so well that can build a business around buying thehomes yourselves.

Would you be willing to share an email so i can ask you a couple of questions if appropiate?

<comment><USER4> Sure! My email is firstname.lastname@example.com.

</comment></comment></comment></comment><comment><USER13> I'm a software engineer at Opendoor- happy to answer any questions!

<comment><USER14> Can you please write an email to your Marketing Department and pass along a note?

Here's the text:

"While effective in your goal of creating Brand Recognition of 'Open Door' please be informed that the blitz campaign with the radio ad featuring the sound of a doorbell ringing, followed by the company name, 'Open Door,' was one of the most unabashedly Pavlovian ear-worm manipulation techniques I can recall. It almost makes 'Head On - apply directly to the forehead' look like high art. DING DONG - OPEN DOOR! DING DONG - OPEN DOOR!

Because of this tactic, I will never, ever reflect upon the brand of Open Door with anything but disgust. Yeah, you got market share, good for you. How you did it, however, makes me want to puke."

It might sound extreme, but I have a sensitive brain. That goddamn commercial was everywhere. And terrible.

<comment><USER15> I am sorry about that ad. We cut it after two weeks, and modified it after the first week to be less intrusive.

I'll take fault for letting that through review; I got your email the first time it went live. I learned a lot from it, as did the team.

<comment><USER14> Yeah it was really bad and hurt the brand. Subsequent ones are a lot more appealing and, not kidding, very high quality and effective.

Glad you've decided to take a more mature tack in advertising, but as we all may well know, you only get one chance at a first impression. As such, I don't intend to brow-beat you or your team, just let you know that certain choices have consequences. That commercial was essentially a landmine and if shrapnel happened to take off a limb or two of yours in the process, I hope it's a good learning experience.

<comment><USER15> Always appreciate the feedback.

Like most companies, we used an agency and gave them a brief containing benefits we want to convey, which they turn into a script and produce. We learned that getting closer to the ads is quite important. We don't work with that agency anymore.

</comment></comment></comment></comment></comment><comment><USER16> What an amazing business model. Not something I would have considered as I would consider the capital requirements too high to purchase almost any house. They will walk a fine line between being too picky and excluding an average consumer or having too high a price and losing money. But regardless it is very cool and potentially disruptive, much more than Redfin. A silicon valley version of "We buy your homes for cash"

EDIT: As commentors on BiggerPockets are saying, it is just like Carmax.

</comment><comment><USER17> As a senior computer science student, who constantly tries to learn and keep up to date on his own time, I felt a little overwhelmed after reading this article. I know that they are just tools that can be learned, but my question is about junior devs. How do you go about hiring (if it is the case that you do hire junior devs) and training them?

<comment><USER4> Ah, they're just tools that can be learned. I had to run around the company quite a bit to make sure I got all the information right.

We don't require experience in any of these tools to get a job at Opendoor. Most programming experience can be transferred between different technologies. We do a lot of pair programming to bring people on board, plus feedback in code reviews.

<comment><USER17> Thanks for the answer! If there is any resource that you remember had an important impact in your learning path as a scalable application programmer I'd very much appreciate to hear about it. Cheers.

<comment><USER18> I'm just a little over a year out of school myself, so I'm far from an expert, but happy to share some things that come to mind.

I haven't had a chance to look through it in-depth yet, but this looks pretty interesting: [https://github.com/donnemartin/system-design- primer](https://github.com/donnemartin/system-design-primer)

As far as things that have had an important impact in my learning path, I do have a few Ruby books I really like (the key here is to get your hands dirty with code as you read along): \- [https://www.amazon.com/Ruby-Under- Microscope-Illustrated-Int...](https://www.amazon.com/Ruby-Under-Microscope- Illustrated-Internals/dp/1593275277) \- [https://www.amazon.com/Metaprogramming-Ruby-Program-Like- Fac...](https://www.amazon.com/Metaprogramming-Ruby-Program-Like- Facets/dp/1941222129) \- [https://gumroad.com/l/rebuilding_rails](https://gumroad.com/l/rebuilding_rails)

I think reading about (and looking at the code) for things you use and trying to understand how they work under the hood has been super useful: [http://aosabook.org/en/index.html](http://aosabook.org/en/index.html)

Having smart people around to learn from is extremely helpful too.

Happy to chat more if you'd like. Just drop me a line: connor[at]opendoor[dot]com

</comment></comment></comment></comment><comment><USER19> So, OpenDoor == CarMax for homes?

<comment><USER20> Data scientist at Opendoor here. That is a very accurate analogy.

</comment></comment><comment><USER21> I wonder, if the stack would be radically different if a) interest rates increase to 'old normal', and/or b) price trend reverses in the opposite direction.

Global housing prices: [http://www.economist.com/blogs/graphicdetail/2017/03/daily-c...](http://www.economist.com/blogs/graphicdetail/2017/03/daily- chart-6)

</comment><comment><USER22> this looks quite clever, opening doors via a code? nice. that would certainly get my attention. One thing, are you guys doing any modelling using graphs? or is all your data normalized and stored in relational DBs?

<comment><USER18> I can't speak for the data science stack, but everything in the web stack is Postgresql (with the exception of Redis for background jobs and things of that nature).

</comment></comment><comment><USER23> For anyone who was wondering, they use smart locks from Schlage.

But i'm curious for two things:

-why they use those except for the different models Schlage has.

-where is Schlage api's documentation :p

<comment><USER24> Hey! Zain from Opendoor here. We actually just switched to using Kwikset 914 locks instead of the Schlage ones. API docs are basically nonexistent for both, but the Kwikset is a lot easier to reverse-engineer than the Schlage! Feel free to email me if you have specific questions about either lock. zain@opendoor

<comment><USER23> Wow, that's seriously open of you guys! Thanks

</comment></comment></comment><comment><USER25> Forgive my ignorance: does "buy and sell $1B in homes" mean your total GMV to date is $1B?

</comment><comment><USER26> Buying and selling over $1B in home is not impressive when done by a computer. If someone did it single handedly maybe. I hate when people quote numbers to impress and confuse others. At $100,000 that's 10,000 homes. Selling 10,000 items is not impressive. So why should I care what stack you used?

<comment><USER27> Have you done it?

<comment><USER26> Sell 10,000 items? Yes, on a daily basis.

<comment> crooked-v Buying a home is much, much more complicated than buying "an item", even if you leave out the complications of a mortgage.</comment></comment></comment></comment>


Europe's Economic Suicide - <AUTHOR> http://www.nytimes.com/2012/04/16/opinion/krugman-europes-economic-suicide.html?_r=2 <comment><USER2> Yes! A Paul Krugman column. I think its worthwhile for anyone to try to understand his economic assertions on the crisis.

The most important part is understanding what is aggregate demand and what things like interest rates tell us.

Actually might change your worldview. For example that sometimes individually rational behavior (deleveraging instead of investing in a crisis) can be disastrous for the economy as a whole.

</comment><comment><USER3> Yes please Mr Krugman ([http://en.wikipedia.org/wiki/Paul_Krugman#Economics_and_poli...](http://en.wikipedia.org/wiki/Paul_Krugman#Economics_and_policy_recommendations)), enlighten us idiotic European people about the ins and outs of proper economic management.

The American economy is doing so well too...

The nerve on this dude, amazing.</comment>


Fun with Lisp: Programming the NES (2012) - <AUTHOR> http://ahefner.livejournal.com/20528.html

<comment><USER2> If one likes the article, as do I, there are couple of cool lisp projects related to the 6502 chip.

Brit Butler has written a 6502 emulator[0] and is now writting a NES emulator in lisp[1]

Henry baker wrote a compiler for a simple lisp named 'comfy' for the 6502 chip which intended to replace it's assembly in emacs lisp[2] which has been ported to common lisp[3]

[0]: [https://github.com/redline6561/famiclom](https://github.com/redline6561/famiclom)

[1]: [https://github.com/redline6561/cl-6502](https://github.com/redline6561/cl-6502)

[2]: [http://home.pipeline.com/~hbaker1/sigplannotices/sigcol03.pd...](http://home.pipeline.com/~hbaker1/sigplannotices/sigcol03.pdf)

[3]: [https://github.com/jaoswald/cl- comfy-6502](https://github.com/jaoswald/cl-comfy-6502)

</comment><comment><USER3> The thing that is fascinating——and only possible in Lisp——is that by extending the DSL that he started as the assembly language he could, eventually, actually program his 6502 in... Lisp.

A typical assembler reads the program in assembly language syntax and translates the lines into binary instructions. And you could write a Lisp compiler that reads in Lisp and produces maybe C which is then compiled into assembly language which is finally fed to the assembler. But he started by writing the assembler in Lisp and instead of parsing and translating assembly language he wrote his assembly program by calling Lisp functions such as (inc) (txa) (lsr) which just emitted the appropriate instruction codes.

However, at this point there was no barrier left between his host-side Lisp and target-side machine code. He could write constructs in Lisp that, by running the Lisp program, expand to the corresponding machine code. And given some well-chosen Lisp constructs he could elevate the code into a much higher level but still output 6502 machine code. He could write Lisp macros to produce Lisp code that produces 6502 code.

And because everything was still tightly integrated in a single running Lisp program, he could keep doing the low-level stuff as well because he was still in control of what machine code instructions would be written out.

This IMHO is a much better way to write assembly language than the usual syntax that assemblers parse. But it's not possible unless code is data is code.

<comment><USER4> This is not only possible in Lisp, this is also possible in Prolog. In Prolog, Data is code. LISP can be viewed as a specialization of Prolog, where the data structure just lists. Prolog has more complex data structure compounds, where a list is nothing more but one type of said compound structure. One can write Prolog code to emit 6502 code or any code as well, and I suspect with as much ease as he did.

Here is a sample of code generation in Prolog for register machines, [https://github.com/segmond/PrologThingz/blob/master/clause_a...](https://github.com/segmond/PrologThingz/blob/master/clause_and_effect/compilation/cg_flatten.pl)

An example for accumulator based machines which the 6502 [https://github.com/segmond/PrologThingz/blob/master/clause_a...](https://github.com/segmond/PrologThingz/blob/master/clause_and_effect/compilation/cg_single_accumulator.pl)

The examples I posted is from an awesome Prolog book I read called "Clause and Effect"

</comment></comment><comment><USER5> High-level assemblers can greatly reduce the tedium of programming for older systems. Just a small amount of structure -- loops, conditionals, symbolic definitions -- improves assembly immensely.

Here's one dev's experiences making a GTA-like game for the NES, using his own high level assembler: [https://www.youtube.com/watch?v=Hvx4xXhZMrU](https://www.youtube.com/watch?v=Hvx4xXhZMrU)

Here's one for CHIP8: [http://johnearnest.github.io/Octo/](http://johnearnest.github.io/Octo/)

</comment><comment><USER6> Wow... programming in Lisp is already not that mainstream... and on top of it, for the NES?

Impressive.

I so want to start learning to program in NES now. Not really in Lisp as I would like to learning curve to be gentler, but this article definitely sparked my interest into learning one of the devices I used most during my childhood.

Great work!

<comment><USER7> Hefner is not really programming the machine in Lisp. The developer appears to have created a 6502 assembler as a "domain specific language" in Lisp, and then is programming the machine in that notation. This could have tremendous advantages over using some clunky conventional assembler; it can likely be made smarter, with less work. You could probably use his tool without knowing Lisp, if it were suitably packaged or documented. (But not without knowing 6502 machine language, in all likelihood!)

Knowing Lisp would help you easily understand and extend the assembler, so you could do things like create yourself some badly needed program organization abstractions and then use them. Otherwise you could just ask the author, or people in a mailing list. "Hey I would like a feature whereby if I write (foo bar) in the code, such and such an effect takes place in the generation of the 6502 image."

<comment><USER6> That's what I thought as well. I guess I was not that off course. But I would still need to refresh the very basic Lisp I used in college.

In any case, learning 6502 asm seems like a must like you say. I'm gonna have to try to learn a bit.

</comment></comment></comment><comment><USER8> Nice! I've been using python to augment my 6502 assembly. I haven't programmed the NES, but I've read that acommon way to wait for a particular raster line on it without using fancy mapper hardware is to use sprite-to-background collision interrupts. Collisions aren't triggered until they happen "on screen" with respect to the monitor beam position (same on C64 or Atari 2600), so you can effectively use it to get a line- or even a pixel interrupt.

</comment><comment><USER9> Beautiful.

I've actually been walking around for a few days just now pondering if one could do the corresponding thing for contemporary graphics processors. Seems like communicating with them in Lisp could be a great thing. (That idea was inspired by another HN post [https://news.ycombinator.com/item?id=7408807](https://news.ycombinator.com/item?id=7408807)) Do you know of any attempts at that?

<comment><USER10> Check out

[https://www.youtube.com/watch?v=I0kWZP9L9Kc](https://www.youtube.com/watch?v=I0kWZP9L9Kc)

[https://github.com/cbaggers/varjo](https://github.com/cbaggers/varjo)

</comment></comment><comment><USER11> For those interested in NES programming in a similar style (DSL that is basically an ASM assembler), there's a Python version of this concept (titled PyNES)

I find it to be very readable:

[https://github.com/gutomaia/pyNES/blob/0.1.x/pynes/examples/...](https://github.com/gutomaia/pyNES/blob/0.1.x/pynes/examples/mario.py) example file, I like it

</comment><comment><USER12> My favorite thing about this post is how they're generating music with Lisp :)

</comment><comment><USER13> That sure looks like fun!</comment>


Dear Python, Why Are You So Ugly? (2012) - <AUTHOR> http://grokcode.com/746/dear-python-why-are-you-so-ugly/ <comment><USER2> I think it has to do with the crowd each language tends to attract.

One of the big draws for Python is NumPy and SciPy, so Python tends to attract more of the scientific/statistical community. They're more concerned about data and analysis than aesthetics.

Rails unarguably attracted a vast number of web designers (many trend- oriented, but the point stands) to Ruby by offering a low-impact way to learn some server-side dev. As a result, many of the people who write Ruby (especially on the web) are more design-oriented -- so they trend towards better aesthetics.

This is not a question of capability, nor of libraries, but of community. The almost-tragic part of this article is that it overlooks the fact that the design differences in the pages it links are implemented neither in python nor in ruby, but in HTML and CSS.

<comment><USER3> > Rails unarguably attracted a vast number of web designers

Why?

> low-impact way to learn some server-side dev

Ruby is _not_ low-impact. There's this myth that Ruby is lightweight, easy to read, and simple to get into. I seriously question if any of the people who perpetuate this myth have ever actually attempted to program Ruby.

Ruby source code is incredibly ugly and difficult to read. There is so much "magic" going on that it is difficult to begin to even understand what the code is supposed to do [1].

Ruby's syntax is incredibly aggravating. I've found it damn near impossible to understand even trivial programs without consulting the manual every three or four tokens. Worse, the language is _ambiguous_ : is that colon a symbol, or a dictionary mapping, or a ternary operator?

And this is leaving out that Ruby == Rails to a huge extent, so much of the documentation and examples that are out there are burdened by the further complexity of a large web application framework.

I've found Ruby so obtuse and unnatural that every time I've tried to learn it, I've quickly become so aggravated at the language's awful syntax and strange abstractions that I simply give up. If Ruby's warts are bad enough to make someone with my programming-heavy background desert it before making much headway, why did "Rails unarguably attract...a vast number of web designers"?

[1] [https://news.ycombinator.com/item?id=5872899](https://news.ycombinator.com/item?id=5872899)

<comment><USER4> Wow. I just read that link. That's.... amazing. I've always thought ruby looked inscrutable, but I figured it was just that I hadn't taken the time to bone up on the syntax.... but no, it really is amazingly bad. Thank you for preventing future me from wasting time trying to learn it.

</comment></comment></comment><comment><USER5> On the left, I see content. On the right, I see crap that hides content. I'll take the left.

<comment><USER6> huh O.o?

<comment><USER5> Which part was unclear?

Websites, especially those concerning technical subjects, should convey meaningful information. The "Ruby" designs are, for the most part, substantially worse at doing so. Characteristics I note include excessive whitespace, limited contrast, and oversized headings/banners.

Could the Python sites be better? Sure, but they're already doing better than Ruby at their primary task: Conveying information.

<comment><USER6> Agree, my previous comment was a misunderstanding of your view point , since i didn't understand what was this "right" "left" and "crap" that you were talking about.

</comment></comment></comment></comment><comment><USER7> This is an old article. While I definitely agree in general (some are stretched, like Google Apps vs Heroku), Python has been making a more concerted effort:

[http://www.python.org/](http://www.python.org/)

That being said, I find Python stuff to be, while ugly, good at getting information across. And now, I find Node sites to be the best.

</comment><comment><USER8> Because Ruby is for designer kiddies that need a way to serve their PSD templates.

<comment><USER6> is that suppose to be funny or at least coherent?

</comment></comment><comment><USER9> > the uglyness makes sites hard to navigate and hard to use

No, ease-of-use and beauty are different things, though often conflated in rants.

I've never used any of those sites so I cannot speak to that aspect, but as far as beauty is concerned in a lot of the examples the ruby site looks more trendy, possibly because they are newer, because python has been around for a bit longer?

Site-wide redesigns are rare for content-focused technical sites, especially volunteer-based open-source projects.

</comment><comment><USER10> Python.org just got redesigned today!

</comment><comment><USER11> I realize this is old, but I can't help but feel that comparing the personal homepages of the creators of two web frameworks and suggesting that the difference in design should have a say in which language it's best to pick borders on trolling…

</comment><comment><USER12> There's something seriously wrong with this article -- it describes Python as ugly, but uses as its evidence the appearance of Python websites, not the language itself.

To a programmer who understands Python, how the Websites look isn't as central as it seems for the article's author.

To a mathematician who uses Python directly, or by way of Sage ([http://www.sagemath.org/](http://www.sagemath.org/)), the open-source Python-powered mathematical environment, the appearance of Python websites will mean even less.

It's all in one's exposure to the language. I think most Python users will rank the language ahead of the websites that describe the language.

</comment><comment><USER13> Well, programmers are humans too and humans (mostly) like beautiful stuff, so there's a valid point in ruby being better at attracting and get people involved than Python does.

Having worked with both, this beauty thing also applies to library APIs. I found ruby libraries to have a lot more syntax sugar and better 'plug-and- playability' than Python tools. Ruby is just more fun.

</comment><comment><USER14> Who cares, really?

Look at Slackware's website: [http://www.slackware.com/](http://www.slackware.com/) it looks the same as ten years ago. Why? Because it works.

It's a website, not a piece of art, I want to get information not hang it in the wall.

</comment><comment><USER6> This old post appeared in HN the same day that python.org got redesigned. Is some kind of revenge?

<comment><USER15> Or a way to say "hey, look how far Python has come!"

<comment><USER6> Well that way is kinda a revenge, is a more subtle way of saying "hey, look at python know, in your face!".

</comment></comment></comment><comment><USER16> Have you seen PHP?

<comment><USER17> PHP actually just got a redesign recently for their documentation. It's not too bad, but the comments part is still crazy unorganized as far as code snippets, etc.

</comment></comment><comment><USER18> Ruby is language geared for building websites. Python is language for scripting.

Why in the world Ruby resource websites would be better compared to ones Python has...

I would venture a guess, that people making websites tend to be better at making websites.

<comment><USER19> You're confusing Ruby and Rails. Ruby is also a general purpose scripting language. The OP was careful to only compare Rails with Django, Ruby with Python.</comment></comment>


You're Not fired: The story of Amstrad's amazing CPC 464 - <AUTHOR> http://www.theregister.co.uk/2014/02/12/archaeologic_amstrad_cpc_464/

<comment><USER2> I had one of these as a teenager and loved it. Learned Pascal with it, and did a lot of assembly language programming with it (Z80 apparently - I'd forgotten if it was that or 6502). It finally gave up the ghost a few years ago. Makes me quite nostalgic.

<comment><AUTHOR> Same here. I remember seeing the advert linked in the article. So many great hours programming and playing games.</comment></comment>


Launch HN: Temper (YC W18) – Get more sleep by blocking games at night - <AUTHOR> Hi HN! We're Rohan and David, founders of Temper (https://www.temperapp.com).
Temper is a desktop app we built to help gamers get more sleep by blocking games at night. You can set a schedule (eg. no games after 11pm) or set a daily time limit (eg. no more than 2 hours of gaming per day) and once you hit those limits, Temper will block you from playing more games until the next day.  We know nobody wants to get blocked in the middle of a game and get an abandon, so unlike most blockers, Temper is game-aware and uses traditional computer vision (specifically, blob detection to identify elements) to ensure the block only activates once a game ends.
We started Temper because we're gamers ourselves (over 5k hours of Dota 2 between us!) and believe games are positive experiences that can help you de-stress and keep in touch with friends. But we also realized that we regularly stayed up late at night playing just "one more game" instead of getting a healthy amount of sleep. After surveying other gamers and looking at the research, we discovered this was a really common phenomenon, with international studies reporting that 9% of gamers overuse video games. So we decided to build Temper to help people (and ourselves) maintain a healthier relationship with gaming.
If you're a gamer who struggles with the same issue, please check us out and tell us what you think! It's Windows only for now and we support League of Legends, Dota 2, Heroes of the Storm, Overwatch, PUBG and Hearthstone. We're adding new games every week so if you have any requests let us know. <comment><USER2> I wrote a program which would take an initial seed password and run a number of sha1 iterations to get a digest back. I used it to lock myself out of websites such that I couldn't get back in without dedicating N hours of serial cpu time. In hindsight, I had invented my own proof of work system.

Never had that sort of addiction with video games, but I can understand it from that experience. I'd only fear that I'd quickly learn how to hack this tool and disable it whenever I wanted.

<comment><AUTHOR> Haha that's a really clever scheme

</comment></comment><comment><USER3> i'm at a loss here as to why people bother installing these kinds of apps (the focus time apps overall i mean) to prevent them from doing something? if i have this on, can't i just simply kill the process through the task manager and be done with it? genuine question here...

bearing that in mind, i'm curious to understand what was the rationale from YC to have them into the W18 batch from a business/revenue standpoint?

<comment><USER4> Oftentimes, having just _one_ step in the way of something is enough to break the habit. Like, move the cookies off the counter and into the cupboard above the fridge even works.

This is just another application of that.

<comment><USER5> But then why not just make the shortcut to the game inconvenient to access (hide it in a folder in a folder in a folder) or just plain uninstall the game (adds the extra step of reinstalling to play).

<comment><USER6> 1) Windows Search puts all my applications just a few keystrokes away, regardless of shortcuts.

2) It's not about abstaining from the game, its about playing a healthy amount. Reinstalling the game daily isn't going to teach you not to play all night, it's going teach you to not uninstall the game every night after your session.

<comment><USER3> and killing a process in the task manager is easy enough for anyone who games enough to see this as a problem...

I can edit my hosts file to point facebook.com to 127.0.0.1 in general, but it's even more trivial to get rid of it when i do want to check facebook (not that i crave it that much anyway)....

</comment></comment></comment></comment></comment><comment><USER7> How in the world is this a potential business? Has YC gone down the drain?

Dear lord. This is a clock for christ's sake.

<comment><USER8> An app that only sent the word "yo" was once valued at $10 million and hyped as a revolutionary new paradigm in communication.

I can't even be surprised anymore at the things people will throw money at.

</comment></comment><comment><USER9> Do you really need computer vision to detect when someone is in a game? There are certain static elements on the screen in every game that you could probably just take a current screenshot and match against known images?

<comment><AUTHOR> We tried matching against known elements (template matching), but unfortunately that didn't hold up well given the large number of resolutions games support.

One problem is that the elements themselves don't necessarily scale proportionally. For example, if you have a button with some text in it and you reduce the resolution, often the game will keep the text larger but reduce the padding around the text. This makes template matching tough.

We found blob detection works pretty reliably and uses minimally CPU, but we're not CV experts so if anyone has other ideas we'd love to hear them!

<comment><USER10> It would be nice to see a metric for performance impact of this blob detection so that gamers with less beefy computers don't have to compromise their gameplay settings to accommodate for this app

<comment><AUTHOR> We don't have official benchmarks, but you shouldn't see much of an impact at all since we only do it once a second and on a small portion of the screen. If you do notice a difference please let me know.

</comment></comment></comment></comment><comment><USER11> Any insight on how this will scale into a sustainable business? I'm an indie app developer and find that most of my ideas for new products die in ideation phase because they seem financially unsustainable. Maybe I'm thinking about it wrong?

Temper sounds like a feature in a larger app, not a business. Whats the next step?

<comment><AUTHOR> We could expand to mobile which includes a large number of gamers. We also think there's more to be done around the area of healthy gaming in general (eg. avoiding toxic games).

Another thing is we've had some people ask us for tools around Facebook/Netflix/YouTube, but we're focused on gaming for now.

<comment><USER11> I'm starting to see the vision a bit. A holistic solution to creating a healthy balance of things like Facebook and video games could become a sustainable business. Headspace might be a good company to learn some ideas from. They seem to be doing really well selling "peace of mind".

Good luck!

</comment></comment></comment><comment><USER12> Do you need computer vision to tell a have is running? Do you need an app to prevent you paying games? Did you start a for-profit tech company just to "help" people?

<comment><USER13> The computer vision is not to detect if the game application is running, it's to detect if the game application is running and the user is in the middle of a "match". In other words, if the application can be shut down without negatively impacting the player's stats or team members.

I don't think that whether or not someone "needs" an app for self-control is the question. It's whether or not outsourcing that self-control is useful. I've seen many comments from people who get benefit from blocking HN, reddit, and FB for specified periods of time.

</comment></comment><comment><USER14> I was stoked for a sec. I'm a gamer who overuses video games, for sure, and especially late at night.

But it'd need to cope with my (evolving) Steam library. So far in 2018 I've spent meaningful late-night play time on half a dozen different games. Mostly single-player. Another year might see another pattern.

I look forward to hearing about your progress. Good luck!

</comment><comment><USER15> I'm interested in what your thoughts, if any, have been to support MMO's. I think it'd be easy enough for folks entering and exiting instanced content to detect, but for folks doing something like crafting or gathering, which are generally repetitive tasks that don't change the field of gameplay much to demarcate a "done" step.

<comment><AUTHOR> This is a good question and something we've been thinking about. We don't have a good answer for non-episodic games, but it might be something along the lines of slowly graying out the screen after you pass your cut-off.

</comment></comment><comment><USER16> I'm a target user and installed Leechblock extension for that purpose to block op.gg

Really smooth download and config. Kudos. I like you don't make me register right away.

I was surprised UAC came up twice though.

Tangent: Recently I found that "3 games" a night really changed my approach to league and gave me more quality and less stress to start another game etc. etc.

<comment><AUTHOR> Thanks! David put a lot of effort into making the config really intuitive so he'll be pleased to hear that. The UAC is once for the installer and once for the app since it requires admin privileges to apply the block.

<comment><USER16> I don't know spefically about your internals, but you could try to install with user rights only (= no UAC) and then only do UAC when you need the block?

<comment><AUTHOR> If I remember right the reason the installer needs admin rights it to be able to kill and overwrite a previous installation of Temper

</comment></comment></comment></comment><comment><USER17> How are you going to block a CIV 6 game? ;)

<comment><AUTHOR> We have some ideas for dealing with single player games like putting an overlay over the screen or slowly grayscaling it, but we've decided to focus on multiplayer games for now. I also kind of like this Tolstoy idea...

</comment></comment><comment><USER18> Any advice on how to get started with computer vision / blob detection? Is there any good open source software to play around with?

<comment><AUTHOR> We're using AForge.NET but OpenCV is great too. This was a pretty useful tutorial: [http://www.aforgenet.com/articles/shape_checker/](http://www.aforgenet.com/articles/shape_checker/)

<comment><USER18> Thanks for sharing!

</comment></comment></comment><comment><USER19> You could just detect key presses. For most games 30 seconds without wasd or 1234 means you're in a menu.

<comment><AUTHOR> We do use that for idle detection (so we don't count it for your total played time). But for the end-game detection we need to be more accurate because we don't want to accidentally trigger in the middle of a game (maybe you're waiting for a respawn and stepped away from your comp while dead) and we want to immediately trigger when the game ends so you can't queue for the next one.

</comment></comment><comment><USER20> Do you do the computer vision part on the end users machine or your server ?

<comment><AUTHOR> End-user's machine. The images aren't saved and never leave your machine

</comment></comment><comment><USER21> couldn't you just look at windows processes and keep track of how long its running based on when a user starts the timer. Really wouldn't an annoying timer do the job just as well ?

</comment><comment><USER22> Please add FortNite

<comment><AUTHOR> That's next on our list!

</comment></comment><comment><USER10> Neat idea! Is there a mac version in the works?

<comment><AUTHOR> Not at the moment - we're focused on Windows and increasing the number of games for now. But we'll definitely keep it in mind

</comment></comment><comment><USER23> How hard is it uninstall and reinstall?

<comment><AUTHOR> It's straightforward using standard Windows add/remove. However if you uninstall while blocked, you stay blocked until you reinstall, so you should only uninstall while not blocked if you want to get rid of the app. If you do happen to uninstall while blocked and want to remove the block contact me and I can tell you how to do that.

</comment></comment><comment><USER24> >9% of gamers overuse video games

This seems low.</comment>


Static cross and native musl-based toolchains - <AUTHOR> http://musl.cc/ <comment> ainar-g Since we're talking musl, the author of the library has recently asked[1] the community to support him more actively on Patreon[2].

[1] [https://twitter.com/RichFelker/status/1101157783620255744](https://twitter.com/RichFelker/status/1101157783620255744)

[2] [https://www.patreon.com/musl/overview](https://www.patreon.com/musl/overview)

</comment><comment><USER2> This is great. Another handy musl-based toolchain that supports some of these targets is ellcc [1]. It's llvm+clang based. It's a little behind so I suppose it doesn't support RISCV yet. It will probably never support SH targets because those aren't in llvm and there aren't any public plans to add one AFAIK.

[1] [http://ellcc.org/](http://ellcc.org/)

</comment><comment><USER3> I'm using musl to cross-compile static Windows binaries from Mac for my app [0]. Here's the instructions I use for it: [https://blog.filippo.io/easy- windows-and-linux-cross-compile...](https://blog.filippo.io/easy-windows-and- linux-cross-compilers-for-macos/)

I've been using this in real world production builds and I've had no issues so far, I compile SQLite with it as it's my main C dependency. No slowdowns, nothing weird happening, it just works like a champ. Very impressive.

[0] (Obvious disclosure, I'm the developer) [https://getaether.net](https://getaether.net)

<comment><USER4> This is great! Thank you for the work and information on how to use it.

Have you been able to get musl-libc to compile on and for Mac OSX/iOS, along with a supported musl-gcc-wrapper? The thought of a completely statically linked, self contained binary/library for Mac/iOS is salivating

<comment><USER3> No unfortunately, I've not needed that, since my native development environment is Mac and I need cross compile the other way round. I don't see why it should not work theoretically, but my interpretation is that Apple's licenses for Cocoa / iOS do not allow that.

</comment></comment></comment><comment><USER4> If I understand this correctly, since MUSL's USP is static linking of musl- libc thereby removing any dependency on breaking changes in glibc, we now have the ability to build with the exact same compiler and generate stand-alone binaries without a libc dependency on Windows, Mac, Linux, across multiple processors (x86, x64, ARM, ARM-64, ...).

This is fantastic news!</comment>


Aaron Swartz, Precocious Programmer and Internet Activist, Dies at 26 - <AUTHOR> http://www.nytimes.com/2013/01/13/technology/aaron-swartz-internet-activist-dies-at-26.html

<comment><USER2>
      Carmen M. Ortiz, a United States attorney, pressed on,
      saying that "stealing is stealing, whether you use a
      computer command or a crowbar, and whether you take
      documents, data or dollars."

...or whether you steal using your prosecutorial power to take the life of a fellow human. Ortiz should be ashamed. She stole from all of us and humanity by driving a brilliant young man who has contributed more to society than she ever will to take his own life. Think about all that he would have contributed over his lifetime. He had decades left and that is all gone. She is the biggest thief in this story.

<comment><USER3> Aaron wasn't murdered, he chose to kill himself. No need to be sensational. Who do you blame more? Aaron for getting himself in the position or Ortiz who was doing her job?

<comment><USER4> > _No need to be sensational. Who do you blame more? Aaron for getting himself > in the position or Ortiz who was doing her job?_

That is naive.

Do US attorneys zealously prosecute every incident of "stealing" that appears on their radar?

Also, "doing your job" is an abdication of responsibility and not a justification in and of itself.</comment></comment></comment>


Apple now rejecting iPhone Apps for "limited utility." - <AUTHOR> http://www.macrumors.com/iphone/2008/09/04/apple-rejecting-applications-based-on-limited-utility/

<comment><AUTHOR> I think its a huge mistake. They could have taken care of the problem of tiny, silly apps with another method, like creating a separate category or revamping their review system. Instead they opened up a can of worms by creating a new category of unwanted "limited utility" apps, yet they still haven't published formal guidelines on what is or is not "limited utility." Now they've got a giant developer relations mess.

</comment><comment><USER2> No doubt this is in response to the "I am Rich" app, which technically could not be rejected on fraudulent grounds since the description stated it did absolutely nothing.

Yes, I know Apple pulled it anyway, but they potentially set themselves up for a lawsuit by some other scumbag down the road if they don't find a way to cover themselves for pulling down apps that are technically legal, but are solely designed to "fool the gullible".

<comment><USER3> I'd be shocked if the terms and conditions for using the App Store didn't already contain something like: "We reserve the right to pull your app for any reason including (but not limited to) Steve waking up in a bad mood."

I'm sure Apple's decision was inspired by "I am Rich" -- but for publicity reasons, not legal ones.

</comment></comment><comment><USER4> What I don't like about the policy is how it changes the risk equation for developers. How do you see if Apple will "get" your app without spending the full $$ on developing it?

Will developers go into any real risk in developing for the iPhone, or will they just abort the attempt?

<comment><USER5> Submit a prototype under a different application name. Then, pull the prototype after it has been approved and after a few people have tried it. You can also experiment with pricing this way.

<comment><USER6> To extend your idea, you could murder existing users when you want to change your price points.

</comment></comment></comment><comment><USER7> I guess this makes the App Store of limited capability as well.

<http://en.wikipedia.org/wiki/Walled_garden_>(media)

 _"A walled garden, with regards to media content, refers to a closed set or exclusive set of information services provided for users (a method of creating a monopoly or securing an information system)."_

This is Apple's system, not yours. No surprise here.

 _(Notice how the parenthesized "media" within the url is not included within the link?)_

<comment><USER8> You need to link to it as <http://en.wikipedia.org/wiki/Walled_garden_%28media%29> ; those are the hex ascii codes for the parens.

</comment></comment><comment><USER9> Android, here I come. Apple's alienated curious developers, but is bringing in the money-grubbers like there's no tomorrow. Not my crowd.

<comment><USER4> That's hardly fair. Give Google a chance to alienate developers as well! :-)

</comment></comment><comment><USER10> "We have determined that this application is of limited utility to the broad iPhone and iPod touch user community, and will not be published to the App Store."

That's like Amazon saying "we won't sell your book, because it isn't of interest to the broad Amazon.com customer community."

They need to do _something_ with the App Store so that it _feeds_ off the "long tail" instead of fighting against it. (UI improvements? try-before-you- buy? some other browsing/search/tryout enhancements?)

<comment><USER11> Apple never promised to publish every application. Books are not a platform Amazon owns.

<comment><AUTHOR> No, but they kinda put out the welcome sign, proudly touted their "60 Million Apps Downloaded!" statistic, and now they're saying, "thanks, you've done your job now go away."

</comment></comment></comment><comment><USER12> Why is anyone surprised by this? It was remarkably clear from the beginning that Apple wants full control over what gets sold in the App Store.

I'm surprised that they've even allowed as many apps as they have.

</comment><comment><USER13> Welcome to the App Store. A free market-place! Where only the anointed few will compete.

<comment><USER14> Few?

<comment><USER15> Yes. Though he should have said, "very few". Have you looked at the Internet lately? Now _that_ is a big selection of software developers.

</comment></comment></comment><comment><USER16> I wonder if this message from Apple is actually real. I did a quick Google search for other instances "limited utility" rejections and didn't find any. There's been plenty of instances of fake controversial legal threats/rejection letters/complaints that have been used to drive traffic or create a buzz about something. If this is fake, I don't see how this person will really cash in on the buzz though.

</comment><comment><USER17> I know its a contrary opinion to what most commenters will have, but I'm glad this app didn't get approved. Apple is apparently responding to the very frequent complaints of useless apps filling up the App Store. What we are seeing is a pendulum, where they swing back and forth with the policies for app acceptance until they settle somewhere in the middle that works best for everyone.

Like many other people, I kept my 1st gen iPhone jailbroken from the day I bought it. I absolutely loved Installer.app and the huge community of developers and their applications that I had access to. A lot of the apps in Installer.app were pretty worthless though, or had little utility. They frequently cluttered up the categories of things that I really wanted to review.

However, it was much harder for developers to create jailbroken apps than it is now with the official SDK. This caused the overall number of available apps to be much smaller than what we have available through the official channel. If Apple were to not attempt to manage all of the apps that people are submitting, it would quickly become nearly impossible to find anything useful. That would also open up the possibility of nefarious apps that are trying to get your personal info, etc.

However, so that I don't sound like a complete Apple flunky, I also admit the App Store on iTunes and on the iPhone itself has a lot to be desired. There are interface issues which annoy me (like navigating into an app description, going back to the category but being at the freaking top of the list instead of where the app appears in the list). They need to improve the App Store application itself. It would be really great if someone could write a _new_ App Store as a 3rd party app that would interface and manage all of the apps you have access to. This most certainly could be done on the old jailbroken systems using something like Summerboard.

<comment><AUTHOR> But a lot of the problems you mention, like "cluttering" and "impossible to find anything" are really problems with the App Store, not the apps. iTunes, after all, has millions of songs, and there doesn't seem to be a clutter problem there. Apple doesn't tell musicians, "don't make crappy music," or "you song is of limited musical appeal."

The nefarious apps argument is not really valid, because the number of apps on the Apps Store has, or will very soon, exceed the number of things humans can keep track of anyways, so even if crap apps are eliminated, there will still be too many apps to keep track of.

This is really a problem of taste, and Apple has messed up here. Some people like silly apps, just like some people like really bad music. The solution is not to insert yourself into the middle and become an arbiter of taste, the solution is to make it easier for the crowd to sort the good from the bad and let each app appeal to its niche while not eliminating innovation or silliness.

<comment><USER18> "Apple doesn't tell musicians, "don't make crappy music," or "you song is of limited musical appeal."

You're right - Apple relies on music publishers to do that for them. The analogy between music store and appstore is not exact.

<comment><USER19> Except, Apple doesn't restrict itself to only music from formal publishers. I've got a couple of albums on the iTunes store, and I don't have a contract with anyone...

<comment><AUTHOR> Not to mention music publishers don't do a great job in this role of theirs you say they have, since there's still lots of crappy music out there. However, I doubt music publishers actually care, since having a crappy song in iTunes can still make you more money than NOT having a crappy song in iTunes. And who knows, someone might like it.

The last time I checked, "Silence" by Guster was still on iTunes. If that isn't the functional equivalent of a "limited utility" app then I don't know what is. But its there, I'm even sure a Guster fan has bought it. The fact is, Apple can do a lot of things about limited utility apps without shutting them down completely.

</comment></comment></comment></comment></comment><comment><USER20> Well that's no big surprise. Nullriver's NetShare already was rejected for limitless utility.

</comment><comment><USER21> This is what you get when you have a closed, totalitarian system. I've said it before and I'll say it again - Steve Jobs makes Bill Gates look like Richard Stallman.

</comment><comment><USER22> This does not bode well for my $.99 whoopee cushion app which is almost done (serious) ... crud

</comment><comment><USER23> Are the 'inline' comments on the YT video new to YT - or some Omnisio integration?

</comment><comment><USER24> Guys: we need a better test-case than "Pull My Finger."</comment>


For your manager: The importance of a Cheif Web Officer (CWO) - <AUTHOR> http://dev.chocolatpistache.com/blog/2010/11/12/the-importance-of-a-cheif-web-officer-cwo/

<comment><USER2> hopefully it will be a good speller</comment>