Code Review Checklist - <AUTHOR> http://blog.fogcreek.com/increase-defect-detection-with-our-code-review-checklist-example <comment><USER3> I recently read Atul Gawande's "The checklist manifesto" which covers applying aviation style check-lists to surgery. The outcome was a 30% reduction in post-surgical complications.

From reading this, I see how bad most software process check-lists are. They tend to be laundry lists mixing obvious minutia and vague uncheckable goals. They are not practical executable tools but well meaning documents that are ignored at the error prone moments when a check-list has the most potential impact.

A check-list for a good check-list:

1\. Plan for a specific trigger giving a single pause point of up to 30-90s at which point the check-list is opened and executed

2\. Decide whether it is a DO-CONFIRM or READ-DO list

3\. Design to engage the brain rather than switch it off

4\. 5-9 items at most

5\. Don't include any action that is rarely forgotten i.e. the criteria for inclusion is the probability and cost of error. This is very different from listing the most important steps or attempting to fully document a process.

6\. Regularly test and measure the check-list for effectiveness

I would say Fog-creek's article is in the "read once" training material category and not a practical check-list. For a real check-list, I would interview the team and examine recent commits and look for the 5 most serious _real_ issues you are experiencing that you need to eliminate from future code. That is a now a review check-list you can mandate, measure and iterate.

<comment><USER4> Practically speaking, I think the parts of code review that could actually be covered properly by a checklist could also just be done by software. The parts that are "fuzzy" shouldn't really be in a checklist at all.

<comment><USER5> Perhaps having automated tasks be a single check box "Has this task been performed?".

For example, instead of having a check for whether braces are in the correct spot, have a check for whether 'astyle' or a similar code formatter has been run.

<comment><USER6> That can work, but ideally, a CI server would actually run all of those, leaving only a handful of things that require human judgment in the checklist.

</comment></comment></comment></comment><comment><USER7> From my experience doing reviews and having my code reviewed the most important thing is to understand:

      - What the intention of change is (what is this trying to achieve)
      - What is the code actually doing

There are three levels of review I typically observe:

      1. Skim, find one or two comments to leave. LGTM!
      2. Review each line or method in isolation. Recognize style and
         formatting errors. Identify a couple local bugs.
      3. Understand the purpose and the code.

#3 takes time. It's what it takes however to find the issues where the implementation doesn't actually accomplish what was set out to do (at least in all cases). To recognize where the code is going to break when integrated with other modules. To suggest big simplifications.

#3 is also where you get one of the biggest review benefits - <USER2> understanding of the code base.

In my experience developing software, it's easy to have a sense of ownership and care most about the code one personally writes. That is often reinforced by the development process - you are responsible for delivering an issue. However, we're much less likely to feel responsible for the code we are reviewing. We don't answer for that deadline. As a result, it's often seen as a favor to review someone's code (even when the policy is for all code to be reviewed). It's also often not time allotted or planned for. So the tendency is to rush them.

Do other people observe the same thing? Have people used a process which gives more incentive to invest time in code reviewing well?

<comment><USER8> My experience is similar.

On some times, I have become very frustrated that I always contribute a #3 but all I ever receive is a #1 of my code.

<comment><USER9> Ditto! I see code review as an opportunity to learn from other members of the team and also to make sure I don't have to fix something tricksy in the middle of the night.

I think that others are more (rationally) motivated by the desire to iterate quickly and deliver a large volume of features and fixes in a short window of time.

</comment></comment></comment><comment><USER10> It seems a bit of a lazy article to me. So apologies but my reply is only brief and I am not going to spend a lot of time on it...

But... on one hand it talks about programmers making 15-20 common mistakes. Fine create a checklist for these issues. And then at number 1 it asks "does the code work?".

Of course it's common that the code doesn't work, but it may not be a binary decision - requirements ambiguity, corner cases, dependent on data, etc.

I have also have issues about the Documentation section - none of that will necessarily help "Stop more bugs"...

I don't see the purpose of the article is clear and I don't think it's particularly consistent between the title, checklist and explanatory paragraphs.

<comment><USER11> Yeah, unless you're Knuth, the answer to #1 is almost certainly "no".

</comment></comment><comment><USER12> Here are some other code review checklists, for comparison:

[https://wiki.apache.org/hadoop/CodeReviewChecklist](https://wiki.apache.org/hadoop/CodeReviewChecklist)

[https://gist.github.com/bwest87/10049924](https://gist.github.com/bwest87/10049924)

[http://www.mindfiresolutions.com/Code-Review- Checklist-238.p...](http://www.mindfiresolutions.com/Code-Review- Checklist-238.php)

<comment><USER13> Cool, thanks for sharing!

I am very procedure oriented and have always liked checklists and templates. I have just created a github repo to share checklists and templates here:

[https://github.com/godber/software_dev_templates_and_checkli...](https://github.com/godber/software_dev_templates_and_checklists)

Feel free to contribute if you think its a good idea.

I've started it out with the Fog Creek checklist ... if Fog Creek guys don't like my having included it, I'll happily take it down.

</comment></comment><comment><USER14> 10 lines of code = 10 issues.

500 lines of code = "looks fine."

Code reviews.

[https://twitter.com/iamdevloper/status/397664295875805184](https://twitter.com/iamdevloper/status/397664295875805184)

</comment><comment><USER15> While I have no problem with the concept, I think this list is rather sloppily produced.

On some of the items a "yes" is good, and on some a "no" is good. A little more thought could have made the list much easier to use.

</comment><comment><USER16> I was just thinking about code reviews and how shitty Fogcreek's Kiln is as a code review tool. It has (or at least had) a weird "workflow" were you can't approve or finish a review. Also, it is very hard to see the full list of all the current reviews, because even 'approved' reviews would still stay in the list. And of course, browsing code in kiln is very slow compared to github.

All in all, it's subpar compared to github pull requests or Reviewboard.

</comment><comment><USER17> Code reviewing is such a hilarious concept in programming. Everyone thinks it's the most important thing, yet I've only seen rubber stamps and uninterested reviewers.

I'd be so much happier if we could get rid of the entire notion and do up front design and pair programming.

Also, oh my god that checklist. Anyone that has a business dedicated to delivery is going to have to throw that thing out the window.

<comment><USER18> I don't know if newer things have contradicted the advice of the Mythical Man Month, but I seem to recall it claims testing finds ~50% of bugs whereas review finds ~80%, with a key caveat being that the two methods tend to find different bugs so the overlap of using both is useful.

I think it also depends on the type of code and the consequences of failure. I have seen good success reviewing data migration and modification code for medical records because that stuff was considered important data and there was a culture there such that if something went wrong, they would ask, "why wasn't this caught in review?", so the process was taken seriously.

I agree with the pair programming sentiment though - I think it could be looked at as a form of code review with a fresher context since you see mistakes as they are made rather than puzzling out the thought process of the other coder when it's cold.

<comment><USER19> I've never been a big fan of code review for finding bugs. Sure, you can find bugs, but the question is, how efficiently?

Long ago I learned a couple simple rules that get my defect rate very close to zero: asserts everywhere, and step through every line of code. Seriously. Write two lines of code, fire up the debugger, and step through them, inspecting each variable. Any tiny 'unit' that you write should go through the debugger, where unit might be that 5 line function you are writing, or a bug fix, or whatever. It just catches a vast amount of the bugs if you are writing in a modular, perhaps functional style. Tons of side effects, well, it's less good at that. asserts do 'okay' at finding those things, but of course the time to find those bugs is longer.

This buys you a few things. First, you are 'reviewing' your code while you write, which is when it is freshest in your mind. It is hard to mentally model the behavior of the computer, hence code reviews are mentally difficult. The debugger ALWAYS shows you what the computer will do (bar things like nasty thread interactions). The debugger does not lie. You get to see nasty things like Nan or underflow that might just pass silently depending on your error handling, which is again hard to find in a code review. And, of course, the sooner you find bugs the cheaper it is to fix - so the best time is about 10 seconds after you typed that line of code. After that the costs grow either proportionally or exponentially.

I know very few people with that uses this discipline, but it changed my life when I took it up. Any time I slip and fail to do it, I rue it.

Pair programming get you similar benefits. I find it harder to think/talk/respond to another person when I am deep in thought (different brain pathways, or so it feels), so I'm more a solo programmer by nature. However, I would still step through the code when pair programming; I guarantee that your mental model of your code is likely to be flawed. The second person will reduce, but not eliminate that threat.

I understand not all code bases/IDEs/whatever allow this (long startups, 5+ minute compiles, etc), but it it is available, avail yourself of it. If you program in a dynamic language and find yourself using a REPL all the time to test your code you are doing a form of this, but it is still better to test the actual code in place.

</comment></comment></comment><comment><USER20> Am I weird if I say "thank you" for the checklist? I think it's a good starting point and has some helpful reminders.

As always, there are some really great and insightful comments and suggestions here, but I'm a bit surprised about the overwhelming negativity around code reviews and this post.

FogCreek's post is just a starting point, and they said so right in the post. It wasn't intended to be taken as the end-all-be-all of code review checklists, but that seems to be getting ignored, sometimes in favor of unconstructive criticism.

It's a decent starting point, and the main takeaway is that there are lots of angles to think about when reviewing commits, every single time, not just whether the code works. It's easy to forget all the angles because code reviews are hard to always do well, so having a checklist, even with redundant items or minutiae really isn't the awful idea it's being made out to be.

The included video, which based on comments I'd be forced to guess almost nobody watched, also clarifies their process and intent, and addresses some of the comments here, for example pair programming. Joel mentions pair programming being the most extreme form of code reviews. In my own experience, he's spot on when he says pair programming is really useful in certain situations, and very hard to use frequently.

One angle that hasn't been discussed that that a long checklist is actually a good thing when it comes to justifying time spent code reviewing to managers (as well as fellow coders). In my own experience, I've witnessed the attitude that code review time is unproductive, and the thinking that code reviews shouldn't take long. Having a specific process that demands a minimum amount of attention is a good thing on its own, completely outside of the benefits to the code and code quality.

Edit: spelling

<comment><USER9> True, this isn't designed to be an end all solution. Based on the number of comments and range of opinions/supplemental links, I'd say you are spot on about this being a great starting point.

Personally, I found the very idea of a checklist itself to be a helpful idea that I'd like to use at work. The specifics are going to depend a lot on the language, project, and team.

RE: long checklists -- I think that most of us commenting on this thread are very passionate about code reviews, whereas our teammates are less so. I think a short code review checklist is more likely to engage coworkers in code review period.

</comment></comment><comment><USER21> An automated checklist seems far superior for most of the items he covers.

We have had good success using pronto to automatically run Rubocop, Rails Best Practices, and Brakeman running on CircleCI against every code commit on Github. Then, we still have another team member review a branch before approving a merge, but we know that all tests pass, coverage has not dropped, and there are no obvious errors.

</comment><comment><USER22> This is funny coming from Fog Creek who's founder seemed to suggest such checklists are bad... or I guess I'm reading between the lines. What I remember taking away from Joel's blog was something like "the more steps you add the less likely they'll get done and people will work around the process you'd prescribed". But maybe I mis-understood

<comment><USER23> The most famous thing Joel has written was a checklist. [http://www.joelonsoftware.com/articles/fog0000000043.html](http://www.joelonsoftware.com/articles/fog0000000043.html)

</comment></comment><comment><USER24> The checklist oscilates between high level (does it work?) and very specific - even stuff auto format could take care of (braces).

Creating such an checklist is great exercise though - writing my own made me think heavily on what is important. Then I realized writing it down is not enough - how do I know it is not bunch of made up rules? So I have also tried to provide rationale for each topic. At the same I have tried to keep the list actionable.

You can judge if I di well here: [http://www.michalkostic.com/post/104272540521/code-review- ch...](http://www.michalkostic.com/post/104272540521/code-review-checklist)

</comment><comment><USER25> When I first started doing code review, there was a similar post on HN. I thought it was a good idea and tried to use a checklist, but a lot of the time you skip over items because they don't apply. And as you do more code review you get better at identifying possible issues, reducing the need for a checklist.

Nowadays you also have software (e.g. Hound) that does some basic checks for you.

</comment><comment><USER26> I'v just released a first private beta for a tool to manage reusable checklists like code-review checklists. For you HN readers, if you are interested you can try it out at [https://app.firesub.com](https://app.firesub.com)

<comment><USER27> Trying it out now. So far, I am enjoying how clean the interface is.

It really feels like a glorified TODO list (or TODO list manager), but I do think that there is potential here. I would recommend adding features that separate it from the usual TODO list, e.g.:

\- Add features of flowcharts

\-- conditionals (if this then go there)

\-- subtasks

\- Allow for finer control over the contents of the headers and items

\-- Currently, it looks like you can add descriptions which display directly beneath the item or header (and is very clean looking!), but it would be nice if I were able to add html content (consider allowing markdown?)

\- I may be using it incorrectly, but I started creating a list and accidentally started the list but kept adding items anyway. Consider adding the ability to add the new tasks from an already-started list to the parent list from which it was created.

\- Other things? What are your currently-planned unimplemented features for this application?

I could see myself (and my team) using this application if the bullets above were addressed.

<comment><USER26> Wow, thanks for the feedback!

Here is my comments on your suggestions,

\-- Flowcharts I think I need a bit more data on how users use the app and in what direction I should take the app and features before implementing this, but it's very possible I will in the future.

\-- Conditionals Yes, I'm thinking of adding something like this, but on a higher priority I will add Triggers, so a checklist can be started automatically based on for example, a time interval or a callback over HTTP. I will also add Outcomes, so you can set up a action that should happen when a checklist is completed, like trigger another checklist.

\-- Finder control over headers and items I will work on this, with the goal of making as simple as possible to get started with the first checklist, but over time be able to use more advanced features for creating items.

\-- Extended item details Markdown is in the backlog. Alos item audit trail, like, Frej changed the description from ... to ... (5 min ago), and so on, so you have a complete track record of changes.

\-- Merge items from "started-checklists" to parent checklist. This is something I'm going to implement pretty soon, so that, when a person perform a checklist and discovers a the need of a new item, or an obsolete existing item, they should not need to make the change first on the active checklist and the same changes on the parent checklist.

\-- On the roadmap for the near future Triggers (se abow), Outcomes, Audit trails for checklists & items, "News feed" and Notifications center is things I have on the roadmap.

Thanks again for your thoughts!

/Frej

</comment></comment></comment><comment><USER28> It strikes me that most of these points can be automated (well depending on the language perhaps). I prefer automating and blocking checkin's based on criteria like these. Leave code reviews for design discussion.

</comment><comment><USER29> The first one doesn't belong on this list:

 _> Does the code work? Does it perform its intended function, the logic is correct etc._

I believe this concern lies with testing (automated or manual). I don't believe a code reviewer should even have to know about the requirements of the feature/bug, and should focus more on the design/quality vs. whether it works.

Mostly because it's almost impossible to know this by just reviewing the code, without having to run it -- and I certainly don't think a code reviewer should have to execute the code.

<comment><USER30> Maybe I'm weird, but I think whether it works should be #1 concern over design/quality. I agree design/quality is a close #2 though.

Also, perhaps you need more practice reading code. So you are not so reliant on a "TEST PASS" output from a tool to know if a particular section of code is likely working.

<comment><USER29> I certainly agree that whether it meets the requirements is important (debatable whether it's more important than design/quality).

I'm just saying it's not the concern of a code review.

<comment><USER31> Am I the only person who works in a place with very half arsed requirements? I have to take a guess a lot of the time as to what management actually want form what they say. Code quality matters 6 moths later when they say it isn't working (as expected) and I have to check what the code actually is doing.

</comment></comment></comment></comment><comment><USER32> > Are all functions commented?

No.

<comment><USER33> I saw that and didn't bother reading the rest.

</comment></comment><comment><USER34> The two stock photos have no place in this article and give it the impression of a content-farm piece. I am really surprised to find such tackiness on Fog Creek's blog. I guess that's what happens when you trust your employees and impose no editorial process.</comment>


Gold rush garbage mined to unearth history of Chinese miners in B.C. - <AUTHOR> https://www.cbc.ca/news/canada/british-columbia/gold-rush-garbage-mined-to-unearth-history-of-chinese-miners-in-b-c-1.5595906 <comment><USER2> Interesting to see this article here, and I'm surprised this is news. Archeology in Barkerville has been going on for a long time. I remember seeing a dig when I visited as a child, they were pulling out opium pipes and bottles.

</comment><comment><USER3> When I saw the title I read it as BC aka BCE aka some really ancient mining artifacts. Still cool, but let down.</comment>


So You Want to Be a Penetration Tester? - <AUTHOR> https://jhalon.github.io/becoming-a-pentester/ <comment><USER2> I think the article overlooks the value of strong fundamentals. If you deeply understand a specific technology it's so much easier than if you have scraped the surface by learning the most common exploits. I find that books, courses and resources about security _specifically_ are often superficial and foregoes deep understanding and instead focus on shallow techniques, tips and tricks. Sure, the tricks are useful, but so much more if they rest on strong foundations.

For someone that just want to get a foot in the industry and be useful in some real world scenarios (where knowledge of the most common problems will probably be enough to find real problems) I think this article is a useful resource. But in the long term you will be better and more valuable to skip security resources most of the time and instead go deep in a wide set of areas.

<comment><USER3> Exactly - the whole proposition is to outsmart software engineers at their own game; you should plan to know at least as much as they do.

</comment></comment><comment><USER4> Rather than working as a pen tester, I'd rather work on developing pen testing, auditing, intrusion detection software. A lot of security has been and is going to be automated.

And pen testing isn't a "sexy" job. Not amongst security and software developers anyway. I see on the same level as QA.

<comment><USER5> Having worked alongside pentesters, I can assure you that there is plenty of pentesting that is far more complex than QA.

There are already many automated pentesting tools, and those are a good first pass, and yes, they could improve much further and take more of the bottom end of the pentesting market.

However, logic vulnerabilities, hardware vulns, research against browsers and operating systems, malware analysis, and even advanced network and web security testing, are all far from being automated.

</comment></comment><comment><USER6> This is a really good writeup for anybody interested in getting in the field. But, also a really good reminder for people who don't do security on a daily basis all of the components that go into keeping things secure.

</comment><comment><USER7> Good writeup! Finding bugs is just a portion of a pen tester's responsibilities.

\- You need to have strong technical writing skills. Reporting for each vulnerability should include:

       * Title
       * Two sentence summary explaining the impact of the finding.
       * Explanation of the vulnerability.
       * Where the bug is (code if available).
       * Proof of concept for exploitation. Clients may want a retest, ensure that the person reading the report can find the vulnerability quickly if need be! A quick explanation of how to navigate the app to the vulnerable page is useful.
       * Remediation.

The reporting should also contain an executive summary, summary of overall security posture, and any strategic recommendations.

\- Report patterns that can lead to exploitation, but are currently not exploitable, as informational findings. Are they copying and pasting security sensitive code throughout application? Recommend a useful abstraction in the remediation! You don't want to play wack-a-mole and try to find all locations to update these scenarios.

\- Does the client have sufficient logging and monitoring capabilities to detect an attack? The client may be interested in knowing if the security team can detect an intrusion is or has occurred.

\- Recommend automation when possible! A Continuous Integration System should automatically be scanning for out of date dependencies.

\- Time management skills are vital. Is a finding really convoluted to exploit, and would take a while to develop a Proof of Concept? Save the proof of concept for the end of the project. Ensure you try and get as much coverage as possible during your available given time.

\- Project management skills are important. Test credentials early, and request whatever else you may need as soon as possible (buffer up questions to avoid email spam). Double check to ensure information hasn't been given to you already. You don't want to wait until the last couple days to request additional access if possible.

</comment><comment><USER8> >Now, being a Pentester doesn't mean you only focus on one thing - such as Network Pentesting or Web Apps

I disagree. There are people who's entire jobs are just to break web apps (most banks probably have a couple on the payroll) or just to get into and around a network (though the latter is slowly becoming less common as network architecture is changing).

</comment><comment><USER9> > It goes without saying that being a Professional Penetration Tester is one > of the "sexier" jobs in InfoSec

I thought this was mostly the perception from people outside infosec. The vibe I tend to get from people within infosec is that pentesting is a low status specialization.

<comment><USER10> > pentesting is a low status specialization

Depends so much. But yes, the good old "compliance checkers" who run a couple of scripts and call them self pen tester are very low on the lader. These are the majority nowadays.

People who can actually penetrate stuff "by hand" are considered sexy alright.

<comment><USER11> People who can actually penetrate stuff "by hand" do exist, and I'm one of them, but how many of us work for pentesting companies? I don't think the money is there, mostly, because clients are wary of buying snake oil and because clients don't actually need real live vulnerability exploits. The pentesting clients just need to close holes, or at least satisfy an insurance company that they did so. Pentesting clients want to certify compliance.

I put a "by hand" job posting in the "Who Is Hiring?" thread. Here: [https://news.ycombinator.com/item?id=19543995](https://news.ycombinator.com/item?id=19543995) It isn't anything I'd call pentesting. We study software, not specific installations of software.

</comment></comment></comment><comment><USER12> Got any insights to offer into the NCC hiring process or what type of work/freedom you have in security research and pentesting?

<comment><USER13> Two or three security challenges, similar to CTF's, a couple of phone interviews, and a day long onsite.

Pretty free to grow and work on what you like. Amazing work life balance, IMO.

</comment></comment><comment><USER14> What an amazing writeup.

From personal experience, Root-Me is easily one of the best way to get into infosec for someone with no prior knowledge of infosec or even information technologies in general.

</comment><comment> Iwan-Zotow Good office porno</comment>


A jQuery Plugin for Comprehensive Animations - <AUTHOR> https://github.com/KuraFire/runloop

<comment><USER2> This looks really cool. Can't wait to mess around with it and see how well it really works.</comment>


Python Projects in Users' Home Directories with wsgi - <AUTHOR> http://codespatter.com/2009/07/08/python-projects-in-users-home-directories-with-wsgi/ <comment><USER2> Can't this be done with an .htaccess file?

<comment><AUTHOR> I tried doing it that way first, but the wsgi directives aren't allowed in an .htaccess file. It would have been much better to have a user place a few lines in their .htaccess file for python projects, but I didn't find a way of doing that.</comment></comment>


Show HN: S3Scanner – Find and dump open S3 buckets - <AUTHOR> https://github.com/sa7mon/S3Scanner <comment><AUTHOR> This is the first project I've created that I've actually put a lot of time into. If you find bugs or have ideas for improvements, please open an issue or a PR!

<comment><USER2> Does it handle the case where objects and pseudo-folders have the same names?

e.g. I can have "testobj" as an object, and also "testobj/child" as an object.

When downloaded to a regular filesystem, that breaks and you lose one object or the other object depending on which was downloaded first, because a regular filesystem can't do that.

<comment><AUTHOR> Hmm, I'm not sure because I'm not sure what pseudo-folders are in this case.

Under the hood, the --dump function calls 'aws s3 sync s3://bucket ./bucket' so however aws-cli handles that.

Admittedly, the --dump function is the area that probably needs the most attention.

<comment><USER2> I mean, the case is what I described. If you have an object named 'testobj' and another object named 'testobj/child', and you try to download both to a traditional filesystem, one of the objects will fail, because you can't have a file and a directory with the same name in a traditional filesystem (S3 is an object store with different properties).

If you're just calling s3 sync, it will fail in this use case, because s3 sync does not account for this.

You'd have to get a listing first, parse it, and then figure out interactively with the user what to do with the conflicting object names.</comment></comment></comment></comment>


Show HN: TMail21 – Collaboration and Lean Processes for Teams - <AUTHOR> https://tmail21.com <comment><AUTHOR> So, what are Lean Processes? Lean Processes are the antithesis of rigid BPM tools.

Here are the key concepts behind lean processes:

1) They are oriented towards knowledge workers (rather than I.T. employees or straight task workers).

2) They allow knowledge workers to start with simple discussions then progress towards goal-oriented discussions and finally lean processes. So, rather than starting with a fully formed abstract process, the idea is to start with examples, observe patterns and then rapidly iterate.

A related idea is to allow users to rapidly achieve Process-Problem fit. (This is analogous to the Product-Market fit concept from the Lean Startup methodology)

3) Zero-Code or Code-Later: The philosophy of Lean Processes is that knowledge workers need to be able to rapidly iterate on processes. Accordingly, anything that slows this iterative process down (such as requiring support from I.T.) is discouraged. To the extent that integration is required a code-later philosophy is implemented which allows a hardened process to be integrated with no interruption in the knowledge-worker flow.

4) Guidance and Support rather than Control: Traditional BPM is more geared towards a high-level of prescriptiveness and control. The Lean Process philosophy is that these types of processes are better handled by apps. Lean Processes are geared towards guidance and decision support. A related concept is that there is expected to be significant variation in processes and which requires a lean process system to be adaptive.

5) Communication and Collaboration are central to Lean Processes: Communication and collaboration need to be tightly integrated into the lean process.

6) Lean Processes span intra-business, B2B and B2C processes.

<comment><USER2> Excellent description that setups the context beautifully with what TMail21 offers. Should be exciting times ahead! Cheers.</comment></comment>


TechCrunch UK - Will TheFunded be good or bad for Europe? - <AUTHOR> http://uk.techcrunch.com/2008/04/16/will-thefunded-be-good-or-bad-for-europe/ <comment><AUTHOR> Related: [http://www.thecoffeeshopsofmayfair.com/2008/04/thefundedcom-...](http://www.thecoffeeshopsofmayfair.com/2008/04/thefundedcom- em.html)</comment>


Finding Beautiful Yelp Photos Using Deep Learning - <AUTHOR> https://engineeringblog.yelp.com/2016/11/finding-beautiful-yelp-photos-using-deep-learning.html <comment><USER2> Damn this is awesome. Does yelp offer this service through an API? I love it.</comment>


Ultimate Frisbee's Surprising Arrival as a Likely Olympic Sport - <AUTHOR> http://www.newyorker.com/news/sporting-scene/ultimate-frisbees-surprising-arrival-as-a-likely-olympic-sport?intcid=mod-latest&mbid=social_twitter <comment><USER2> I don't know, I mean it's fun to watch, but as a spectator sport to fill an olympic stadium? I doubt it.</comment>


Crumbles; text to movie clips - <AUTHOR> https://www.crumbles.co

<comment><USER2> god damn you augusta</comment>


Random Agent Spoofer Firefox Addon for Browser Privacy - <AUTHOR> https://github.com/dillbyrne/random-agent-spoofer <comment><USER2> Not the dev's fault, but using youtube was painful with this addon. It disables 'full screen' for a lot of browsers, which was a pain in the ass.

I wish the addon had an option to select from a sublist of mainstream browsers. Picking browser one by one would be painfully boring - I ended up replacing this with Blender.

I'll try it again, though. I quite like it, apart from that annoyance. Kudos to the dev/devs!

</comment><comment><USER3> Interesting. I might try it out. I'm not exactly hiding in a crowd right now.

Does anyone know what features are missing from the Mozilla version? And does anyone know whether the other features are likely to interfere with things like NoScript?</comment>


Bias Lighting - <AUTHOR> http://www.codinghorror.com/blog/2011/11/bias-lighting.html

<comment><USER2> <http://stereopsis.com/flux/> <\-- It changed my life. (Automatically adjusts screen brightness/color/etc such that your circadian rhythms resemble that of a normal human being as opposed to someone who stares at an artificial sun for 16+ hours a day.)

<comment><USER3> I had severe problems with flux under Ubuntu so I switched to redshift:

<http://jonls.dk/redshift/>

Everybody should try a program like this, during the night/evening it is so much better then the normal color configuration!

</comment></comment><comment><USER4> Is this something people don't do? I can't stand using a computer if the room isn't bright enough to offset the screen. Although a lot of times I won't notice as it gets darker, and become more and more uncomfortable until I realize I need to turn on a light.

But I like complete darkness when watching movies-- a single light on in the other room drives me crazy. Any theories? Probably something to do with immersion.

</comment><comment><USER5> To everyone mentioning redshift/flux; they are great (I use flux on every computer I have) but they do not solve the issue being raised here. Bias lighting keeps the light levels behind your screen (or whatever you are looking at) higher, so that your irises don't have to contract and expand nearly as often or as much. This leads to less eye strain. (<http://www.cinemaquestinc.com/ideal_lume.htm> seems like a good explanation, first hit on google)

Redshift/flux vary the color temperature of your monitors. This keeps your internal biological clock from thinking the sun is up at midnight because of a bright white high-color-temp monitor. (More info at <http://stereopsis.com/flux/>)

<comment><USER6> Actually if the light is behind the screen, your iris will adapt to different levels every time you look towards any other direction than the screen. The best solution is to have constant level of ambient light all around you.

</comment></comment><comment><USER7> Strapping LEDs to the back of monitor? It's easier to just point ordinary desk lamp at the wall behind monitor.

<comment><USER8> Same. I use a flexible desk lamp (also from IKEA), which is really useful to regulate the type of light I want. For computer usage, I just point it at my white wall, which scatters it uniformly around the screen. For reading books, I can just twist it in my direction to get more light.

<comment><USER9> I do something similar. I have a led desk lamp with a clamp [1] on it, and point it at the wall behind my monitor.

[1] [http://www.argos.ie/static/Product/partNumber/4328049/Trail/...](http://www.argos.ie/static/Product/partNumber/4328049/Trail/searchtext%3ELED+LAMP.htm)

</comment></comment></comment><comment><USER10> Personally, I can't stand working in a dark room. My partner, on the other hand, prefers it very dark in every room. I suspect he grew up in a house where the electricity bill was monitored very closely every month.

<comment><USER11> It's more natural, at night at least. I suspect you wouldn't have gotten as much accomplished in another century.

</comment></comment><comment><USER12> A dark room during the day is not very good for your health and mood.

<comment><USER13> And people tend to be more productive in natural daylight.

</comment></comment><comment><USER6> I don't see any real science behind this "bias lighting" vs any kind of lighting. What problem is it supposed to solve? The eyestrain is caused by our eyes focusing and fixating for too long on the same distances. Look outside the window if you want to relax your ciliary muscle. You also want your center of vision to receive ample light and contrast so you can read easier. Ambient light should just be enough so you don't see glare around the screen.

<comment><USER14> It has nothing todo with accommodation strain, it's an "exposure" problem. If you are looking at a bright screen in an otherwise dark room, your pupils will adapt to the average flux hitting your retina. But if most of your field of view is dark, with a bright screen in the middle, this will cause an uncomfortably high flux from that part of your field. With a more even lighting so that the brightness of the screen is close to the average illumination, this doesn't happen.

<comment><USER6> That is true, but better served with ceiling lighting (more even flux in your field of view

</comment></comment></comment><comment><USER15> I have a set of these running along the back of my desk, and pointed towards the back wall:

<http://www.ikea.com/us/en/catalog/products/50119351/>

I pretty much leave them on 24/7. It's a nice amount of backlight for my monitor in the day and night. Unfortunately, my home office doesn't get much natural light so I'm thinking about getting a sun lamp as well for the day.

</comment><comment><USER16> I must own the last LCD in the universe with a matte screen. The primary light source of my room is behind me and I never ever have glare problems. Every laptop these days seems to have a glossy screen on it for the purpose of high contrast. But either you're inside and you don't need that much contrast (i.e. you turn the brightness control down), or you're outside and you get glare. I can think of few cases where glossy screens are superior.

</comment><comment><USER17> Just cranked down my work LCD from 100% brightness to 20%. Much better.

<comment><USER11> My samsung is very bright, but luckily it has presets I can cycle thru... 100% during the day, 0% at night.

</comment></comment><comment><USER18> \- Redshift/flux

\- those fancy windowshades with pinholes

\- laptops with antiglare screens, dammit!

</comment><comment><USER19> Um, I just put my computer in front of a window. I like watching the sun come up and go across the sky as the day goes on.

<comment><USER20> And you stop coding the moment it gets dark?

<comment><USER19> No, more like around 2pm or so. I realize this doesn't work for everybody, but I wanted to point out that there is a solution to this issue which does not involve clamps or LEDs or anything of the sort.

I mean, the article has pictures of a computer monitor right next to a freaking window and it never even mentions natural light. It's just kind of silly.

</comment></comment></comment><comment><USER21> Random light-related horror story:

Not long before developing a debilitating neck issue, I got moved away from my excellent desk where I sat near a window, with my back to it. I was quite happy.

After getting moved toward the middle of the room, sitting with the window to my side, I was miserable. After a few months, my neck issues started.

I've only recently realized that this was at least partly due to my astigmatism. My contacts didn't compensate for astigmatism, and without realizing it, I was craning my neck further forward over time. Having the bright light at my back gave a significant sharpening effect, thanks to the pupil constriction, and allowed me to work without eye strain for much longer.

Recently, I've gotten contacts which correct astigmatism. They don't correct precisely enough to come anywhere near the precision of my glasses, so I still experience eye strain and crane my neck. I'm now beginning to ponder Lasik, since it sounds like they're getting consistently better results out of it these days.

<comment><USER14> Lasik might be improving, but as far as I understand, the "best corrected vision" is still inferior to glasses. This means that while you no longer need correction, your visual acuity is worse than what it was with glasses.

I'm curious what you mean when you say your contacts "don't correct precisely enough". Is this because the axis/cylinder combination you want doesn't exist or because the contacts move on your eye and screws up the correction?

I have a fair amount of problems with the latter (my cornea has some funny shape that has a tendency to twist the contacts), but I find that it varies a lot between contact brands. So if you didn't already, next time you renew your prescription, try getting trial pairs of different brands and wear them for a week to see if one fits you better.

<comment><USER21> I haven't done any sort of rigorous investigation yet, but it seems like I'm reading more incidental stories of people being corrected well past 20/20.

As for the contacts, I believe that they just aren't available in fine enough increments to properly fix my astigmatism. I'm using the Acuvue Oasys for Astigmatism type, which have little, vertical ridges at the top and bottom. Every time you blink, it forces them into alignment. It is rather irritating, though. It took me a couple of weeks to get used to them, and if I go a few days with glasses then they irritate me again the next time I wear them.

Another option I haven't tried is regular contacts along with glasses which just correct the astigmatism. I haven't tried that yet, though my eye doctor was happy to write a separate prescription for that. I don't mind glasses too much while in front of the computer, I just hate them for every other part of life (gym, cycling, motorcycling, etc).</comment></comment></comment>


How to Get Hired By a Hot Startup - <AUTHOR> http://adammcnamara.com/post/4919582973/how-to-get-hired-by-a-hot-startup-value Applying to a startup is completely different than applying to a large company. Five tips to help you stand out... <comment><USER2> Oh please people stop using this top bar that appears after we scrolled, it's today's version of blinking flash banners.

<comment><USER3> Agreed and turned off.

</comment></comment><comment><USER4> If you've built 20+ IOS apps, you don't need the rest of his points to join a hot startup in this environment. You just need to walk in the door and ask for HR.

<comment><USER3> Completely agree, but that's missing the point. Lots of people apply who have published 100+ apps. The problem is that they're 100 variations of the same app, which has no value at all.

Most startups we know would prefer three bullet points on how you can help them win as opposed to a three page resume.

</comment></comment><comment><USER5> This is good advice, and for the most part generally applicable to applying to any job.</comment>


Yet another reason why no one should be using PHP  - <AUTHOR> https://bugs.php.net/search.php?boolean=0&limit=30&order_by=id&direction=DESC&cmd=display&status=Open&bug_age=0&bug_updated=0&bug_type=All&patch=Y&pull=Y

<comment><USER2> If you expect your languages to have ->0<\- errors, then you have unrealistic expectations. PHP is listing only 373 issues listed, Ruby and Python both have thousands! Sure PHP may not be a perfectly crafted language, it has its downsides, but, it works. Stop trying to steer people away with these misguided posts. This is the internet, you can find justification for nearly anything when you do not provide a proper context for your arguments, in this case it would need to be a chart showing bug count vs other languages.

</comment><comment><USER3> This is such a misguided post. There are 3873 open bugs at <http://bugs.python.org/>

I'm guessing no one should use Python either?

</comment><comment><USER4> I am not sure what do you mean?

</comment><comment><USER5> wow, so a large open source language that is used on many different platforms has bugs?

I can also point to all of the recent security flaws found in Ruby..

</comment><comment><USER6> Troll</comment>


Lisp Badge – Self-contained ATmega1284 Lisp computer - <AUTHOR> http://www.technoblogy.com/show?2AEE&xyz <comment><USER2> Looks great! The greyscale plot is impressive for such a display. Where can I get one? Now to make a Lisp Machine on a badge with custom ASIC/FPGA!

</comment><comment><USER3> By the maker of ulisp ([http://www.ulisp.com/](http://www.ulisp.com/)).</comment>


They Don't Complain and They Die Quietly - <AUTHOR> http://powazek.com/posts/2489 <comment><USER2> I wonder how many Hacker News readers are also gardeners. I started this year after realizing how wasted our (pitifully) small back yard was. It's not much, but I'm growing some plants back there and am about to have the first harvest of tomatoes. It's relaxing sometimes to go back there and just weed and do something away from the computers.

It's a growing trend and I think a good one. There's a lot of untapped potential out there and anything that gets people realizing what good vegetables taste like is good in my mind. Luckily most of us aren't starting gardening for such depressing reasons!

</comment><comment><USER3> This is a great blog post and I'm glad someone put it up on HN otherwise I probably never would have read it.</comment>


Backdoor in DVR firmware sends CCTV camera snapshots to email address in China - <AUTHOR> https://www.pentestpartners.com/blog/pwning-cctv-cameras/ <comment><USER2> Someone with the same name has some chinese CCTV apps on the Apple appstore, one updated 5 days ago: [https://itunes.apple.com/us/app/ipctester/id870933100](https://itunes.apple.com/us/app/ipctester/id870933100)

And on Google Playstore [https://play.google.com/store/apps/details?id=com.juanvision...](https://play.google.com/store/apps/details?id=com.juanvision.EseeNetProj)

Do they also contain backdoors? Domain and email used: www.dvr163.com email@example.com Screenshots in the app come from this site: [http://www.juancctv.com/jishu.asp](http://www.juancctv.com/jishu.asp)

</comment><comment><USER3> I would love to see a documentary / an interview of the developer (team?) behind these Chinese crappy products. Are they really that incompetent or is it just totally different culture?

I mean, after all they are capable of bundling the all FOSS together, writing some code by their own, and even shipping a working product, but they don't realize that running commands as root from query string is horrible idea? That's hard to buy.

<comment><USER4> I use a bunch of cheap ip cameras of various brands: foscam, crenova, etc. They all have telnet backdoors, which is actually pretty convenient for me.

I keep mine on a separate lan which can't connect to the internet or the other more-trusted lan. The average grandpa connecting these things to the internet is screwed though.

<comment><USER5> That's essentially where I am. I actually _want_ a simple camera with options for standard format streams over IP so I can connect them to a NAS on its own LAN, hidden in a closet for a cheap security setup using hardware I already own.

But so many of these things are pitched as "oh so easy to set up! Just plug it in and open an app on your iPhone and you can monitor your house from anywhere!"

It's bad enough that this app-centric branding/marketing pitch ignores the fact that you never even see the popup saying "for security purposes, change your password", much less mentions just how this easy access works.

Sure, it's easier to just plug something in and get a picture with no more action needed than pointing at a square on a screen. But even the ones that can be made moderately secure (at least versus casual Shodan searchers and Google dorks) by setting a password and turning off DDNS, telnet, ftp, etc. are often left in their wide-open setup state by users.

On the flip side, I don't want something that only works with a "cloud" subscription or by going through a third party that I may or may not have to pay for monthly. I just want to be able to pull an mp4 or mjpeg stream from an old computer running iSpy or my Synology on the local-only LAN.

tl;dr: these things are affordable and very useful if you know how to set them up but by default they're wide open and often irresponsibly marketed as plug- and-play and never actually configured.

</comment></comment></comment><comment><USER6> That sounds horrific.

This code seems related - it has the cow ascii art and the email-sending functionality and email address mentioned in the article: [https://github.com/simonjiuan/ipc/blob/master/src/cgi_misc.c](https://github.com/simonjiuan/ipc/blob/master/src/cgi_misc.c) \- I wonder what else is in there!

<comment><USER7> Good find. Wow, that repo is a class act. Binaries checked in and everything. Clearly looks like this and the OP's DVR share lineage.

From what I can tell, the e-mail address etc. are defaults used in CGI_send_email, which is only invoked as the handler for the /email endpoint. Looking at the order of endpoints defined in [https://github.com/simonjiuan/ipc/blob/master/src/ipcam_netw...](https://github.com/simonjiuan/ipc/blob/master/src/ipcam_network.c) it seems that /email was probably left out in the DVR's code, so it's possible this function is simply never invoked, and we're just left with the WTF that not only did the original author (Mr. Law) think that an e-mail service needed a default "To", but that he thought it should be him, and that he left it in the final product.

<comment><USER6> Yeah, it wasn't at all clear to me from 2 minutes of static analysis under what circumstances an email would be sent and to which address. I'd hope the authors of the linked article would have verified this with a packet sniffer (as mentioned in another comment here) before making the claim.

<comment><USER8> Sorry, should have been more clear.

Yes, it does send the emails.

</comment></comment></comment></comment><comment><USER7> They don't say whether they actually caught the DVR in the act of e-mailing frames. A simple Wireshark trace could reveal the difference between malintent and some dumb vestigial debugging code.

Actually, from a brief scan of a related codebase, it's likely that it _doesn 't_ send e-mails. The title of the article is therefore at a minimum unsubstantiated.

<comment><USER8> I'm the author.

My device sends an email at boot to the email address, and it has also been triggered at other times - I am not sure why.

It looks like there are a number of variants of the device out there.

The repo mentioned in another comment has a MakeFile for another device, and has been forked 9 times. It could be used anywhere.

The article will be updated, but I'll have to get a trace another time.

<comment><USER8> Someone else who has looked at them has pointed out that theirs reboots randomly. I haven't actually been using the DVR functionality, so I suspect that the emails are only sent at boot and it boots more often than I expected.

</comment></comment></comment><comment><USER9> "Visiting moo shows us a curious image of a cow."

That image isn't so curious. Try 'apt-get moo' on any debian based box.

<comment><USER8> Thanks, updated the post.

</comment></comment><comment><USER10> Very interesting talk at Blackhat about the numerous security vulnerabilities CCTV cameras have such as hard coded master passwords in firmware: [https://www.youtube.com/watch?v=LaI0xjeefpg](https://www.youtube.com/watch?v=LaI0xjeefpg)

</comment><comment><USER11> I have one of those. Root password is "juantech". Did not know about the shell, how useful! The telnet daemon crashed quickly on mine last time I played with it.

... :-/

Fortunately, I disconnected it from the network a long time ago. Works well standalone, the UI is ok.

<comment><USER8> Yeah, I tried juantech. Not the password, unfortunately.

openssl passwd -salt a0 juantech a0hDjN2cjQ1hI

I've bruteforced all alphanumeric for the descrypt hash, and not found anything. Trying the whole space now, but it will be weeks.

I think mine was regularly rebooting, but I've put it away so need to check.

</comment></comment><comment><USER12> Are there any DVRs in the consumer space that aren't terrible? I bought a Dahua based on some recommendations, but in the end am disappointed.

<comment><USER13> Blue Iris and IP cameras, you'll never look back.

<comment><USER5> I've always been a fan of iSpy ([https://www.ispyconnect.com/](https://www.ispyconnect.com/)) and still occasionally mess with it even though my couple of cheapo cameras (a Foscam and a Dahua) now just record on motion to my Synology NAS.

I think I messed with Blue Iris when I was initially playing with using an old laptop as an IP cam DVR but never bought it after the trial expired.

<comment><USER13> Looks like to get the most out of iSpy you need a subscription, starting at $8 per month and going up to $50 per month, sorry no thanks. Blue Iris is a one time fee, I get SMS and email alerts included. I don't like paying subscriptions for things that I'm hosting myself.

<comment><USER5> Sorry for the late reply. I never used any of the "pro" options so I guess it never came up for me. It's like Plex in that regard, at least how I personally use it. I just use iSpy as a free, flexible program I can run on an old computer, attach it to the same LAN as the IP cameras, and set it up for motion detection, recording, and storage/archive.

I definitely agree that if you want some or all of the "premium" features, a one time purchase is the only option. I don't like recurring subscriptions and avoid them when possible. I guess in this case, since you're paying for functionality on their servers it makes sense to pay as you use it. Still, as an end user, I do avoid subscriptions if I can.

Good to know you've got a better option though. Anything that allows you to self-host this stuff (mostly at least) is a positive thing IMO. In my early experiments before moving to the Synology software on my NAS, I had the computer running iSpy save to the Dropbox folder on that computer and limited the archive size to match the capacity of that Dropbox account. That way I could at least access recordings from elsewhere but I never got into email or SMS alerts. Not sure how I'd personally set that up.

</comment></comment></comment></comment></comment><comment><USER14> Neo: Who are you? The Architect: I am the Frank Law, the architect. I created the Matrix. I've been waiting for you.

\---

Someone please go arrest this voyeur before he deletes the evidence.

If he was some low level engineer i would perceive this as unintentional. That's not the case. Unless the title "chief software engineer" means something else in China... [https://www.linkedin.com/in/frank- law-2b14b790](https://www.linkedin.com/in/frank-law-2b14b790)

From my sleuthing experience, deleting things [the github repository] usually means some kind of wrongdoing; not necessarily related to the erased.

It is my belief this was intentional.

</comment><comment><USER15> I can't figure out whether this is malicious intent or just incompetency. Regardless, we really need consumer protections for software flaws.

<comment><USER16> If you can come up with a non-malicious intent scenario why the images from the first camera would be mailed to some address I'll be most impressed.

<comment><USER17> Debug code that was never removed?

<comment><USER18> Yep. A manual, end-to-end smoke test of the firmware: Put the new software image some hardware, turn it on and wait for an email. If you get a correctly- formed picture of your own face, that's a pass.

It's a dirty dangerous hack even for a debug scenario, but you can see how it might come about

</comment></comment></comment></comment><comment><USER19> The Amazon link presented in the article has no reviews of this product that explain what it does. If anyone decides to buy one to play with, it'd be good to leave a warning to others about this sort of behavior. The product does not appear to be available in the US for whatever reason.

[http://www.amazon.co.uk/dp/B0162AQCO4](http://www.amazon.co.uk/dp/B0162AQCO4)

(Link has been shortened to use only the ASIN.)

<comment><USER8> Author here.

I submitted a review but it has yet to be approved.

It has been approved but the exploit link and link to the blog post are not in it.

[https://www.amazon.co.uk/review/R20SLCJIPN9UDB/ref=pe_157228...](https://www.amazon.co.uk/review/R20SLCJIPN9UDB/ref=pe_1572281_66412651_cm_rv_eml_rv0_rv)

<comment><USER19> Thank you. I can't seem to comment on .co.uk as my account is on .com, or I'd mark it helpful.

</comment></comment></comment><comment><USER20> firstname.lastname@example.com

yeah.com is early free hosting and email provider in China.

maybe the same person with an avatar [http://tieba.baidu.com/home/main?un=lawishere](http://tieba.baidu.com/home/main?un=lawishere)

maybe his blog [http://blog.csdn.net/lawishere](http://blog.csdn.net/lawishere)

lots of C/C++, mpeg, streaming stuff.

<comment><USER21> More info:

On Google Play, [https://play.google.com/store/apps/developer?id=Frank+Law](https://play.google.com/store/apps/developer?id=Frank+Law)

The developer email is the same.

By the nicknames combine(lawishere and Frank Law), this maybe his Github page, [https://github.com/lawishere](https://github.com/lawishere)

<comment><USER8> Yes - his GitHub actually had the repo for this in the past.

Someone reported the issue on there before I found it.

</comment></comment></comment><comment><USER22> I wonder if a project to build an open replacement firmware for DVRs, along the lines of OpenWRT, would gain traction.

<comment><USER8> Possibly.

Part of the problem though is that there is not a full toolchain. You could replace the DVR app, but the OS is still going to be crap.

I had a very quick go at updating the firmware with Juantech and it failed. There is some check in place to prevent this.

</comment></comment><comment><USER23> I'm thinking about what we can do about the flood of hideously insecure embedded devices. I wonder if there are industry standard, consumer-visible product security certifications?

</comment><comment><USER24> the Esee Cloud Android App seems to be developed by the one who own the email address in the article: [https://play.google.com/store/apps/details?id=com.juanvision...](https://play.google.com/store/apps/details?id=com.juanvision.EseeNetProj&hl=en)

<comment><USER8> Yes, the device has reference to Esee and IIRC it sends XML data to their server.

I didn't look into that as the other stuff meant it was game over.

</comment></comment><comment><USER25> In 2001 I wrote a 10,000 word series of articles for the physical security industry on emerging computer-based threats. Apparently they didn't read them.

</comment><comment><USER26> the github code has been removed, that's fast.

</comment><comment><USER27> This post could be titled:

"Backdoor in DVR firmware sends CCTV camera snapshots to email address in China"

OR

"Backdoor in DVR firmware sends CCTV camera snapshots to email address"

Notice the difference?</comment>


Ask HN: How many of you quit using Facebook or rarely use? - <AUTHOR> <comment><USER2> I made a personal policy to not use it a few months ago. I still have the account, because of some messenger threads, but the app is gone from my phone and I have a policy of only logging into FB itself in a private browsing window. This at least reduces their tracking, and makes it a little harder for me to give in, so I only use it if I'm actively using it for something (e.g. looking for hours on a restaurant that doesn't have a real website, checking event information, finding somebodys birthday). I don't allow passive browsing anymore.

My reason is that it was just becoming too big of an echo chamber. Everyone on it was spouting their opinions and getting waves of agreement, making their opinions stronger, in an endless cycle. I just don't want to be part of it.

The biggest effect it's had on my life is that I get seriously bothered when someone asks me if I "saw their post". I immediately respond with something like "i'm not really on facebook anymore, what are you talking about?". The amount that it's dug itself into everyone's lives in pretty baffling. It's nice to not find myself absently staring at an endless "news feed" of the same soundbites and photos over and over again.

My wife will often be using it and get upset at the stupidity of something she sees, and I can't always resist a told-you-so.

</comment><comment><USER3> I stopped using it entirely a few years back. It got to be an unhealthy obsession which I realised was making me quite unhappy.

While I read Hacker News and some technical subreddits, I don't think these are entirely benign, but they are an interest rather than an obsession. They do both have an element of gamification--your comment upvotes/karma etc., but they aren't actively sucking you in with a never-ending stream of status updates from the site members either.

</comment><comment><AUTHOR> I quit facebook and smoking together. I used to smoke 4-5 cigarettes a day and once i started being mindful about why i do and what i get, i took a stance to quit. I convinced myself to quit and also out of curiosity picked up a book about quitting smoking.After doing all this, I felt facebook and smoking are similar in so many ways. Trying to fill the non existent void in everyday life. And even though we are so much aware of our physical health , we hardly try to resolve our mental health issues. And then i quit facebook. Even though i used facebook for may be all together 45 mins a day. It feels so much better to not consume that insensible, utterly useless content.

</comment><comment><USER4> I almost never use the Facebook website or app, but I haven't quit for the sole reason of Facebook Messenger. I still find it the most convenient means to contact my family and friends who are living overseas because Facebook is still widely used amongst these people.

I've tried to move my friends onto alternative means of communication, predominately Signal, so I could disassociate myself from Facebook, but my friends just don't stick it out. We converse as per usual over the first couple of months, but then their replies slowly dwindle down and if I go back and message them again over Facebook Messenger they respond as soon as they see the message.

Although them not moving to Signal is a pain for me, it's a bigger pain for them to move to an alternative messenger. Why would they want to use two different applications to message friends, let alone to just message one friend. A lot of these people aren't the technologically minded folk of Hacker News, these are the type of people who are Facebooks primary target audience. They don't care about how invasive Facebook can be with advertising or that their communications actually aren't that private.

I would love to see all my friends and family messaging me over some encrypted and decentralised messaging application so I can leave Facebook for good, unfortunately I just don't see that happening for the circle of friends and family I have.

<comment><USER5> Ah, facebook messenger was one of the reasons I quit facebook.

The fact it popus up on your phone and you cant get rid of it. So then I only had it on the webbrowser - but then i'd only go on the browser version once a day and people would have to take ages to get a response from me and it might be important. But most people assume you'll check it multiple times during the day.

So I just removed it entirely and gave people my whatsapp. And I'm so, so, so much happier i've done this.

</comment></comment><comment><USER6> I doodled with it a bit.

Added a few friends and relatives, then realized that most people that I know are either not on it, or not very active. And I couldn't figure out what to do with it. I posted a bit but that fizzled out.

Right now it seems such a primitive and restricted system and not of much use at all unless you are addicted to it or you have no idea of what is available on the Internet.

I get the feeling that it only appeals to those who like to get into a rut and stay there.

</comment><comment><USER7> I never made an account because I could never grasp what value it really had for me. It seemed to me that it was better suited for the "reality show" crowd that liked following other peoples drama.

<comment><USER8> this summarizes my opinion about fb perfectly.

</comment></comment><comment><USER9> I'm probably just babbling but here's what it was like for me and what i think about it.

I think i just wanted to use it to show off... And then i eventually thought what's the point of getting likes on fb. I didn't find it translate into enjoying my life more or making my life better.

I thought maybe it's useful as a record of experience. But then i just kept my photos on my phone and share them in real life by handing the phone.

I don't think it's impossible to use fb in a way that works. Maybe there needs to be a class... How to use fb like a pro. I think messenger is more useful. But then i just used hangouts since its no setup required. I didn't get enough out of fb to be worth time.

Mostly i feel happier chatting on the phone or face to face irl, instead of texting or scrolling newsfeed.

I think in an ideal world fb would be a great tool to connect. But the world is not ideal. People are not ideal. Fb is not ideal.

</comment><comment><USER10> I'm using it to source and sometimes to talk to my users (from my personal account) on days when I don't feel like going out. Most people in my country (Vietnam) use it to sell stuffs, sort of like how they'd using Craigslist. They particularly abuse the livestream feature to showcase their products... sort of a fascinating behavior in my opinion. None of us uses it to have "meaningful connection with one's acquaintance"... because we all know that can only happen in the offline world.

</comment><comment><USER11> Never really used it, closed 3 accounts over time. Main use is to peek at pages, and I've advertised my business on it at one point, with really bad results. I deeply hate everything about FB, from the fakeness of it as a distant relationship maintenance tool, to its core business model, to the fact it is highjacking a big chunk of the web. To me, FB is a trap, tailor made to attract the Internet illiterate, as I-products does with hardware and music files.

</comment><comment><USER12> Still have an account but haven't used it in about 5 years, except occasionally to deal with website integrations or answer an incoming message or invitation. My life is much better without it. I do sometimes miss out on announcements (especially weddings and births), and am not as much in touch with some friends and family as might be ideal. That's a price I'm willing to pay, but ymmv.

</comment><comment><USER13> I closed my Facebook account a few months ago, and then reopened but deleted everyone and everything to use it as a dev tool and for login on certain platforms (I could not get a new account going without sending in a "proof of id"; I did not want to give Facebook a picture of my ID card)

</comment><comment><USER14> I quit fb in 2013. It's a pesky habit to kick. I was an early adopter, early 2005. In fact, as soon as I got my .edu email I signed up. I tried giving it up several times. I could go without saying how much easier it is to leave fb when someone else does it with you; Finally, my future wife and I gave it up together at the same time. Present day, the unfortunate thing is certain apps only use fb auth and if you want all access to work with fb for developers, your only option is to login through a fb acct. I imagine if you wanted to work for fb one might need a fb account too.

</comment><comment><USER15> Quit in 2013. Erased all posts. Unfriended all contacts. Asked others to take off references to myself in pictures and in posts.

Now only owns a blank account to get access to our rugby team group for logistics purpose. Al least, FB knows I love rugby.

</comment><comment><USER16> I found that my friends and family didn't mix well, my crude friends were posting random garbage that my grandma was reading. Then there was family drama, backstabbing, angry political posts. The reasons for me to leave far outweighed the benefits of staying. I also don't like being a "product", I'm not interested in seeing advertising and the way they manipulate your feed now is also something I dislike. I pulled the plug and haven't looked back, I don't miss it at all.

</comment><comment><USER17> I still have an account because of an IRL social group that likes to do event planning through FB Events, but that and using Messenger to communicate with one person are the only reasons I still have an account.

FB and Instagram were only contributing guilt, anxiety, and FOMO to my life, and I am so much better off without them. Weirdly, I've gone back to Twitter, but I only follow one person that I know IRL there. Twitter is great for news and weather.

</comment><comment><USER18> I was on Facebook for a couple years, caught up with all my old High School classmates and a couple University classmates as well. Once I saw how everyone was doing Facebook lost interest to me. I got to the point where the only time I logged in to Facebook was to opt-out of some new option that automatically opted me into. It was easy to give it up and I haven't missed it since. That was probably 6 or so years ago.

</comment><comment><USER19> I've kept my account because I joined a local music gear buy and sell group, and the experience blows craigslist and kijiji out the water.

<comment><USER20> I find the facebook buy/sell groups to be awful. The group itself is fine, the interface/search/etc is terrible.

It's getting better, though--I think FB lately has begun to make it a "product."

</comment></comment><comment><USER21> Uninstalled it many years ago. Check about once a month and stay signed out. I totally avoid it otherwise, too intrusive.

</comment><comment><USER22> I use Facebook once a year. Just when it is my birthday because last year I forgot to close the account and it is rude not to answer happy birthday messages.

I simply don't get the Facebook stuff... I really find interesting Facebook ads and all targeting options, but FB is definitely not for me.

</comment><comment><USER23> I deactivated mine two and a half years ago and never looked back.

Besides the occasional surprise that I don't have a Facebook when I meet someone it has never been a problem. Sometimes I don't know about events going on with friends but I inevitably learn if it's important.

</comment><comment><USER24> I made a New Years Resolution to stop using Facebook, deleted the apps on my phone but occasionally end up on it by accident through my browser through shared links etc. (never logged out, just stopped visiting).

The only thing I use is Messenger because people still contact me on that.

</comment><comment><USER25> I rarely use it. About 2-3 times in the last 18 months or so. So yea, hardly. At some point, it got too much to look at every little thing that friends/family are doing and sharing. I have better things to do.

</comment><comment><USER26> Long story short - facebook is dead, majority of the people migrated to Instagram. we went from myspace (personal) to FB (friends) to instagram (personal). Looks like people would rather focus on themselves.

</comment><comment><USER27> Use it rarely. Figured there was too much information noise from people i barely care about. Use the web site version. There is one or two friends i chat over messenger, but that is about it.

</comment><comment><USER28> Used in lurking mode for a few months in 2008. In the last few years I open it once every few weeks on average, mostly because of the email notifications. The facebook is a sad place

</comment><comment><USER29> I use Facebook daily. I tried quitting before, but for one excuse or another I always come back.

I need to plan it better next time, where I have another way to contact everyone I usually do over Facebook.

</comment><comment><USER30> Using it about 10 mins per day. Hacker News is taking much more time.

</comment><comment><USER31> I stopped using it actively 3 years back, now i use very rarely.

</comment><comment><USER32> Actually deleted mine yesterday, then had the fun of creating a new Spotify account as apparently that was linked to my Facebook and you can't unlink it!

</comment><comment><USER33> I deleted in 2008 it is easy for me to stay off.

I lost touch with some people but it did not impact existing good relationships.

</comment><comment><USER34> Quit in 2011, i believe.... Deleted everything and moved to a more dangerous platform called Twitter.

</comment><comment><USER35> I use my Facebook account when I need to do stuff for work.

</comment><comment><USER36> I never used it and never will. I want something better.

</comment><comment><USER37> Quit 3 years back, Saved lot of time since then.

</comment><comment><USER38> I hardly use facebook now-a-days.

</comment><comment><USER39> Quit in 2012.

</comment><comment><USER40> I'm a web developer.. takes me a while to get "in the zone" to do some programming, but once I'm there, I'm good to go! If I'm not, I tend to go on websites or randomly search Google for stuff which causes me to procrastinate. One of the websites is Facebook. I used to mindlessly get on Facebook and just scroll through my feed. It was the worst during the 2016 Presidential elections. Even though I really didn't care what was being said about either candidate, it was more fascinating to see how my friends were reacting. It was like watching a drama online with high school and college friends you used to have drama with back when you saw them everyday.

It got so bad that I was doing it at work and had to install software to block myself from Facebook. I give myself a little leisure, about 10 minutes a day or so, before it locks me out for the day. It takes me a few more minutes to be mindful of not typing in Facebook or whatever other sites I blocked myself from.

When I'm at home, if I hop on Facebook, I installed a button ( [https://chrome.google.com/webstore/detail/hide-facebook- feed...](https://chrome.google.com/webstore/detail/hide-facebook- feed/fohdbaioejiekbmphjempgmniojhjgin?hl=en) ) that makes you click in order to see it. This makes me fully aware of my actions. This has reduced my time at home to very little on Facebook. Occasionally, I'll type in Facebook and see that button and I instantly become aware of what I am doing. I trained myself to get back to something more productive.

I think of it this way: For every minute I'm on Facebook and not being productive, that is a minute they are making money on me and I'm not making anything at all. It usually helps me get back to work. Why don't I just quit? Because I live across the country, away from my family, who I don't get to see. I do pick up the phone every few days and talk to them all and make sure they are okay. But I also feel Facebook helps me keep in touch with them. I also have lived in a few parts of the country, and I've met, befriended, and Facebook'd many of those people I like to call friends. I may not be close to them anymore, but I still like to think of it as the best way as a means to keeping in touch.

There are two types of people on the Internet and Facebook teaches it very well: You are either a consumer or a creator. Creators make money. Consumers give money. If you spend your time on Facebook, which one are you? If you are working on something productive, even if it may not make you money right away or at all, as long as you are doing something productive: you are a creator. When you justify all of your time on the Internet, and even deal with your addiction to the Internet, which one will you be? A consumer or a creator?

Facebook has some AI scripts in it to learn your behavior and show you the stuff you think is most important and the stuff you want to see. Every "Like" (or reaction) is not just a like, but it registers into a series of algorithms. For example, if you like a lot of a person's timeline, you're more likely to see their timeline. The more you interact with each other, the more you are likely to see each other's timeline. If you both have a lot of mutual friends, you are more likely to see their timeline. Facebook, like Google, is not just one giant database, but algorithms get created to do different things depending on your actions within the application. And if someone has a wedding or a baby, I see it, because Facebook has deemed this a very significant event, based on the reactions it has. The rest is just news or something someone is posting from a page you liked.

And I'm on here.. Hacker News, procrastinating, but answering questions is relaxing and actually does help me to begin my focus. These are just some ways I deal with my desire to procrastinate and stay focused.</comment>


Lowest priced online billing system? - <AUTHOR>

The startup that I work at has built a Saas application that has around 20 customers so far. We make anywhere between $1000-3000 per customer depending on usage. We collect this revenue via check or bank wire, which reduces the number of fees we incur.
We are in process of opening up the application to more users at a lower price point, but are not sure how to bill many people easily at an affordable rate.
What is the lowest priced online billing that we can use? <comment><USER2> [http://expletiveinserted.com/recurring-payment-cost- calculat...](http://expletiveinserted.com/recurring-payment-cost-calculator/)</comment>


Groupon Panic: Is It Insolvent - and Could IPO Get Pulled? - <AUTHOR> http://www.launch.is/blog/groupon-panic-is-it-insolvent-and-could-ipo-get-pulled.html

<comment><USER2> Grouponzi.com</comment>


NSA officials worried about the day its potent hacking tool would get loose - <AUTHOR> https://www.washingtonpost.com/business/technology/nsa-officials-worried-about-the-day-its-potent-hacking-tool-would-get-loose-then-it-did/2017/05/16/50670b16-3978-11e7-a058-ddbb23c75d82_story.html <comment><AUTHOR> > Some officials even discussed whether the flaw was so dangerous they should > reveal it to Microsoft, the company whose software the government was > exploiting, according to former NSA employees who spoke on the condition of > anonymity given the sensitivity of the issue.

> In the case of EternalBlue, the intelligence haul was "unreal," said one > former employee.

> Richard Ledgett, who retired last month as the NSA's deputy director, said > disclosing all flaws would amount to "unilateral disarmament." He said the > idea that "everything would be just fine" if the NSA disclosed all the > vulnerabilities it finds is "nonsense."

So WannaCry isn't going to cause any changes in the NSA.</comment>


Ask HN: Which transactional email service do you use? - <AUTHOR> Deliverability is #1 priority for me, but I only send about 20k emails per month. Anybody have any strong recommendations? <comment><USER2> Five years ago, I would have recommended AlphaMail, a service me and some others were building. However, it does no longer exists...</comment>


30 Female Internet Entrepreneurs - <AUTHOR> http://www.incomediary.com/top-30-female-internet-entrepreneurs/

<comment><USER2> Pretty sad that only half of those are even entrepreneurs. Having a lot of followers on Twitter is not the same as starting a business.

<comment><USER3> How is Miss O and Friends worth $15 million? Alexa says it only gets a few thousand visitors a day.

</comment></comment><comment><USER4> It would seem to me this would be more accurately titled: "20 female Bloggers I think our cool, and 10 female entrepreneurs who are actually impressive."

<comment><USER5> Or even more accurately "Link bait sure to generate controversy and drive traffic to my obscure blog"

</comment></comment><comment><USER6> Great :-/ Let's not go there, okay?

<comment><USER7> Agreed. Sexism is bad. Posting "female only lists" probably doesn't help.

<comment><USER8> Well, to some extent visible role models and tangibly successful women (look how much she earns!) can be inspirational. It's just a matter of how you present it. (Hint: not like this.)

<comment><USER9> I hope no one takes offense, but I never really liked the idea of attempting to inspire a member of human subgroup X only with examples of successful fellow X-ers, or even just focusing on those examples. I prefer to emphasize that an individual X-er may be capable of accomplishing just as much as any human has.

If a member of subgroup Y is the first human on Mars, why should we have to wait for an X-er to step on Mars before we can tell X-ers they can do it, too? Can't an X-er be equally inspired by a Y-er, or indeed any human?

(Substitute in any racial or gender groups of your choice for X and Y.)

<comment><USER10> I don't think your comment is offensive, and I get what you're saying -- you would prefer that all of humanity be inspired by what one of us does. Regrettably this is not the case.

People identify more with people that look like themselves. This is a bug in the human OS and we can't ever totally fix it. Even if we could somehow fix that, there are good reasons why someone will gauge their own chances based on the success of others who are similar to them, especially in a society that's still working on eliminating racial and gender disparities.

Let me take an example closer to home. Paul Graham's theory about Y Combinator was, among other things, that people were ready to found successful companies at a much earlier age than was previously suspected. He has pretty much proven this by now, and I know lots of bright kids who are ready to take the startup plunge.

But think of how people felt before -- "I can't start a company, I'm just a college kid" or "What do I know about business, I've just worked in a coffee shop" or "The people who start computer businesses have to be really smart, I don't even have a degree yet." or even if they do think they have the skills, that "nobody is going to trust a kid like me, the game is stacked against me. Forget it." And there is even the worry that one might succeed, but then be totally alone and alienated from all your friends.

If the barrier is that high just for ageism, consider how much higher it is for sexism and racism. And people grow up and leave their youthful inexperience behind; you can't do the same with gender or ethnic background. Think how much more mental fortitude it would take to try to succeed in a profession where you'll always be the odd person out due to your gender or color. Knowing that someone's blazed the trail for you becomes very important.

<comment><USER9> I see what you mean, and I get the motivation for this kind of thing. I'd quibble with your choice of example, though - Paul backtracked on that, unfortunately. But leaving that aside, I liked the way you described the reason for all this: as a bug. As intelligent beings (ha ha), I think humans should try to be aware of the bug and work around it, instead of _reinforcing_ it, which is what this does. (In this case, sexism is reinforced.)

Consider the implications of your last sentence: The trail has only been blazed for you if someone else in your subgroup has done something already. It hasn't been blazed if some other human did it. Again, this just reinforces the separation of humans into subgroups, instead of rejecting the importance of subgroups entirely.

<comment><USER11> _Paul backtracked on that, unfortunately._

I did?

<comment><USER9> IIRC, about four years ago you made the point that if grad students can start companies, undergrads can too. Some time later, I believe you implied that you'd gone too far, and undergrads generally weren't as ready as you'd thought. I think one of the reasons you once mentioned was that people who'd worked for a while had experienced how much it sucked, and this made them more determined or desperate when they ran their startups.

That first point was in an essay or talk, but the second might have been somewhere else. Maybe "backtracked" wasn't the best word (backpedaled, maybe?), because I'm not saying you completely reversed your position and started rejecting all young people, but I hope it's clear what I'm getting at.

Here is the talk: <http://www.paulgraham.com/hiring.html>

And this _might_ be the other thing I'm thinking of: <http://www.paulgraham.com/mit.html>

<comment><USER11> Current undergrads do turn out to be at a disadvantage as startup founders. But because of the gravitational attraction of college, not because of their age.

<comment><USER9> Sure, but doesn't this increase the average age of YC founders, especially since you still advise young people to go to college?

Put another way, rather than telling 18-year-olds to start companies, you now tell them to go to college for the experience - where, as you say, they're at a disadvantage as startup founders. I assume you wouldn't tell them to do both at the same time.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


A rant about Twitter Bootstrap - <AUTHOR> http://www.skylarsch.com/post/bootstrappin

<comment><USER2> Designing in PS and using Bootstrap are extreme opposites. You can get a decent layout going on Fireworks in an hour or so, or do it in CSS directly.</comment>


Suggestion to Adobe (or others) about iPhone/iPad - <AUTHOR>

A suggestion for Adobe: Make Flash available for all jailbreaked iPhones/iPads. (For other companies the same thing in case they got something rejected.)
By doing this, probably more iPhone users will get interested in jailbreaking their iPhone and using it. At some point, the pressure for Apple will become high enough about closing old jailbreaks and about the AppStore as a whole - much higher than it is even right now.
I also assume that this is actually not that much work for you to do. Assuming the Flash codebase is already pretty much portable and you have already the MacOSX port, maybe use the Chromium code base and the recent work about embedding Flash in there to do the actual port to the iPhone.
Maybe even go so far as providing all the jailbreak tools and an easy description about how to get the jailbreak and to install this. <comment><USER2> Most people are not going to miss Flash on their iPhones/iPads. All the major sites will soon offer HTML5 for video and there will be 250,000 apps in another year. I think it's the idea of Apple forbidding Flash more than actually really needing Flash this is annoying some people.

</comment><comment><USER3> Adobe probably wouldn't chose that strategy given that they would be encouraging and supporting people breaking the EULA on software and this would hurt Adobe in their own need to keep their software unhacked.</comment>


Hiring Sucks - <AUTHOR> https://medium.com/swlh/making-the-first-hires-in-a-startup-the-hard-truth-fa7dbf37160f <comment><USER2> I know hiring is hard, and the truly qualified candidates for any posting are sparse, but startups throw out way too many potentially-decent candidates before giving them a real look. Bigger companies can afford to use more blunt heuristics than startups can. When that "elite 1%" only makes up .1% of your applicants, you have to be willing to use a finer comb.

I can't speak to the general case, only my personal experience as an applicant and early employee at 3 startups, but I can't count how many times I've been told that I wasn't a good fit (pre-interview) because I didn't have experience with parts of their tech stack, even though any developer worth hiring for those early positions should be able to pick up a new stack and run with it. Very little development experience is actually "irrelevant" to any given opening.

<comment><USER3> Absolutely. In my experience it's the non-technical (or pseudo-technical) internal recruiter who's the most common issue.

</comment></comment><comment><USER4> > "Not to mention HR companies which in my opinion are during this stage, a > complete waste of time and money. But mostly time."

Well, most recruiters are promising you that they are "experts" in their field and will bring you the best engineers. And then nothing happens for weeks or you get spammed with crappy CVs which is even worse (waste of time).

I am a former programmer, now running coderfit.com in Zurich. I am doing tech recruitment for a couple of very early stage startups here.

I am switching to a retainer-based model where the company prepays me a third of the fee before I start working. Especially for hard to fill roles, for instance, no-name startups, this is a better strategy than just working on pure commission. So, if working with recruiters at all look for the ones that will offer this.

Also ask: "From ten profiles you send us, how many will we approximately hire?" When they can't answer, that is a bad sign.

</comment><comment><USER5> What's with the use of female pronouns? I've seen it third time this week I think, referring to an imaginary/unknown developer as a woman. Isn't the norm to use "they" if one wants to avoid using specific gender?

<comment><USER6> >Isn't the norm to use "they"

In theory, yes, but in practice we see "he" used way more. The subtext is that it is a lot more noticeable when people use "she" precisely because the opposite is used so often in typical writing. It is a response to underrepresentation, only made more salient because of the recent political conversation surrounding women in employment.

Your reaction seems to prove the point.

<comment><USER7> > Your reaction seems to prove the point.

I don't think it does. Markedness is much more universal in language and not merely affecting grammatical gender in indeterminate contexts. If "the point" in question is some kind of job underrepresentation, it would be more plausible that this pronoun thing is some kind of symptom of it if this indeterminate gender issue were isolated and recent, but the indeterminate gender is ancient (older than any jobs, in fact), and markedness in general is pervasive, so I'm not sure what it could prove about recent job issues.

<comment><USER6> >If "the point" in question is some kind of job underrepresentation

Still seeing the forest for the trees.

The point isn't job underrepresentation in meatspace, the point is that the underlying assumptions about gender roles in employment are expressing and reinforcing themselves whenever the English language is written with a determinate gender as in TFA. And that determined gender seems to be disproportionately male to any perceptive reader. This betrays that the forces that engender (pun intended?) discrimination are operating in the writer and are reinforcing the worldviews of those who still hold such prejudices.

The causal relation between using this language and discriminating against women is not a direct one, but it's intellectually dishonest to assume on the flipside that no relation exists in anybody who does habitually use gendered pronouns in their writing.</comment></comment></comment></comment>


On the Road to Irmin v2 - <AUTHOR> https://tarides.com/blog/2019-05-13-on-the-road-to-irmin-v2.html <comment><USER2> Discussed in 2015: [https://news.ycombinator.com/item?id=10503465](https://news.ycombinator.com/item?id=10503465)

and 2014: [https://news.ycombinator.com/item?id=8053687](https://news.ycombinator.com/item?id=8053687)

<comment><USER3> This is a new update though.

<comment><USER2> Oh sure! That's why we didn't mark the OP as a dupe. These links are just for curiosity (as kencausey said). I'd like to find a way to communicate that when posting those, but none I've found is succinct enough. It gets old quickly to say "This is just for curiosity" every time.

</comment></comment></comment><comment><USER4> meta: what happened with Docker+MirageOS? Seems like the whole team that was acquired a while ago left to found this new company (Tarides)? Not sure if anybody has more background, just curious :-)</comment>


Show HN: Co-optimal - A Steam matchmaking app made in Node.js and Socket.io - <AUTHOR> http://co-optimal.com/

<comment><AUTHOR> Those recent articles about finding friends in adulthood gave me the idea for this. Let me know if you run into any bugs or have any other feedback. I'm still a bit of a novice at Node, so I'm sure I've done a few things wrong.</comment>


The Tragedy of Google Books: Torching the Modern-Day Library of Alexandria - <AUTHOR> https://www.theatlantic.com/technology/archive/2017/04/the-tragedy-of-google-books/523320/ <comment><USER2> I followed this story a bit as it happened. This seems like a good retrospective summary. It is a tragedy that we can't have access to at least some of those books. What's needed is a major change in international copyright law, but that would be a very difficult thing to achieve while legislators have almost no interest in the matter, other than occasionally extending copyright when asked to do so by Disney and co.

Obviously you can't change international copyright law by means of a civil action between a US-based "ad slinger" (as theregister.co.uk calls it) and some private writers' association.

</comment><comment><USER3> I personally wouldn't call it a tragedy. No way google did this to "serve humanity", they see a way to make money on this. 10-20 years down this road, and the only way to access this knownledge would be to subscribe to some service.

<comment><AUTHOR> Yeah, the article discusses this point a lot—the argument in favour being that's it's better to have _some_ imperfect access to out-of-print books than none at all. But yes, your point is ultimately a big part of why the project didn't happen</comment></comment>


Network Solutions Hijacking Unassigned Sub-Domains - <AUTHOR> http://www.techcrunch.com/2008/04/08/network-solutions-hijacking-unassigned-sub-domains/ <comment><USER2> Wow, that's pretty low . . . even for Network Solutions.

</comment><comment><USER3> Worst. Registrar. EVER!

</comment><comment><USER4> Network solutions has to hear the out cry from their last mistake and now this one!?

\- where is their leadership? or Public relations?

</comment><comment><USER5> Just put a wildcard in DNS manager.

Not sure I see an issue here. It's something you can fix yourself in like 5 minutes.

<comment><USER6> Even though it's easy to fix, having this as a default is the problem. I wonder what it would take to really make Network Solutions feel the pain for this kind of malpractice.

</comment></comment><comment><USER7> _Again_?!</comment>