Universally Unique Lexicographically Sortable Identifier - <AUTHOR> https://github.com/ulid/spec/blob/master/README.md <comment><USER2> > Uses Crockford's base32 for better efficiency and readability (5 bits per > character)

From what I can tell, this is the alphabet:

      0123456789ABCDEFGHJKMNPQRSTVWXYZ

Is there any reason why Crockford's alphabet hasn't been rolled into an RFC that supersedes RFC 4648 if it's more efficient and readable?

RFC 4648 specifies [0-9a-v] (base32hex) and [a-z2-7] (base32).

</comment><comment><USER3> A long uppercase trash is hardly considered a recognizable identifier. Remember, it needs to be identifiable. IMHO UUID's are more identifiable with its 4 words.

Uniqueness is usually guaranteed by a symbol table, and the op is gensym().</comment>


Systematic Parsing of X.509: Eradicating Security Issues with a Parse Tree - <AUTHOR> https://arxiv.org/abs/1812.04959 <comment><USER2> There's one thing that gives me pause here:

The single most common error is listed as DNS/URI/email format violations. There is absolutely no discussion as to what kinds of violations these break into, nor is there even a discussion as to what the paper thinks the correct formats ought to be. This is unfortunate because the format of these parameters is one thing where specifications often have a view of the world which is completely incongruent with reality. As a simple case, you will sometimes come across documentation that thinks that DNS names cannot start with a digit, which does not match reality at all.

<comment><USER3> > As a simple case, you will sometimes come across documentation that thinks > that DNS names cannot start with a digit, which does not match reality at > all.

I wish that were true. It's seriously annoying that DNS names are nearly indistinguishable from ipv4 addresses.

<comment><USER4> To complicate this further, there are certificates issued with IP addresses as names. One of the early bugs in CT Advisor[0] involved not knowing what to do with such a thing. I'd be interested in whether those writing this report considered these a valid URI.

An obvious example: [https://188.8.131.52/](https://220.127.116.11/)

[0] [https://ctadvisor.lolware.net/](https://ctadvisor.lolware.net/)

<comment><USER5> I'm seeing the SAN for the cert served by 18.104.22.168 to contain the IP 22.214.171.124, not the domain 184.108.40.206. Or am I misunderstanding?

<comment><USER4> Yes, the name is listed in the SAN on that cert. That said, that's one of the fields that's parsed, and potentially a source of issues in this paper.

</comment></comment></comment></comment></comment><comment><USER6> see also langsec.org

non-Turing complete languages, formal grammars and context-free parsing are fascinating and the current state of tooling is really sophisticated but sparse. So much boilerplate code and adhoc parsing exists in my code and I never really appreciated how much until I asked myself if I really needed a Turing complete language to tell me if an input really is an integer or a string of 4 chars, etc.

I'm terrified what would happen if a fuzzer ever went to town on my python code.

<comment><USER7> The last couple of times I had to parse/generate string according to something that can be described with a grammar, I resisted the temptation to implement an ad-hoc parser just because it was "simple". So I took the time and started to use Boost Qi/Karma (C++) instead. Just BECAUSE the formats are simple, they are the perfect opportunity to start learning more powerful tools.

</comment></comment><comment><USER8> It constantly underscores how early we are in the development of reliable tooling that such basic errors as these are still regularly being made. I am glad this sort of research is being done to uncover and identify our societal technical debt.

<comment><USER9> There's a lot of debt from just ASN1 and X509 parsing itself. The formats are only popular because of their popularity: their payloads are what matters.

<comment><USER10> The formats are popular because they were popular in closed-source software. And they were popular in closed-source software because there were (and still are) good commercial parser generators for ASN.1.

ASN.1 has been a failure in open source because there weren't any good parser generators. The only open source ASN.1 generator for C code I'm familiar with is asn1c[1], which was published long after OpenSSL and other projects added their ad hoc certificate parsing code. I think there may be one or two for Java, but that's about it.

Moreover, open source projects have historically disfavored using parser generators. They don't like the dependency, and there's still the sense that good protocols shouldn't need parser generators--contrast commercial protocols like X.whatever with SMTP, HTTP, etc.

ASN.1-based formats were _never_ intended to be parsed using hand written code. Abstraction Syntax Notation refers to the grammar for specifying the wire-line formats.

ASN.1 is solid technology. The technical debt exists because open source tooling never developed around it. At first the community thought it was too complicated and unnecessary. Then when the need arose the community simply reinvented the wheel (Protocol Buffers, etc).

[1] asn1c is amazing, BTW. Not only will it generate encoders and decoders given the ASN.1 specification, but it can generate _streaming_ encoders and decoders, something that most open source alternatives (e.g. Protocol Buffers) can't do. (And by streaming I mean streaming a _single_ message, which is important for low-memory environments, either because of minimal hardware resources, as a performance optimization, or as a security constraint.)

<comment><USER11> I agree with Your claim about ASN.1 not intended to be parsed using hand written code. The ASN.1 is indeed quite close to a grammar specification, as also shown in the paper. However, I believe that a major issue related to its parsing complexity is the binary encoding generally used, which is either BER or DER: both of them employing length fields. While the usage of length fields is usually ubiquitous in formats related to communications protocols, these fields are quite annoying to be handled from a grammar design perspective. Indeed, a length field requires to count bytes of the payload: this operation is tedious to be done with grammars, while it is extremely easy with hand written code, in turn generally making the usage of grammar based automatic parser generators for these formats a less common choice.

From a grammar design standpoint, a delimiter based structure would be preferable. For instance, in the context of X.509, we proposed a new format[1] which replaces DER encoding with a new format where there are no longer length fields but the payload is terminated by a fixed delimiter. The grammar for this format was way easier than the length field base encoding, without requiring any hand written code.

[1] A novel regular fomat for X.509 digital certificates, [https://link.springer.com/chapter/10.1007/978-3-319-54978-1_...](https://link.springer.com/chapter/10.1007/978-3-319-54978-1_18)

<comment><USER10> I believe I read that paper recently :) Ultimately I ended up using PEGs. LPeg in particular, using LPeg's match time captures to recursively invoke PEGs for length-encoded objects. (In addition to the match time capture extension, what's especially nice about LPeg--missing from every other PEG library I've seen--is that you can build _and_ transform the AST in one shot.)

I've also tentatively rejected translation to a format like that proposed in the paper. In a secure enclave-like environment I'd rather be dealing with statically defined C-like structs with stronger invariants--i.e. no optional or sum types, no variable-length fields; basically, no need for any kind of parsing whatsoever. If I have to transform, I'd like to transform the message both syntactically _and_ semantically into the simplest possible form. Parsing complexity is only part of the equation. The other part is semantic complexity, which is a different kind of problem that better formats and parsers can't fix.

In another timeline things could have been different, but we don't live in that timeline :( We can't let perfect be the enemy of good. Even if we could move away from DER or even ASN.1 in the open source world, the entire telecommunications industry (and specifically the cell industry) is built around ASN.1 and DER/PER/XER. AFAICT the biggest users of asn1c are people working with 3GPP and similar standards. No matter how sane and secure we can make our open source ecosystems, ASN.1 and similar older tech will still lurk in the background, remaining the weakest link in the chain. If we want real security we have no choice but to develop better tooling in that regard. I appreciate your proposal is very much of that mindset, I'm just not sold on the practical utility.

</comment></comment></comment></comment></comment><comment><USER12> My default position on parsing anything more complex than a couple of comma- separated non-string values these days is to write a grammar and pick up a tool. I wish more programmers felt this way.

<comment><USER13> Event that is always highly annoying. How do you deal with (for example) Dutch decimal numbers, which use the comma for decimal separation, or numbers with a comma as a thousands separator?

<comment><USER14> 'Dutch' notation can usually be distinguished with enough context (i.e. if the number has decimals), or by comparing it to other numbers found in a file.

But don't get me started on people mixing American date notation and ISO notation. Especially mixing the separators.

If you ever have to work with date notations, use a hyphen as a separator for ISO, and use a forward slash (/) when using American notation. It's the only way to distinguish dates before the 13th day of the month.

<comment><USER15> I am sorry to tell you the rest of the world also uses slash with dates, it's not just a US thing. But with same field order.

<comment><USER16> Please note that in The Netherlands, the most commonly used date format using '/' is day/month/year, not month/day/year as seen in the US.

See also [https://en.wikipedia.org/wiki/Date_format_by_country](https://en.wikipedia.org/wiki/Date_format_by_country)

</comment></comment></comment></comment></comment><comment><USER17> Interesting how Apple's SecureTransport seems to be the most permissive of them all, rejecting 0 certificates that all the others complained about syntactic errors with in the dataset.

</comment><comment> k-ian [comment about x509 being bad]

<comment><USER18> Sucks that you're being downvoted since at the time you posted "X.509" wasn't in the title and it was reasonable context on _why_ "20% of HTTPS server cert are incorrect, half considered valid by libs"</comment></comment>


China Bans K-pop Music - <AUTHOR> http://www.digitalmusicnews.com/2016/11/29/china-bans-korean-hallyu-kpop/ <comment><USER2> The linked article is hyperbolic if we're generous, in my opinion it qualifies as an instance of "fake news".

>China has prohibited all hallyu, or Korean Wave (K-pop), content in the country

This and the headline are false. K-pop is available on Chinese music streaming services, Korean dramas are similarly still airing, etc. What is true is that Korean stars are increasingly being barred from having concerts, events, and TV appearances in China, and that is leading to concern about whether more regulations are to come. BTW, MAMA 2016 went ahead without issues.

A non-clickbait account: [http://www.telegraph.co.uk/news/2016/12/04/south- koreas-k-po...](http://www.telegraph.co.uk/news/2016/12/04/south-koreas-k-pop- stars-caught-crossfire-diplomatic-spat-china/)

</comment><comment><USER3> If China didn't want a missile shield at their doorstep, maybe, just maybe, they should've stop propping up a regime that carries out provocative ballistic missile tests in the region and threatens nuclear strikes against neighbors ad nauseam. China has nobody but themselves and shortsighted foreign policy to blame for this mess.

<comment><USER4> Yes China. Stop propping up the USA!

</comment></comment><comment><USER5> Curious how China's escalating displeasure with the THAAD system will affect the 2M Korean-speaking Chinese known as Joseonok[1]. One would have hoped their fortunes were on the rise, even if only slowly, but national attention on "Koreans" in general might be misconstrued against them.

[1] [https://en.wikipedia.org/wiki/Koreans_in_China](https://en.wikipedia.org/wiki/Koreans_in_China)

<comment><USER6> For those, like me, who were not in the know regarding THAAD, it stands for Terminal High Altitude Area Defense and is a US made antimissile defense system. The US is working with South Korea to install THAAD systems there. China is not happy about this.

<comment><USER7> It seems like pure defense system. Why should anyone object to it?

<comment><USER8> Because it breaks the doctrine of mutually assured destruction. If China loses the ability to effectively retaliate against a hypothetical US nuclear strike, it loses its superpower status.

<comment><USER9> THAAD isn't overly destablising to MAD, which operates on the strategic level. It has little effectiveness against ICBM re-entry vehicles which move very, very fast ( about 8 to 10 km / s ) and have all sorts of decoys and countermeasures.

It is designed for dealing with theatre missiles, IRBMs and the like, which move much more slowly, aren't well protected and aren't generally considered in the MAD calcul

Per state.gov:

 _Many of our regional defense deployments, like the Patriot system and the Terminal High Altitude Area Defense, or THAAD system, are inherently designed for theater use. They are not capable of defending against ICBMs launched at the United States. THAAD, however, is capable of defending against the medium- range and intermediate-range ballistic missile that North Korea is deploying._

</comment></comment></comment></comment></comment><comment><USER10> So it's a response to American imperial ambitions?

Note how missile defence in the nuclear arena can't be interpreted as purely defensive as it increases the viability of a first strike.

America also has retained the right to the "first strike" option unlikely China which has declined such an option.

</comment><comment><USER11> There's something truly childish about Chinese diplomacy. They regularly release statements to the effect that the Chinese people have been insulted by some obscure diplomatic statement, and now they're implementing sanctions in the form of banning pop music of all things.

Anyone have any recommendations for books or articles that shed some light on this seemingly bizarre behavior?

<comment><USER12> It does not seem childish to me.

From the article:

> Why? .... South Korea made the decision to deploy the THAAD American missile > defense system in the country

They are responding to increased military tension with their neighbor, with a minor economic sanction that will not hurt the health, welfare, or stability of their neighbouring country.

Such sanctions are a warning shot---a way of saying "yes you see what we did to the pop industry? we can do that to your heavy mining industry next".

<comment><USER13> > we can do that to your heavy mining industry next

You're ostensibly incorrect because China is a member of the WTO and can't unilaterally start economic sanctions against other WTO members.

I'm no expert but a particular kind of music (k-pop) is more cultural than anything else and so it may be one of the few legal options China has.

<comment><USER12> The US is a member of the WTO, but banned online gambling for years without any real sanctions against them.

Countries can and often do unilaterally break portions of global trade deals, and don't care unless there's action taken against them.

Oil producing countries are in a full blown international cartel, but does anyone stop them? Nope.

Is China going to get hit, whilst they're producing so much of the raw materials needed for electronics?

<comment><USER13> > The US is a member of the WTO, but banned online gambling for years without > any real sanctions against them.

I see you're trying to cast a hypocritical light on the US, even though the US has nothing to do with it.

The complainants (Antigua and Barbuda) were compensated in 2014, by the US.

Ultimately a country can build a case for banning a thing (a good, service, etc.) but if a country says 'These widgets are OK, in fact we manufacture them ourselves, but we've decided to ban the ones that come from country X' then that usually is anti-trade in no uncertain terms, in WTO language it is 'unfair.'

It's not like the US banned online gambling on purpose so as to try to cripple the Antiguan economy, as would be the case for banning Korean exports to China.

</comment></comment></comment></comment></comment><comment><USER14> The article reminds me how Obama stopped the burgeoning deployment of this system in various European countries at Russia's request, right after he took office, and I wonder if Trump will try to restart the effort to deploy them.

<comment><USER2> I'd be surprised if he tried to start a diplomatic crisis with Russia right away, just yesterday he said the US will have good relations with Russia under his admin.

The whole Trump/Russia situation is similar to Obama's pledges to warm relations with Russia (most famously, the "reset"), complete with the opposition's foreign policy hawks being perpetually outraged. Of course, the economic crisis was first through tenth on everyone's minds, so it never became a top issue for Obama.

</comment></comment><comment><USER15> A few concerts and other media products weren't approved. I didn't see in the article any official government statement categorically banning K-pop.

</comment><comment><USER16> That's one way to protect the local industry.

<comment><USER17> Actually, it's not aiming at protecting local music industry, if so they would do that years ago. It's more like to push political/business pressure on South Korea to stop them installing THAAD.

<comment><USER18> Yep, it said so in the article. But it's also possibly going to have the effect of protecting the local industry.

<comment><USER19> It is always hard to tell why they do things. The pretext is...retaliation, but they look at all the other wins, and protectionism has a lot to do with it. Heck, Korean dramas were getting way too popular for local media comfort before the THAAD cut backs.

<comment><USER20> S. Korea is also a democracy. The regime is highly suspicious of any foreign culture which might make people more interested in control of their own government.

</comment></comment></comment></comment></comment><comment><USER21> When we press the right buttons, we see that the world is plenty of crazy leaders.</comment>


Apple to release Siri SDK - <AUTHOR> https://go.theinformation.com/apple-opening-siri-developing-echo-rival <comment><AUTHOR> Summary:

1\. Enable Siri-2-app integration (likely similar to Android's intent URIs): "To work with Siri, the third-party apps will need some kind of search-query box that Siri could fill with the user's verbal request once the app is accessed. It's unclear what would happen if an iPhone or Apple Watch owner had multiple apps that did the same thing, like Uber and Lyft, and then asked Siri to "book me a ride home." (Don't bother asking Siri to book an Uber ride today; the results are typically terrible.)"

2\. Apple to release an Amazon Echo rival, powered by Siri, and probably open it up to content providers and developers.

3\. Both are likely to be announced at the upcoming WWDC.

</comment><comment><AUTHOR> Here is the direct link (paywalled, see summary below): [https://www.theinformation.com/apple-opening-siri- developing...](https://www.theinformation.com/apple-opening-siri-developing- echo-rival?shared=264e86)

</comment><comment><USER2> Also this: [http://techcrunch.com/2016/05/24/apple-prepping-siri-sdk- and...](http://techcrunch.com/2016/05/24/apple-prepping-siri-sdk-and-echo- like-home-assistant-gadget/)

</comment><comment><USER3> Paywalled :(

<comment><USER2> Yes, but there is a summary in one of the comments above</comment></comment>


Why Arguing is also a Good Habit? - <AUTHOR> http://www.theideallab.com/blog/thoughts/why-arguing-is-also-a-good-habit/

<comment><USER2> Good one.</comment>


SSH Security and You - /bin/false is *not* security - <AUTHOR> http://semicomplete.com/articles/ssh-security/

<comment><USER2> Best to lock the user account

usermod -L username</comment>


ZOMG My Passwords are Insecure, now What? How to Change Auth Backends - <AUTHOR> http://schneems.com/post/24678036532/zomg-my-passwords-are-insecure-now-what

<comment><AUTHOR> Here is another way [http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish- pass...](http://blog.jgc.org/2012/06/one-way-to-fix-your-rubbish- password.html)</comment>


PhpMyAdmin 3.3.10 is released - <AUTHOR> http://sourceforge.net/news/?group_id=23067&id=298637

<comment><USER2> Nice to hear it's still being developed. Personally, I've moved on to other, better solutions that are client-side. HeidiSQL (<http://www.heidisql.com/>) works well over SSH for Windows, or Sequel Pro for Mac (<http://www.sequelpro.com>). Being able to fastly import and export data, easier query manipulation, syntax highlighting and much better table manipulation. Oh, and MySQL Workbench is a very mature product and is great for modeling and syncing.

</comment><comment><USER3> Would have been nice to link instead to the release notes for this version. I assumed that something amazing had happened since the last one, but it's nothing too mindblowing.

Link to release notes: [http://sourceforge.net/projects/phpmyadmin/files%2FphpMyAdmi...](http://sourceforge.net/projects/phpmyadmin/files%2FphpMyAdmin%2F3.3.10%2FphpMyAdmin-3.3.10.html/view)

<comment><USER4> Not since the last one, but it appears the one before it had a pretty decent sized vulnerability.

[http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.ph...](http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php)

</comment></comment><comment><USER5> I've been using Navicat, a native app for this purpose. Basically mySQL workbench but nicer to use, or that Sequel Pro thing but with more functionality. It's a very polished piece of software, and I highly recommend it.

<http://www.navicat.com/>

</comment><comment><USER6> HeidiSQL ( <http://www.heidisql.com/> ) has interesting statistics on its home page:

MySQL version usage*

      MySQL 5.1 44.6%
      MySQL 5.0 42.8%
      MySQL 5.5 5.1%
      MySQL 4.1 4.2%
      MySQL 4.0 2.0%
      MySQL 3.23 0.7%
      MySQL 6.0 0.3%
      MySQL 5.4 0.1%
      MySQL 5.2 0.1%
      MySQL 5.6 0.0%

* Reported by 62028 HeidiSQL users over the last month, which have the statistics feature enabled in their preferences dialog.

I have a WAMP distro called WampDeveloper that uses MySQL 5.1 and have had a few emails about why I don't use 5.5...

Mostly because MySQL (and PHP) have had a really bad history of having their current "general release" versions of being beta quality. To skip the headaches, you should run 1 major version behind. The stats seem to back this up nicely. There are just about as many people using 5.5 as 4.1.

P.S., HeidiSQL is written in Delphi / Pascal and is GPLv2.

</comment><comment><USER7> phpMyAdmin needs a lot of work in my opinion, it feels incredibly outdated. SequelPro is probably the best MySQL front end I have ever used.</comment>


NodeKnockout is in Full Tilt. Checkout some demos - <AUTHOR> http://nodeknockout.com/

<comment><USER2> This seems like unnecessary namespace pollution.

There is a very popular frontend mvc framework called knockoutjs that people will be searching for information about using with nodejs.

Calling this node knockout is worse for people wanting to find this event and people wanting to find info about the knockout + node stack.

The Internet namespace is a commons that belongs to us all. Please respect that when naming your thing.

EDIT: apparently, knockoutjs and nodeknockout were released nearly simultaneously. Thank you for correcting me.

[https://web.archive.org/web/20100614190739*/http://nodeknock...](https://web.archive.org/web/20100614190739*/http://nodeknockout.com/)

[https://web.archive.org/web/20100709135451*/http://knockoutj...](https://web.archive.org/web/20100709135451*/http://knockoutjs.com/)

Apologies for thinking this was willful pollution, not simultaneous release.

<comment><AUTHOR> I think you may be misinformed. The NodeKnockout domain was actually purchased prior to the release of Knockout.js. The event was also announced prior to the actual release of Knockout.js. I belive it just happens to be an unfortunate coincidence.

Domain Name: NODEKNOCKOUT.COM Creation Date: 2010-05-28 02:13:00Z

Domain Name: KNOCKOUTJS.COM Creation Date: 01-jul-2010

[http://en.wikipedia.org/wiki/KnockoutJS](http://en.wikipedia.org/wiki/KnockoutJS)

<comment><USER2> I was misinformed. Thanks.

</comment></comment></comment><comment><USER3> Love the "Simon Says" app from Los Noders:

[http://los-noders.2013.nodeknockout.com/#](http://los- noders.2013.nodeknockout.com/#)

brought back some memories (and smiles!) :)</comment>


How to Overthrow a Government [video] - <AUTHOR> https://www.youtube.com/watch?v=m1lhGqNCZlA <comment><USER2> The speaker's previous presentation at a different year of the same conference, about using online records to fabricate your own death or the birth of a made-up baby, is also worth watching: [https://www.youtube.com/watch?v=9FdHq3WfJgs](https://www.youtube.com/watch?v=9FdHq3WfJgs).

<comment><USER3> Thank you very much for posting this. This is nearly unbelievably bad and also reminded me of last weekend's discussion here: [https://news.ycombinator.com/item?id=12511202](https://news.ycombinator.com/item?id=12511202) and brings that into a completely new light: Why even bother trying to vanish in order to fake your death when you might just as well just fill out the required forms on your own.

</comment></comment><comment><USER4> Made me realize I need to get a farm and a couple of solar panels.

<comment><USER5> I'm sure marauders would thank you (nicely of course) for all of your hard work to supply them with your booty.

<comment><USER6> [https://en.wikipedia.org/wiki/Second_Amendment_to_the_United...](https://en.wikipedia.org/wiki/Second_Amendment_to_the_United_States_Constitution)

<comment><USER7> Then the marauders will thank you for your pile of guns as well.

<comment><USER8> I sometimes think that the whole fashion around "prepping" is few hardcore survivalists ensuring that there will be lots of food, fuel and weapons stockpiled by the clueless masses and easily accessible after the apocalypse.

<comment><USER9> Like Civil Defense?

</comment></comment></comment></comment></comment></comment><comment><USER10> This is the classic book on the topic:

Edward Luttwak, Coup d'État: A Practical Handbook, 1968

<comment><USER11> One review on Amazon says "[...] The only asterix one would attach to it is that the second, and most recent, edition was published in 1979, so we don't have anything about dealing with the internet, mobile phone networks, etc.".

It seems that's a really big omission in any "practical" handbook. Apparently the author is still alive. Time for a third edition? (and I have yet to watch the video)

<comment><USER12> There is a new edition which was published this year (2016). I was able to get it via Amazon - maybe the review is a bit old? I haven't read much of it so far as I have a few other books on the go but the internet and mobile phones are certainly mentioned.

Edit: Revised edition still has the original author.

Edit 2: Amazon link (not affiliate link): [https://www.amazon.com/gp/product/0674737261/ref=oh_aui_deta...](https://www.amazon.com/gp/product/0674737261/ref=oh_aui_detailpage_o00_s01?ie=UTF8&psc=1)

</comment></comment></comment><comment><USER13> I don't get it, there was a lot of screenshots of consoles and such, is he implying that he actually did do this? .

<comment><USER14> He did pentesting for Kuwait government.

He's saying he could have done it.

<comment><AUTHOR> Why not follow through with something mild to demonstrate his case (with or without admitting to it)?

<comment><USER15> Yeah, why not?

(Holy f* s*)

</comment></comment></comment></comment><comment><USER16> Is he just saying that you can put down a government by faking a lot of news?

<comment><USER17> It's why China is cracking down "Internet rumors", and also why in the U.S., Twitter, Facebook, and Google, are forming an alliance to crack down on "fake news" [1], starting with stuff like censoring Hillary Clinton's passing out video and related trending hashtags [2][3], or videos of North Dakota's pipeline protests [4].

We're going to need a decentralized and censorship-resistant Internet/social media sooner than people think. By the next U.S. election, I fear the these three main sites will have already been co-opted to work as government propaganda arms [5], as a smooth transition from old TV media propaganda to Internet propaganda, as more people cut their cords.

The worst part is people won't even be able to easily see it. It's one thing to see a moderator on TV constantly hitting (or praising) a candidate and eventually realizing that maybe he or she isn't very fair or is biased, and may have ulterior motives for doing that.

But it's quite another to be so vigilant as to notice when Google shows you mostly pro-Clinton search results for neutral election-related queries, or when Facebook and Twitter "don't" allow some topics to trend (although I think more people are starting to catch on to these tactics, but it's probably not happening fast enough to make a difference this election).

[1] [https://www.engadget.com/2016/09/14/facebook-twitter- first-d...](https://www.engadget.com/2016/09/14/facebook-twitter-first-draft- google/)

[2] [http://observer.com/2016/09/facebook-and-youtube-show- franti...](http://observer.com/2016/09/facebook-and-youtube-show-frantic- alliegence-to-clinton/)

[3] [http://www.breitbart.com/tech/2016/09/11/hillary-health- stor...](http://www.breitbart.com/tech/2016/09/11/hillary-health-story- missing-twitter/)

[4] [http://www.theverge.com/2016/9/15/12926058/facebook- dakota-p...](http://www.theverge.com/2016/9/15/12926058/facebook-dakota- pipeline-video-censorship-protest)

[5] [https://theintercept.com/2016/09/07/google-program-to- deradi...](https://theintercept.com/2016/09/07/google-program-to-deradicalize- jihadis-will-be-used-for-right-wing-american-extremists-next/)

<comment><USER18> It seems these days that misinformation is the name of the game. It's all-but- impossible to tell the difference between intentional misinformation from a biased source and crying foul by a victim of misinformation, however. ("He's a psychopath!" "She's near her deathbed!")

Somewhat relatedly, I tried following both the main Clinton and Trump subreddits for a while and there was significant value in doing so. They were often talking about entirely different shenanigans going down... but... they were so vitriolic (and, frankly, childish) that I had to unsubscribe to them.

<comment><USER19> Yet false equivalences like this abound. Clinton is not nearly dead. Trump _is_ a classic archtype of narcissist personality disorder. This is reasonably demonstrable.

So, there are standards of evidence, science and expertise, which the peanut gallery in politics has been hacking away at for decades, paid for by rich short-sighted oligarchs, esp for example oil (look at the anti-climate-science lobby).

</comment></comment></comment></comment><comment><USER20> I liked the media manipulation part.

</comment><comment><USER21> Is the 'Chris Rock' in the comments the same Chris Rock who presented the talk? Seems like a pretty unpleasant human being, if that's the case...

Petty name calling, racist comments, etc...

<comment><USER22> I didn't do this much work and effort to be dissed by idiots and 13 year olds online that couldn't hack themselves out of a paper bag with a machete. Unpleasant maybe, man of the year haven't entered, discussing a modern day method, focus on the material not the delivery.

<comment><USER23> Hey, I'm just some random dickhead, but I enjoyed the talk, and past ones you've done. Hope to get to see one in person at defcon or something sometime.

Keep rubbing people and systems the wrong way.

</comment></comment></comment><comment><USER24> Will I be on a watchlist after watching this?

<comment><USER25> Depends on what watchlist you're referring to. Short answer: yes, multiple, but not because of the subject.

What you probably want to ask is 'how big is the watchlist'.

<comment><USER26> Any idea where I could read up more on watchlists. I kind of assumed they are happening but no idea what sort of thing gets you on one other than a sensible guess.

<comment><USER27> > no idea what sort of thing gets you on one

That's the evil nature of them. You don't know how you ended up on one (or how many). You don't even know if you're on one. And if you did, there's no process for getting off it.

There was a story several years ago about how one of the US states (Rhode Island??) was dumping everyone convicted of a felony into the national terrorism watchlist. And didn't care, because {shrug} they're felons.

</comment></comment></comment></comment><comment><USER28> I was expecting to see the comedian for some reason.

<comment><USER29> Oh he's a comedian, that explains why the talk was like this. Can't say I found it very amusing though.

</comment></comment><comment><USER30> This belongs to Reddit</comment>


Seven Ineffective Coding Habits of Many Programmers - <AUTHOR> http://www.infoq.com/presentations/7-ineffective-coding-habits?utm_source=hacker%20news&utm_medium=link&utm_campaign=coding%20habits

<comment><USER2> I think he is right on most stuff. I don't really like curly braces on their own line though, kinda separates the code too much unnecessarily.

But it's also harder to stay below the 80 cols on such a verbose language as java, I sometimes feel it's better to just ignore it and place everything in a single line (if it's greater than around 110 charecters then you really need to split it or refactor something).

In C at least it's idiomatic to place qualifiers and return types in their own line, leaving more space for the rest of the function signature, or you could code in a less noisy language like Haskell too.

</comment><comment><USER3> Slides are also at: [http://www.slideshare.net/Kevlin/seven-ineffective- coding-ha...](http://www.slideshare.net/Kevlin/seven-ineffective-coding- habits-of-many-programmers)

</comment><comment><USER4> This presentation could move a little faster, I think.</comment>


Ask HN: Review my startup Hachi (a tool to connect smartly) - <AUTHOR>

Hachi launched into private alpha last month. It's still a minimum viable product - we have a long way to go, and lots to do.
Hachi warms any cold call - it helps you connect smartly with anyone you want to reach out to (or connect with). Just input the name of the person, and Hachi will search thru all your social networks to find the best person to ask for a personal intro. Currently, Hachi searches 2 social networks, and we're working on adding more.
Demo video is on our splash page - http://www.gohachi.com/
Sign-up at http://www.gohachi.com/users/register , using the invite code: HN100
Would love to hear your thoughts and/or suggestions. <comment><USER2> First of all.. wonderful idea!

I tried logging in twice and this is what Hachi showed me

Warning (2): Invalid argument supplied for foreach() [APP/services/users_service.php, line 255] Warning (2): Invalid argument supplied for foreach() [APP/services/users_service.php, line 264] Warning (2): Invalid argument supplied for foreach() [APP/services/users_service.php, line 303] Warning (2): Invalid argument supplied for foreach() [APP/services/users_service.php, line 333] Warning (2): Cannot modify header information - headers already sent by (output started at /home/hachilabs/hachilabs.com/cake/libs/debugger.php:673) [CORE/cake/libs/controller/controller.php, line 742]

<comment><AUTHOR> Hey - sorry that this happened. We'll look into it right away. Do give it a try after a while!

<comment><USER2> Hey Hachi, thanks for noting comment. I wonder if the user/customer will come back after saying him "Do give it a try after a while" instead, I think more appropriate way would be to tell/respond him when you are done fixing the issue, rather than user checking whether the issue is fixed. Also, the later deepens the bond between you and user(taking appropriate (such) small steps makes all the difference and this is what separates you from your competitors coz everybody has hold on bigger steps). -Hope this helps :)

<comment><AUTHOR> hey - great suggestion! makes total sense - we will let you know when it's fixed. thank you :)

</comment></comment></comment></comment><comment><USER3> This seems to have some issues. I tried many different connections and none worked! I tried a direct connection as well. Apart from that, I suggest including a "text message" in the search bar to inform users what they can enter. I had a question - "Instead of entering a username, can I enter "Sales at Amazon" and will your system get my connections at Amazon?" - didn't know where to look for. Also a small change - Move logout link to top with FAQ, About as the linkedin alert masks it. Finally, consider providing cross connection through linkedin and facebook. That would be useful. Otherwise this would just be another implementation of Facebook connect.

<comment><USER3> Also, I could not find a link to delete my account. I think that's important.

<comment><AUTHOR> Yes, that's a valid request, and we'll work on it. For now - if you want, you can revoke access by going to Facebook Privacy settings --> Apps & Websites ---> there you can revoke access.

</comment></comment></comment><comment><USER4> Although I'm not on Facebook so can't properly check it out I do like the concept and it's great you're getting a MVP out there.

I can think of a couple of directions for this to go in. Whether you stick to the lead warming angle (b2b) or move towards some sort of umbrella search across all a user's social network (consumer play) is probably a decision to be taken once you have some feedback on how people are using it.

<comment><AUTHOR> Thanks Paul for checking out the app! Whether to go B2B route or go for consumer play, is something even we're debating internally, and you're right - it's a decision that'll be based more on how people use the product.

<comment><USER5> I can't see it being useful enough from a consumer point of view to warrant me paying for it (or using it often enough to be worth showing advertising to). I _can_ see businesses seeing it as something worth paying for if it works.

Unfortunately I can't get it to recognise even direct FB connections at the moment.

<comment><AUTHOR> We'll drop you a mail to understand more on why you couldn't find direct facebook connections.

And yes from monetization perspective - so far it does look like that business folks will be more willing to pay for such a tool. Thanks for checking it out and sharing feedback!

</comment></comment></comment></comment><comment><USER6> Just signed up and searched for a person in my facebook network even though I'm not directly friends with her. Hachi could not find way to connect with her though we have some mutual friends in common. Also how about connecting twitter account to get more connections?

<comment><AUTHOR> Hey thanks for checking it out. A bit surprised that this (Facebook) error happened.. thanks for reporting, we're looking into it. And yeah we are working on adding more social networks - Twitter is definitely up on the list!

</comment></comment><comment><USER7> Nice Concept. But don't get me wrong, you guys have to find a good designer for your site. Especially, the black background panics me (gives me an impression that I just logged in to some hacker site) plus the marquee on the home page takes me back to 90's era.

<comment><AUTHOR> Point noted. :) We've already started working on it.

</comment></comment><comment><USER8> Clickable links:

<http://www.gohachi.com/>

<http://www.gohachi.com/users/register> (Invite code: HN100)

</comment><comment><USER9> This sounds like caller ID on steroids.

<comment><AUTHOR> hey - not sure if I understood you clearly, pls explain. thanks!

<comment><USER9> Imagine hooking this up as a caller ID of sorts, you get an email, a text or a call from someone - and your engine goes and crawls all your social networks and contacts and pulls up whatever relational info it can find on the person.

Presenting you with their online social dossier as it were.

You could make it more powerful for business users and charge them for more indepth spidering of a person.

Sure, prolly a few iterations before you could do it to such a degree - but if youre not doing this, then who will be in your place? There has to be something like this out there already.

<comment><AUTHOR> Hey thanks for clarifying!

>>Imagine hooking this up as a caller ID of sorts, you get an email, a text or a call from someone - and your engine goes and crawls all your social networks and contacts and pulls up whatever relational info it can find on the person.>>

Rapportive (and few others) provides you with this info.- when you get an email from someone. If I understand correctly, then you're suggesting Rapportive++ ..??</comment></comment></comment></comment>


Show HN: Idea to App store in 1 month using JQuery Mobile + PhoneGap - <AUTHOR>

This is a side project I made with the help of JQuery Mobile and PhoneGap.
Design (1 week) Actual coding was about (2 weeks) Release to apple roller-coaster ride (1 week) Content came from my business partner.
I was so worried Apple would reject the application because it's 90% javascript, but to my surprise it passed with flying colors!
I ended up rewriting the app a few times because jquery mobile was so slow.  I wrote it again using Zepto but it wasn't any faster.  Turns out the web view in iOS uses an older version of the mobile safari, and as a result a slower javascript engine.  Apparently this will be corrected in the next version of iOS.
After trying it on a few other devices I realized the root cause of the slowness was my 3G iphone and not jquery mobile.  A hard reboot of the device made the app run smoothly.
You can check it out at this link.
http://itunes.apple.com/us/app/astro-dating-2012/id467097635?ls=1&mt=8
or
http://defyent.com/#astro-dating <comment><USER2> From my experience, using the webview in iOS becomes painful quickly.. It would be better if you slowly started learning objective-c, because that gives you more options once you become a little familiar with how things work...

And, just curious - you have priced the app at 1.99 - how are the sales so far?</comment>


Ask HN: Staying in SF during TechCrunch, any advice? - <AUTHOR>

Hey guys.
I'm the Founder+CEO of Qbix, Inc. We're based in NYC and this is the first time I'll be going to check out TechCrunch in San Francisco!
I was wondering if there way anyone here who could hook me up with some accommodations while I'm there. Either a hacker dorm, or maybe a room or something like that. Would be much more interesting to stay with fellow entrepreneurs and hackers than in a hotel room.
Let me know. You can find my contact information at http://qbix.com/about
Thanks in advance!
Greg Magarshak
PS: I realize it says I'm a president and yet I'm looking for a place to stay. I will look back on this later and probably think it looks quaint and cute. Still I like this! <comment><USER2> There's a startup campus in SOMA. Bunk-bed dorm style, mostly devs + startupers, $35/night if they still have space (I think they're almost filled with the Disrupt coming up). I've heard good things, message me and I'll put you in touch with the organizer.

<comment><AUTHOR> I would love to. Can you email me? My email is on <http://qbix.com/contact>

I dont know how to message you otherwise.

</comment></comment><comment><USER3> I have plenty of room in my new apartment and you a free to stay here, but I live in Berkeley. If you don't mind the hour commute hit me up! Email is in profile.</comment>


Show HN: AmzSear – The Unofficial Amazon Search CLI and Python API - <AUTHOR> https://github.com/asherAgs/amzSear <comment><USER2> Very interesting! Are there any limitations for the API usage of this script?</comment>


How to Write Unmaintainable Code and ensure a job for life - <AUTHOR> https://www.thc.org/root/phun/unmaintain.html

<comment><USER2> Well, I'll be: [https://hn.algolia.com/?q=how+to+write+unmaintainable+code#!...](https://hn.algolia.com/?q=how+to+write+unmaintainable+code#!/story/sort_by_date/0/how%20to%20write%20unmaintainable%20code)</comment>


Official Hacker News T-Shirt - <AUTHOR> http://teespring.com/hntees <comment><USER2> I don't really get this T, i understand its going for minimalism, but would someone who frequents HN recognize it if they did not already know its affiliation?(i wouldn't) & if the answer is no, then whats the point of the T?

Edit for clarity: Not knocking the cause, it is great. Just the design really, maybe im missing something.

<comment><AUTHOR> I kind of wish this were the top comment. It would be humorously appropriate if the top comment on the thread about the official HN t-shirt were the traditional nitpicking/point-missing type that is so commonly the top comment when people launch new technology here.

<comment><USER3> I mean no offense, and I realize that this is your site; but I really think jug6ernaut's comment added far more value than your response.

I don't think jug6ernaut missed the point whatsoever, and I wouldn't characterize him as nit-picking either: The question of who is expected to understand the t-shirt and what its point is (as compared to an unbranded t-shirt) are perfectly reasonable. Personally I see nothing wrong with t-shirts which can only be understood by an "in" group, but that doesn't mean that there's anything wrong with asking if that was the intention.

Your reply, on the other hand, strikes me as exactly the sort of knee-jerk defensiveness which often makes me wish that submitters couldn't comment on their own posts: Not only did you fail to answer the question, but you implied that jug6ernaut was being unreasonable to even ask it.

It's your site and you're entitled to encourage and discourage whichever types of posts you want -- but I think if your desire is to have a site where people engage in meaningful discussion, you made a poor choice here.

<comment><AUTHOR> I feel like I'm trapped in an HN parody.

It's precisely because I want HN to be a site where people engage in meaningful discussion that I try to discourage people from upvoting the first dismissive comment they come across. Even discourage is probably too strong a word though. I feel like someone standing in the surf, trying to hold back a breaking wave with his hand.

(I didn't answer his question because other users already had: <https://news.ycombinator.com/item?id=5363492>)

<comment><USER4> _I feel like I'm trapped in an HN parody._

Congratulations! We have a winner.

You have just won first place in the crowd sourced competition for the front of V2.0 of the official Hacker News Tshirt.

Honorable mention:

      Wear something people want.
      Correlation != clothesation.
      Fuck. That. Shirt.
      Take off this shirt and get back to work.
      Shirt early. Shirt often.
      Made from 100% down (votes).
      I clicked "threads" and got this shirt.
      RSS (Real Soft Shirt)
      Y Combed Cotton

<comment><USER5> Don't forget the runner-up,

        Unknown or expired link.

<comment><USER6> That one didn't get enough votes for obvious reasons.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> It seemed particularly appropriate for the HN t-shirt to raise money for Watsi, since you guys in a sense discovered Watsi. They'd had some publicity before, but it was after their highly upvoted post on HN that their growth really took off. That was also how we found out about them.

<comment><USER7> I was surprised to see that the price is only $13.00. You could charge more in my opinion. I normally am not seeking a bargain when my purchase is affiliated with a group that I have a strong affinity for and when the proceeds are going to a good cause. Most of my past purchases of charitable t-shirts were in the $20-$30 range.

Perhaps you will test a higher price for the next iteration and share the results in true HN style.

<comment><USER8> $13 is okay for us non-USians having to pay the $10+ shipping. So, an option for an additional donation might be better.

</comment></comment></comment><comment><USER9> I just wish it wasn't black. I get what you're trying to do with the color scheme from the site, but the black just completely overwhelms it.

If you're going to go with something without text, have the shirt be the grayish color, with the orange stripe going across the entire chest.

<comment><USER10> I was just going to comment on that.

To my eye, Slate, Asphalt, or Heather Grey would work better (in order of preference). [http://www.americanapparel.net/wholesaleresources/ExpressOrd...](http://www.americanapparel.net/wholesaleresources/ExpressOrder/catalog/product.aspx?s=2001&cid=198&w=0)

Also, these are 100% cotton, right?

<comment><USER11> We just added a Slate Grey option to checkout, you can now purchase! Thanks for the feedback.

<comment><USER12> any chance we can see a preview of it in the slate option?

<comment><USER11> I also added that to the campaign! Just click the thumbnails on www.teespring.com/hntees.

</comment></comment></comment></comment></comment><comment><USER13> Will there be a higher-grade customizable offering for us high-karma old timers who haven't seen a top bar in that color for years? I'd hate to associate myself with all these Orange Bars.

Buying, nonetheless. Not to wear in public, of course.

<comment><USER14> What color do you see? I never realized that the bar changes color.

<comment><USER15> With sufficient karma (trying to remember: was it 300? 400?), you can set the color you prefer.

<comment><USER16> Interesting, I did not know that.

Anybody know why the bar is defaulted to that shade of orange (#FF6600) in the first place?

<comment><USER17> I like the question. Until and unless the person who chose it wishes to answer, here's my attempt at a more-than-complete answer.

I guess orange may be chosen as a rather eye-catching color. A reddish orange may be chosen to be a bit more tasteful or distinctive.

The choice of RGB component values may originate in an older practice in web design called web-safe colors (<http://en.wikipedia.org/wiki/Web_colors#Web- safe_colors>). It uses the observation that 33 hexadecimal (let's write 0x33) evenly divides the range of an HTML red-green-blue color component: 0x00, 0x33, 0x66, 0x99, 0xCC, 0xFF. Choosing each of the three color components from among these six values yielded 6^3 = 216 colors, a palette that would fit into a low-end graphics adapter's table of 256 colors with room left over for system-defined colors.

Those who have studied Mersenne primes may recall that it is sufficient to observe that 8 is a composite number in order to prove that 0xFF = 0x100 - 1 = 2^8 - 1 is a composite number. And we compute that 2^8 - 1 = 255 which ends in 5, so it's obviously divisible by 5, the quotient being 51 = 0x33.

</comment></comment></comment></comment></comment><comment><USER4> Proud to buy and wear this. Thank you!

But I think I'll customize the back of mine:

"My cofounder went to Startup School and all I got was this lousy MVP."

<comment><USER18> Mine will be "Stay away and work"

</comment></comment><comment><USER19> Nice "insider" design!

Since international shipping is $10.50, putting the cost per shirt at $23.50, but shipping for additional shirts is only $1, if there was enough interest I'd be happy to front a UK HNLondon Meetup group-buy, with all costs shared equally, and shirts to be distributed at the next event following their delivery.

<comment><USER11> Hi from Teespring! If you guys wanted to collect a few UK orders together we'd be happy to ship them for free on us!

We used to use a cheaper international shipping service, but things would get lost too often and we hated seeing people wait weeks for their tees. We recently upgraded to USPS Priority International.

<comment><USER20> There must be a myriad number of dye-sub printers in the UK that use AA shirts - wouldn't it be cheaper to simply commission them to print and deliver your shirts in UK and Europe with your [customers] branding?

Shipping simple tshirts piecemeal seems so terribly wasteful to me.

<comment><USER11> We looked into this and surprisingly it's cheaper to produce the t-shirts here in the US. Their isn't the same level of competition on blank garment suppliers and screen printers, so the costs are significantly higher. Coupled with the fact you don't capture the bulk discounts it actually ends up a little more expensive!

We'll continue to look into it though, perhaps when we reach a certain scale we'll be able to command better prices.

</comment></comment></comment></comment><comment><USER21> Can I get one with "Unknown or expired link" on the back?

<comment><AUTHOR> We considered that, but it seemed too heavy handed.

</comment></comment><comment><USER22> To everyone who doesn't like the shirt design, but agrees with the idea:

Just donate 13 dollars to Watsi.

</comment><comment><USER23> If I saw someone wearing this t-shirt, I wouldn't know that it was HN-related. But wearing the t-shirt below, I have occasionally bumped into other people "in the know":

<http://sdf.org/store/shop.cgi?3;sdf10>

Plus the design is way cooler.

<comment><USER24> I dont really get why people want the shirt to be recognisable. To me it seems that only super brands will get a huge recognition, other brands will be left in an equally puzzling world.

Instead I prefer tees that trigger intrigue and sometimes awesome conversation. I have the 20th anniversary SDF tee, in four years of wearing it I have added a score of users to the service. Even once someone saw the DEC terminal and struck(?) up a really cool conversation about the hardware he worked on.

As an aside, my favourite conversation starter is the Double Fine Costume Quest Blueprint tee.

<comment><USER25> > I dont really get why people want the shirt to be recognisable.

That's kind of the core concept of putting something with any sort of meaning on a t-shirt.

<comment><USER26> What he meant to say was "widely recognizable".

</comment></comment></comment></comment><comment><USER27> The Teespring homepage seems to be designed just for people wishing to _sell_ their apparel, not for people looking to browse around for shirts. Is this in the works?

<comment><USER11> Most definitely in the works! We're planning on releasing a product iteration that has more discovery tools soon.

<comment><USER27> Sweet. Just followed on Twitter so I can check it out.

</comment></comment></comment><comment><USER28> Ah interesting, all proceeds going to the nonprofit 'Watsi' (YC's first nonprofit [1]) with the thread started by pg. I guess there must have been latent demand for such a shirt for a long time, and now that there's an appropriate recipient of the profits, the tshirts have become a reality :)

[1] <http://ycombinator.com/watsi.html>

</comment><comment><USER29> I guess the only reason I would know this has anything to do with HN is because this post. Other than that I think it's a little too obscure.

The price is right though, so I might go ahead and get one (plus I love HN), but I hope to see more designs in the future!

</comment><comment><USER11> Per request, we just added a Grey option in both men's and women's cuts!

The specific color is Slate - you can check it out on American Apparel's website at <http://store.americanapparel.net/product/?productId=2001>.

<comment><USER30> Skip the colour selector and go direct to Slate: [http://i.americanapparel.net/storefront/photos/zoom/serve.as...](http://i.americanapparel.net/storefront/photos/zoom/serve.asp?media=2001_slate.jpg)

</comment></comment><comment><USER31> Lots of negativity here, but I love the design. I wouldn't buy a shirt if it said hackernews on it. I would get to many questions for too many people, and I don't really want to explain what I'm wearing.

This is perfect. People who know, know. People who don't, won't care.

<comment><USER5> I don't seen an overwhelming amount of negativity here at all. Only couple of posts near the top respectfully commenting on the design. The reaction here seems to be positive across the board.

</comment></comment><comment><USER32> I love the shirt. I was nervous at the concept of a shirt dedicated to Hacker News, but it's very simple, yet will promote solidarity amongst weathers.

And I hear black is the new black.

</comment><comment><USER33> Ok, let's break it down a bit.

What is it?

A t-shirt.

Why?

To help charity through Watsi.

Why that design?

Because this is a shirt about hacker news and not ycombinator itself. Even though they are hosted in the same place, they are two different things and brands.

Also, notice that the only common design clue in hacker news is the orange top bar with the gray background. Hacker news lacks a logo. The nex best thing to use would be the only other thing that visually differences it: the ugly design.

Why not the ycombinator logo?

Because the shirt is about hacker news. Not ycombinator itself.

</comment><comment><USER34> This is ugly. I was shocked to Ctrl-f "ugly" and come up with nothing, but that's exactly what this shirt is.

<comment><USER35> That's funny because Ctrl-f "ugly" is the first thing I did after seeing the shirt, which is how I came across your post.

</comment></comment><comment><USER36> Why is the Hacker News not even written on the shirt? In my view, the favicon would have been a better design idea than this one. I don't get it.

</comment><comment><USER37> I knew these reminded me of something!: [http://www.google.com/search?q=london+train+ticket&tbm=i...](http://www.google.com/search?q=london+train+ticket&tbm=isch)

</comment><comment><USER38> How is it "official"?

 _Edit: I missed who posted it - thanks for head's up._

<comment><AUTHOR> We organized this.

<comment><USER38> I have ordered my t-shirt as well.

</comment></comment></comment><comment><USER39> There are minimalist shirts, and then there are official Hacker News shirts. Count me in.

</comment><comment><USER40> Hey, good job on the t-shirt! I like the color, _and_ the design, _and_ I think that proceeds going to watsi is AWESOME!

I ordered one and can't wait to get it!

</comment><comment><USER41> I am disappointed by the price. Why $13 and not $13.37?

</comment><comment><USER42> I love that people can't even refrain from negative comments on a t-shirt. You're not adding to the discussion here but still you need to snipe.

</comment><comment> user-id I don't mind the minimalism, it just looks weird sitting in the middle of a tee like that. Something a little more practical would have been cool, like a white tee with a beige pocket and orange trim on top of the pocket. Heck, even if it was just a printed faux practical pocket, it would actually be quite apt really.

</comment><comment><USER43> Does the price include shipping?

<comment><USER44> Looks like they tack on shipping when you check out. It was very reasonable for me though < $4.00

</comment></comment><comment><USER45> We used Teespring recently for a campaign for Roll20 t-shirts, sold around 200, and we've already gotten tweets coming in from people who have gotten their shirt and love it! So if, like us, you'd rather keep focusing on your product/customers rather than filling t-shirt orders, give Teespring a shot.

</comment><comment><USER46> The t-shirt is really boring.

</comment><comment><USER47> all that's missing is for a DMCA takedown notice to replace this page in a few hours, and a new thread of about three-hundred responses saying that copyright is destroying our freedom, followed by someone downloading the design and making it available via torrents to set it free!

</comment><comment><USER48> Teespring looks interesting. Has anyone here used it before? Does it print well?

I've been using printfection for a personal shop that does all the fulfillment (<http://shop.mrcoles.com/>), but the campaign approach looks pretty cool

</comment><comment><USER49> Why is the selection of payment methods so limited? :( They should learn from Humble.

<comment> robert-wallis MVP

</comment></comment><comment><USER50> I will buy the black t-shirt, but can I humbly request a white t-shirt option too?

</comment><comment><USER51> Awful design. So many other ways to do minimalist without doing downright ugly.

</comment><comment><USER52> Great idea! I would never use a t-shirt that "brand" me as HackerNews. Not even one that a "fellow HN user" would recognize - going further, I even think that wearing a t-shirt with my own startup logo is kinda silly.

Like it was designed though, as an "ode to the defining style of HN" (not an ad for HN, which is _very_ different), it fulfills the goal of relate to HN for the _buyer_ and promote the fundraising campaign. And I would still use a cool t-shirt, not a branded one. A jackpot, as I see it. I will check if they deliver to Brazil.

</comment><comment><USER53> It would be cool if my alias was printed on it.... and maybe my karma and my #1 post/comment (which would force me to purchase a new one every time I hit a new milestone, haha!))

</comment><comment><USER54> It's like a burqa for your nipples.

<comment><USER23> This is the best comment on this whole page

</comment></comment><comment><USER55> Small thing: I bought a slate T, and the confirmation page featured a large image of a black T, I had to go and double check the right one had been ordered.

<comment><USER11> We're working on that! The MVP for Teespring was originally built to support only 1 product, we've since realized that almost everyone wants to sell their tees on a few different styles/colors and have been revising the system to support the new functionality.

</comment></comment><comment><USER56> I was going to read through the comments in my usual routine of gathering insights the original link missed. Then it struck me. I liked that t-shirt. It simply looked good. What comment was I expecting? Some kind of logical reasoning about what's wrong with that t-shirt? Or a proof that the t-shirt is just fine? As wise barber once said, "We think too much and feel too little."

</comment><comment><USER57> I like this. I was ready to jump in here an complain about attracting attention from outside the hacker community. But this is perfect.

</comment><comment><USER58> No deal, I clicked the link excited wanting to finally show off my love of HN to my co-workers and was faced with a strange orange bar with a gray bottom. What? What are you trying to say with this? Watsi suffers for your decision. I would have bought two of them if it had actually said HN or Hacker News or anything more identifying than a bar with two colors.

</comment><comment><USER59> Love the idea, dislike the 1 color and the design. nothing wrong with minimal but this feels to narrow.

Should have put the [Y] somewhere in there imo

<comment><USER11> Hi Seb, we just added a Slate Grey option to checkout!

</comment></comment><comment><USER60> Does anyone know _which_ American Apparel shirt these use? Specifically, the fabric? 100% cotton, or 50/50 poly/cotton blend?

<comment><USER61> It appears to be 100% cotton [1] (linked from the "Launch a Campaign page [2]).

[1]: <http://amzn.to/WlmcDR> [2]: <http://teespring.com/design>

</comment></comment><comment><USER62> In the middle? Seems a bit tacky. Especially with the black color.

I'd see something like this would be better : <http://i.imgur.com/vURo089.png>

EDIT: I'm not fan of the design at all. Here's an idea (I suck at photoshop): <http://i.imgur.com/EqhulyO.png>

<comment> robert-wallis Any reason the logo is on the right instead of standard left? [https://www.google.com/search?hl=en&biw=1435&bih=762...](https://www.google.com/search?hl=en&biw=1435&bih=762&tbm=isch&q=company+tee+shirt+logo)

<comment><USER62> I supposed I pictured myself in a mirror when I did that.

</comment></comment></comment><comment><USER63> Anyone else having issues paying? I use my CC online all the time to pay bills and buy off Amazon, and never have any issues, but I receiving an error first that my card was declined, and then after retyping everything "There is a problem with the card you entered." - Contacting my bank now to see if they can give any insight.

<comment><USER11> Hey jneal, sorry to hear you're having trouble - want to shoot me an email at email@example.com? We can tell you what error we're getting from the cc processor.

</comment></comment><comment><USER64> I'd love to donate to Watsi + proudly wear a Hacker News shirt, but this design doesn't really do it for me.

<comment><USER65> It's plain and simple. My first instinct was "ugh, really?" because I don't like the design of the site to begin with. But then I realized... no one would ever ask me a question about the t-shirt, which is a big plus. Only people who frequent HN would recognize it, and where I'm from that's like zero people.

</comment></comment><comment><USER66> If the top comment is going to be nitpicking and point-missing, then I want to make a point about how the site has gone to hell in a hand basket, dammit.

Obligatory pointless side note: going to hell in a hand basket is much worse than simply going to hell. Perhaps it is because hand baskets are flammable?

<comment><USER67> It's actually because first they chop you into little pieces to fit you into the handbasket. You go to hell as a collection of parts, like legless C3PO, thus helpless to do anything about it.

<comment><USER66> pg selling t-shirts on HN, gambling at Rick's, cats and dogs lying together.

The barbarians are at the gates, I say!

</comment></comment></comment><comment><USER68> They look pretty darn slick to me.

</comment><comment><USER69> Fantastic. I just ordered mine. I shall wear it proudly and see if anyone recognises it. Hehe.

Thanks pg! :)

</comment><comment><USER70> Awful design: why design a shirt that won't sell?

Aside: why is white so often not available for t-shirts?

</comment><comment><USER71> This is really cool. I don't usually like to wear printed shirts of any kind, but this is nice and minimalist. Also I can never have enough black tees. And the watsi donation is icing on the cake. Thanks for doing this!

</comment><comment><USER72> Could we get a black bar version? For Aaron. And Steve. And Robert. And so on.

</comment><comment><USER73> Nice, I got two. Might be cool to write you HN username on it in sharpie.

</comment><comment><USER74> Nice design. Kudos to whoever came up with it.

Forget the naysayers. People have been spoonfeed by corporate advertisers so long, they think anything that doesn't function as an effective corporate logo is flawed.

</comment><comment><USER75> I'm sad that this one didn't get quite the same attention. Disclosure, I made it. <http://teespring.com/fundraising>

</comment><comment><USER76> Now if only there was a way to set up an NGO which could be run on auto pilot. Then it would be possible to do this for Dwarf Fortress without getting bothered by the hassle!

</comment><comment><USER77> ok, really like the idea, but I can't get comfy with the design. I would've really preferred a version with a big (orange) Y on it - or something a little less cryptic.

</comment><comment><USER16> HN has crept into one of my most frequently visited sites over the past years. I've spent way too much time on this site over the past several years.

This shirt's an autobuy for me.

</comment><comment><USER78> Here's an unofficial shirt of the famous YC saying "make something people want"

<http://teespring.com/makesomething>

</comment><comment><USER79> I am looking for a PyCon pass. If you are a hacker news reader and have an extra pass. I would buy ~20 of these for you, maybe for you to give away at PyCon.

</comment><comment><USER80> Well done. Happy to contribute and pick one up. Cheers!

</comment><comment><USER81> Order Placed! I'd be curious to know the the male/female tee style breakdown of the sales. Could the nice folks at teespring provide us with these stats?

</comment><comment><USER82> Now _that's_ a minimum viable product. Great execution and focus. You should double the price though - you would get twice the number of orders.

</comment><comment><USER83> Beautiful. Abstraction has a much longer shelf life :)

</comment><comment><USER84> Is the price the same shipped anywhere in the world? Its starts asking for your credit card details before shipping information.

<comment><USER65> To the right it shows shipping cost, with a question mark next to it that explains the fee.

<not affiliated, just on that page right now>

<comment><USER85> I think it's really misleading. I didn't notice this question mark, and found out about total price with shipment to UK only after I purchased it. There was no second step with confirmation or anything...

Shipping costs should just change on the page based on which country you select.

<comment><USER65> Oh, that blows. I guess I assumed it somehow knew I was in the US but would ask/figure out if you were elsewhere. You should probably throw them a message. I know someone who works there WAS creeping on this thread.

</comment></comment></comment></comment><comment><USER86> I won't wear this kind of branding, but if it was a HN-grey shirt with HN- orange collar/cuffs/trim, that I _would_ wear.

</comment><comment><USER87> They should increase the height of the orange header and add the Y logo to the left as it is on the site.

</comment><comment><USER88> Tried to buy one, but I just get a message that says "Your card will not accept a charge at this time".

</comment><comment><USER89> <http://teespring.com/rubypowered>

</comment><comment><USER90> I would've loved a fully orange design with a plain white Y in the middle.

</comment><comment><USER91> "Larger" view is smaller.

</comment><comment><USER92> Is the color not brown? Perhaps I need to calibrate my monitor

<comment> user-id It's pretty much beige.

</comment></comment><comment><USER93> It wont accept my card. It keeps saying there is a problem

<comment><USER63> Having same issue. My bank says they are not declining but the website keeps saying declined...

</comment></comment><comment><USER94> anyone have experience with american apparel tshirts? are they big, or smallish. Can't decide if I need double x or x.

<comment><USER94> from what i read elsewhere, they run a little small, 2X it is!

</comment></comment><comment><USER95> I'm a sucker for cryptic T-shirts, sold!

</comment><comment><USER96> I love the minimal design. Purchased.

</comment><comment><USER97> pg you are very kind .

</comment><comment><USER98> nice and subtle :)

</comment><comment><USER99> Watsi is great but I am not sure if I want to be constantly explaining the shirt to people.</comment>


Ask HN: What do you use to open large CSV files? - <AUTHOR> As a data analyst in a large organization, we still deal with large Excel files - wondering what the HN analytics community uses to open these large files? <comment><USER2> [http://www.schematiq.com](http://www.schematiq.com) \- files are loaded externally from the Excel process but are transparently accessible from within Excel.

</comment><comment><USER3> I use the sql BULK INSERT command to put it in a table. It's simple, fast, and gives you options to generate error files containing any rows with malformed data.

</comment><comment><USER4> If you are confident that it is well-formed, bulk-load it into SQLite is the easiest method. There're methods in R and Pandas too.

Or you could load into the Excel data model instead of the grid, look in the Get & Transform feature. Then do your initial exploration there. Data model (formerly Power Pivot ) is very underrated IMHO.

</comment><comment><USER5> [http://openrefine.org/](http://openrefine.org/)

</comment><comment><USER6> We use pandas for opening big data files, manipulating the data and then save it to a pickle file or a sql database for use consumption.

<comment><USER4> DataFrame.to_sql() seems painfully slow, do you have any tips for speeding it up?

What I do is dump it as CSV again after manipulation and then bulk load it into the DB using the DB's native tool. It's messy but 10x faster.

</comment></comment><comment><USER7> If you can do what ever you want to do by analyzing one line at a time I would recommend reading the file as a stream for processing.

If you can't do whatever you'd like one line at a time, read the file as a stream and write it to disk with some database(e.g sqlite, MySQL, Mongo). This will be slower but might be easier to play with the data.

</comment><comment><USER8> At first, I just look into it with less and then usually use R's data.table(fread) or some form of SQL for exploration.

</comment><comment><USER9> Targeting .NET and SQL Server, the LumenWorks CsvReader in conjunction with the SqlBulkCopy class. The performance quite good and avoids issues with permissions and file access when attempting to automate bcp commands.

</comment><comment><USER10> When you say "large", do you know _how_ large? Solutions might vary based on whether you are looking at a million rows or a billion rows.

<comment><AUTHOR> I'd say several million to several hundred million rows. Haven't seen a CSV that has a billion rows yet although I have had to consolidate multiple million row files into a single CSV.

</comment></comment><comment><USER11> [https://www.csvexplorer.com](https://www.csvexplorer.com)

<comment><AUTHOR> This website doesn't get past the corporate firewalls :)

</comment></comment><comment><USER12> Are you looking for something for free or open source?

<comment><AUTHOR> I'm fine with paid or free. Open source is fine as long as there is a pre- built package.</comment></comment>