Rob Pike: Notes on Programming in C - <AUTHOR> http://www.lysator.liu.se/c/pikestyle.html <comment><USER2> Can anyone who's worked on a well-written, large C project comment on the best way to structure headers and include files?

I don't like including stdio.h and stdint.h in every .c and .h file, but it seems like the "standard" way to compile with Makefiles is to compile each .h and .c pair as an object then link them together at the end. So you need the header files to use includes and such in every file or the compiler barfs.

Every time I try to structure a C project I feel like I'm doing it wrong and that there must be an elegant solution that I'm missing.

<comment><USER3> I'm not a C/C++ expert but I can highly recommend the book "Large-Scale C++ Software Design" by John Lakos. It gives an extensive discussion on how to structure programs and addresses the issue above in detail, in addition to many others. I'd be very interested to hear the opinions of any HN C++ experts on the principles espoused in this book (assuming a few have read it!).

<comment><USER4> It's a great book with valuable insights, i have successfully used them multiple times to decrease build times of multi-million LoC projects.

</comment></comment></comment><comment><USER5> I disagree with the include files section.

As long as each file has a proper include guard, it won't matter how many times you've included a file. I'd much rather have the preprocessor figure out when and where to include a file than do it myself. Maybe this was a significant performance issue in 1989, but it shouldn't be anymore.

That said, you should only include files that are direct dependencies. There's no need to include stdio.h in every other file.

<comment><USER6> That's a naive viewpoint. It's more of a concern in C++ ... if your codebase grows to massive proportions, and you #include headers within headers, then modifying a header can result in ~60% of your codebase being rebuilt. (At work, I deal with this pretty much every day.)

Including header files within headers is simply unnecessary, especially in C. You need to forward declare in header files, then include in source files where you _actually use_ that header file.

<comment><USER7> C is not C++.

In C you shouldn't be chaining header files because you don't make function calls in header files in C code (well most good C code at least, people abuse macros sometimes).

In C you should only include header files in header files if you have types in the other header files. It's _okay_ to forward declare if you must, but its often quite a bit clearer to not.

Additionally, you should always include all the h files that have your undefined functions (only relying on include chaining for header files at most). So if you have:

DogModule.c calling Sounds.c functions and exporting a public function in DogModule.c called "PlayBark(struct soundNode);", DogModule.h and things that use DogModule should both import Sounds.h.

Good C habits and structure are _very different_ than good C++ habits and structure. They're not the same language, not even close. Mangling your concepts of Good C and Good C++ is a great way to write both poorly.

<comment><USER6> Insightful, thank you.

</comment></comment></comment></comment><comment><USER8> I think it's helpful to have criteria like this out there, so that we can discuss them. That said, what's with the bias against capital letters? maxphysaddr is more readable than MaxPhysAddr? godisnowhere is more readable than GodIsNowHere? Or is that GodIsNowhere? I'm personally a fan of coding styles that cut down on ambiguity.

<comment><USER9> I prefer god_is_nowhere. The easiest thing to read is what you are used to. To fairly compare godisnowhere, GodIsNowhere, and god_is_nowhere, you need to stick with each for several days. I bet you'll discover, as I have, that god_is_nowhere is the easiest to read.

<comment><USER10> It makes the distinction between god_is_no_where and god_is_nowhere much clearer than GodIsNowhere and GodIsNowHere. A slightly more subjective one is for things with acronyms in them. Compare: check_url_index, CheckURLIndex and CheckUrlIndex.

</comment></comment></comment><comment><USER11> ''' The following data structures are a complete list for almost all practical programs:

array linked list hash table binary tree '''

this is why it's such a pleasure to program in modern high-level languages (e.g, python, ruby) --- these basic data structures (essentially sequences and mappings) are baked into the language with simple, concise syntax

<comment><USER12> Except for one. Quick: What's the syntax for a binary tree in Python?

OK, I'll give away the answer: It's not there. I don't think binary trees are even in the standard library for Python or Ruby. It's a sadly neglected data structure because, when exposed for what it is, it's a little bit too computer science-y for most people's taste.

<comment><USER13> Balanced binary tree versus hash table is an _implementation choice_ for the associative array abstract data type. Similarly, growable array versus linked list are implementation choices for the list abstract data type.

I don't buy that balanced binary trees are "too computer sciencey for most people's taste" as an argument against not have them as implementations of native types in Python. Designing a good hash table is equally as subtle in terms of both the theory and the implementation itself. But those details are not exposed through the _interface_.

<comment><USER14> "Balanced binary tree versus hash table is an implementation choice for the associative array abstract data type."

You can treat it as an implementation detail, but it's a good idea to let the client know that the underlying key-value collection is actually sorted by key. This allows the client to iterate over the key-value pairs in sorted order without dumping the keys to an array and then sorting it, retrieving the k smallest keys through forward iteration, retrieving the k largest keys through reverse iteration, etc. I think Java solves this nicely by creating the SortedMap subinterface of Map; if you have a SortedMap, you're assured these properties hold. (The typical implementation of SortedMap is a balanced tree, while the typical implementation of Map is a hash table.)

</comment></comment></comment></comment><comment><USER15> I agree with about everything but the best part is the function pointer chapter.

Function pointers are an insanely novel concept. They're not even a C thing per se but since C has first-class pointers they fit right it.

Nevertheless, most design patterns, closures, higher-order functions, more complex dispatching, etc. are effectively just a function pointer and possibly some userdata. You can think in Lisp but do it all in C with function pointers.

<comment><USER16> > _They're not even a C thing per se_

Really? from stdlib.h:

        void
        qsort(void *base, size_t nel, size_t width,
            int (*compar)(const void *, const void *));

<comment><USER15> Not even a C thing _per se_ , as in "C has function pointers but it's not really a C specific feature as some other languages have them too. Like assembly, very obviously."

Many other languages don't. If they're sufficiently high-level they might have function objects or closures, which often cover everything you want. If they're Java they have neither but you can write a Visitor-style class or some other scheme from the design patterns book that emulates the behaviour of a function pointer.

But fundamentally (and when the program is compiled down to machine code also hopefully) they're just function pointers.

<comment><USER17> I agree. Though what it gets compiled down to depends on the compilation strategy. If your compiler is smart enough, and your use of functions as variables / function pointers is weak [1] enough, your functions may, say, just get inlined into a big case-statement-like construct.

[1] In the sense of <http://en.wikipedia.org/wiki/Strength_reduction>

</comment></comment></comment></comment><comment> contol-m There is a lot more in his book, "The Practice of Programming" - <http://cm.bell-labs.com/cm/cs/tpop/toc.html>

</comment><comment><USER18> "Thus I say maxphysaddr (not MaximumPhysicalAddress) for a global variable, but np not NodePointer for a pointer locally defined and used."

Yes, because "maxphysaddr" is extremely readable for people who are not native English speakers.

Wait, was that "maxiphysadd" or "maxmphyaddrss"? Better stop coding (breaking up my train of thought) and scroll back up to the variable declaration to double-check how I spelled it.

(Yes, I know that modern IDEs can remember variable names for you, but there's _always_ those emergency situations where you wind up trying to debug something with VIM over SSH via a slow-as-molasses hotel wifi service.)

<comment><USER19> If you can't remember maxphysaddr vs maxiphysadd, I doubt you'll do much better remembering MaxPhysAddr vs MaxiPhysAdd.

<comment><USER12> MaxPhysicalAddress is more readable than all the above. Pike simply had it wrong, IMO, probably from having been immersed in a culture of poor readability for so long that he had become blind to some of it.

<comment><USER20> I agree with Pike on this one - and I think it's likely true what he says about being used to reading prose. For those of us who do a _lot_ of non- programming reading, Funny Out-Of-Place Capitals interrupt the smooth flow when reading variable names.

I do_tend_to_use underscores, though - I find that they don't have the semiotic noise value as WeirdCapitals.

<comment><USER12> I find the opposite — underscores are hard to read, but innercaps are almost effortless. At any rate, they're equivalent — you can mechanically transform from one to the other without data loss. I would say that either is preferable to not delimiting your words at all. It sounds to me like you agree with me more than Pike, modulo an insignificant matter of taste.

</comment></comment></comment></comment></comment><comment><USER21> The rule against nested includes seems dated — he doesn't like include guards in header files because "[t]he result is often thousands of needless lines of code passing through the lexical analyzer, which is (in good compilers) the most expensive phase." Surely not any more?

<comment><USER22> Indeed. I have read that parsing is the slowest part of compilation several times, but I guess this is very dated. For example, compiling numpy (a python package with ~ 100 kLOC of C code):

      - CFLAGS="-O0" -> ~ 20 sec
      - CFLAGS="-O1" -> ~ 35 sec
      - CFLAGS="-O3" -> ~ 60 sec

Since the amount of parsed code for those modes is approximately the same (for numpy it is exactly the same, but one could imagine differences in glibc headers, etc...), this shows that parsing is not the bottleneck anymore if you build non-debug builds.

<comment><USER23> No, that shows that the optimizer work takes a non-trivial amount of time. Optimizations (how often?) happen after parsing, type-checking and constructing the intermediate representation.

<comment><USER22> sure, that's exactly the point I am trying to make: if it takes 75 % time more to compile @ O1 than O0, it means that parsing takes at most ~ 60 % of compilation time for quite conservative optimization. I think it is quite common to compile above the lowest level of optimization.

To have an accurate estimation, one could look at clang, and only run the tokenizer.

</comment></comment></comment></comment><comment><USER24> I disagree with him on the include part. It is very difficult to remember the order of includes + dependencies for each file you want to include. It becomes very messy.

<comment><USER25> I agree. I have better things to do than to memorize the random prerequisites of header files. Not to mention cluttering my C source with junk that isn't important to the source in that particular file. My rule is that I should be able to make an empty C file and put a single #include "header.h" line. If it doesn't compile then there is a bug in that .h file.

<comment><USER26> One also sees the common advice to include the paired header (ie, foo.c should include foo.h) as the first #include to verify that foo.h is dependency- complete.

The problem with dependency-complete headers is that once a .c file relies on that header for a symbol, if the header is changed to no longer require the symbol, all those .c files have to have their #includes fixed. This can take a _lot_ of time to iterate through in a projects that require hours to compile.

</comment></comment></comment><comment><USER7> Notice the date folks: 1989.

Lots of development has gone into C for the better since then.</comment>


A New Stock Market Based Upon Athlete Performance - <AUTHOR> https://www.predictionstrike.com/ <comment><USER2> is this subject to regulations on sports betting? also the contact us form at the bottom doesn't work. no way am i giving you my money.

<comment><AUTHOR> This will most likely fit under the same exception to traditional sports betting rules as DraftKings and Fanduel. Apologies for that bug. We will address it ASAP</comment></comment>


Ask HN: What was your best passive income in 2018? - <AUTHOR> Any side projects, Game, OSS, Hacks. <comment><USER2> I built [https://dependabot.com](https://dependabot.com) to be passive, but ended up going full time on it (the startup I was working on feel through). Generates $9k/month passively, but I put my full-time energy into growing it (adding new languages / improving support for existing ones).

<comment><USER3> Your pricing seems way too cheap for the value you're delivering.

<comment><USER2> Haha, thanks, I guess that's one place where Dependabot shows its side-project roots - I just want as many people to use it as possible, and am less fussed about capturing the biggest share of value.

<comment><USER4> You can still get that benefit with the lower tier. I would definitely raise the prices for your higher tiers, because those are going to be for businesses, and they have money to spare. You might see your ARPU go up considerably. :)

</comment></comment></comment></comment><comment><USER5> I built [https://basicbands.com/](https://basicbands.com/) a fashion blog about watch straps. Its not very much work. Brands send me photography and I post it, or go to websites and request it and people send pictures to me to post. When I have time I write an article, but now most of the obvious articles have been written (how to replace your watch strap, etc), so I don't do that as much.

It's an affiliate income model, and it makes me enough to buy groceries and have a few nights out a month. It's much more fun than I expected it to be though. Turns out there are a lot of custom leather workers out there doing watch straps as a hobby and they produce AMAZING work, just incredible. Stingray leather, horween, lizard, I had no idea this stuff existed before I started. They are also a lot of fun to contact and hear their stories, so now I send them interview questions by email and post those. All in all I'm very happy with it. I got my inspiration from this subreddit: [https://www.reddit.com/r/juststart/](https://www.reddit.com/r/juststart/)

<comment><USER6> So how much are you making exactly monthly?

How did you decide on a niche?

How did you research your niche?

How long have you been doing it?

How did you do keyword research and such?

How much content do you write/produce?

Do you do reviews? If so whats your method?

Who are your affiliates? It sounds like you work with independent strap makers, how does being compensated for sales work with them?

How long did you blog before you started seeing a profit?

Do you think one day you'd be on track to promote your own watch/strap?

How did you make the actual site?

Thanks in advance. Hope you dont mind the questions

<comment><USER5> I make anywhere from $100 - $300 a month, once over $450 when someone bought a Rolex. I came across the niche browsing reddit's r/watches. There are a lot of watch blogs and websites, but almost nothing devoted just to watch bands & straps. It turns out a lot of people have an old watch they'd like to fix up because the strap broke.

The research wasn't very hard. I bought some straps and installed them to get the hang of it. Its actually very easy, and now they make quick release straps, so you can change out your strap every day if you want. Mostly it's a fashion blog, so the companies do the work for me by putting out great photography.

I've been doing it about a year and a half. The first 6 months I hardly made money and almost gave up, but then I wrote a popular article and managed to rank quickly and and people purchase watches through it.

I don't really do keyword research. Most of my money comes from two or three articles, one of which is about a particular watch. So I could write more articles about other watches when I have the time. But I have a full-time job that I love, so I only do this for fun. I've done some advertising on Pinterest that seems to have been useful, and Pinterest itself brings in visitors.

I used to write a lot of content but got a new position at my full time job that's been taking up a ton of time. When things settle down I'll write more. Other people hire writers, I'm not sure about that just yet. I don't do reviews, mainly because I didn't want to handle the shipping of bands back and forth. Seems weird to keep the review bands, although plenty of companies have offered free bands I've never accepted any.

I'm an Amazon affiliate, and also Etsy & Jomashop (a popular online watch seller) and one or two others that I've never got a sale from. I usually don't get compensated from featuring independent strapmakers, unless someone buys through Etsy. But they provide the interviews and a lot of great photography, so I basically feature them for free. The blog would be boring otherwise and they're very talented artists and fun to work with. Check out Combat Straps ([https://www.combat-straps.com/GALLERY.html](https://www.combat- straps.com/GALLERY.html)) or Jones in Tokyo ([https://www.etsy.com/shop/JonesInTokyoLeather](https://www.etsy.com/shop/JonesInTokyoLeather)) and you'll see what I mean.

I'm not interested in my own straps or watches, there are enough people doing that already so I'll stick with my quiet little niche. My website is just a WordPress theme.

Hope that helps. Check out the reddit link for r/juststart. It really is very informative and fun. This is my second business. The first one was an iPad travel magazine that failed miserably and never made a profit, but was also a lot of fun.

</comment></comment></comment><comment><USER7> I've posted about this before, but years ago I made a blog about completing the application and exams to obtain a professional engineering license in my jurisdiction. It is just a WordPress blog. Over a year or two, it started getting organic traffic since it provided information in an underserved niche.

After making next to nothing with Google ads, I was approached by another site that sold help packages for the licensing process and we struck up an affiliate deal. It didn't work right away and had to build up, but nowadays it generates anywhere from $200 to $800 per month in completely passive revenue (haven't written a new post in years). The revenue has been growing too. It will have done about $5k in 2018.

</comment><comment><USER8> Back in 2015 I wrote an ebook called "how to start and grow your subscription box from 0 to 1000 subscribers", as I felt I had learned enough about the topic while running my own business to have something useful to share. Odd thing happened though soon after releasing it, I'll get to that in a bit.

I recall it sold about $2k right after release, as Product Hunt happened to have just opened a book section back then and it got to #1 place for a day. I put it on Amazon, iBooks and Gumroad. Basically all the initial sales were from Gumroad.

But the cool thing is that although comparatively sales slowed to a trickle, now 3 years later it's still selling about $10 worth each month, now completely from iBooks and Amazon. It's not much, but at this point it's completely passive.

So the odd thing? While I was writing it I had just crossed 1000 subscribers myself. But after I released the book, I soon found out that a lot of my subscribers were actually using stolen card numbers and I had to cancel about a third.

So now I have a book out about how to get 1000 subscribers, but I don't actually have 1000 subscribers, and turns out I never really did, although I was convinced of it while writing it. It feels a bit like karma from being too proud too soon.

<comment><USER6> What do you mean exactly?

Your subscribers were using stolen cards?

So technically you did have subscribers they were just committing fraud to pay you?

<comment><USER9> They commit fraud to test their credit cards, not because they're interested in the product. Patio11 has a good article on this phenomenon.

</comment></comment></comment><comment><USER10> Listed a paid vm on azure,aws and gcp . The VM has all the required setup for learning Etherem and Truffle. Created video tutorials alongside to help use the VM. I have made around $1500 so far in 6 months and still counting.

[http://techlatest.net/products/products/](http://techlatest.net/products/products/)

[http://techlatest.net/support/ethereum/](http://techlatest.net/support/ethereum/)

</comment><comment><USER11> One small geography site, bringing "only" like 600-700$ a year, but it is passive. [https://random.country/](https://random.country/) I made few more similiar sites, but they all failed.

<comment><USER12> From ads?

<comment><USER11> To be honest, I don't even know how to montize such small and simple site. This is not service where you return every day, or every few days. It's like you use this site for a minute, two, than you forget about it.

<comment><USER6> What about a newsletter? Like random country/city facts emailed daily/weekly? Keeps traffic and interest in your brand more consistent and eventually you can funnel it into a bigger project?

I imagine it would do well with the trivia crowd

</comment></comment></comment></comment><comment><USER13> Started an online course on algorithmic trading at [https://algotrading101.com](https://algotrading101.com) and some Udemy courses 4 years ago.

Revenue peaked at $20k/month 2 years ago and is less than half of that now. That's probably because my SEO rankings plummeted this year, and that people seem less and less eager to pay for online courses. Maintaining the course is quite passive (answering students' questions by email) but growing revenue is an active process.

<comment><USER6> Did you ever feel imposter syndrome about teaching?

Are you qualifications ever questioned?

Do you think anyone with a self evaluated passion and knowledge of a subject can teach a course online?

How did you entice people tk buy your course? How did you market? Build a reputation?

<comment><USER13> 1\. At the start, I do feel it. But over time as I receive good feedback from students, it goes away. The key is to deliver (or rather, over-deliver) value to your students.

Many online teachers think they are not good enough because they compare themselves to the top 1% in the field. But even if they are far behind the top 1%, they are far ahead of the bottom 50% and their teaching is still valuable.

Sometimes, they turn out to be better teachers than the top 1% because they are nearer to their students level and can empathise and hence teach in a more effective manner.

2\. Rarely. Some students ask for my trading background and performance. I'll tell them the truth. Don't be afraid they will think you are under-qualified. If they do feel that way, they won't enroll and move on. There are plenty of people who will enroll in your course regardless of your qualification (I only realised this after I started teaching).

3\. Yes.

4\. I did an interview piece, you can find more info on how I started there: [https://hackernoon.com/founder-interviews-lucas-liew-of- algo...](https://hackernoon.com/founder-interviews-lucas-liew-of- algotrading101-250a58b50e34)

</comment></comment></comment><comment><USER14> I sell erotic stories online through Amazon Kindle. Made more than $200K last year but it's hard on the imagination

<comment><USER15> That doesn't sound very passive to me.

<comment><USER16> Authoring a book is very passive income.

Passive income is defined as high upfront work and very low maintenance work. Other than possible marketing tasks the author's job is done once the book is published and collects money on every sale.

<comment><USER15> >>Authoring a book is very passive income.

Authoring _a_ book, sure. But the parent poster implied that he/she continuously writes these stories, i.e. many of them, hence why they said it is "hard on the imagination".

<comment><USER16> Each book is passive income. I'd consider a prolific author as someone that makes a series of passive income intellectual properties.

<comment><USER15> I guess with such a generous definition of "passive income", anything is passive income.

I mean I'm still getting paid for the features I wrote for my company's software two years ago!

<comment><USER17> If you're getting paid for things you're not ACTIVELY working for, guess what... that's PASSIVE.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I published a video course ("Rapid Flask") and a book ("Flask by Example") in 2015 and 2016 respectively. I've made on average $100/month in royalties since. It wasn't a great financial decision considering the amount of effort required, but I learned a lot and feel like I could produce something moderately more successful next time (if I could find time) based on lessons learned from the failures.

</comment><comment><USER19> Real estate. The downstairs apartment gets me a cool $1700 a month for almost no work.

If you're going to buy a first house, it's worth it to go for a multifamily; up to four units you can still get in under FHA, you just have to live in one for a couple of years.

<comment><USER20> Until they stop paying rent and trash the place and squat and sue you for any imperfection such as accidental loss of heat in the apartment, while simultaneously not letting the boiler repairman in the house.

<comment><USER21> Couldn't that be covered with a decently written contract though?

<comment><USER20> Cant collect damages if the tenant is flat broke :/

<comment><USER22> Yeah, that's the problem. Tenant stops paying, illegally sublets the place, then disappears, and by the time you finally got their stuff out you've lost a year of rent and had to pay their utilities.

It's not that common, but it's a possible outcome, and a contract won't help even a little bit.

<comment><USER23> 1\. Invest in pro-landlord states. I know plenty of investors that haven't even walked the properties they own and invest out of state without issues. 2\. Interview potential tenants and verify income, rental history, references, credit check, background check, etc. 3\. Have a strong lease agreement that outlines all of this. 4\. Account for vacancies every month as an expense - 3-5% is pretty reasonable. And don't touch this money.

</comment></comment></comment></comment></comment></comment><comment><USER24> I built [https://hnrecommends.com](https://hnrecommends.com) a little while ago. It's the start of a curated list of Hacker News recommendations. I'm adding recommendations and products daily.

It's made a few dollars from affiliate links so far.

<comment><USER25> Thanks, that looks quite interesting. I have already found a book I might like.

> I'm adding recommendations and products daily. Do you add the > recommendations manually or do you use a crawler/API to copy the comment? > How automatic is it?

Finally, I have two suggestions: You're only selling to people in the US. Maybe you could also add links to other Amazon domains (or use a service like geni.us)?

And how about linking back to the comment thread? Sometimes, a comment only makes sense in its context, and I couldn't find a link back.

<comment><USER24> I do it all manually, but I use the API to get the actual comment text. I have been collecting recommendations for years. This is my way of organizing and sharing them.

Amazon has a service called OneLink that supposedly routes users to the Amazon store that's closest to their country (presumably, from their IP address). I'm using it (a simple script tag) but I don't know how reliable it is.

<comment><USER25> Thanks, I was wondering if you can parse all comments for a link to Amazon or something (but even that probably wouldn't get the recommendations without links).

At least for me, OneLink doesn't work. Apparently you need to be in the US, Canada or UK; the other countries aren't supported so far. Pity.

<comment><USER24> As you noted, you would still miss many recommendations without an Amazon link.

But even so, that would kind of defeat the purpose; I don't just want to aggregate recommendations. I want to include, more so, the ones that are interesting than frequent.

Additionally, besides books, I'll be posting other types of recommendations (travel, hardware, etc.).

<comment><USER25> Ah, thanks for clearing up my misunderstanding. That makes it even more interesting!

</comment></comment></comment></comment></comment></comment><comment><USER26> I built [https://alchemist.camp](https://alchemist.camp). It started as a screencast YouTube channel focused 100% on the Elixir language and after a some initial positive feedback, I created the site and added some premium content for paying subscribers.

At first I only charged $12/month or $96/year. As the library of screencasts grew, I raised prices to $15/month or $135/year and I'll probably raise prices again pretty soon. So far, it's been slow, steady growth and nobody has unsubscribed.

I think a key thing that helped me is that I made very different content from the other Elixir screencasters. They all focused on short, highly-edited content that taught specific language features or small libraries and I chose a project-based approach where I introduced language features as needed and videos sometimes reached nearly an hour. It made my service a bit less of a rival good to the others and instead something that people might buy _in addition_ to one of my competitors.

In 11 months of 5-10 hours a week, Alchemist Camp is covering the rent and it's also lead to me meeting a few famous Elixir devs, including José Valim! Definitely a fun indiehack and I'm glad I'm doing it.

<comment><USER27> I remember this site from Indiehackers, glad to see you're getting some traction!

</comment></comment><comment><USER28> Alright. I'll be that guy. I look at your list of side projects and I see nothing that's remotely passive. They all look like tons of work! My best passive income this year is my index funds -- for instance, the S&P 500 is up 3.9% year-to-date, and I've cumulatively spent under an hour this year thinking about it. Hard to imagine what else besides investments qualifies as passive. Maybe real estate? But how passive that is is questionable and very dependent on your particular circumstances.

<comment><USER29> I think it's pretty well understood that passive means without requiring on- going work, support or maintenance.

Even investing takes up-front work in the form of research and to actually setup the investment.

<comment><USER30> And the work to get the money in the first place of course

</comment></comment></comment><comment><USER31> Made 2$. I created WhatsApp Business Account ( Basically WhatsApp Business App for Business) and I help people with their questions. For example someone pinged and asked what is best tv to buy during black Friday. I see people value for real human feedback

<comment><USER6> So you're just a person people reach out to? How do people find you? How do they pay you?

<comment><USER31> Basically I let everyone know in my friends circle and relatives. They contact me with any questions or search queries (like best tv to buy within 1000$). Affiliated links by which I earn

</comment></comment></comment><comment><USER32> Wrote my first ebook about CSS last November [1]. With little marketing, I sold hundreds in the first few months, and after a year it's still bringing around $500/month.

I'm thinking about writing a new one, but I'm not sure about the topic.

[1] [https://jgthms.com/css-in-44-minutes-ebook](https://jgthms.com/css- in-44-minutes-ebook)

<comment><USER6> How did you market it?

<comment><USER32> Mostly through Twitter and my newsletter.

</comment></comment></comment><comment><USER33> About $2000 a month of pure passive income coming in from a diversified index fund portfolio (us + international + reit + small cap value) under the form of dividends.

It's somewhat more consistent than the appreciation/depreciation of the underlying securities due to the recent volatility, and I get the distribution straight into my bank account, which I usually just reinvest since I have a full time job that easily supports my expenses.

Dividend yield based on the current high valuations is pretty low though, I believe for my portfolio is around 2%, but hopefully in the long term that'll be just a small portion of the returns.

<comment><USER34> How much capital is driving that?

<comment><USER33> Roughly $1M.

<comment><USER35> <off-topic:> Cool username btw, huge Kerouac fan. I'm also from Lowell.

</comment></comment></comment></comment><comment><USER36> Is anybody doing "Parrot Secrets" type eBooks? And if you have and are reading this, what have been your best selling books?

Referencing this sort of thing: [http://www.parrotsecrets.com/](http://www.parrotsecrets.com/)

An explainer: [https://www.cringely.com/2009/03/14/parrot- secrets/](https://www.cringely.com/2009/03/14/parrot-secrets/)

<comment><USER37> "Sales Safari"[1] is probably one of the best ways to find which topics will sell.

General guideline from Russel Branson's "Expert Secrets": Pick one of the 3 major hot markets (health, wealth, relationships), pick a sub-market, then create a new niche in that sub-market (not recommended, but you might succeed competing with an existing niche).

"Stop your Divorce" [2] was written in the same way, and seems to have sold pretty well. (Also netted the counselor a lot of leads because his phone # was in the book.)

Interestingly, there's a counter argument to the advice presented in the "Parrot Secrets" book: [3]

[1]: [https://shop.stackingthebricks.com/sales- safari-101](https://shop.stackingthebricks.com/sales-safari-101)

[2]: [http://www.stopyourdivorce.com/](http://www.stopyourdivorce.com/)

[3]: [http://goodbirdinc.blogspot.com/2013/06/internet-fraud- targe...](http://goodbirdinc.blogspot.com/2013/06/internet-fraud-targets- parrot.html)

</comment></comment><comment><USER38> I have three sources of decent (return on effort put in) passive income this year.

\- Membership fees and sponsored posts on [https://thefootytipster.com](https://thefootytipster.com) (I maintain the WP site, but no real ongoing work) (roughly £300 per month)

\- Advertising on my tech blog [https://tosbourn.com](https://tosbourn.com) (roughly £30 per month)

\- Advertising on [https://howoldistheinter.net](https://howoldistheinter.net) (roughly £15 per month) - zero effort put into this once made and one redesign

I'm hoping to grow [https://cbdscores.com](https://cbdscores.com) over the next few months and add it to the list.

</comment><comment><USER39> I have an App on the PlayStore which generates around 400$ per month on average, liveable money when you're from India

<comment><USER40> LessPhone ?

How long did it take you to develop the app ?

<comment><USER39> Around 2 days for the prototype and 3 months for refinement.

</comment></comment></comment><comment><USER41> Real estate

Bought 3 student apartments in 2012 (when I was 24) and finished paying them at the beginning of 2018.

The apartments are entirely managed by an agency that finds the student, collects the money, does all the maintainance, and give me a fixed, guaranteed income.

This income is about 50% of what the students pay (about 330€ for me when the student pays 600).

So now I have 1000€ of passive income per month and only need to do my accounts once a year.

(In France, you can use a company to rent your apartments and avoid paying taxes, so I do that)

I'll probably buy 2 or 3 more in the future to be able to "retire early" and become an indie game dev full time.

</comment><comment><USER42> \- I have a self-published book at [http://discover- haxeflixel.com/](http://discover-haxeflixel.com/). Makes around 70£ per month.

\- I've got several android apps at [https://play.google.com/store/apps/developer?id=leoncvlt](https://play.google.com/store/apps/developer?id=leoncvlt). together they bring in about £80 a month. One of them, however, was recently picked as 'editor's choice' by google and this month alone brought in £600, hopefully it keeps some of that steam.

\- Built [https://cosflowy.com/](https://cosflowy.com/) in the last year, my biggest project to date which ironically brings in the least, just enough to pay for server costs. Need to do more marketing work, but I find it twice as tiring than actual development itself.

Lots of small things but no golden bullets yet. I'll keep trying!

</comment><comment><USER43> I translated some well-regarded public domain works into English. I make around 2-3k a month from the ebook sales. If you find niche areas of interest or research it can be quite lucrative. Of course you invest the time to translate but I find it rewarding and less like actual "work"

<comment><USER44> You just search for them and translate them by yourself? Or do you have some kind of publisher?

<comment><USER43> I often have specific authors or periods in mind - such as when I am reading a book and come across a reference to an untranslated author or piece - and so I just search for the source text (usually on wikisource or gutenberg) and make sure its public domain.

I publish them myself, yes - there is a "press" I put them under but its just me. I have a few friends who do reviews and I am also on several academic mailing lists

</comment></comment></comment><comment><USER45> I found a $20 in an ATM

</comment><comment><USER46> I have 3 apps on the App Store and I make around 500$ a month. It's not fully passive because I invest time in order to improve them and do bug-fixing.

[http://emailmeapp.net](http://emailmeapp.net) [http://www.digitalphotoframeapp.com](http://www.digitalphotoframeapp.com) [https://www.peopletrackerapp.com](https://www.peopletrackerapp.com)

</comment><comment> atom-morgan Self-publishing my first book [https://www.theangulartutorial.org/](https://www.theangulartutorial.org/)

<comment><USER47> How much are you making? How did you market it?

</comment></comment><comment><USER48> I set up [https://sketchpads.co](https://sketchpads.co) as a simple shopify site and I've been selling mobile and browser sketchpads to rapidly iterate on your wireframe designs.

I did some initial marketing and it's been bringing in steady income of about $200 every month. I've sold out of inventory multiple times and keep ordering bigger and bigger batches of sketchpads each time.

</comment><comment><USER49> I developed a trading model on [https://www.portfolio123.com](https://www.portfolio123.com) for my own personal use but that I later decided to open to subscribers. P123 calls them Designer Models and they're offered under a publishing model were subscribers assume responsibility for whether or not actual trades are made.

Subscription revenue is about $500/month.

<comment><USER50> Where I can find your verified track record? Thanks!

<comment><USER49> P123 maintains a record of simulated trades. Those trades are recorded at a price of trade day (High+low+2*Close)/4\. They also make a slippage adjustment. Trade commissions are added under their Book system.

There isn't a direct link. You may find my models under Models->Designer Models ([https://www.portfolio123.com/app/r2g](https://www.portfolio123.com/app/r2g)) and then filter by my username - wwasilev.

</comment></comment></comment><comment><USER51> [https://piln.xyz/](https://piln.xyz/) has earned me 918 satoshis so far.

</comment><comment><USER52> I built [https://www.docsapp.io/](https://www.docsapp.io/) while learning new programming language. Now DocsApp generating passive income for me, not a lot, but small profit. Next step is to build content around my product to generate more traffic.

Anyone know where to find good technical content writers?

<comment><USER53> Depends on what level, you can probably find the more creatively independent on here, and even judge work sample through the comments. Email is in my profile if you're interested.

</comment></comment><comment><USER54> Built [http://www.vitiligotreatmentinfo.com/](http://www.vitiligotreatmentinfo.com/) some time back. It generates income through Adsense and Amazon associates program. Planning to update the content whenever I have a few days off. So far, it is on auto-pilot.

</comment><comment><USER55> An app in the iOS store which generates $0.20 per day on average. That's the best;) All other income is active.

</comment><comment><USER56> I made about $4000 from my newly created product [https://archbee.io](https://archbee.io) with very little maintenance. Not exactly passive, but close. With the knowledge earned I'm launching V2 early next year hoping to build a solid company :)

</comment><comment><USER57> I created two udemy courses a few years ago. Been generating money ever since.

[https://image.ibb.co/b75uVL/B77-D6-BA2-7-EBB-4645-8946-C5-C8...](https://image.ibb.co/b75uVL/B77-D6-BA2-7-EBB-4645-8946-C5-C83-C846-CB0.jpg)

<comment><USER58> You think they pirated your course on March?

<comment><USER6> What happened in march?

</comment></comment></comment><comment><USER59> A small pre production, storyboard & film treatment templates shop on Gumroad: [https://gumroad.com/storyboards](https://gumroad.com/storyboards).

</comment><comment><USER60> Salary from the employment contract.

<comment><USER61> Daddy's trust fund

</comment></comment><comment><USER20> My bank account pays me $93 a month in passive income. This is truly 0 effort and is almost enough to afford Thai rent

<comment><USER62> 93 $ a month, how much rate of interest does your bank pay ?

<comment><USER63> If you have a 2% interest rate, 10-15k in your account will generate that amount monthly. Totally doable if you're living in a country with a COL that low to begin with.

<comment><USER30> Due to inflation the value of the money is going down though, so I don't think this is really income, unless you're getting returns greater than inflation.

</comment></comment></comment></comment><comment><USER64> Market making on various cryptocurrency exchanges. Not entirely passive, still a lot of work. But can't really complain.</comment>


Making All Software Into Tools Reduces Risk - <AUTHOR> http://smoothspan.wordpress.com/2007/11/30/making-all-software-into-tools-reduces-risk/

<comment><AUTHOR> Interesting take on the "shoulders of giants" metaphor.

With the right software, you can be your own giant.</comment>


Ask HN: How would you solve case mis-match in C++ includes? - <AUTHOR> I came into possession of a large-ish C++ project (2000 files, 20 Mb of code) that i want to port to Linux.
The code is rather clean and not too OS-dependent, so i didn't expect much problems. But straight away i ran into a show-stopper.
The files are all in rather random case - some are lowercase, some are camel-capitalized.
The #include statements in them are also in rather random case.
And the problem is that these two randoms are different randoms that rarely match.
Windows does not care about such things, but in Linux this matters.
So, how would you go about fixing something like that?
On one half, renaming a lot of files to lowercase is a matter of a simple bash script.
But on the other half it's a matter of going through thousands of files and manually changing the case in #include to lowercase...
I was thinking of making a relatively simple CPP-like parser that would look for the right preprocessor statements and fix them, but first i'd like to know whether this bicycle have been invented already.
TL;DR: Is there an existing tool that can go through 2000 cpp and h files and change the #include "..." statements to lowercase? <comment><USER2> Sed is not enough ?</comment>


Hacking healthcare: Checkout our Startup Weekend project, CarePrice - <AUTHOR> http://www.careprice.co

<comment><AUTHOR> We were happy to finish Startup Weekend 6 in Charlotte with a fully functional site and demo including a compare demo, mailing list, contact form, authentication, user management, and backend demo containing private health provider data demonstrating out of pocket costs to users (a much different number than the frontend medicare data).

We're looking for our first integration with a small to medium sized health insurance agency that doesn't have the resources to build such a system themselves. If you or anyone you know might be interested, please contact me at email@example.com and we can discuss.

The website itself doesn't lend itself well to explaining our pitch, but everyone should find it useful nonetheless. Please don't hesitate to ask questions reddit AMA style.

</comment><comment><USER2> Did you include HHS hospital charge data? If not, might be a nice fit: [http://www.hhs.gov/news/press/2013pres/05/20130508a.html](http://www.hhs.gov/news/press/2013pres/05/20130508a.html)

<comment><AUTHOR> Our public facing demo at [http://www.careprice.co/compare/](http://www.careprice.co/compare/) utilizes the full CMS data set (200,000+ records) and is freely available. While this data is useful, it doesn't directly represent out-of-pocket costs for consumers and doesn't factor in things such as in-network and out-of-network costs as well as the specific insurance provider plans for a companies employees.

Our vision is that the paid backend version of the site will utilize insurance provider data for each individual's insurance plan to accurately price out healthcare procedures/issues.

We have a grandiose vision and we're looking for a pilot partner insurance company.</comment></comment>


Turns out coffee pods are pretty good for the environment (2019) - <AUTHOR> https://www.wired.co.uk/article/coffee-pods-nespresso-recycling <comment><USER2> >According to research by Halo, a British producer of compostable coffee capsules, every minute about 39,000 of these pods are made worldwide, while up to 29,000 are dumped in landfill sites.

29 000 every minute.

I find it really hard to believe that this is better than the traditional espresso.

IMO the way this blog post is written makes it seem sponsored by capsule manufacturers, which have huge margins versus traditional espresso.

<comment><AUTHOR> 29,000 every minute, compared to however much grounds/filter waste used to make drip coffee.

<comment><USER3> Obviously capsules still have grounds in them, they have to be washed before recycling first. And filters are usually made out of waxed paper which decomposes quickly.

</comment></comment></comment><comment><USER4> Interesting article. It really does highlight how "just put it in a landfill" can be a legitimate strategy.

What about the carbon footprint if the coffee is brewed with renewable energy? Depending on how you brew your coffee, I can see pods scoring worse as they would have the hard to recycle plastic waste, vs none at all.

Also, what about the health impact of micro plastics leached when the capsules get heated up?

What about the extra shipping costs of all these little pods vs a bulk purchase of beans from a local shop? The big bag is more efficient to ship.

<comment><AUTHOR> Would aluminum pods leach micro plastics?

<comment><USER4> Presumably not, unless there was a plastic coating of some sort. The Nespresso pods in the article mentioned a silicon coating on their metal pods. I don't have an idea if that would leach or not.

Since the recycling process for those metal pods is such a pain, I can see them acting pretty much the same as plastic when it comes to an environmental impact, other then possible leaching. (Not to mention to recycle them they need to be shipped to a special facility)

<comment><USER5> Have you seen the Nessie Press recycler tool? It's a manual tool that cleanly removes the grounds from the pod in one quick motion, so it can make it into your household recycling along with the aluminum cans. I'm surprised Nestlé doesn't include one in the box. [https://www.upress.coffee/](https://www.upress.coffee/)

<comment><USER4> I have not! Thats pretty awesome. I must confess I don't actually own a coffee machine; a kettle and french press does all I need!

<comment><USER5> Everybody has their preference. FYI, you might consider checking out the AeroPress[1] if you're a french press user. I find that it delivers some of the best coffee I've ever had, while providing a similar coffee making experience. Since it uses a paper filter, you won't get as much cafestol and kahweol in your cup (it's the bad kind of cholesterol [2]). Not to bag on french press; I find it pleasing.

Edit: Neglected to mention for anyone seeing this that Pete's Nespresso pods[3] include a paper filter under the aluminum foil, so if you're concerned about filtering out the less desirable compounds, those are the pods to look for.

[1]: [https://aeropress.com/](https://aeropress.com/)

[2]: [https://voltagecoffee.com/is-french-press-coffee-bad-for- you...](https://voltagecoffee.com/is-french-press-coffee-bad-for-you/)

[3]: [https://www.peets.com/coffee/espresso- capsules](https://www.peets.com/coffee/espresso-capsules)

</comment></comment></comment></comment></comment></comment><comment><USER6> No way Nespresso pods are lined with _silicon_ , right? Maybe _silicone_? There are a bunch of sites repeating "silicon" and several others saying "food grade lacquer".

Pedantry assistance appreciated.

</comment><comment><USER7> It's an interesting argument, but it doesn't address how you balance electricity usage, biodegradable waste, and non-biodegradable waste.

Let's assume the article is correct and coffee pods result in more efficient use of the coffee. How much more efficient does this have to be to balance out all the extra plastic?

Just comparing the energy needed for growing/processing coffee and manufacturing pods isn't enough. How do you factor in all the pod waste? What is the metric there?

The article argues that recycling coffee pods is feasible... but I've never heard of anyone actually doing that, and I don't see how they ever would.

</comment><comment><USER8> I didn't assess the study itself, but it focuses on the wrong metric. Even if a single coffee pod were to be more CO2-efficient than an espresso from an espresso machine, the popularity and consumerist approach makes it so that you will have more coffee (rebound effect). Without a nespresso machine in the office or at home, would you walk out to the coffee shop for a coffee 3 times a day?

Coffee is made from an exotic plant and should be treated as a special treat, not a "brain enhancing" commodity like it is today. If people had this mindset, it wouldn't matter how you brew your coffee.

</comment><comment><USER9> >And according to new research, recyclable aluminium pods are more environmentally friendly than all other capsules, whether they are made from plastic or compostable materials.

What's the environmental impact of large burlap bags or those small aluminum/plastic bags that hold less than a pound? Just as good as any other solution that doesn't require customers to recycle?

</comment><comment><USER10> > His team found that instant coffee comes out best, but that capsules are the > runner up in the environmental impact stakes. Filter or drip coffee comes > third, while traditional espresso has the worst environmental impact. "The > impact, such as greenhouse gas emissions, water and fertiliser use, mostly > occurs where the coffee is grown," says Hill. "Capsules tend to need less > coffee input to make a single drink and so their overall impact can be lower > even though we see more waste when we throw them away."

I find it difficult to believe that the 2 tablespoons-of-coffee per 8-oz cup has a bigger environmental impact than the plastic-bit.

I think I see the argument, but its hard for me to agree to it.

EDIT: Hmm... there's a cool heuristic that I always go back to whenever we start measuring small things. Assume all weights have the same environmental impact: because the biggest user of greenhouse gasses is the truck (or boat, or train) used to transport the material.

EDIT: So 2-tablespoons of coffee weighs ~10-grams. The article quotes 5.7 grams of coffee per capsule. How heavy is the capsule? If the capsule itself is 4.3 grams (or less), then maybe you're saving energy on transportation costs.

EDIT: My bet however, is that a bag of coffee beans delivers the greatest coffee-to-weight ratio and is the most environmentally sound. Coffee Filters are extremely light, and there are steel mesh reusable filters if you care about the environmental impact of disposable paper filters.

\</comment><comment>-----

> Aside from the environmental impact of growing beans in the first place, the > second biggest hit is the energy it takes to brew coffee. That's why > barista-made espresso fares so badly in terms of its environmental > footprint: a lot of energy is needed to brew just a tiny single espresso > cup. Capsules, on the other hand, are more efficient. The coffee machines > only flash-heat the amount of water needed for one portion, unlike, for > example, boiling a kettle.

Cold brew for the win? I actually prefer cold brew whenever I do things myself for taste reasons. (Less bitterness). Cold brew is also more convenient: I pull it out of the fridge, then drink without any wait time.

\</comment><comment>----

> Sebastien Humbert, an expert in life-cycle assessment studies at Quantis, a > company that works with many organisations to improve their sustainability, > cautions that if you take a responsible consumer — not an average consumer — > then it is possible to make drip-filter coffee with less negative impact > than capsules, albeit just ever so slightly. "However, if you are an > irresponsible consumer, if your drip filter machine is very inefficient, if > you leave it on, if you make more coffee than necessary, then you can make > drip-filter coffee significantly worse than capsules," he says.

Okay: so it seems like they're assuming irresponsible and wasteful behavior on behalf of drip-coffee makers.

<comment><USER4> > Okay: so it seems like they're assuming irresponsible and wasteful behavior > on behalf of drip-coffee makers.

Not to mention it ignores the other ways of consuming coffee, such as pour- over or French press.

<comment><AUTHOR> I think they are saying that in those cases, you'll likely boil a whole pot of water, which takes a lot of energy compared to flash-heating just the water needed.

I didn't see a comparison to automatic espresso machines, which I would assume would be similar in energy/water use to a capsule maker, but without the capsule waste.

<comment><USER3> I make all of my coffee in a mokka pot, every morning - so it boils exactly as much water as fits in my mug, nothing more. And it doesn't consume any materials, the whole thing is stainless steel with a rubber gasket which I just rinse under the tap after every use.

<comment> blaser-waffle Aye, same here.

Rubber gaskets last a long time, too. I've replaced them once in 5 years. You can get a 3-pack off of Amazon for like ~$8 bucks or less.

Don't have to boil tons of water, not tossing out anything except grounds, and generally get a better coffee than via drip.

As as of the grounds: I have an old coffee tin, one of the big ole "chock fulla nuts" ones, that I put the old grounds in. Eventually they end up in a compost pile outside, with all of my veggie choppings and lawn clippings.

<comment><USER10> > As as of the grounds: I have an old coffee tin, one of the big ole "chock > fulla nuts" ones, that I put the old grounds in. Eventually they end up in a > compost pile outside, with all of my veggie choppings and lawn clippings.

I don't have a yard, so I can't compost. But it should be noted that coffee grounds are one of the most ideal items to compost.

Most people's compost piles are Carbon-heavy, but Coffee Grounds are (just slightly) nitrogen-heavy. So with a mix of some carbon-heavy items (paper, leaves, etc. etc.) you're all set.

</comment></comment></comment></comment></comment></comment><comment><USER11> Everything that comes out of these pods tastes like plastic to me. I can't see the attraction.</comment>


Logging vs. instrumentation - grey-area http://peter.bourgon.org/blog/2016/02/07/logging-v-instrumentation.html <comment><AUTHOR> I think, like most people, I will disagree with this:

> _In my opinion, my thesis from GopherCon 2014 still holds: services should > only log actionable information._

This assumes that I have future knowledge of which logged events will be actionable.

I used to work in the classifieds department of a newspaper. The rule of thumb was that the cover of the newspaper was worthless by 11am, the classifieds by 2pm.

But that's not quite true. Every single edition of a newspaper retains a small probability of turning out to be very important at some unknown future time. Hence the practice of archiving.

So it is with logs. In my day job I have on several occasions turned to raw logs in order to reconstruct the history of unexpected events.

What metric, to take an actual example, tells me that a user was trying to evade export control by hopping to a VPN halfway through a session? Which gauge tells me that an error was caused by the interaction of third party javascript and an obscure web browser?

For myself, I draw the boundary differently. Logging is for events with identity, events that will be inspected individually. Metrics are for events that will never have identity and will only be understood statistically.

<comment><USER2> IMO the author buried the lede:

> Finally, understand that logging is expensive. I've seen entire teams of > absolutely brilliant engineers spend years building, managing, and evolving > logging infrastructure. It's a hard problem, made much harder by > overburdening the pipelines with unnecessary load.

It's ultimately a piece about engineering cost versus benefit. There's a real cost associated with logging every event with identity, to create an audit trail. Maybe that's necessary in your domain, for compliance reasons or otherwise. In which case it falls into the bucket of machine-read structured logging, and you design for it. But for lots of domains, it isn't strictly necessary.

<comment><AUTHOR> In which light, allow me to rephrase the argument:

Log as much as you can afford.

Given that the cost of logging is low and continuously falling, the default decision should be "log everything".

"Log only actionable messages" is analogous to advice like "always use bit masks instead of booleans", or only "use two digits to encode years". It assumes algo-economics that are no longer the normal case.

<comment><USER2> > Given that the cost of logging is low and continuously falling

Everything gets cheaper in time, but the cost of logging is actually quite high.

<comment><AUTHOR> I don't know who downvoted you, though I still disagree.

If I was writing an embedded system, or a system with soft-to-hard realtime requirements, or one where flat straight line performance was the only requirement that counted, sure, I might ditch or constrain logging.

These systems might be common by manufactured volume. But most programmers will never touch one.

You're probably thinking of I/O costs. Again, these aren't as a brutal as they used to be -- SSDs swallow bursty writes with aplomb and when those aren't enough, log-structured filesystems are good at smoothing out writes.

As for myself, in the work I do in my day job, I print out to STDOUT/STDERR and let the platform wick those lines away to a central firehose.

<comment><USER2> > in the work I do in my day job, I print out to STDOUT/STDERR and let the > platform wick those lines away to a central firehose.

I think this is the correct approach, but (to the nearest approximation) ~every organization I've worked at that does this has hit saturation limits of "the platform" in extremely short order. Especially if you're doing audit- trail-style logging, in my experience, this becomes the primary bottleneck of your infrastructure very quickly.

<comment><AUTHOR> Did you come up with particular tactics? Any insights on platform bottlenecks?

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> Sounds like it was written by someone who lacks good infrastructure to collect and search logs.

E.g. it is very useful to collect all user actions and other major actions. So later when user face some problem and sends support a message you know what was going on. You can send user a message that his issue was fixed instead of asking the user for a reproduction steps.

The aggregate numbers poorly tell you a story what has happened to this particular user and at scale there are bugs that just some ppl will hit.

You can process logs and produce the metrics out of them, but you can't do the opposite. Saying logs are just human readable actionable errors seems backwards to me.

</comment><comment><USER4> > In my opinion, my thesis from GopherCon 2014 still holds: services should > only log actionable information. That includes serious, panic-level errors > that need to be consumed by humans, or structured data that needs to be > consumed by machines.

But what if I need some information to debug a problem in the future? I log some related information and when error happens, I can look to the logs and get that information. This might help to debug a problem. Ideally I would like to have a values for all variables at any moment of time. Practically I can't have it, but I can get some values, which, I think, are more important. So later, when I debug a problem, I'll have more information. And if I don't ever need that, no problem, disks are cheap and logs are small (if done properly, there's nothing worse than searching for a needle in a 100GB log file).

For my programs I developed a simple rules. Log everything important with DEBUG level (but it shouldn't be too much, don't log 10MB data for each HTTP request). Log everything that happens in the system at a "higher" level with INFO level (like "add record with text {}"). Log everything unusual with WARN level (like user validation failed). Log every unexpected but recoverable (application can serve other requests) error with ERROR level. Log unrecoverable error with FATAL level and shutdown application. Works fine for me. And TRACE level just for debug, it's usually turned off, so it might produce any amounts of data.

<comment><USER5> I too thought that his logging recommendations were weak. Simply logging an error (even with context) doesn't tell you much about how you entered that state.

I follow these guidelines (similar to yours):

      - ERROR: Failed assertions, unrecoverable conditions
      - WARN: Exceptions (request is toast, but system works)
      - INFO: Important actions (entered a certain state)
      - DEBUG: Information associated with the actions above

Note that we too don't log full requests, etc. at DEBUG - that's way, way too much. If you really want to do that? TRACE, but that's usually important for the developers of those libraries. We're also lucky in that we use logback, so we can change the log level of the system at runtime very easily.

In production we usually run on INFO and above and the logs aren't overwhelming - though we're constantly trying to improve the quality and consistency of the messages.

</comment></comment><comment><USER6> I have found tracing to be very useful when troubleshooting problems. Tracing (or session-based logging) lets you activate detailed logging for specific customers. The system I worked on processed SMS messages for mobiles. There you could enable tracing on a specific mobile phone number, and whenever that subscriber sent an SMS, you got more detailed logs for everything affecting that SMS. Really a great tool. I've described it in more detail here: [http://henrikwarne.com/2014/01/21/session-based- logging/](http://henrikwarne.com/2014/01/21/session-based-logging/)

<comment><USER7> Your point is especially true when a bug is difficult to reproduce. In those cases, good logging can mean the difference between a few hours and a few months to solve a problem.

</comment></comment><comment><USER8> 1\. Logs should contain as much information as possible in order to debug. If you have to ask a user to reproduce a bug so that you can insert extra logging statements then I think you're doing it wrong. You want to be able to go straight to your logs and have enough information to find the problem immediately without further delay. For example, how are you going to debug a syncing error in a file sync app if you're not keeping detailed logs as to scans, inotify events, incoming and outgoing transactions etc.?

2\. You almost want your log entries to tell a story, you want to spend nearly as much time on your log entries as on your code. I think the more you get this right, the better your software design will be.

3\. You also want to be able to grep your logs easily using a transaction and user ID. For example, if you just fetched a batch of emails over IMAP, you want to have a transaction ID to describe the session, and include this in all related log entries for the session. You also want to include an account ID in all related entries so you can see all fetches for a given user.

4\. Your log entries should do as much work for you as possible. For example, if your log entry logs a filename or string that contains unusual Unicode characters, then you might want your log function to also log what Unicode normalization form the string contains (NFC, NFD, Mixed). This can make otherwise complex bugs trivial to solve.

5\. Logs should also be distributed, in the sense that you don't ship all your logs to a central location, but rather have each server manage its own logs. If you need to query your logs, then send a query out to the relevant servers and get them to do the work for you. If logs are always a fraction of a server's data output then you can easily manage gigabytes of log data per server this way.

<comment><USER2> > Logs should contain as much information as possible in order to debug.

There's a huge operational and engineering cost buried in that statement, which the article is trying to unearth and provide better solutions for.

> 5\. Logs should also be distributed, in the sense that you don't ship all > your logs to a central location, but rather have each server manage its own > logs.

Though it does give you some nice properties, this is counter to a lot of accepted best practice... is there a good distributed log query system? `dsh` doesn't cut it, for the record :)

<comment><USER8> > There's a huge operational and engineering cost buried in that statement, > which the article is trying to unearth and provide better solutions for.

Sure, there's always an operational and engineering cost to logging. I think the original comment makes that plain.

</comment></comment></comment><comment><USER9> I know something of logs.

Logging is figuring out how to keep any and everything in a small to mid-sized time window which you hope (but don't really know) may be useful later in a very small time window.

Monitoring is having something watch instrumentation (metrics) for anomalies. This may include views you build up over time on the previously mentioned logs.

If there was ever an industry that could benefit from AI, it's logging.

</comment><comment><USER10> My two cents: if you need to instrument native Windows applications, including Win32 and COM, my company develops three mature GPLv3 libs:

1/ Deviare In-Proc (like Microsoft Detours): [https://github.com/nektra/Deviare-InProc](https://github.com/nektra/Deviare- InProc)

2/ Deviare Hooking Engine (even novices can instrument apps): [https://github.com/nektra/Deviare2](https://github.com/nektra/Deviare2)

3/ RemoteBridge (access internal COM and Java apps) [https://github.com/nektra/RemoteBridge](https://github.com/nektra/RemoteBridge)

All these libs include examples and there are additional use cases in our blog [http://blog.nektra.com](http://blog.nektra.com)

</comment><comment><USER11> I think the author raises some valuable points but does not emphasize the key point about logging; that _logging has relatively limited applicability_. If you think of logging that way, you log everything, but keep only a time-bound window of log data. Around two weeks is plenty because most of the times you need to access the detailed log information is same or next day. I think careful attention should be paid to annotating log messages in various parts of the stack with some piece of data that can be used to correlate messages that are important to your use case. E.g. make sure a customerId or invoiceId or something logs through various levels of the stack.

</comment><comment><USER12> Interesting!

I must confess, I'm currently trying to get hard data on how our users are using our product and the thought of logging every request had crossed my mind. As an entry point to to finding the right solution and also because our product is hosted on the client's server and rarely under heavy load (we never have more than a dozen users connected at the same time).

I'm now going to look into instrumentation...

</comment><comment><USER13> Is anyone else here using Prometheus? I'd be interested in hearing about experiences with it.

<comment><USER14> I am also interested since I saw the lightning talk about it at FOSDEM (video: [http://mirror.onet.pl/pub/mirrors/video.fosdem.org/2016/h221...](http://mirror.onet.pl/pub/mirrors/video.fosdem.org/2016/h2215/prometheus- a-next-generation-monitoring-system.mp4)).

For what it's worth, FOSDEM itself uses it for the real time monitoring of its infrastructure.

</comment></comment><comment><USER15> The author talks about Graphite and Prometheus as instrumentation systems but they're for collecting data. What do people recommend as a linkable library for collecting metrics in the service process? (before it is collected). A quick google gave me 'go-metrics' and 'dropwizard metrics' but the code I'm working on will require linking with a native C library.

<comment><USER13> The author is a Go developer; if you are too, a good starting point is to use expvar and then whatever tool your collector provides for collecting expvars. Besides being in the standard library, there's the advantage of there being lots of tools that speak expvar.

<comment><USER15> Thanks for that. 'expvar' looks like a great hidden gem for go development. Unfortunately most of our services aren't written in Go so we might have to write our own if there isn't a handy library we could write bindings for.</comment></comment></comment>


When is "ACID" ACID? Rarely - <AUTHOR> http://www.bailis.org/blog/when-is-acid-acid-rarely/ <comment><USER4> While I appreciate how thorough the article is, it's a bit of a strawman. Pretty much everyone who makes use of a relational database in a professional capacity has to be aware of what transaction isolation level they're using, make their own choice about what to use, and then do things like acquire explicit update locks or do optimistic locking in order to ensure data integrity. But that doesn't mean that the ACID properties are useless merely because you have to do that; it might mean you have to think about a few things more than you'd like to, but it's still a different world than trying to mimic ACID properties in a NoSQL database, and there are still fairly hard guarantees about things like consistency that you get with other isolation levels. For example, with read committed or snapshot isolation, I still have transactionality and can be sure that if I issue a sequence of 10 updates in a single transaction and then commit it, any other single query is either seeing the results of all 10 or of none of them. That's an important guarantee in many situations, and it's a guarantee that I can use to make decisions about how I structure my application logic.

The author of the post basically seems to treat any isolation level below serializability as some sort of sham perpetrated on the development community, and that's not the case: they're still useful, and they're still something that you can use to build the sorts of application guarantees you want. The mere fact that pretty much every database vendor gives you a choice as to what isolation level to use should be a pretty obvious clue that there's no one- size-fits-all answer there, so harping on the non-existence of a serializable isolation level is somewhat missing the point.

<comment><USER5> I think it is extremely hard to reason about data integrity properties in non- ACID systems.

Consider a banking application that uses linked accounts such that transactions fail if the combined balance of linked accounts is below zero. If I implement this in Oracle using Snapshot Isolation (the highest isolation level Oracle offers) in the obvious manner, I'll get silent constraint violations: transactions that should fail will succeed because MVCC can't stop two competing transactions debiting the same account pair (i.e., I have two linked accounts A & B with $100 in each and I launch two simultaneous transactions to transfer $150 away from both: afterwards, I'll end up with -$50 in both or some garbage data).

Now, you can fix if you recognise the problem in advance by doing a select- for-update or changing your schema to materialize the constraint (say by creating a linked-balance table that holds the combined balance for all pairs of linked accounts).

But it is really hard to even notice the problem, especially if you've got a few dozen tables with multiple applications writing to your database (RDBMS advocates insist that this is a good thing). And there are no automated methods for determining when this will be a problem: you just get silent data corruption or silent constraint violations in your extremely expensive "ACID- compliant" (but not really) Oracle database.

<comment><USER6> "MVCC can't stop two competing transactions debiting the same account pair (i.e., I have two linked accounts A & B with $100 in each and I launch two simultaneous transactions to transfer $150 away from both: afterwards, I'll end up with -$50 in both or some garbage data)."

That isn't true. In a pure MVCC world you could detect such issues, specifically that two trxs were opened and they both tried to update the same row. This would generate a conflict and one transaction could just get shot. Snapshot-isolation/MVCC describes this issue.

However what InnoDB/mysql and Clustrix actually do is use MVCC for read-write conflicts and two-phase-locking for write-write conflicts which trivially fixes your proposed problem.

<comment><USER5> To clarify the example, the two simultaneous transactions are updating different rows: one updates account A's row while the other updates account B's. There is no way for MVCC to recognize this conflict: it will happily corrupt your data.

<comment><USER6> Sorry, I'm not following. If you have ___2_ __rows storing how much money you have in __ _1_ __account then your data isn't normalized and serializability isn't going to solve your problem, if you could be (even) more explicit, I might be able to answer.

<comment><AUTHOR> I think we're conflating Snapshot Isolation and MVCC (e.g., _Snapshot- isolation/MVCC_ ). MVCC is a general concurrency control mechanism, not an isolation level. Coupling MVCC and Snapshot Isolation is like saying "using locks provides serializability," which is not true in general--it depends on how you use the locks.

That said, Snapshot Isolation _can_ lead to anomalies like Example 1.2: [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.142...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.142.556&rep=rep1&type=pdf) If you perform additional synchronization (e.g., 2PL, as you describe), then you can get serializability.

<comment><USER5> Yes, you're totally correct. I was thinking of SI.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Clustrix says it provides repeatable-read because it complies with the ANSI spec. In truth we actually provide something closer to snapshot-isolation by default. Snapshot isolation in summary is a guarantee that all reads made in a transaction will see a consistent state of the database. A transaction will only fail to commit if there is a conflict of two updates. This is a strong isolation level that does have a set of anomalies but most companies don't care about them. Microsoft put out a great paper about snapshot-isolation: <http://research.microsoft.com/pubs/69541/tr-95-51.pdf>

As the post points out, weaker isolation levels allow for more concurrency which translates to more scalability, which is why we chose our isolation level.

</comment><comment><USER7> Huh? You ought not be depending on the default isolation settings. If your workload needs serializability, set it. Most don't. CAP teaches us that ACID is a spectrum in a distributed system.

<comment><USER5> Did you read the post? First, it covers both default isolation and maximum available. Second, note that many databases (like Oracle 11g) don't actually give you serializable semantics at ANY setting. Third, most of these products are not distributed systems. Fourth, ACID is not a spectrum for distributed systems; it is basically impossible to apply without sacrificing availability. But that's perhaps not a big deal if our non-distributed DBs don't provide real ACID anyway.

The real issue here is that the database world is a cargo cult where ignorant people scream ACID to denigrate new technologies without noticing that most production databases aren't running with anything close to ACID and that major database vendors can't even support ACID.

<comment><USER7> I did read the post.

It does cover both default and maximum. I didn't dispute that. I called out the notion that anyone ought to be depending on the defaults in the first place, or that SERIALIZABLE as a default was a good choice.

Yes, many don't support SERIALIZABLE. Didn't contradict that either.

As to whether many of these are or aren't distributed systems:

Ingres - has replication.

Aerospike - distributed/fault tolerant/blah blah

Persistit - nope. appears to be a library.

Clustrix - clustered.

Greenplum - this is shared-nothing clustered postgres.

DB2 for zOS - i have no idea. let's call this one not distributed, for giggles.

Informix - <USER2>

MySQL - lots of replication and HA options

MemSQL - <USER3>

MSSQL - replication and federated query modes

Nuodb - cloud database management? looks distributed to me.

Oracle - dont they have RAC ?

Berkeley (x2) - dont know. probably not.

PostgreSQL - a few replication options

HANA - no idea. lets call it in your favor.

ScaleDB - clustered.

Volt - shared nothing clustering

That's a little over half, by my count. Certainly close to most.

"The real issue here is that the database world is a cargo cult where ignorant people scream ACID to denigrate new technologies without noticing that most production databases aren't running with anything close to ACID and that major database vendors can't even support ACID."

Some can't. Some do. I'm not screaming. My main message is this: Don't depend on defaults. They differ from vendor to vendor. Understand your workload and use the APPROPRIATE isolation for it.

( edited for formatting and clarity )

<comment><USER5> _I called out the notion that anyone ought to be depending on the defaults in the first place_

Regardless of whether you should depend on them, many many people do. Heck, many people don't even understand that there's a choice to be made: after all, everyone knows that Oracle is ACID compliant, right?

 _Yes, many don't support SERIALIZABLE. Didn't contradict that either._

Sorry, I was confused by the bit about "If your workload needs serializability, set it" since that's physically impossible on Oracle 11g.

Just because a DB has a replication package available (like MySQL) does not mean that it is a distributed system. And the file backed DBs (like Berkeley) are definitely not distributed. Sure, there are some extremely expensive massively parallel DBs in use (like Volt), but the number of deployments for those systems is a drop in the bucket compared with single-node MySQL/Postgres/Oracle/SQLServer/DB2 instances.

<comment><USER7> "Regardless of whether you should depend on them, many many people do. Heck, many people don't even understand that there's a choice to be made: after all, everyone knows that Oracle is ACID compliant, right?"

Ignorance is not an excuse. It just isn't.

"Just because a DB has a replication package available (like MySQL) does not mean that it is a distributed system. And the file backed DBs (like Berkeley) are definitely not distributed. Sure, there are some extremely expensive massively parallel DBs in use (like Volt), but the number of deployments for those systems is a drop in the bucket compared with single-node MySQL/Postgres/Oracle/SQLServer/DB2 instances."

I do not understand what point you are trying to make here. Are these systems de-facto non-distributed systems merely because of deployment counts? Is there an objective criteria here I should be aware of?

<comment><USER5> _Ignorance is not an excuse. It just isn't._

I'm not interested in excusing anything, I'm interested in understanding the real world. And what I see is that a lot of people who insist on the absolute need for ACID don't really understand it because they're using non-ACID technology right now.

 _I do not understand what point you are trying to make here._

Consider MySQL with asynchronous replication to a slave. In a weak sense, that is a distributed system because the remote slave is on a different machine (and probably very distant) from the master. But the distributed bit here doesn't interfere with correctly implementing ACID: MySQL with async replication operates identically to single node MySQL: it just transmits the binary logs to a slave server. The database system itself is a single-node service whose state gets replicated at transaction boundaries.

In contrast, distributed shared-nothing databases like Volt have to work really hard to maintain consistency: there is no single node in those systems that does all the work and gets replicated: multiple nodes have to cooperate in order to get anything done.

</comment></comment></comment></comment></comment></comment><comment><USER8> When I first read this headline, I thought it had to do with purity of a certain Swiss-made variety that left its mark on San Francisco (and surprisingly, Palo Alto---e.g. Jerry Garcia and Ken Kesey). My mistake

<comment><USER9> I should have known better, especially in the context of this website. Due to a recent conversation with a friend about ph balance and the acidity of various foods, I thought it was a discussion of the chemical properties of various substances. Extraneous context affecting my initial impression.

</comment></comment><comment><USER10> I think it's great that someone is taking a detailed look at distinct isolation levels for different systems. It's also worth looking at distinct levels for atomicity, consistency, and durability. One could then define an overall "pH" level for systems.

I would take exception to Bailis' statement that "it is impossible to simultaneously achieve high availability and serializability." At FoundationDB, we do exactly that.

Stephen Pimentel

foundationdb.com

<comment><USER11> I think it's rather clear that he's talking about high availability in the CAP sense, which is precisely the kind of availability FoundationDB (rightly) doesn't claim to achieve (<http://foundationdb.com/#CAP>).

BTW, the images are failing to load on that page for me.</comment></comment>


Jet lands at wrong airport, is too big to leave - <AUTHOR> http://nypost.com/2013/11/21/jumbo-jet-might-be-trapped-after-landing-at-wrong-airport/

<comment><USER2> It has since taken off successfully.

<comment><AUTHOR> I heard that later in the day. I guess an example of newspapers first information coloring what the true situation is. The runway needed takes into account many factors (weather, load, fuel considerations etc.) Obviously it was entirely possible to get this plane up in the air. But knowing that upfront wouldn't have made it as interesting a story.</comment></comment>


Kaspersky Lab Defeats Patent Troll   - <AUTHOR> http://www.securityweek.com/kaspersky-lab-celebrates-15-years-win-against-patent-troll

<comment><USER3> The story is missing a key detail: HOW did they win in court?

There are a couple of ways a plaintiff can lose. (1) the court finds that the defendant did not do anything that is covered by any of the valid patent claims. (2) the court finds that the patent should not have issued in the first place, due to a problem such as prior art making it not non-obvious, the patentee not being the inventor, and so on.

Knowing this is important because it determines who this case affects those who are not Kaspersky. If Kaspersky won because they simply did not do anything that is covered by the patent, but the patent is valid, then everyone else still has to worry about that patent.

If Kaspersky won because the court found that the patent is invalid, then we can all scratch this patent off our lists of patents we have to worry about.

(And all of this, of course, depends on what happens in the appeals court if the plaintiff appeals).

<comment><USER4> Troll's claims were "dismissed with prejudice", according to Kaspersky's personal blog. So, i suppose, this means that effectively the patent is invalid.

<http://eugenekaspersky.files.wordpress.com/2012/06/dec.png>

[http://translate.google.com/translate?sl=ru&tl=en&js...](http://translate.google.com/translate?sl=ru&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Feugene.kaspersky.ru%2F2012%2F06%2F26%2Fkill- the-troll%2F)

upd: court order: [http://www.scribd.com/doc/98161737/Https-Ecf-txed- Uscourts-g...](http://www.scribd.com/doc/98161737/Https-Ecf-txed-Uscourts-gov- Cgi-bin-Show-Temp-pl-File-7587570-0-27765)

[http://www.scribd.com/doc/98161154/Https-Ecf-txed- Uscourts-g...](http://www.scribd.com/doc/98161154/Https-Ecf-txed-Uscourts-gov- Cgi-bin-Show-Temp-pl-File-7750520-0-27466)

<comment><USER5> The Order indicates that Kaspersky won summary judgment on noninfringement grounds, not invalidity grounds.

e: Not sure about this, but the Order also suggests that some of the Troll's claims survived summary judgment and are proceeding to trial, so it's not clear to me how complete of a victory this is. I'll check the underlying order (this ruling was on a motion for reconsideration) and the PACER docket and see what I can figure out.

<comment><USER5> The public documents in this case are heavily redacted, because the relevant underlying facts involve confidential or sensitive information about licensing agreements. That, plus my unfamiliarity with the underlying technology, makes it tough for me to put together a complete picture of how this litigation actually unfolded. But, as best as I can tell from a brief initial review of the papers:

The Troll was alleging many different "flavors" of infringement that broadly fall into two categories: direct and indirect. Direct infringement would be if Kaspersky itself were violating the patent, for example by using patented software itself. Indirect infringement would be if Kaspersky were inducing others to violate the patent, for example by selling patented software to customers.

Kaspersky moved for summary judgment, which is essentially asking the Court to rule in your favor without a trial because the evidence is so overwhelmingly in your favor that no reasonable jury could find against you and a trial would just be a waste of time.

Kaspersky successfully argued that it wasn't directly infringing on the patents because the patents described a method for having a computer carry out some process, and in order to infringe, Kaspersky would have had to actually carry out that process, rather than selling software that carried out that process.

Kaspersky successfully argued that it wasn't indirectly infringing on the patent because all of its customers were covered by preexisting license agreements. Unfortunately, the key facts on this claim are redacted.

The Court granted summary judgment to Kaspersky on these grounds on most of the Troll's claims, but there were a few remaining claims that fell outside of Kaspersky's arguments. (These seemingly related to specific manipulations of computer hardware? Not really sure, don't understand the technology and don't want to learn it, already wasting too much time on this LOL)

After the Court granted summary judgment, the Federal Circuit handed down some new case law that was directly on-point. This new law made it clear that Kaspersky was going to win on those few claims that survived through summary judgment.

Kaspersky moved for reconsideration, essentially asking the Court to consider this new case and revise the original summary judgment order to dispose of the rest of the claims as well. Unfortunately, there are some fairly strict timing rules involved in moving for reconsideration and Kaspersky didn't comply with them, so it wasn't able to win this motion.

However, the writing was on the wall at this point, and the Troll apparently realized there was no way it could win at trial. On June 15, the Troll voluntarily dismissed the rest of the claims, effectively giving up and going home.

Congrats on reading this far. Happy to try to answer questions if you have any. Others who might know more about the case should jump in and supplement or correct me if I missed or misunderstood anything.

e: Responsive to the original parent comment in this thread:

1\. Given that the Troll voluntarily dismissed its claims - <USER2> conceding defeat - I would be surprised if the Troll appealed. However, there might be some grounds for appeal in earlier nondispositive motions relating to interpretation of the patent claims.

2\. Kaspersky won on noninfringement grounds, but they structured their noninfringement argument in a very elegant and powerful way that essentially renders the patent-in-suit toothless while still technically valid. This isn't legal advice and everyone knows it would be idiotic to rely on a HN posting in making any decisions with potential legal consequences, but I personally would go ahead and "scratch this patent off our lists." One down, several hundred thousand to go...

<comment><USER6> "plus my unfamiliarity with the underlying technology, makes it tough for me to put together a complete picture of how this litigation actually unfolded."

If you can't get the big picture, what chance does a lay jury have?

Isn't it time the US moved to a specialised patent court, as is found in many other jurisdictions?

<comment><USER5> I think a good trial lawyer would probably be able to get a jury to a level of at least rudimentary understanding of the technology over the course of a multi-day trial. But I agree with the spirit of what you're saying. Reliance on trial by lay jury is just one of the many, many ways the American patent system is broken.

</comment></comment></comment></comment></comment></comment><comment><USER7> Kaspersky is undoubtedly one of most interesting companies in the antivirus space, if not _the_ one. They do a lot of research and they push things forward instead of just scaremongering their userbase into buying annual subscriptions to a bloatware like Symantec does.

That being said, they do ship some really buggy stuff that is an absolute pain to deal with. For a couple of years I had to deal with support of a networking application and every time a new type of bug report cropped up, the first question was "do you have Kaspersky installed" inevitably followed by "yes, we do." I just can't tell how many men-hours were sunk into chasing problems that were ultimately created by bugs in their resident antivirus shields. It was few years ago, perhaps things have changed for the better.

<comment><USER8> _They do a lot of research and they push things forward_

Indeed, Kaspersky is superb. And if you're in the US, I have another reason to recommend Kaspersky: It is most unlikely that US law enforcement agencies such as the FBI could convince a _Russian_ AV company to whitelist FBI spyware.

Nor will the Russian government cooperate. Can you imagine the Russian government saying to Kaspersky, "Yeah, sure, ignore the FBI's trojan horse, don't flag it".

Of course the Russian government would have leverage to plant _its_ spyware in Russian-made AV. So you would think that buying Russian vs buying American makes no difference. Not so! Think about motivations: If you're an American, the Russian government doesn't care if you cheated on your tax, if you downloaded Hollywood movies, etc.

Buying your security from a different jurisdiction is a way to minimize risk.

</comment></comment><comment><USER9> What impact, if any, does this have on the companies, such as Microsoft, that previously settled and agreed to pay the licensing fees? Can they ride the coattails of this success?

<comment><USER10> That's what I was thinking too. It'd be really easy for them to terminate their agreements with the trolls and start using the technology free again. My guess is that at least some of them will take this course of action.

</comment></comment><comment> jack-r-abbit Awesome. It is refreshing to see companies not only stand up to the trolls but to actually win. We need more of this.

<comment><AUTHOR> Especially a smaller (albeit well-off) company than some of the bigger ones who caved.

</comment></comment><comment><USER11> Surely, Kapersky can't be bigger than Microsoft and other companies mentioned in the article? If they can fight it out, why can't the big guys fight it out? If only the big guys took a stance, and fight these trolls, it'll be nice.

<comment><USER5> It's very expensive. Kaspersky almost certainly paid its lawyers much, much more to take this case through summary judgment and trial prep than Microsoft paid the Troll to go away.

Don't get me wrong, I'm with you. But...it's easy to pontificate on the virtues of taking a principled stand against trolls when you're not responsible to greedy shareholders.

Does anyone know who owns Kaspersky? It would be interesting to note who was on the Board that OK'd the decision to open the company coffers to fund a fight against a patent troll.

<comment><USER12> Unofficially, it's believed that Eugene Kaspersky holds the controlling block of shares.

<comment><USER5> Seems consistent with what we're seeing in this case. Very hard to imagine any VC greenlighting this sort of "it's the principle" litigation; very easy to imagine a founder doing so.</comment></comment></comment></comment>