Why the Latest Rails Exploit Is Indicative of a Bigger Problem - <AUTHOR> http://blog.sdelements.com/why-the-latest-rails-exploit-is-indicative-of-a-bigger-problem/

<comment><USER2> Their server is down. Here's the content:

\-- by Rohit Sethi on February 13, 2013 \-- <http://blog.sdelements.com/author/rohit/>

The latest Rails security flaw [1] is example of a common anti-pattern. Ned Batchelder wrote an awesome post [2] explaining how a similar issue may also exist in Python's YAML parser [3]. Looking at these vulnerabilities, I am reminded of similar flaws in other frameworks and libraries.

The issue in each case is an abuse of extensibility. At first glance the idea is clever: allow for run-time execution of new code or binding of server-side variables without changing your compiled code, thereby greatly enhancing extensibility. For example, provide extensions to your Python YAML parser that allow you to create arbitrary objects and execute Python code; provide extensions to XML Template parsing that allows for arbitrary command execution [4]; or dynamically assign user-supplied parameters to server-side variables [5] (aka mass assignment) based on the parameter name. This kind of vulnerability is by design in contrast to many other by accident vulnerabilities. We called the mass assignment anti-pattern out [6] several years ago when doing a security analysis of the Core Java EE Patterns for OWASP.

I have a strong feeling we'll see more vulnerabilities of this type, particularly with the rising popularity of standards like SAML that are built upon several layers of libraries implementing and extending complex specifications. These kind of issues can sometimes be hard to catch with an automated scanning technology, which means most organizations adopting the status quo of application security due diligence [7] will undoubtedly miss detecting some instances of extensibility abuse.

Security-minded developers can protect themselves by taking the following steps:

Turn off unnecessary extensibility in third party libraries and frameworks Do not use untrusted input in libraries that provide broad extensibility, such as Apache's Xalan [8] with extensions enabled.

Be vigilant about monitoring for and patching newly discovered vulnerabilities in frameworks and third party libraries. Wherever possible, sign up for security mailing lists or groups like Ruby on Rails Security [9]

[1] [http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to- ma...](http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass- assignment-and-sql-injection) [2] <http://nedbatchelder.com/blog/201302/war_is_peace.html> [3] <http://pypi.python.org/pypi/PyYAML> [4] [http://labs.securitycompass.com/tutorials/xslt-command- execu...](http://labs.securitycompass.com/tutorials/xslt-command-execution- exploit/) [5] [http://www.codeproject.com/Articles/471784/Exploiting- Micros...](http://www.codeproject.com/Articles/471784/Exploiting-Microsoft- MVC-vulnerabilities-using-OWA) [6] [https://www.owasp.org/index.php/Category:OWASP_Security_Anal...](https://www.owasp.org/index.php/Category:OWASP_Security_Analysis_of_Core_J2EE_Design_Patterns_Project/PresentationTier#Avoid_3) [7] [http://blog.sdelements.com/raising-the-bar-on-application- se...](http://blog.sdelements.com/raising-the-bar-on-application-security-due- diligence/) [8] <http://xml.apache.org/xalan-j/extensions.html> [9] [https://groups.google.com/forum/?hl=en&fromgroups#!forum...](https://groups.google.com/forum/?hl=en&fromgroups#!forum/rubyonrails- security)

<comment><USER3> Doesn't this get into the issue of whether XML dependency injection is a good idea? All of the wiring and some logic is built up in some files that are outside of the build/compilation process. Doing "proper dependency injection" (quotes for sarcasm) to me has always made me worry that I've lost control of how my application works, and somehow based on the right XML/JSON/etc config magic it will work perfectly and meet all security standards.

Maybe I'm just too jaded...

<comment><USER4> Do your remote users have any control over those files? Probably not, or at least, probably not on purpose. The problem here is highly extensible systems that consume some user-sourced data and ultimately contain some sort of path whereby the user is essentially running a program with some set of capabilities they are not supposed to have. (Many of these attacks have resulted in arbitrary code execution, but weaker forms are possible, where perhaps you can only instantiate a class that results in some file being created on disk with arbitrary contents, or reads from it, or something.)

Many of these systems are written with the use case in the developer's mind where the data can be trusted to some degree, because perhaps they assume it's going to be read only by the program that generated it and only viewed by the user who already owns the computer, etc. In some sense the error only occurs when one takes this sort of software and then exposes it to the network, but it can be hard to realize when you... or somebody buried three layers deep in $YOUR_FAVORITE_FRAMEWORK... has done that.

</comment></comment></comment><comment><USER5> I believe over-engineering is also a culprit here. We had a similar situation in JSON handling in browser. Some over engineered feature allows custom objects to replace built in object for lists, allowing XSS through JSON parser. The solution was to make every REST API to start with a top level dictionary object. It just sounds arbitrary over engineering!!

<comment><USER6> Why can't there be a set of parsers for YAML, JSON, and XML that are tested, abused, and audited aggressively so that your interchange formats don't become attack vectors?

The current state of having a half dozen of each of these is complete chaos. Presumably nobody thinks they're accountable because everyone has the option of using another package instead if they're not happy, basically passing the hot-potato constantly.

Is there a non-Ruby project that has a good implementation of these worth studying?

</comment></comment><comment><USER7> Google text version cache: [http://webcache.googleusercontent.com/search?q=cache:9m5PdBh...](http://webcache.googleusercontent.com/search?q=cache:9m5PdBh6sEkJ:blog.sdelements.com/why- the-latest-rails-exploit-is-indicative-of-a-bigger- problem/&hl=en&tbo=d&gl=uk&strip=1)

</comment><comment><USER8> I also don't understand why all parsing of user input needs to have YAML turned on by default. All this stuff should be turned off. I think it is a fundamental design choice that has to be looked at.

<comment><USER5> We should call it "insecurity by default" (in contrast to insecurity by design). A major problem is that nobody takes responsibility or pays attention for default choices.

A ton of packages have default choices that are inherently bad/insecure (mail servers listening on all interfaces by default, SSH servers accepting root login by default, and so on). Packaging is just as important as development.

</comment></comment><comment><USER9> Serious developers take an interest in making things as simple as possible, ideally each piece have singular responsibilities, and no magic. Software engineering is hard, and it is heartening to see more people realise and promote awareness of some of the more dangerous anti-patterns we see in frameworks like Rails.

<comment><USER10> There is no magic in Rails, it's just Ruby code. There will always be APIs that shouldn't be given untrusted data. When this happens anyway, calling it an "anti-pattern" does not mean you have perceived some kind of systemic fundamental flaw in the framework. That's just a transparently self-serving way for you to feel superior because after all you're a "serious developer".

<comment><USER11> magic is just a shorthand for "code executed automatically, behind the scenes, based on some reasonable assumptions". Rails does a whole lot of this type of magic, as does basically every framework.

<comment><USER10> Then it's a meaningless term. The fact that iTunes doesn't need to ship with drivers for my sound card is the same kind of "magic".

<comment><USER11> this isn't a good analogy. Rails is a software development framework whose users are programmers. iTunes is a media player whose users are non-technical. in other words Rails is a tool while iTunes is a finished product. you wouldn't compare a hammer with a cabinet, would you?

if zero-framework development is a hammer, then development with a framework is a power-tool combination drill/hammer/driver. the power-tool does so much more then the basic tool that it feels "magical". its not a meaningless term then. its a description of the power of the tool.</comment></comment></comment></comment></comment>


End of the World - <AUTHOR> http://www.pitt.edu/~dash/type2033.html <comment><USER2> the page seems to only work over http

i had to disable the site's HTTPS Everywhere rule</comment>


The Wrong Aesthetic - <AUTHOR> http://sheddingbikes.com/posts/1276445247.html <comment><USER2> I've always felt that most good programmers go through 3 stages.

Stage 1: Write very simple, naive code, no fancy design patterns, just kind of brute force everything.

Stage 2: Discover design pattens, and fancy obscure programming constructs. Use them _everywhere_ regardless of whether it makes sense or makes the code easier to understand and maintain.

Stage 3: Realize the folly of stage 2, and enter a zen like state where one writes deceptively simple, clean code. Rarely, if ever, use any fancy constructs or design patterns (except where it actually makes sense to use them.)

For the novice programmer looking at someone else's code it's very very easy to confuse stages 1 and 3.

<comment><USER3> Being a novice programmer, what should I make of this?

<comment><USER4> You are going to make a lot of mistakes, some painful, others interesting. Happy hacking!

</comment></comment></comment><comment><USER5> I guess this is what he meant to write, programming language permitting:

        int Total()
        {
            return dice.Sum(die => die.FaceValue);
        }

<comment><USER6> It should be pointed out, because I fear people are missing this point, that while the instantiation of his point is language-specific, the general point holds regardless. In Haskell, to take the opposite extreme, "foldl (+) (map dieSum dies) 0" would be idiomatic (or would be if the sum function wasn't built in to Prelude as well but I feel that's cheating too much), whereas the closest equivalent to the loop approach in C++ would be grotesque and unidiomatic. How grotesque would be up to the user; you could go all the way to having the die values in an array and iterating an index through them if you like, but it'll make the C++ version of that look pretty sane.

The exact algorithms aren't the point. It's really something more like "stay idiomatic in the language you are in and keep it simple". Another example is when people start going nuts with lambda in Python; you're really not supposed to do that and there is almost always a better way that doesn't involve lambdas.

<comment><USER5> Yes, staying idiomatic is a good idea, it's worth pointing out explicitly.

As a tangent, while the original author was trying to abstract away the loop, I feel he left too many fragments of the loop behind, such as the start and end conditions. As such, I don't think the sum function is cheating too much, and is in fact the goal. I might describe the Total as "the sum of the dies' face values," instead of the more verbose: "the sum of the dies' face values, starting from the first die and ending at the last die."

In a sense, this runs parallel to your reminder to stay idiomatic: when you sum a list of things, it is common to add them all together, not just some subset. It is this shared understanding which lets us be succinct.

Though I do fear that I'm preaching to the choir :-)

</comment></comment></comment><comment><USER7> I disagree. I like the second example, because it explains what it's trying to do -- accumulate, over +, the values of the dice from begin to end. Instead of dumbing down the algorithm for the machine, it uses the words in the problem domain to describe the problem. (Now, you could argue that C++ is messy because you are using a hammer to screw in a screw, and that's true. You could also argue that it's stupid to rewrite code in this new way when the old way works fine and the problem is so simple. Also a valid point.)

Oh, and I don't know Boost, but I guessed that the error was a missing _ before the 1. And after reading the linked article, it turned out that I was right. So it's not _that_ hard to figure out.

I think the article makes sense if you consider its source. This is Zed Shaw, who has given up high-level languages in favor of C, at least for the purpose of blog posts. Of course he would prefer the "how the machine does it" version of the code to "how the programmer thinks of it" version that Boost (and presumably Ruby) prefer.

I think 50 years of programming has proven that approach wrong, but he is entitled to believe whatever he wants to believe. I take the opposite stance -- describe your problem as precisely as possible, and let an optimized library or language figure out how to get the computer to solve the problem quickly. You can do both, of course, but keep the two parts separated!

</comment><comment><USER8> Great Post!

While a lot of factors go into determining whether a language is readable I have always felt the most obvious is familiarity. The human mind is very good at adaptation, and often it's astonishing what we will perceive as "normal." Familiarity only comes from constant exposure, though, which means that languages with relatively simple syntax become familiar more quickly. Lisp is at one extreme, with only one syntactic construct. It's very easy to become familiar with Lisp, although grasping the large Common Lisp standard library is another matter. I tend to agree with the author that C++ is a language at the other extreme. Most C++ coders I have encountered use only a relatively small subset of the C++ language. Worse yet, everyone uses a slightly different subset.

Of course, the biggest impact on readability comes not from the language, but from the developer. A poor developer can write illegible code in any language. A good developer? I've even seen well-written, readable Visual Basic code (once).

</comment><comment><USER9> Such functional code in C++ doesn't need to be bad. Though I would have coded it a bit different:

        int Dice::total() const {
            return sum(dice.begin(), dice.end(), _1 ->* &Dice::faceValue());
        }

with:

        template<typename T, typename Iter>
        T sum(Iter begin, Iter end, function<T (Iter)> f = *_1) {
            if(begin != end)
                return sum(next(begin), end, f) + f(begin));
            return 0;
       }

This allows some more flexibility. For example, you could also provide other implementations of sum. You could also easily make your code threaded without changing the code of Dice::total (well, take this example a bit carefully -- of course it implies that faceValue() is threadsafe and also does only make sense if faceValue is expensive to call).

Summing up some numbers may be anyway not the best example for this because the naive implementation is really so short and trivial and in most cases enough.

<comment><USER10> Tail call optimization is not guaranteed for optimized C/C++ programs, and is not done at all in debug mode, so this kind of implementation can cause trouble with large structures.

I used to have fun, too, implementing tail-recursive functions to do stuff like flashing a LED on microcontrollers. I have since recovered :)

It is also my experience that helper functions like "sum" tend to be used very few times, and need a lot of variations, so it's actually better to just write the loop when needed. The theoritically advantageous functional programming is hard to convey into C++. Syntax and other technical reasons are partly to blame, but the biggest has to be simply the culture. Very few C++ coders think functionally, and coding, especially in C++, tends to be a team job...

<comment><USER9> The tail recursion was not my point. I also could have given another implementation of sum.

I wanted to demonstrate that the implementation of Dice::total() can be much clearer and still in a similar functional way.

</comment></comment></comment><comment><USER11> I dunno. This reminds me of that post about "Say what you mean in javascript"

<http://news.ycombinator.com/item?id=1358753>

Sometimes, things are confusing or are seemingly super weird depending on your background. While I haven't done C++ in years, I recognized that std::accumulate() was probably very much like Ruby's inject().

I suspect those that have seen map, inject, and their ilk wouldn't be so confused.

While you can argue that the 'average corporate programmer' wouldn't know what the hell it is, and you might be right. But if we stuck with that attitude, we'd still be using goto's liberally because the 'average corporate programmer' would find for loops weird and confusing.

<comment> loup-vaillant > I suspect those that have seen map, inject, and their ilk wouldn't be so > confused.

No doubt. However, C++ stays a major contributor to that confusion. In ML languages,

        let total = foldl (+) 1 (map face_value dice)

is nearly idiomatic. Compare that to the C++ code. Compare that to C++ code that would use accumulate _and_ an equivalent of map.

<comment><USER12> And in Haskell,

      foldl (+) 1 (map face_value dice)

would use fusion to avoid causing map to create another array!

<comment><USER10> Why does the sum start with 1? Why not eg.

         foldl1' (+) $ map face_value dice

<comment> loup-vaillant It should have started with 0. Sorry. And I avoided `foldl1` because I wanted to stay close to C++'s `accumulate`.

</comment></comment></comment></comment></comment><comment><USER13> I don't particularly understand what makes the second one more confusing than the first.

In particular, as a non-c programmer this: "(*i)->faceValue()" would be pretty confusing to me.

The first one in 'English':

"For each i starting at dice.begin(), while i is not equal to dice.end, incrementing i. Add to 'total' the face value of the thing that i is pointing to."

The second one in 'English': "Accumulate from dice.begin to dice.end, initializing the accumulator to 0, adding the face value of each die."

The first one might be idiomatic C++, but it doesn't seem to me that it would be idiomatic in any natural language.

(reduce #'+ (map 'list #'faceValue dice))

what is obvious depends on your background.

<comment><USER14> Really?

bind(std::plus(), _1, bind(&Die::faceValue, _2))

reads as "adding the face value of each die." to you? how. Because not knowing bind() or c++ I'm wondering what _1 and _2 means. More importantly why bind seems to take an operator, _#, and something, on the outside but takes only an integer and _# on the inside call. and, although the surround code might explain it, where 'Die' came from.

Unless you're just overlooking everything on that line except Die::facevalue. If you are, then why keep mentioning the 'i' in the for loop version.

<comment><USER13> Yes, really!

I do a lot more functional programming than I do imperative programming. An anonymous function in context of an accumulator is obvious to me.

The point that I maybe didn't make so well was that the second version is working in higher level constructs. The first version is doing a lot of integer and pointer manipulation, the second is summing across a collection.

The two versions might be speaking in different languages, to some extent, but that doesn't mean that one or the other is aesthetically wrong.

</comment></comment></comment><comment><USER15> Wish zed would have a date on the blogpost of when he posted that.

<comment><USER16> ``import time; print time.ctime(1276445247)`` where 1276445247 is the post's filename.

<comment><USER15> Ah, I see, thanks for that.

</comment></comment></comment><comment><USER17> This would have been fine with a BOOST_FOREACH. I find it hard to believe that he knows his way around boost:bind, but not BOOST_FOREACH.

<comment><USER18> Take one look at the code and dependencies behind BOOST_FOREACH, and you'll thunk twice before using it.

<comment><USER17> I have taken a look (and read the article about it). I'm not sure I agree that this should stop you using it. Its like saying you shouldn't use Rails because there is deep magic going on.

</comment></comment></comment><comment><USER19> Did anyone else notice the inconsistency without Zed's help?

Even if I hadn't, it still wouldn't have affected how I thought about the code. It's just a type error that would have been caught by the compiler.

[http://www.boost.org/doc/libs/1_43_0/boost/bind/placeholders...](http://www.boost.org/doc/libs/1_43_0/boost/bind/placeholders.hpp)

</comment><comment><USER20> So in other words the author isn't used to boost::bind and stl algorithms and complains that he doesn't understand code written with both?

First of all today you would rather use a lambda which is easier to understand.

The advantage of the second code is that it's generic and less error prone. You can't get the loop wrong. You can change the addition by any operation very easily, and the compiler will complain when you get things wrong.

fyi, the same code written with a lambda:

        int Dice::total() const {
          return std::accumulate(
              dice.begin(),
              dice.end(),
              0,
              [&](size_t v, const Die & d) -> size_t { return v + d.faceValue(); });
          );
        }

For more information about why the second version is better, I advise the book "Elements of programming".

ps: the spelling error introduced by the author prevents the code from compiling, so the argument doesn't hold

<comment><USER21> errr, no.

It is in no way more generic or less error prone. Just asserting that does not make it so.

You _can_ get the loop wrong, if you accumulate(dice1.begin(), dice2.end(), ...) for example, or switching the begin() and the end(). You can just as easily change the addition operation to anything else in the non-boost/stl version.

In the 2nd version, when you _do_ make a mistake, if the compiler catches at you get an error message that's totally unreadable with 2000 character error lines. And if the compiler doesn't catch it, and it causes a runtime problem, it is also extremely awkward to backtrace.

Not to mention, you need the latest-and-greatest compiler to do the lambda thingy, for no obvious benefit.

<comment><USER20> Most STL implementations catch the two errors you gave in debug mode (switching begin and end, using two different containers, etc.), and many more!

As for the compiler giving crazy errors, it's true for g++ mainly. VC10 and most of all clang give intelligible messages.

<comment><USER21> I haven't been following STL implementations recently, but that definitely wasn't the situation even in 2007 (Over 10 years after STL was finalized..); In fact, the only implementation that it did back then was STLPort, at a huge performance hit, and only at runtime.

And what you say about compilers is EXACTLY why I wrote the "latest and greatest". It's only recent clangs that can give intelligible messages for C++ (if at all) because Clang C++ support is not even ready for production yet.

VC++ 2005 (last I used) did not get give reasonable errors.

</comment></comment></comment></comment><comment><USER22> I suspect that some of the programmers who find the second version better are non-experienced. To them, the first version is _not_ standard C++ code, so it looks as "ugly" as the second version. The second version is cooler (= harder to understand), so they prefer it.

Having said that, the second version written in a better language _is_ pretty standard. It's mostly the limits of C++ which make the "functional" version look so bad, imo.</comment>


C++ for C Programmers: part 1 - <AUTHOR> https://ds9a.nl/articles/posts/c++-1/ <comment><USER2> I have recently used C++ in a project to get some performance increase from python code base (computation geometry/gis).

I have been very surprised how quickly I got up and running. Modern C++ had come a long way from what I remember a ways back.

<comment><USER3> I tried to rewrite my node backend in C++ but I got stuck at the package management part. When I learned Node I was able to install NPM and run "npm i -P uws" and was up and running quickly. Reading through about 5 WebSocket C++ lib installation instructions and still not making any progress was enough to make me wonder if my time would be better spent paying for a faster and/or bigger server cluster and just keeping node.

<comment><USER4> Packages are not really a thing in C++, partly because there are so many different environments and compilers anyway, and partly because C++ apps aren't really made by stitching together hundreds or thousands of tiny packages like in Node.

On Windows you might use NuGet, on Linux you might use whatever the native package format is, but you would thinking fewer, bigger libraries rather than what you're used to.

If you are looking for REST stuff try Casablanca, it's on Github or in the repo for Ubuntu.

<comment><USER5> Vcpkg is becoming the way to go for those that don't mind compiling everything, otherwise NuGet as usual.

<comment><USER6> Vcpkg has been really helpful for me, however I can't recommend its usage in day-to-day work considering it compiles things differently from vanilla releases.

It was a rather deceptive aspect of its usage that wasn't well advertised. Compilation units should be functionally equivalent to releases directly from vendors.

</comment></comment></comment></comment></comment><comment><USER7> author here, comments are welcome btw!

<comment><USER8> I don't know what you have planned for future installments, but I would make sure to emphasize that C++ more-or-less simply codifies common practice in C. E.g. how std::vector just codifies the practice of dynamically sized arrays using realloc, and iterators just codify and generalize the use of pointers as indices. I was not a C++ convert until I realized this.

<comment><USER7> hi colanderman, that is exactly the plan! I have a section on classes already done as something that most C projects eventually do by hand (ie, bunch of functions that accept a pointer to a struct as first parameter, which is actually "this"). You can even extend that into inheritance where you see most C based GUI toolkits emulating classes in all kinds of ways. Even the Linux kernel has tricks like this. Thanks for the tips!

<comment><USER5> Regarding the standard library you might also give a brief explanation about bounds checking in debug builds for example.</comment></comment></comment></comment>


Gigatron, TTL computer kit without a CPU - <AUTHOR> https://gigatron.io/ <comment><AUTHOR> Provenance: There was a recent post about PiDP-11 which is awesome in itself, but the page led to this which is probably more remarkable than is apparent at first; a Single Board Computer which implements all logic in TTL and with a remarkable functionality given the relatively few chips.

There are many SBCs of the era using more chips that this, despite having a Z-80 or 6502 onboard.

</comment><comment><USER2> I bet these are built with 74HCxx ICs, which are not TTL whatsoever; in fact they are CMOS.

<comment><USER3> You can build them with 74xx, 74LSxx as well as 74HCTxx, or mix those. Mixing with 74HC is also possible if you're careful, but full 74HC won't work.</comment></comment>


The Wolfram Alpha API Has Arrived - <AUTHOR> http://blog.wolframalpha.com/2009/10/15/the-wolframalpha-api-has-arrived/

<comment><USER2> $60 for 1000 requests just for protyping and personal use? Do they actually want anybody to use their product?

<comment><USER3> It's stunning. For commercial use (i.e. the way that a huge number of startups would like to use this), the cheapest option is $2000/month.

They say to contact them to tailor it to your needs, so maybe they're willing to come way down from that number.

<comment><USER4> There really is no better response than: hahahahahahahahahahahaha!

</comment></comment></comment><comment><USER5> If you want an example of how NOT to launch an API and get developers on board, take a look at Wolfram's API.

<comment><USER6> They lost me before that, precisely on "download a pdf to see the api docs".

</comment></comment><comment><USER7> The prices seem insanely high, and the most expensive plan also has a bizarre structure (<http://products.wolframalpha.com/api/pricing.html>). After you pass your initial 10 million request quota, the per request price is higher than during the quota! This means if you're doing 50 million requests, it's cheaper to buy 5 API keys w/10 million requests than to have one API key doing all 50 million. I would've expected that Wolfram encourage higher usage w/deeper discounts _especially_ when you reach the top, not _until_ you reach the top.

I also wonder if ~6 cents/request is supply and demand or maybe gree, or if the system is so complex and sophisticated that they actually need to charge that much to pay for the computational requirements.

<comment><USER8> _All_ their plans have that structure. I'm guessing that they want to be able to plan what resources to give to Alpha on the basis of what their customers have signed up for, so they want to discourage "overuse". Also, you pay up front for the quota and presumably pay in arrears for any extras, so obviously they want to encourage you to pay earlier.

(Still seems pretty daft to me, though.)

</comment></comment><comment><USER9> Charging developers to try out your API. Questionable. If anything, don't they want to do everything they possibly can to attract developers?

<comment><USER10> That is the first thing I noticed also. the pricing is non-trivial to. $60 for 1k/day requests? damn

<comment><USER11> I believe that's $60 for 1k _total_ requests - you use those up, you need to pay $60 more.

</comment></comment></comment><comment><USER12> What has been created here is a new kind of API, one the result of a lifetime of experience, and one that will no doubt influence the way you think about programming for years to come.

How fortunate you all must feel to use this API, and to interact with this amazing, lifechanging software. I don't think I exaggerate when I say that within this API lies the ability to understand our very universe.

</comment><comment><USER13> I went ahead and posted this comment on the blog post. It'd be great to be able to at least have a sandbox to build a library for communicating with the API to test out libraries and clients under development. Without something like that, I really don't see open, robust client libraries being built, and driving adoption in applications and around the web.

\---

 _I'm surprised that no one has said this yet, so I'll step up.

This is massively expensive.

Releasing an API without offering developers any way to build client libraries for Ruby, Python, and other languages short of ponying up $60 to test their client (or even offering a sandbox for sample data) is a bit much.

I'd be interested in putting together a Ruby library for interfacing with Alpha that would abstract the work of creating a request and parsing the response, making integration a snap for other developers and enabling deeper integration with Alpha around the web. I've thought a bit about how that might look, too:_

      query = WolframAlpha::Query.new(:query => '7.5 parsecs in light years')
      response = query.execute

      response.pods.keys.map(&:title)
      => ['Input Interpretation', 'Result', 'Additional Conversions', 'Comparison as distance', 'Interpretations,' 'Corresponding Quantity']

      response.pods['Result']
      => '24.5 light years'

_But with such a strong financial disincentive to develop for the platform, it's not likely that I'll register as a developer to create something like this. Feel free to contact me if terms change._

</comment><comment><USER14> They have temporary free plans called Pioneer Grants but you have to "discuss your application" with a representative. Oh silly wolfram, wasn't it enough to see microsoft learn a lesson the hard way from google?

</comment><comment><USER15> I was looking forward to using the API in my Firefox add-on that shows the Wolfram Alpha results next to the Google results. Quick calculation of the cost: 18,000 users/day * say 3 searches/day = ~$2,300/day. I think I'll stick with loading it in an iframe. I would have thought that this kind of thing fit perfectly with the example use case "augmenting web and meta-web search with computed knowledge" but I guess they have a different target market.

</comment><comment><USER16> On the other hand, it's much cheaper than Mathematica!

<comment><USER17> Their home edition is $300, but unlimited requests. Their API version is the equivalent of 5000 total requests over 5 months, or 4000 requests in 1 month ($240 for 3000 overage requests)

</comment></comment><comment><USER18> Wolfram|Alpha uses _algorithmic computation_! Sign me up!

"Wolfram|Alpha uses a unique paradigm for modeling data, based on algorithmic computation, that allows for implicit relationships among the data and the emergence of new knowledge."

<http://products.wolframalpha.com/api/faqs.html> ("Comparisons")

</comment><comment><USER19> I was going to ask is does this mean the wolframalfail own all your source code?

But I'm thinking the 6/c a query thing means it's all moot.

</comment><comment><USER20> This is a paragon of obfuscatory buzz-speak.

</comment><comment><USER21> I guess I'll stick to Yahoo! Pipes.

</comment><comment><USER22> When academics launch a company, what do you expect?

<comment><USER23> Wolfram is _industry_ , not Academia. They're used to billing sectors like aeronautics and oil for gazzilions. To them "web startups" are nobodies, and the price is there to keep the vagrants at bay.</comment></comment>


NYTimes paywall easy to circumvent with bookmarklet - <AUTHOR> http://euri.ca/2011/03/21/get-around-new-york-times-20-article-limit/

<comment><USER2> As much as I appreciate the link directly to my site, the discussion from the Nieman Journalism Lab at Harvard ( submitted as <http://news.ycombinator.com/item?id=2352023> ) is a lot more insightful than the snippet on my blog.</comment>


Ask HN: What do you use for personal daily goals? - <AUTHOR> What's your take on pen & paper vs web/mobile apps for your todo lists and short-term, long-term goals? <comment><USER2> Twitter, actually. I've been making it a habit to tweet short term goals and then follow through.

</comment><comment><USER3> Trello.</comment>


Facebook's Earliest Rival, Why It Failed - <AUTHOR> http://www.sociableblog.com/2010/10/12/facebook-earliest-rival-why-it-failed/

<comment><USER2> Bad site design, it might have had the features but poor presentation killed it as much as anything.</comment>


Emboss Text with CSS (Simple Rule) - <AUTHOR> http://www.reynoldsftw.com/2009/03/text-embossing-technique-with-css/

<comment><USER2> Very pretty and the article is to the point. No Firefox support and IE requires some "workaround".</comment>


Razzle Clones Woot - <AUTHOR> http://www.startupnorth.ca/2007/11/23/razzle-clones-woot/ <comment><USER2> I don't understand the appeal of such services. It is one thing to fall for the standard sales ploys while out shopping ("only for a limited time", "now or never", etc.). But to expose yourself to them deliberately and knowingly? Their customers must have a serious shopping addiction.</comment>


How to make site popular without any finance? Is it even possible? - <AUTHOR>

I am at high school right now. I like programming. And I have no money. I assume that's enough for my introduction.
So, today I was just having a nap and a new idea just came into my head. I googled about it and found nothing similar to my idea.
I can implement it by myself. But how can I advertise my website without any funds? Where to start? I really believe it can be useful website for a lot of people including me.
Thank you very much. <comment><USER2> Honestly, there is really no easy way to market, with or without money. The cheapest, and honestly the best way, is to be personally recognized.

You'll notice that once people break through to the public sphere of whatever niche they are in, anything they do seems to get instant traction. While a lot of people stumble into their status, there is a systematic way of getting there.

I could spend hours talking to you about blogging and making an name for yourself, since I am currently a PR student,but the fact remains, there is no easy way to gain traction. Everything you will do (paid or not) will take time and dedication to get right.

Another way to gain some initial users is to make it viral in your own personal sphere. If you are in High School, make it big within your High School. Remember, the virility of something refers to how "contagious" is it, not how many people pick it up. Lots of immensely popular companies started locally (See Facebook and Ben & Jerry's).

Anyways, hope that helps.

<comment><AUTHOR> That's a great advice. I will make brochures and give it for my classmates and all people in school. It should be fun :D

</comment></comment><comment><USER3> I'm exactly in the same position as you. I have very little funds and I'm very good at programming.

If anyone could advise on the matter, it would actually be useful. Getting things viral is not as easy as it looks.

If you want, you can check out my project - <http://twtquiz.com>

<comment><AUTHOR> This project looks very good. I think you can really succeed. Good luck.

</comment></comment><comment><AUTHOR> I am thinking about 2 things right now:

First, send e-mails to famous blogers and ask them to post about my website.

Second, post about website right here, on hackernews, and ask people to post review on their blogs if they find it useful and interesting website.

What do you think?

</comment><comment><USER4> Start a blog and write articles (preferably something related to your target market/product). You also might want to make a twitter account.

When you have no money, marketing will take time.

</comment><comment><USER5> I know of some sites that started organically and grew because there was need/demand for it. If you regularly participate on email lists, it is usually ok to put a link to your site in the signature block. Same with a lot of forums. (On Hacker News, you could put the link in your profile.) As long as you are a genuinely participating, regular member and they have no reason to think you are simply spamming them, this shouldn't be a problem. Then try to not talk incessantly about your site. For the most part, just participate as usual and let people check it out if they find something you say interesting. Mention the site where it is pertinent to the conversation.

This is probably not a way to get big traffic quickly. But if you regularly develop the site so that there is new content frequently, it can become a fairly high traffic site over time. This method gets some traffic for a couple of my sites where the goal was to share information and there wasn't a business goal or financial goal at the outset. I am real bad about not putting up new content very often. The following for my sites has grown very, very slowly. But for the particular sites in question, I think that is okay and will likely change as I get to the point where I am ready and able to update them more regularly.

Good luck and wishing you many excellent answers from other members. :-)</comment>


Show HN: 1m video visualization of Covid-19 spread - <AUTHOR> https://www.youtube.com/watch?v=P3Tf03n9Gvc <comment><AUTHOR> Hi HN

As the Covid-19 pandemic was progressing, it was hard to get my head around the numbers being bandied about—and I work with data daily (LOL!)

Then on March 26, the NYT open-sourced their daily data on case counts in the US and made it available on GitHub. Using the data and a few hours a night, I built an interactive map for the web.

That effort is open source and built with Bootstrap, TypeScript, React, Redux, and Redux Sagas. You can find that here:

[https://covid-19-map.leshill.app](https://covid-19-map.leshill.app)

The effect was pretty stunning. Just watching the NYC count go up day by day was pretty scary .

After getting similar feedback from others, I added some text for context and made a 1 minute video using iMovie and KeyNote (for the text slides) and posted to YouTube here:

[https://www.youtube.com/watch?v=P3Tf03n9Gvc](https://www.youtube.com/watch?v=P3Tf03n9Gvc)

Hope this is at least informative,

All the best and stay healthy,</comment>


Germany urges global minimum tax for digital giants - <AUTHOR> https://www.thelocal.de/20181021/germany-urges-global-minimum-tax-for-digital-giants <comment><USER2> Sooo, citizens working their asses off should pay regular tax and digital giants raking in billions and hiding them in off-shores should get a break?

Got it.</comment>


Show HN: DroidEdit, a source code editor for Android - <AUTHOR> https://play.google.com/store/apps/details?id=com.aor.droidedit

<comment><AUTHOR> Tired of having to deal with my laptop battery, I decided to get a Transformer Prime. The only thing I needed to get rid of my laptop was a decent source code editor. And thus DroidEdit was born.

<comment><USER2> Looks very promising. Two questions:

* CoffeeScript support

* DropBox is nice, but GitHub would be the thing that would really make this rock

(another happy Transformer Prime user, now doing a little hacking via chrooted Ubuntu and VIM)

<comment><USER3> > but GitHub would be the thing that would really make this rock

no. not 'github', but 'vcs support': git, mercurial, others. where it's hosted doesn't matter.

<comment><USER2> Well, sure, but with GitHub you could additionally give a very easy way to browse and clone the repositories you have access to. So: a UI instead of writing repo URLs manually.

</comment></comment></comment></comment><comment><USER4> No one has mentioned Terminal IDE which supports vim, and git.

[1] [https://play.google.com/store/apps/details?id=com.spartacusr...](https://play.google.com/store/apps/details?id=com.spartacusrex.spartacuside)

</comment><comment><USER5> This is cool!

People who are interested in this should also take a look at AIDE, which can compile and install Android Apps on the Device itself, has code completition and lots of other cool things.

<comment><USER6> I tried AIDE. It was very neat. I couldn't believe it was doing what it seemed to be doing. Tried it on an ASUS Transformer with a keyboard. Don't think I'll switch to that as my primary development mode but it is quite handy if I am on an airplane or doing something else and don't have my larger laptop but want to try something to see if it works.

</comment></comment><comment><USER7> If your an iPad user, try Textastic app. In my opinion, it's the best source code editor for mobile at the moment. It has syntax highlighting, code completion, symbol navigation, (S)FTP, Dropbox support and great keyboard extension with easy swipe access to all special characters and numbers. See more: <http://www.textasticapp.com> I code for living and with this app, coding even on the touchscreen is a breeze.

Your app looks great too, though.

</comment><comment><USER8> I can highly recommend [https://play.google.com/store/apps/details?id=jp.sblo.pandor...](https://play.google.com/store/apps/details?id=jp.sblo.pandora.jota)

It has syntax highlighting too, not sure about indentation.

</comment><comment><USER9> I recently uninstalled DroidEdit because I had to handle more updates to it than uses for a text editor on my tab. This is mostly because typing without tactile feedback isn't that great. The editor in itself was quite smart though.

</comment><comment><USER10> Looks great, just bought the pro version. I tried a few others last week but was not satisfied.

Eager to try the remote commands for unit testing and source control.

</comment><comment><USER11> A ssh client, vim and external keyboard is all I need for code editing. I don't see the need for this kind of app.

<comment><USER2> You can also run Vim and Git on a chroot so no Internet connection needed: [http://androlinux.com/android-ubuntu-development/how-to- inst...](http://androlinux.com/android-ubuntu-development/how-to-install- ubuntu-on-rooted-transformer-prime/)

That said, the editor in this post looks interesting.</comment></comment>


TypeScript Deep Dive: Comprehensible handbook from basics to compiler internals - <AUTHOR> https://basarat.gitbook.io/typescript/ <comment><USER2> This book is fantastic. I think it is on the way to becoming, if it isn't already, "the" canonical book to check out when you start using TypeScript.

<comment><USER3> Yes I agree, I learned TypeScript from this book and learned modern JavaScript along the way as an extra.

</comment></comment><comment><USER4> Already love TypeScript, but haven't read any book about it yet, gonna pick it out and see how it goes!</comment>


Chemical analyses of the Isdal woman point to Germany and France - <AUTHOR> https://www.nrk.no/dokumentar/chemical-analyses-of-the-isdal-woman-point-to-germany-and-france-1.13523415 <comment><AUTHOR> Figured I'd post this here as several past installments on the same story have been posted to HN.

As to the article, I find it quite interesting that it is (apparently) possible to narrow down the area where her teeth were to such small areas - I'm off to google to find out how it is even possible.</comment>


The Future of Transmit iOS - <AUTHOR> https://panic.com/blog/the-future-of-transmit-ios/ <comment><USER2> I hate to admit it, but I have both Transmit and Coda for iOS and I never use them. I've never really used them. I know a lot of care went into making these applications, so I don't want to say it was a waste of money, but I just can't make iOS any more of a productive platform... even with great software.

Honestly, this story/link should be considered maybe a both a blow to the "post-pc" narrative (we're going on 8 years of "post-pc") AND to Apple itself.

MS didn't go about Win8 very gracefully, but honestly, I think A LOT of the thinking behind Win8 was right-on and future-minded. These concepts just needed a gentler, multi-staged introduction. I think Win10 is turning things around.

Also: I wonder if this reality has anything to do with that "cross-platform" UIKit/AppKit replacement PR drop we got a few weeks ago?

<comment><USER3> Careful. People on HN aren't really a part of the "post-PC narrative". People plugging keyboards into iPads and using them full-time to write papers at school are.

I'm not really clear why I'd use Transmit on the Mac either, except that it's a very pretty interface.

<comment><USER4> > People plugging keyboards into iPads and using them full-time to write > papers at school are.

How many people are doing that? A chromebook I can buy as a school computer. An iPad... The idea of trying to select chunks of text and move them around in a paper, or simply re-positioning the cursor sounds like a nightmare.

If I were a kid I'd beg my parents for a real laptop.

<comment><USER5> That's because your idea of a "computer" has a command line, Python interpreter, filesystem, etc.

Kids these days don't get exposed to that so they don't really desire it. Their idea of computing comes from apps that are take-it-or-leave-it, interact with other apps only in predefined and constrained ways, and use touch UI. They may want a better text selection interface but I'm not sure they concretely know that a "real laptop" has one.

<comment><USER6> But isn't that a failure of their education system?

Compare the kids who grew up on their iPads against a kid in Eastern Europe who grew up hacking on a Linux or even Windows machine using a real keyboard. Wouldn't the latter have all sorts of advantages in all sorts of jobs?

If nothing else, growing up using a real keyboard would mean they could type a lot faster than the one who is used to a touch screen.

<comment><USER7> > _Compare the kids who grew up on their iPads against a kid in Eastern Europe > who grew up hacking on a Linux or even Windows machine using a real > keyboard. Wouldn't the latter have all sorts of advantages in all sorts of > jobs?_

No, especially since the other kids grew up in a more dominant economy and have way more opportunities (which matters more than learning to mess on a cli).

Besides, the degree to which Eastern European kids learn to "hack on Linux" is perhaps overrated. Most kinds in school couldn't even learn to power on the PC on their own (but amazingly one would teach another all there is to start playing some game).

</comment></comment></comment></comment></comment></comment><comment><USER8> Transmit for iOS is $10, but I bought it because Panic is known for making premium-quality software to match the price.

…So I was quite surprised to find out it doesn't support the SMB protocol (i.e. Windows file sharing). That's one of the most common file transfer protocols, not to mention the only one that current macOS can serve out of the box. And the lack of support is not an OS limitation, since there are other iOS apps that support it (e.g. Documents by Readdle). So what gives?

I suppose the lack of support is inherited from Transmit for Mac; macOS can mount SMB network drives natively, so there's no need for a separate app. (Although I might like to use one anyway - mounting network disks is always a laggy affair, since most software doesn't expect the filesystem to be that slow.) But iOS has no builtin SMB client, so it would be quite useful there - is useful, with those other apps.

The list of cloud services supported by Transmit for iOS is also rather small - S3 and DreamObjects, that's it - even (especially?) compared to Transmit for Mac, which supports something like 10 other services![1] Why couldn't they port that functionality over?

The app does have a quite nice UI, and unlike some, I place a high value on that. But a premium UI is no use if I can't even connect to the servers I'm trying to access. Maybe they'd have gotten more sales with an app that could.

[1] [https://panic.com/transmit/](https://panic.com/transmit/)

<comment><USER9> > I suppose the lack of support is inherited from Transmit for Mac

I'd add that CIFS/SMB is one beast of a protocol... a basic ftp client for up/download can be done in a day, but CIFS/SMB? The spec alone clocks in at healthy 441 pages. Either reimplement a huge subset of this (and test with the countless versions of Windows + the even more countless deployed versions of Samba) at considerable expense, or ship Samba with the app... there are IIRC some Android apps doing exactly this, but I don't know if it's at all possible to do so on iOS.

<comment><USER8> Samba is GPL, but there are other options. I Googled 'smb client library' and saw at three viable-looking libraries on the first page:

[https://github.com/naxos/SMBClient](https://github.com/naxos/SMBClient)

> SMBClient is a small dynamic library that allows iOS apps to access SMB/CIFS > file servers.

[https://github.com/videolabs/libdsm](https://github.com/videolabs/libdsm)

> lib Defective SMb (libDSM) is a SMB protocol client implementation in pure > old C, with a lot less features than Samba but with a much simpler, and a > more permissive license

[…]

> The initial goal of this project is to have a library that can access most > SMB shares to read files and that has a license compatible with the > iOS/Android/WinRT appstores in order to integrate it into VLC for iOS and > VLC for Android.

[https://jcifs.samba.org](https://jcifs.samba.org)

> JCIFS is an Open Source client library that implements the CIFS/SMB > networking protocol in 100% Java. […] This client is used extensively in > production on large Intranets.

(Java would be annoying to run on iOS, but probably doable, perhaps using Google's Java-to-Objective-C translator.)

There's also Apple's own SMB implementation, which used to be included in opensource.apple.com source drops, although it seems to be gone as of macOS 10.11; here's the latest version:

[https://opensource.apple.com/source/smb/smb-759.40.1/](https://opensource.apple.com/source/smb/smb-759.40.1/)

Or you could go to the BSD SMB implementation that it was based on. I'm not sure how difficult it would be to port either of these to run as a standalone library - it looks like parts are already a library, but smbfs itself is a kernel module - but it's probably viable. In fact, 'fs-utils' from the rumpkernel project, which is an existing effort to port filesystem modules from the BSD kernel to userspace, seems to have a version of it:

[https://github.com/rumpkernel/fs- utils/blob/master/lib/exter...](https://github.com/rumpkernel/fs- utils/blob/master/lib/external/netsmb/smb_rq.h)

…Forgive me for the wall of links. I guess one example library would have been enough, but I was curious what options were out there.

I don't know how these libraries compare to each other and to Samba in terms of quality and compatibility. Most likely Samba is the best, but they all seem widely used enough that I'd expect them to do the job in most cases.

</comment></comment></comment><comment><USER10> Every time I read stories like this, I feel like the value of iOS development is slowly dwindling. App development has been a race to the bottom for small teams/indie developers making it difficult to build a sustainable lifestyle business. I'm not sure if there is anything that can turn the ecosystem around, but I hope WWDC introduces some more sustainable plug and play business models for developers.

<comment><USER11> I never understood the needs for the vast majority of apps. With everything clearly moving towards the web over the last twenty years, why did we all of a sudden focus on native applications? Money is the only one I can think of. I sure as shit don't need a native application to view news / tweets / whatever other nonsense there is these days. I've limited myself to the very first "page" of my iPhone. No more.

<comment><USER12> Because the kludge of HTML 5, CSS 3 and JavaScript is no match for actuall good UI/UX and platform integration, as proven by all WebApps platforms introduced since the WebRuntime on Symbian OS.

WebAssembly will be the final nail, making the browser just yet another general purpose VM, targeted by all major language eco-systems, using their UI framworks on top of Canvas and WebGL.

<comment><USER13> Admittedly, I have barely used MS Word in at least a decade, but I find Google Docs a far superior overall experience. Do you honestly have no positive web app experience at all?

<comment><USER12> Google Docs is at the level of Word 2.0 for Windows for Workgroups. Aka an improved typewriter version with some support for images.

No, I have yet to use any web app that could provide a better UI/UX than native alternatives, specially in execution speed.

<comment><USER11> So you'd rather Hacker News was an app correct? I sure don't.

<comment><USER12> I use the Reddit app yes.

Better yet would be for HN and any other kind of discussions forum, to just be NNTP hosted and then I could use any newsreader I like.

The Internet is about network protocols and distributed computing, not trying to shoehorn everything into [http://](http://)

<comment><USER11> www would disagree.

<comment><USER12> Mobile native apps and the market failure of all browser based OSes would disagree.

Even ChromeOS only had an impact in the US school system, forcing Google to support Android native apps.

<comment><USER13> Just because browser based OSes haven't been spectacularly successful, doesn't mean that webapps as a whole are failures. I am willing to bet that Google docs has better usage on the desktop webapp than it does on the mobile native app.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> > Transmit iOS made about $35k in revenue in the last year

Not good given the obvious development effort that went into it, but the transparency is appreciated.

I suspect this is directly related to the extraordinarily difficult experience that comes with trying to accomplish technical work on iOS. Perhaps that will change as iOS matures. Personally I've tried to use even boring old ssh and vim from an iPad a handful of times and it's beyond frustrating, you'll never want a real keyboard and cursor more in your life.

<comment><USER15> I'm afraid iOS never "matures", except maybe by important user-facing parts of it being consumed by MacOS when it becomes viable on i-devices.

iOS was designed with entirely different use cases in mind, entirely different workflows, and completely different users, those who prefer to never know words like "vim" or "ssh", and honestly have no need in either.

It's a square peg in a round hole.

<comment><USER16> iOS has matured some and continues to do so. The Files app and drag and drop enhancements in iOS 11 are good examples of this. I don't know if iOS will ever meet all of the use cases of a desktop OS, but it has definitely become capable of doing a lot more than it could a few years ago.

</comment></comment></comment><comment><USER17> The thing that actually surprises me most here is that Transmit for Mac _is_ apparently quite profitable. Free FTP clients have been around for so long, and have worked so reliably, that the thought of paying for one never crossed my mind. I personally have used Cyberduck for years, which is free (although it does tastefully ask for donations) and has never given me a reason to look for other options.

Can anyone explain what Transmit does that makes it worth $45? I am wondering if I am missing out on something here.

<comment><USER2> Transmit/Mac when it's discounted is definitely worth it IMO. $45 is a little steep, but Transmit performs really well, especially when you have a lot of little files to move.

<comment><USER6> $45/yr is probably an hours worth of work in most of the US for software devs. If you work minimum wage that's probably 5 hours of work.

It literally needs to save you about an hour's worth of time over its lifetime to be worth it. And that isn't even including all the other benefits you get from using a more frictionless and pleasing to use software.

I find complaints about the steep cost of tools from professionals when they don't even cost triple digits quite short sighted, to be honest (an exception could be made for professionals from countries where their pay is significantly lower).

<comment><USER17> I'm fine with paying for good software and I probably have about a half dozen paid apps running right now on my desktop. I completely agree with your point that $45 is probably not worth worrying about (or the difference between $45 and a $25 sale price) in the grand scheme of things if the software is useful to you.

One thing I will say though is that there are other costs associated with non- free software beyond just the license cost. You've got to manage license keys. You've got to worry about upgrades. If your company is paying for it you've either got to go through IT for procurement or you've got to submit an expense report to be reimbursed. Sometimes there are obnoxious license servers that you need to deal with (I'm looking at you, IntelliJ!). Installation of paid apps is harder to automate than a simple homebrew or npm command.

Of course, all of this may still very well be worth it if the software is useful.

</comment></comment></comment></comment><comment><USER18> Sad to hear this. Transmit for iOS is a fantastic app and a staple for my usage of iOS. Since Apple still hasn't implemented any sane ways to easily share files between iOS and PCs, Transmit is always there to allow a quick safe upload to a trusted server (with no "cloud service" nonsense involved!).

Hope it will keep running for a long time even without updates!

</comment><comment><USER19> I love Panic, and their software is great quality for what it does, but I'm sad to say I just don't have a place in my life for those kids of development tools anymore.

I find it unsurprising that there isn't a market for Transmit on iOS, but I do find it surprising that there's still a large market for Transmit for Mac. I bought it in 2011, and got a year or two of use, but now only use it once or twice a year which doesn't justify an upgrade.

I'd love to see them focus on more modern development tools, but I'm not sure their approach will work in that context.

<comment><USER20> might be why they started making games. Firewatch (the tree icon on their home page). It was fun and different, but failed to make me more productive...

<comment><USER19> As I understand it, Firewatch was not made by Panic, but the founders of Panic had creative input into it. I don't think it's a company focus for them.

</comment></comment></comment><comment><USER21> Removing, from what I can see, a pretty good piece of software from sale doesn't seem the correct option.

Then again I understand making it free / heavily discounted may irritate people who have bought it already.

Is there a better option for apps such as this?

<comment><USER22> I can see why they wouldn't make it free, they would have all the support costs without any revenue.

In an ideal world someone would be willing to take it over but who would want to take on a product that is a commercial failure?

<comment><USER23> It's only a "failure" if the goal is to make money with it. If the goal is to build good will and help their users who have bought their other products, and help recruit new users for those other products, it doesn't have to be looked at as a failure.

They could always offer it without support. Or open source it.

<comment><USER2> I bet they won't. I think there is a (or maybe a few) soecial and proprietary Panic libraries that they include across their applications. Open sourcing Transmit iOS would also mean open sourcing part of their other conmercial applications.

</comment></comment></comment></comment><comment><USER24> >Finally, the new Files app in iOS 10 overlaps a lot of file-management functionality Transmit provides

I disagree completely. Every time I need to save a file to my phone, I can't use the files app because you can't just save files the root, and I can't make a directory in the root either. You need to save into an App or an App's directories. So I need a "container", unless I've completely missed the point of the Files app.

EDIT: I should say, this is for the "On My iPhone" option, not iCloud Drive, which I don't use.

I always save files to the Transmit "folder". In fact, before files it WAS the files app on my phone, and it continues to be today.

I'm very sad to hear it's being discontinued. I wish they'd open source it so it could live on in some way. I'd be willing to pay money to help this app live on (e.g. pay the Apple developer fees to host it myself).

Damnit. Are there any good replacements for Transmit?

</comment><comment><USER25> I love Panic's tools, but I was one of those that got burnt when they pulled their StatusBoard app off the App Store a couple of years back. I have a small side project [0] that I created a specific integration with StatusBoard because it suited our web service so neatly. Shortly after I launched my app, they shut it down!

Haven't been able to find another app like it, and I believe a lot of our customers (including myself) still use an older version of StatusBoard still, so I've left the integration info on our web site for now.

But like others on here, I have most of their other tools on my iMac and my iPad, and while I use the iMac ones semi regularly, I hardly ever use the iOS versions (apart from StatusBoard).

[0] - [http://www.staffstatus.io](http://www.staffstatus.io)

</comment><comment><USER26> As someone who really wants to use my iPad for everything, I really really tried to use coda for development. But it crashes soooo much. It's sad because the potential is there. The iPad is so powerful but we need apps to utilize it fully.

Also, relatively unrelated, I await Apple to release Bluetooth mouse support. The touch screen ergonomics aren't good for long perdiods of hackin:-)

</comment><comment><USER27> Aw that stinks. Transmit was the first app I bought for my iPad Pro. I use it every day.

I guess it'll keep on working for now.. hopefully someone else fills the gap in the future.

</comment><comment><USER28> I simply had no idea it existed. Bought just to support a great developer, but also because I may find uses for it in the future.

I still can't get into tablets but I can absolutely see how this would make tablet work feel more like "real" computer work.

<comment><USER29> Try FileExplorer. Not as pretty, but substantially similar at 50% of the price.

</comment></comment><comment><USER30> Bummer. Coincidentally, I just (about an hour ago) purchased a bunch of license for Transmit 5 Mac -- fantastic product. I've also been a Prompt and Transmit iOS user since release -- also great products.

</comment><comment><USER31> That's a real shame. I'll keep using it, but at some point I guess I'll need to find a new SFTP client. Any recommendations? Bonus points if it integrates with the new Files app.

</comment><comment><USER32> Also sad to see it go. I use it all the time to transfer videos from my Linux workstation.

</comment><comment><USER33> Sad to see it go!

</comment><comment><USER34> Crappity crap... Then again, it was very rarely updated - usual sign of noncommittal developers.

<comment><USER35> > Crappity crap... Then again, it was very rarely updated - usual sign of > noncommittal developers.

I call bullshit.

Panic has been developing apps for the Mac for many years. Wikipedia lists Transmit for Mac as first released in 1998. Transmit 5 was released several months ago. Though they have been slowly ending development on their iOS apps, this is a preferable outcome to burning money and closing up shop altogether.

Disclosure: I am a customer.

<comment><USER34> I was talking about Transmit for iOS specifically.

</comment></comment></comment><comment><USER23> Wow, I just saw the price. $10!

There seems to be a lot of entitlement amongst developers of successful apps. I mean ten dollars... Have they ever considered that it could be a free app that is a thank you to the community that has supported them over the years, which could pay for itself by bringing new users into their customer base?

<comment><USER36> > Or a free app that is just done as a thank you to the community that has > supported them over the years? What would be wrong with this?

That would be a very expensive thank you for a tiny business! Given Panic's level of polish and concomitant development timelines, I expect this app took several months of a designer's time and at least six months of an engineer's time—probably more like nine. Then QA, support, etc. I'd guess we're looking at a >$150k price tag here, plus ongoing maintenance.

As to paying for itself via bringing new users into their customer base: given the average sale price of their desktop software, this iOS app would have to generate several thousand net-new sales. That doesn't seem _wildly_ outlandish to me, but I'd guess one order of magnitude fewer is more likely.

<comment><USER23> You haven't responded to the point that the cost is sunk.

I have made free apps and the indirect dividends have been huge. You yourself make a free app (and I donate to it monthly, hurray for me) and yet you don't see why anyone would want to make a free app?</comment></comment></comment>


Caution, train wreck in progress - <AUTHOR> http://www.cringely.com/2012/02/caution-train-wreck-in-progress/ <comment><USER2> _And stocks are rising as powerful people and organizations prop up share prices just long enough to unload their own positions, leaving the little guys to drown. Far better to just let Germany take over the payments and own that Greek jalopy outright._

Giving big financiers an escape route at the expense of everyday folks is so bad. Bug giving big financiers an escape route at the expense of everyday Germans is good.

What does Cringley have against Germans?

</comment><comment><USER3> Is... is the author advocating that Germany buy Greece? Or simply that Germany help bail Greece out? Either way sounds a bit... unprecedented and unlikely.

<comment><USER4> It's happening already -- Papademos was Germany's choice for interim prime minister. This was in return for the last round of bailouts.

<comment><USER3> And besides not crashing the EU economy, what is Germany getting out of it? Germany and Greece are quite far from each other, geographically. It is like the US buying a controlling influence in Israel in return for a (economically) stable and growing trading partner? Is it simply plugging the hole with your finger to keep the boat from sinking? Or are they looking for geographical expansion?

<comment><USER4> This isn't like a US-Israel situation; it's more akin to a California-Alabama situation (which is actually about the same distance as Germany-Greece). Germany and Greece are part of this economic bloc called the European Union, and they share the same currency. Greece's debt is also financed mostly from German banks. If Greece goes down, so does a large chunk of Germany's economy, as the banks will either fail or take drastic measures (like putting a stop to all lending) to protect their balance sheets. Since Germany is the largest economy in Europe (20% of the EU's GDP), this will basically kill the EU as we know it and may bring on a global depression.

<comment><USER3> Right, what I was dancing around asking was "does the author really believe Germany is going to buy Greece and keep it?" Like California buying Alabama and now you've got two Californias.

</comment></comment></comment></comment></comment><comment><USER5> europe is just letting greece live long enough so that they can get a wall of money for spain and italy and recapitalize the banks enough to cover a greece default.

after that -- greece goes under the bus.</comment>


Use verbs in your to-do list - <AUTHOR> http://www.whatsthetrick.com/noticias.php?id=15

<comment><USER2> Verbs are key for getting people to do stuff. Compare "Use this form." to "Talk to me." Also, read the previous sentence; it's just easier to convince people to do stuff if you give them verbs to work from.</comment>


Why 0.1 Does Not Exist In Floating-Point  - <AUTHOR> http://www.exploringbinary.com/why-0-point-1-does-not-exist-in-floating-point/ <comment><USER2> Representing 0.1 (or rather, 1/10) has the same problem in binary that representing 1/3 has in decimal. Your denominator doesn't divide any power of your radix, so your representation has to be either infinite, or inaccurate. If you've ever tried to do complex decimal math by copying results like 0.6666667 into and out of a calculator, you've probably run into the same issues.

<comment><USER3> Yeah, I was surprised why it didn't mention that as being the same problem in a different, more familiar form.

</comment></comment><comment><USER4> Hah! If Mike Cowlishaw was here he could give you a wonderfully eloquent treatment on why binary floating point sucks. And he's actually done something about it [1] with both a format and software to deal with decimal numbers.

Further the densely packed form gets very close to optimal in terms of bit representation. Assume that 4 bits (BCD) is 'worst' case, you can represent 0-9 but you 'waste' the information space 'a-f' (in hex, 10-15 in decimal) but 3 bits only gives you 8 states. What you want is a total of 10 states which is 3.3125 bit's worth (best case) or 3 digits in 9.9375 bits, these formats give you 3 digits in 10 bits which is pretty close.

Mike goes on to talk about how to build hardware that does floating point operations on this stuff. I built some into an FPGA and it really is pretty straight forward, especially if you do iterative multiply and divide.

Consider the interesting thing where you take 128 bits (two 64 bit words) where you use 60 bits for the whole part (18 digits) and 60 bits for the fractional part (18 digits) and you've got 8 bits left over for various non- number entities (+inf, -inf, NaN, etc). Would be great for CAD package, or a financial spreadsheet.

[1] <http://speleotrove.com/decimal/DPDecimal.html>

<comment><USER5> That was an interesting link, thanks. I liked other parts of the site too, for instance

<http://speleotrove.com/decimal/>

Any idea what decimal floating point is used for?

(I have little to no idea about CAD or financial software.

I can see that fixed-point decimal with two decimal places is useful for things where you want to be able to reason about rounding of cents.

I can also see that you'd want more than two decimal places for a lot of calculations, for instance computing interest.

But decimal floating point...what's specified in such a way that you need to use decimal floating point?

I checked the wikipedia decimal floating point page. Didn't see any concrete examples there either.)

<comment><USER4> It is used in high end CAD systems where tolerances need to be exact, there was also a wonderful decimal package for COBOL which was doing financial computations. Unknown to many (most?) people some early IBM Mainframes [1] were decimal machines.

If you work in 3D modeling you will be familiar with the effects of binary floating point as 'gaps' between polygons where they shouldn't be. Sometimes those gaps only appear at a certain scale because that is where the rounding gets it wrong, or if you compensate by always rounding up you get overlaps or texture issues.

[1] [http://en.wikipedia.org/wiki/IBM_700/7000_series#Decimal_arc...](http://en.wikipedia.org/wiki/IBM_700/7000_series#Decimal_architecture_.287070.2F7072.2F7074.29)

</comment></comment></comment><comment><USER6> It depends on the underlying representation. I know it's almost never anything except IEEE 754 now, but it could be different.

When I was an undergrad doing the ACM programming contest, one year we had this triangle problem where, given the length of the three sides, you had to print whether it was an equilateral, isosceles, right, or not a triangle at all. Lots of naive programmers (including me) just checked if (a _a + b_ b) == c*c for a right triangle. The kicker is, for the (secret) test data, that worked fine if you used single-precision floats and failed if you used double- precision floats.

That educated a whole region of ACM contest competitors on floating point representations.

<comment><USER7> How did the spec specify input format?

<comment><USER8> In the ACM programming contests, input formats are usually ASCII text, read from STDIN or from a file.

</comment></comment></comment><comment><USER9> You know how you can't store 1/3 in decimal. (I think I learnt that in primary school)

Same case with 1/10 to binary.

Discussion Over. How does this story have any up votes?

<comment><USER10> Your comment is exactly why getting into programming for the first time is a shit experience for many people.

I even had Ph.D. TAs in college with the same attitude.

Unbelievable.

<comment><USER11> This is the type of thing I learned in my first semester of undergrad as a CompE. This information is not a revelation for 90% of people with programming experience unless I'm greatly overestimating our collective knowledge.

<comment><USER9> kmfrk: You have a point. I guess my point was that _I_ don't think HN is a venue for sharing articles aimed at beginners. But the upvotes prove me wrong :) The article is pretty well written.

</comment></comment></comment></comment><comment><USER12> Sure it does - in that any floating point scheme is a well defined partition of the real line in the range [-FLT_MAX, +FLT_MAX] into 2^n intervals (less two Infs, a load of NaNs and a spare zero), one of which absolutely contains 0.1

<comment><USER9> Perhaps you could prove your point by supplying 0.1 in a binary floating point format. You can choose the standard.

<comment><USER12> Sure adaml_623,

0x3dcccccd in IEEE 754-2008 (binary32) corresponds to the interval (0.09999999776482582, 0.10000000521540642) - which contains 0.1.

Disclaimers: I worked this out with double precision, and if you care about if the endpoints are inclusive/exclusive, the wikipedia article will help.

<comment><USER7> X \elem S is not the same as X == S, in many important contexts.

<comment><USER12> Agreed. I "proved my point" but I didn't do it "by supplying 0.1 in a binary floating point format", because that wasn't what my point was.

</comment></comment></comment></comment></comment><comment><USER13> I would be MUCH more interested to get some insight as to WHY a binary numbering system, which can't represent accurately a number so trivial as 0.1, have ever become ubiquitous for general-purpose floating-point applications. Or why it's no worse than any other system.

Any taker?

The original article in itself is pretty interesting, but of very limited appeal to the HN crowd. The visitors here being mostly technical types, anyone with a Comp. Sci. or Comp. Eng. degree has already gone through those computations many times over during their career.

</comment><comment><USER14> The exact way of representing of numbers like 1/10 and 1/3 is to use a Rational type.

I'm not clear as to why this is a problem though, and where it can be magnified even despite using rounding in your application.</comment>


Cloud-based User Management for Web Apps - <AUTHOR> https://userapp.io/ <comment><USER3> Why? Honestly, how can you "outsource" such a vital part of your web app to a third party? Not only is this a privacy disaster but also, if this user service goes down or has a temporary downtime, your own business is effectively unusable.

I understand that it makes sense to not write these types of user functions and management things over and over again. The solution however, is not a SaaS, but a library or a little framework. And from what I remember, major Web development frameworks offer exactly these types of functionality.

I don't want to be a downer and you guys probably spend a lot of time on the product, but from my perspective, any business owner using a third party to handle user data acts irresponsibly. You OWE it to your users to keep their data as tight and as centralized in one spot as possible – a spot only you and employees have access to and servers only you rented and have access to and not a third party.

I'd even rather use Wordpress as a basic user management platform than use a third party service. This way, it is at least fully under my control and I'm the only one responsible if things get broken or data gets stolen.

<comment><USER4> One possible use case: Let's say you are building a new app and you don't know if it will be successful. At this point you are supposed to be working on the core. You are supposed to be talking with the users as soon as possible. You are not supposed to spend your time on things that don't matter such as registration, email delivery, forgot password.

If the app becomes successful you can always implement these things in house later.

<comment><USER5> Please , in every languages there are a tons of libraries dealing with these stuffs, Starter projects with these functionalities ...

        At this point you are supposed to be working on the core

<comment> UK-AL Invoicing, Price Plans and Payment. These are not normally built in. Basic user management is, but not those things.

</comment></comment></comment></comment><comment><USER6> I wish you the best of luck with this. It's really well designed.

I launched a very similar service named Accthub about 18 months ago and unfortunately it didn't fare well. Now, there's Mozilla Persona, Stormpath, Userapp, and probably several other in the same space.

Hope you can turn it into a legit business, but the general issue developers had was:

1) This is not a legit issue I have, my framework can handle this in the matter of a few minutes, maybe an hour or two if I want something really complex. 2) Privacy concerns. 3) High availability issues.

Best of luck, I will be monitoring your service closely because I want it to do well.

</comment><comment><USER7> Looks intriguing and I can tell you guys have spent a lot of time on the feature-set. But the biggest thing that will hold me back(and may be others) is a lack of clarity about security and my data(what happens in the event that you are down? in the event that you close shop?)

<comment><AUTHOR> OP here.

This is something that we are very aware of. We only have good intentions and want our users to feel 100% secure with us. If you don't, please let us know how we can change that! :) We don't have it now, but we will make it possible to export all of the data in UserApp at any time.

Regarding security and privacy we have written a section about it here: [https://help.userapp.io/customer/portal/topics/550128-securi...](https://help.userapp.io/customer/portal/topics/550128-security- and-privacy/articles)

Additionally, everything is SSL and passwords are stored using bcrypt. And we will make it possible to login using 3rd party providers later (OAuth). From a personal perspective, we will run this ship to the end of the world if we have to. Since we're developing quite a few other services (www.amail.io to mention one) we are also basing all our services on UserApp.

<comment><USER8> This sounds pretty good at a first look - so why do you bury it somewhere deep in the help section?

<comment> UK-AL Yeah its the number one concern with this type of product. So it might even be good to have a security section on the front page, to ease nerves.

<comment><AUTHOR> OP here.

I totally agree. Don't know how we could miss putting it up there. I will see to it that this gets the attention it needs on the front page. Thanks! :)

</comment></comment></comment></comment></comment><comment><USER9> Would be interesting to see the comparison of this against [https://www.dailycred.com/](https://www.dailycred.com/)

<comment><USER10> DailyCred cofounder here.

We do not (currently) manage pricing and plans for you, so that's a plus for UserApp.

We are more focused on user management, oauth simplification (FB, Twitter), auth, and user analytics.

We're also VC backed (Google Ventures) and are storing millions of accounts. Because we have a few larger clients bringing in real revenue, we're not going anywhere anytime soon.

Some unsolicited advice for UserApp:

* You need to address lock-in. It's the first thing everyone asks us. We designed our platform for zero lock-in and account portability for this very reason.

* This space can be a hard sale. People are reticent to store their user data in the cloud. (As they should be!) Compare that to the next social/mobile app that people will try on a whim. That's the bad news, but the good news is once you've "wowed" a customer, they will likely be a customer for a very long time -- even if you make export easy.

* Lastly: good luck!

</comment></comment><comment><USER11> This looks great! For me as a developer, who considers using it for a side project, I would even bother to spend the 9$ for the development version. Would be great to have a (user limited?) forever free account.

</comment><comment><USER12> Good luck. I have been using [http://dailycred.com/](http://dailycred.com/) for an year now and very happy with it. They have free account available too which is definitely needed to try a product such as yours.

</comment><comment><USER13> You could consider "Bring Your Own Database."

Meaning give developers the nice UI and added features but connect to the database of the developer's choice to actually store User data. That might address security and what if you close shop issues.

A SaaS app that does something similar conceptually is CushyCMS -- you give them your FTP information and they provide an interface without storing or hosting your content.

[https://www.cushycms.com/en/static/faq#tech_host](https://www.cushycms.com/en/static/faq#tech_host)

</comment><comment><USER14> Looks great! Will surely use it for my next project.

Few suggestions:

1\. Implement multiple ways to login (and charge accordingly) e.g Keyfile based, Color combination based, Biometric based, etc.

2\. Do cross-platform API. I know you might think that BB is a sinking ship but to be ubiquitous you service needs to have an API on EVERY platform.

3\. (This is more technical) Shard your db based on the location of your customers and accordingly replicate your data. e.g. If I launch a webapp hosted in India, I obviously don't want my customers to hit sweden or US every time they login (with the undersea cable breaking every now and then). If the India mirror of your service goes down then there will be graceful degradation (users will login slowly by hitting the other replicas) but not a full downtime. Basically for a customer X running webapp W, the primary replica should reside in the vicinity of where W is hosted but backed up by replicas in other locations.

4\. Introduce a free development tier for upto 4-10 users.

</comment><comment><USER15> Hey, this looks like a nice time-saver for those of us starting up side projects. Not everybody wants to build out this stuff over and over, and working with OAuth is a pain. So, thanks!

Now, I know it's on your roadmap, but I would really like to see sample code integrating with one or more payment providers or recurring billing management services. Stripe and Recurly would be top of my list. Would love it if you could get that up soon.

Would also like more docs about the differences between permissions and features. I mean, I think I get it, but more specific text would make me feel more sure.

Minor bug: in my own account information, when I went to go edit it, you have separate fields for given/first name and surname, but you refer to both in the info/help text as a surname or last name.

Anyway, nice job!

</comment><comment><USER16> Looks good. I think the 'hours saved' under 'save time with userapp' is exaggerated a little :)

If i were to use it, I'd want some easy way to export the users though. I know i could iterate through them all and get the data (maybe not password hashes??), but at one point a web app would probably need something custom enough that i'd just want to have all the data myself.

I think things like stopping invalid signups, good spam protection etc could push people to use this. Also integrating login via facebook/google/twitter and making it work seamlessly out of the box would be a big plus. For those small website projects it would be much easier/quicker to plug this in, and focus on the core of the app, rather than all the user backend crap.

</comment><comment><USER17> Since I've built user/admin systems for the majority of my career, this is really interesting to me. The site looks great and the Family Guy stuff is funny ("No,n0_p4ssword!") Hah.

I agree with the lion share of what WA said.

The MVP/prototype argument is a valid one, but remembering that nothing lasts forever, it's probably wise to think of these services as temporary tools and not permanent solutions.

I believe that user management is such an important (and basic) thing, that you should own it. For the hackers out there, feel free to checkout my Drywall project, which is a website user system build for node. [https://news.ycombinator.com/item?id=4951605](https://news.ycombinator.com/item?id=4951605)

</comment><comment><USER18> My gut's telling me this tool is going to be successful. But you'll definitely need to grow some thicker skin. Disregard skeptics (unless it's constructive criticism), keep building your product, and keep pushing.

Good luck.

</comment><comment><USER19> This would be cool as an extension of the Mixpanel API. So instead of just tracking users you'd have all these features as well. I'll agree with the criticism of this being a point of failure too big for mission critical systems, but if it gets proof of concepts off the ground sooner, who knows? Could be a great way to save time. I would suggest thinking carefully how you would eventually grow out of each component. That'd be my main concern. I want to be able to switch out components one at a time.

</comment><comment><USER20> Nice work guys. I especially like the integrated pricing system. Adding a means of payment is a tricky aspect of a product. If that is taken care of well it saves a lot of time.

</comment><comment><USER21> Would not use this. If I want saas I'll use open id (facebook/google login), its free and people are already using it.

If I want ownership of code, I'll use existing frameworks.

</comment><comment><USER22> I would honestly just use this to start off and save time, but once things start picking up, data export and in house user mgmt would be the move.

</comment><comment><USER23> Really neat idea, and seems well built this far.

However, I feel like it needs a bit more until I try it out. Right now it would be a compromise between saving some hours in a few areas, and use those hours to learn Userapp and integrate it.

Anyhow, hope it moves along well – will check back on the progress in a few months and see if it have improved with more features, demos and examples.

</comment><comment><USER24> This is a great idea. I've been thinking of developing something similar. But you cannot sell it as SaaS. It needs to be a one-time self hosted project so that startups and download, install and be ready in minutes. At the same time there are no security/privacy issues that most users here are worried about.

<comment><USER25> I agree strongly. Ideally this would be a self-hosted project.

This would eliminate most of the potential privacy issues that might inhibit usage of this.

I'd love to see something like this take off because its time wasted that prevents you from working on a core product idea.

</comment></comment><comment><USER26> Can anyone recommend a service similar to this (a backend framework) but which allows you to keep your own data?

</comment><comment><AUTHOR> We just launched UserApp after 9 months of hard work. Please try it out and let us know what you think :)

<comment><USER27> Have you done any A/B testing on including text like "That's about 4 cups of coffee" in pricing pages?

I found this: [https://news.ycombinator.com/item?id=4394114](https://news.ycombinator.com/item?id=4394114)

<comment><USER28> Hi, I'm the "front-end dev" of UserApp. No, I just went on my feeling on this one :) I actually got the idea from wrapbootstrap (e.g. [https://wrapbootstrap.com/theme/ace-responsive-admin- templat...](https://wrapbootstrap.com/theme/ace-responsive-admin-template- WB0B30DGR)). Thanks for the link btw, I will check it out later!

</comment></comment></comment><comment><USER29> I'm working on something like this, but installable on your own server. Subscribe here if you want to know when I release it: [https://lists.codingrobots.net/?p=subscribe&id=3](https://lists.codingrobots.net/?p=subscribe&id=3)

<comment><AUTHOR> Nice. I have subscribed to your mailing list. Will be interesting to see how you approach it :)

<comment><USER29> Thanks, and good luck with UserApp!

</comment></comment></comment><comment> UK-AL This is actually a pretty good idea, solves a legitimate annoyance. Obviously there is privacy concerns.

</comment><comment><USER30> You claim it's a low-latency, HA platform. What does that mean? Details are the only way to make your users feel secure that you won't be going down when they need you the most.

</comment><comment><USER31> good idea, but coming from a privacy startup this is obviously a no-go..

and distributing a web-app would equal to just open source it.. I know, it's a dilemna

<comment> bjelkeman-again I need to integrate something like this in an open source platform. Is there anything even close as an open source project? Or do we need to develop the same thing as FOSS ourselves?

<comment><USER32> OpenAM

edit: I seem to have been voted down. It was a serious suggestion though - <USER2> I misunderstand the question?

<comment> bjelkeman-again It wasn't me. Someone down voted me too. Sometimes the HN crowd is a bit negative against open source as they are focused on making money and there is some who think there is a conflict in that.

</comment></comment></comment></comment><comment><USER33> It does feel like they are running their user credentials and other "critical" stuff in MongoDB. I wouldn't advice that.

Am I wrong? Curious.

<comment><AUTHOR> We are actually using Redis and have configured it for high consistency/durability.

</comment></comment><comment><USER26> This looks interesting, maybe a video of how it works? It's clear that a lot of work has been put into this so kudos for that.

</comment><comment><USER34> $89 is not "about 18 bottles of beer."

<comment><AUTHOR> Then you don't live in Sweden. Beer here is expensive :) :(

<comment><USER35> How are privacy laws in Sweden?

<comment><USER35> Why was I downvoted? I am genuinely interested to know where to host data.

[https://news.ycombinator.com/item?id=6182989](https://news.ycombinator.com/item?id=6182989)

</comment></comment></comment></comment><comment><USER36> Way too expensive for just a small piece of your business. Keep in mind a decent server at Digital Ocean is just $5/month.

</comment><comment><USER37> Are you going to add other currencies? What are the limitations of doing it?

</comment><comment><USER38> This seems best suited for building a prototype quickly (i.e. Hackathons).

</comment><comment><USER25> This site looks beautiful and very well thought out at first glance.

I think there might be a use case for this for simple projects, but the privacy implications of this in light of NSA and other government spying makes this unusable for most potential applications.</comment>