Lazy Authentication Still the Norm - <AUTHOR> http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/ <comment><USER2> I closed my paypal account after reading this. The gist is that the author had his account compromised and after warning paypal about this, had it compromised immediately again. It turned out you don't even need a password to get into accounts.

There's no excuse for a multi billion $ company to be this lax on security today.

<comment><USER3> That seems excessive. Do you have any enemies you're particularly worried about attacking you? If not, then this is important but not THAT imminent of a threat to you.

<comment><USER2> I closed it more as an incentive for them to improve their security than because I feel I'm at risk. I think customers should do this more often otherwise companies are slow to address these issues. And if it were too difficult for me to close my account I'd know I am too dependent on them.

<comment><USER4> What data do you have on your PayPal account that you're so worried about?

<comment><USER3> I think he sufficiently justified his actions. He is just 'voting with his dollars'. I agree with him, in principle.

<comment><USER5> I feel like it would be more effective to keep the account open and badger them every day about the issue. Worst case: they close his account (which he's already willing to do). Best case: they fix the problem :)

</comment></comment></comment></comment></comment></comment><comment><USER6> I agree that banks and other high value targets still assume that attackers somehow "play by the rules". I got a call not too long (maybe a year ago) from someone claiming to be with my bank. Their first line was, "To verify your identity, what's the last 4 of your SSN?" My response, "You called me, how do I know you're actually with (bank)?" The rep was flabbergasted at the response and didn't know what to say.

Finally he gave me a number and suggested I call him back at it. Same problem. He gave me the number. It's a random phone number. I ended up looking up the number and confirming it was associated with the bank and then calling him back on it. Not ideal, but the whole security model is completely broken.

<comment><USER7> This is a great comment. It is this kind of social engineering attack which is unbelievably effective, simply because most people don't want to offend the other person at the other end of the phone.

Banks really need to stop phoning people like this. A simple way to do this would be to have a TOTP type password that the caller needs to confirm with the callee, regardless of which direction the call is going on; bank to customer, or customer to bank. As a customer you should be able to ask the bank representative for the shared password and if they can't answer the question then you should call your bank immediately to warn then.

<comment><USER8> And it's particularly effective because some banks apparently do exactly this. This would be reason to move to a different bank. These banks encourage behaviour that rewards phishing.

</comment></comment></comment><comment><USER9> Paypal remains the only online service I've used for real world stuff (as opposed to throw away e-mail accounts on spam forums) that has been compromised (to my knowledge).

In 2007 or so $50 was taken from my account and sent to SecondLife (remember them?), despite me never having played that game. I think even back then the only way I could prove I was the rightful owner of the account and get my money back was to send a photo of my drivers license.

I'm glad they've stepped up their security game in the past 8 years.

</comment><comment><USER10> PayPal seems to have a lax attitude towards security in general. I had a similar issue a year ago, that (fortunately) didn't end up in having my account compromised <[http://www.sanspoint.com/archives/2014/09/11/great- paypal-em...](http://www.sanspoint.com/archives/2014/09/11/great-paypal-email- hack-wasnt/>) but my dealings with PayPal support didn't give me much hope for if and when things do blow up.

In this case, it's likely that phone support is optimized for speed, rather than security. Good if you're legit, bad if you're a target.

<comment><USER4> I fail to see how your story is at all similar to Brians.

</comment></comment><comment><USER11> I don't blame companies for supporting the "20 questions over the phone" last line of lost passwords, but your account should be secured as part of the process - take a restore point, dump the credit card info, lock some features for a week, etc.

<comment><USER12> I do blame them. These questions are always the weak spot and any system is only as secure as that weakest point. Three answers to those questions are typically trivial to find out. I find it downright malicious to even suggest someone protects their data or wealth by asking people what the name of their high school teacher was. This is a incredibly stupid idea and suggesting this to your users shows that they are either stupid to the point where they should be considered unemployable at any company or criminals.

</comment></comment><comment><USER13> It would be nice if there was a good solution that companies could implement because this isn't just a fault of PayPal, this is most utilities, TV providers, etc. You can call up and pretend to be the account holder and as long as you have the address on file and account number you can gain access to a lot of things.

<comment><USER14> There is, auth your users through google/facebook/whatever. It's really quite simple.

<comment><USER15> The problem is that then you need to force customers to be on Google/Facebook/whatever.

There was (Still is!) something very similar in an organization called CAcert[1], which was a predecessor to the current Let's Encrypt project (free SSL certificates) that hasn't succeeded dramatically because it hasn't been able to get its root certificate into browsers.

Basically they host parties, usually alongside a Linux or BSD conference, where trusted members will look at your legal documents and then affirm on their website that you are who you say you are. Some amount of "you are who you say you are" was then needed to get a free SSL certificate.

But imagine that in this context: everyone keeps one secure CAcert account, and then when you need to reset your password, some sort of OAuth handshake with CAcert proves it. You have one secure account with CAcert, and all of your utilities and cell phone stuff and PayPal will only reset your password with a handshake with the CAcert servers.

[1] [http://www.cacert.org/](http://www.cacert.org/)

<comment><USER14> You and the other responder to my comment both raise a point that is extremely important and near/dear to me. I talk constantly about the need to establish tech "utilities" that can offer pure commodity services without being compromised by things like a profit motive, need to grow, etc. Authentication is a perfect candidate for this.

However, even given such a pure, charitable utility, OAuth is still the best way to do this stuff, and that's really what I meant in my comment. Authing through a universal standard means you're not tied to ANY parties, and you can always offer the best of the bunch as an option. In fact, any such "utility" should enforce interoperability/standardization as a primary feature, lest it leave its users subject to economic/political volatility.

As for forcing customers to be on google/facebook/whatever, I see this as a sub-optimal practice insofar as it does NOT include such a pure utility, but not for any other reason. I don't have up to date data on the topic, but offering both Google and Facebook OAuth surely covers almost everyone, and even for the occasional user of neither it would still significantly reduce account proliferation and bad practices if everyone forced people to sign up for one of a few select accounts vs. the alternative of everyone rolling their own.

</comment></comment></comment></comment><comment><USER16> What's the business case for PayPal not using 2FA? I've never done an integration with them but I wonder if there are SLAs in place that require a maximum amount of steps or an average transaction time or something that verifying via SMS or a physical token would invalidate. Seems to me that PayPal accounts would be a major honeypot for seedy activity and that the customer service impact of dealing with this is high.

Unless this is a very rare thing at PayPal and internally they know it.

<comment><USER17> They do offer 2FA, but calling customer service circumvents it. I wish he had been a little more explicit here, but I think Krebs' point was to raise the question: Why doesn't customer service use (dynamic) 2FA?

<comment><USER18> And the answer is all-too-often:

"We didn't build or train our call center, nor is it actually part of a single central system. We get contracts and then their support staff plugs into our backend and we hope the security constraints written on the contract are real and the training is adhered to."

I'm in the middle of requirement gathering for an unheard-of project: a custom, in-house support console for a new product I'm working on. We're even going to source someone to make training and testing materials, and do auditing independently of the call center (along with their auditing).

Sad part is, while I find it a bit intimidating because I've never undertaken a project like this before, it's not proven very difficult. It's just the miserable state of most enterprise IT and how very bolted-on customer support is to most operations.

</comment></comment></comment><comment><USER19> You are lucky enough to be in a country where PayPal offers 2FA at all. For unknown reason 2FA is available in very few countries, while majority cannot use it. I talked with their call center, but I was under strong impression that the lady didn't even understand why I need such thing.

<comment><USER20> Except the point of the article is that PayPal's 2FA is pointless, since password reset bypasses that and relies on easily-obtained information.

</comment></comment><comment><USER4> Krebs talks about the supposed problem, but fails to point out a solution.

Without knowledge based auth, what is PayPal supposed to say when someone calls them and says that they lost their phone and therefore access to their email and can't remember their password?

Right now, to social engineer someones account (Like Krebs's in this case, I've personally listened to the call he's talking about here) you need almost all the information that's on the account already (besides payment history, which could be a big deal to someone I guess).

A detail worth noting is that stealing someones PayPal account in this manner doesn't allow you to steal money from them.

<comment><USER21> Improve the UI for things like recovery codes in ways that essentially force users to print them. One thing I've seen out there is asking the user for a recovery code during the login process a few days after enabling 2FA (with an option to skip it a few times, and generate new recovery codes if the user failed to print them the first time.)

Add a waiting period for affected customers, let's say a week or a month. During this period, try contacting the user on all known communication channels (email, SMS, push, robocalls; Coinbase does this quite well for Vault transactions) to inform them about the impending account change.

It's certainly not the easiest thing to get right, but it's not asking for too much from a high-profile target like PayPal.

</comment></comment><comment><USER20> Reminds me I should try the password reset flow for each service before trusting it.

Would be awesome if there was a site that documented these, even if it was as simple as plaintextoffenders.com.

</comment><comment><USER17> > Any company that authenticates customers with nothing more than static > identifiers — address, SSN, DOB, phone number, credit card number, etc. — is > vulnerable to these takeover attempts.

Does having two-factor auth even matter if it can be circumvented with social engineering from static data?

 _I also submitted the same article last night:_

[https://news.ycombinator.com/item?id=10805415](https://news.ycombinator.com/item?id=10805415)

</comment><comment><USER22> The real problem I see is: A lot of places are _still_ using SSN (and sometimes address) as a "password". And it's not just PayPal. It's the "something I know" that was never a good idea in the first place. I never understood how just your SSN was a good authenticator of who you really were.

</comment><comment><USER18> If you are concerned about this (and you should be) there is very little you can do about Paypal. But for your banks, all of them allow you to ask to set a "password" or "security phrase" for customer support.

I strongly recommend you do this. It's actually stronger than the branch security.

</comment><comment><USER11> If only PayPal had some truly private non-static information about the customer that's not freely available in hacker databases that they could ask the customer about. Possibly some piece of info that the customer keeps in their wallet.

If only. If only.

<comment><USER23> Sorry, you're being too obtuse for me, and I'm legitimately interested to know what you're suggesting. Some sort of one-time code that the user prints out to call into phone support?

<comment><USER24> The US Treasury's consumer web portal used to do this for online accounts many years ago.

They mailed you a plastic card that had a map-like grid. I believe it was mailed using USPS Certified Mail that you validated online. Once validated, you were asked to provide the code for "Column A, Row 14", and then were prompted for a password. IIRC, you could also set it up so that you can login and view your balances with just a password, but would need to do step-up auth to buy/sell/transfer securities.

IMO a nice solution from a security POV. Certainly better than online brokers -- Charles Schwab "protects" my retirement savings with some bullshit 6 character password.

Customers HATED it, and the "I lost my card" process involved having another card mailed to you. So they replaced it with another solution that is IMO less secure.

<comment><USER7> It's called a TAN: [https://en.m.wikipedia.org/wiki/Transaction_authentication_n...](https://en.m.wikipedia.org/wiki/Transaction_authentication_number)

</comment></comment></comment></comment><comment><USER24> If you're a high-risk user, it's incumbent on you to take specific measures against this stuff. Gangs of criminals specifically targeting an individual aren't the type of risks that most businesses are going to be thinking about.

"Use two factor" isn't a valid response here. If you expect the electric utility to throughly vet every service request, why would you allow them to assume that the authorized user actually controlled his phone? (Especially when people tend to connect/disconnect utility services when they are buying/selling/renting a house and often doing things like changing phone numbers.)

Why does Brian Krebs have anything like this in his name? I would think that someone this high profile would have an anonymized LLC or similar legal structure to hold these accounts.

<comment><USER21> The article does specifically mention that he has taken steps to protect himself from stuff like this (i.e. require in-person confirmation with his utility providers, etc.). 2FA is certainly a valid response here, and requiring this even for phone transactions when a customer is using it should become the norm. It's a bit weird to blame customers for broken security protocols, and they should be fixed nonetheless. Not every high-profile target is a security expert.

<comment><USER24> It's not about blaming the victim -- My point is extraordinary risk requires extraordinary response. If your career centers around rattling the cage of criminal hackers, you've made a choice to expose yourself to extreme risks.

Things you can do about that vary. For example, in New York, if you're a victim of severe domestic abuse (stalker, etc), you can actually get a special address provided by the State, who will confidentially keep your real address and forward mail to you. Maybe a similar approach/service can be used in this case.

NIST defines the various trust levels that underlie identity solutions and offer increasing levels of validation from level 1 (no proofing, just validation that you are the same individual) to level 4 (in-person proofing with "hard" crypto authentication token). Two-factor auth without proofing doesn't really change the game -- that's why PayPal MFA is a joke for many use cases.

The problem with this stuff is that proofing requires a big uplift in cost & effort. If I were a service provider, in the absence of a mandate to serve Mr. Krebs or other high-risk targets like him, I would terminate my relationship with him.

<comment><USER21> It seems to me like 2FA would've certainly affected the outcome in this particular case, and probably many other scenarios.

</comment></comment></comment></comment><comment><USER25> That's not the biggest concern. The biggest concern is _SSN AND CREDIT CARD INFO_ being compromised. Priorities, folks. With someone having this info, an authorized two-step or two-factor authentication process is a joke in comparison.

What advanced type of stupid makes articles like this seem completely fine to individuals in the tech sector?

<comment><USER26> SSN and credit card numbers should not be considered secret. Anything that must be shared with a third party in order to make some kind of transaction cannot be considered secret; compromises happen, and once compromised, there is no way to make them secret again.

Brian Krebs, as a high-profile author on security who actively antagonizes black-market groups on the internet, is a common target. He has had all of his basic personal information posted on the internet publicly for some time. The credit cards that were used for this attack were all old, disabled ones, since he disabled them after the numbers were leaked; but apparently PayPal still has them listed on the account and so you can use knowledge of them to "prove" your identity to PayPal.

<comment><USER25> > actively antagonizes black-market groups on the internet

Sounds to me like they're both at fault then. It's really nice and idealistic to have this mentality that you're doing it in the name of infosec, but it's a position held from an ivory tower.

If he's in software, what did he expect? This isn't a wise approach. This is the advanced stupid I'm talking about. Someone who thinks it's wise to antagonize, but then cries and writes an article over it when they're attacked. It's a joke. Conventional wisdom here is nonexistent.

<comment><USER27> How is Kreb's at fault? Talk about blaming the victim!

<comment><USER25> Lets reduce this first to understand it. First, why would you antagonize black-market groups on the Internet? Why would you actively make yourself a possible target? Does that seem wise?

To me, that's a far less complicated question than anything security related at a technical level. You can literally ask a child this question and they'll tell you it's not smart.

This is advanced stupid.

<comment><USER28> Brian Krebs is a security researcher partially responsible for uncovering some of the biggest credit card leaks in recent history. It's his job to "antagonize" the credit card black markets.

He's not just some internet troll, he's doing real good that you very well may have personally benefited from as a result.

<comment><USER4> That's not at all true, releasing=/=uncovering.</comment></comment></comment></comment></comment></comment></comment>


Marissa Mayer teaching at Stanford University - <AUTHOR> http://www.youtube.com/watch?v=soYKFWqVVzg <comment><USER2> What a bizarrely sexist description:

"Intelligence has never been this adorable: Marissa Mayer, the sexy, hyperactive, geeky Vice-President of Search Product and User Experience at Google. Her Googliness was at Stanford University, giving her insightful take on creativity, followed by the usual Q&A. She's really the girl of the millenium."

<comment><USER3> > What a bizarrely sexist description

Calling it sexist is sexist. I don't see what is so wrong with calling someone adorable and sexy.

<comment><USER4> Just listen how ridiculous it sounds when it's a man:

"Intelligence has never been this hunky: Paul Graham, the handsome, hyperrich, nerdy Chief Architect of Hacker News at Y-Combinator (among other things). His Y-Ness was blogging on his website, giving his insightful take on founding a startup, followed by the usual round of HN comments. He's really the boy of the millenium."

<comment><USER5> Not that ridiculous in this era. Women openly drool over hunky men. From Jon Hamm to Beiber to Brad Pitt to Clooney and on and on it goes depending on your taste. They're obviously traditional celebrities.

The only thing unusual about it is the fact that Mayer is in tech where I think the cultural stereotype would be that there are less sexy people because most jobs don't benefit from it or require it. However I've seen guys like Kevin Rose, Jack Dorsey, Elon Musk and Dennis Crowley regarded for various degrees of sex appeal.

Or take a negative example of this: Bill Gates for the entirety of his Microsoft career, was frequently regarded as looking nerdy, dressing badly (early days), looking unkempt, not combing his hair, all sorts of negative descriptives have been applied to him from the founding days forward. Do you think that was detrimental to his career? His start-up efforts? Do you think it kept him awake at night? Did it crush his self-esteem? Did it harm him as a professional? You could hardly read an article about him without them first describing him based on his nerd'ish looks. Gates was regarded as a 'boy wonder' for about the first 15 years of his career, thanks to his young appearance (despite being in his 30's).

The reality is, guys don't get upset when they're ogled for being sexy. It's a compliment. There's an intense double standard derived from the notion that women are not given equal opportunity and are treated in a sexist manner across the board.

On average men and women take sexual advances completely differently, and they take compliments about appearance very differently as well. If you compliment Elon Musk for being good looking, he's not going to think that detracts from his abilities, and nobody is going to care. If you do the same thing to Mayer, you'll create a firestorm; suddenly it's sexist and not being fair to her. Thus a double standard.

Take a bar poll some time about how men and women react to having their ass slapped by the opposite sex, see how those numbers roll out, and that'll tell you most of what you need to know about the difference between the sexes on this topic. Point being, men and women generally react very differently to the same input.

<comment><USER6> Why does it feel like the only knowledge that men on HN have with women comes from watching one episode of Sex and the City 10 years ago?

<comment><USER7> Feel free to enlighten us. Men everywhere await with bated breaths.

</comment></comment></comment></comment></comment></comment><comment><USER8> Enjoyed the video, disappointed there's no actual discussion to be had about it here :(

</comment><comment><USER9> Check 41... why Google desperately tried buzz, wave and now G+

</comment><comment><USER10> Interesting question at 30:00</comment>


Commit Logs from Last Night - <AUTHOR> http://www.commitlogsfromlastnight.com/

<comment><USER2> Kinda "useless" without links to the patches.</comment>


Tell HN: this is a startup I would use passionately if someone created it - <AUTHOR>

(In case there are any legal questions, I hereby place this idea in the public domain... and I hope I'm not having a Michael Scott bankruptcy declaration moment.)
High-level description

  * A site for line-by-line song lyric analysis/commentary
  * Analyses are created and voted on by users
  * Lyrics are (probably) imported by the site owner, so voting mechanisms on "songs to import" should be provided for more obscure songs
  * The site makes money by providing links to purchase the songs (similarly to Pandora)
  * Users who want to analyze a song can provide line-by-line explanations and commentary
  * Users who want to understand a song can read a highly-voted analysis
  * Users who have just fallen in love with a song can purchase it on the spot
 If this already exists, it doesn't exist on the scale that it could (or else every Google search for "$song analysis" would lead to that site). The idea came to me tonight when I wanted to really understand Stairway to Heaven, and was able to write out an interpretation of it line by line.
And yes, I realize the irony of really getting Stairway to Heaven and then immediately thinking about a startup opportunity. <comment><USER2> [http://rock.rapgenius.com/Led-zeppelin-stairway-to-heaven- ly...](http://rock.rapgenius.com/Led-zeppelin-stairway-to-heaven-lyrics)

You can click each line for annotations.

<comment><AUTHOR> Awesome, thank you. I suspect there are things I would change if I could just wave my hand, but nothing is stopping me from creating my idealized version myself (aside from laziness and not wanting the stress of owning a website).</comment></comment>


Icelandic parliamentary election - <AUTHOR> http://icelandmonitor.mbl.is/elections2016/ <comment><USER2> How odd: They have the correct time on the front page (22:32 as I write this) but the countdown clock is counting down to my local 10pm, not to 10pm GMT.

Nor is it a particularly live "live tracker": It shows the most recent update as Thursday (I'm guessing AM given the lack of qualifier).

A quick search reveals no sites with better live results and several with worse. I shall wait until the morrow....

EDIT: A redditor suggests that based on 2013 results, the first results should be reported around midnight GMT.

<comment><AUTHOR> yeah this seems to be the best source, at least in english</comment></comment>


NSA whistleblower Edward Snowden not welcome in the UK - <AUTHOR> http://www.express.co.uk/news/uk/407480/NSA-whistleblower-Edward-Snowden-not-welcome-in-the-UK-as-Home-Office-issues-alert <comment><USER2> As a UK citizen I feel that he certainly hasn't done me any harm and probably has done quite a lot of good so I find it bizarre that the government would make such a statement, especially as he would be mad to consider coming here!

I presume the real reasons for this are:

\- To show solidarity with the US (presumably the NSA and GCHQ are as thick as thieves)

\- So he doesn't give anyone at GCHQ ideas

I'm going to write to my MP about this:

[http://www.theyworkforyou.com/](http://www.theyworkforyou.com/)

<comment><USER3> Why is it bizarre ?

The UK government simply doesn't want a repeat of the diplomatic mess that was Julian Assange's asylum claim.

<comment><USER2> I find it bizarre that they feel the need to make the statement - it's not like there is any chance he would be considering coming here.

<comment><USER4> It's signaling.

</comment></comment></comment></comment><comment><USER5> That is fun. But they do have the right according to wikipedia.

 _The treaty has been claimed to be one-sided[3] because it allows the US to extradite UK citizens and others for offences committed against US law, even though the alleged offence may have been committed in the UK by a person living and working in the UK (see for example the NatWest Three), and there being no reciprocal right; and issues about the level of proof required being less to extradite from the UK to the US rather than vice-versa.[4]_

So basically Toni Blair has bent over, spreaded cheeks and prelubed himself.

<comment><USER6> Exactly, yes.

More over, the US doesn't NOT need to show evidence. It just needs to make the claim and say that it has evidence. No UK court gets to see any evidence at all.

IIRC, it was supposed to be two way, but the US never signed off on it's half of it, while we good little Brits let the legislation sail through.

<comment><USER7> I think we'd be better off in the UK with Europe and Russia on our side these days.

In fact we'd probably be better off with the Eastern Bloc states if they existed as well...

</comment></comment></comment><comment><USER8> "The official spoke on condition of anonymity because he was not authorised to discuss the matter publicly."

The irony is delicious.

<comment><USER9> "The ship of state, dear Bernard, is the only ship that leaks from the top" \- Sir Humphrey Appleby

</comment></comment><comment><USER10> Related: _" Senior politicians from across the political divide have united to call for UK security services to be given greater internet monitoring powers"_ [1]

[http://www.bbc.co.uk/news/uk-politics-22891845](http://www.bbc.co.uk/news/uk- politics-22891845)

<comment><USER7> And this is the point at which they no longer represent us but themselves.

<comment><USER11> The crazy thing is they're trying to claim Nick Clegg is shielding companies rather than the people.

I just can't understand the slightest bit why anyone thinks that snooping and storing everyone's data is a necessary thing to do. They don't even make the wild claim that it'll stop terrorist attacks, they want it to find out who people were talking to after the attacks.

Madness.

And to top it off, you can't easily find a copy of the letter because it's behind the Times' pay wall! Not a single story has a link to the actual letter.

</comment></comment></comment><comment><USER12> I guess "dealing with" Assange is expensive enough for them.

Just think about all those police officers constantly monitoring the ecuadorian embassy.

Now think about having two of them in the country! Crikey!

</comment><comment><USER13> When the 'Hong Kong Baffled by Snowden's Hideout' WSJ article was posted ([https://news.ycombinator.com/item?id=5853397](https://news.ycombinator.com/item?id=5853397)), one paragraph that leaped out at me and also got some attention in the comments was the following:

 _" Hong Kong is the worst place in the world for any person to avoid extradition, with the possible exception of the United Kingdom," said one lawyer who's worked on a dozen extradition cases both in the U.K. and Hong Kong"_

I don't know what to make of that or how to put it together with this Home Office alert, but it is all rather interesting.

</comment><comment><USER14> I'm not sure it's actually a bad thing.

Realistically if he was in the UK he'd face extradition to the US. The home office putting out this alert means they won't have to do that.

The US would be happy for Snowden to enter the UK where he could easily be arrested.

<comment><USER15> It's a bit irrelevant. There's not a chance that he would have even considered coming to the UK.

<comment><USER14> Well hypothetically say he wanted to go to Iceland, you can't fly from HK to Iceland so you'd have to change in Europe.

The obvious route is changing via London Heathrow, this stops him doing that.

<comment><USER16> Actually the airports of Amsterdam, Frankfurt and Paris are all bigger, better and see more traffic than outdated Heathrow.

<comment><USER17> As a French citizen, I'd like to object vigorously to the notion that Paris (if you mean Paris Charles de Gaulle, Paris' main airport) is one of the "better" airports.

If I believe wikipedia, Heathrow is actually Europe's busiest airport (CDG is next).

<comment><USER16> As a UK citizen I vigorously object that Heathrow is the "best" airport.

</comment></comment></comment></comment></comment></comment><comment><USER18> Erm. How exactly is he detrimental to the public good?

<comment><USER19> They probably mean detrimental to the governments good. They wouldn't want to say no to US requests but they would been seen as the bad guys while the extradition (and/or asylum) proceedings dragged on for months.

They are also trying to pass legislation (Communications Data Bill) [http://www.bbc.co.uk/news/uk-politics-22891845](http://www.bbc.co.uk/news/uk- politics-22891845) to allow[1] communications logging of metadata. Having him in the country would make it even more newsworthy as there would be a human interest angle.

[1] Whether they are doing it now without legal standing is an interesting question. My guess is yes and the former Labour home secretaries are aware and complicit and would really like it legitimised.

<comment><USER20> They are doing it now with legal standing. (Regulation of Investigatory Powers Act 2000)

Specifically chapter 2: [http://www.legislation.gov.uk/ukpga/2000/23/part/I/chapter/I...](http://www.legislation.gov.uk/ukpga/2000/23/part/I/chapter/II)

The new legislation is updating the definition of Communications Data for the age of application specific messaging.

</comment></comment></comment><comment><USER21> He'd be an idiot to come here, the UK government thinks the sun shines out of the USA's ass.

</comment><comment><USER22> "detrimental to the public good"? How about letting the public decide that?

</comment><comment><USER23> I'm sure he's very disappointed. That's a big loss for him.

</comment><comment><USER24> HMRPR hard at work to avoid Assange 2.0

</comment><comment><USER25> After Assange this is a surprise?</comment>


Twenty-five ways in which MIT has transformed computing - <AUTHOR> http://news.mit.edu/2019/25-ways-mit-has-transformed-computing-0225 <comment><USER2> This is pure propaganda. MIT wants to take credit for the accomplishments of any and every person who did something interesting and useful there. Blah, blah, blah.

<comment><AUTHOR> Propaganda is a harsh word. Self-promotion maybe better.

The article is to commemorate the "launch of the new $1 billion MIT Stephen A. Schwarzman College of Computing" and credit has been given to the creators and outside groups that MIT worked with.

<comment><USER2> Point well taken. However, some of the "25 ways in which MIT has already transformed the world of computing technology" are a stretch. For example, email was not developed at MIT. A more accurate claim would be something like "25 ways in which MIT graduates and researchers have transformed the world of computing".</comment></comment></comment>


Ask HN: Has Coronavirus affected your online sales? - <AUTHOR> I'd be curious to hear from online business owners if your sales have been affected and what kind of business you run. I've seen about a 30% dip in sales for my dev tool (divjoy.com) <comment><USER2> I run a site [1] that aggregates Amazon prices for a select number of product categories, and I've seen more and more search engine traffic for toilet paper, which is sad to see, as they are currently all sold out. (Note: I listed toilet paper long before Coronavirus. I despise anyone trying to profit from this awful pandemic.)

[1] [https://unitprice.org](https://unitprice.org)

</comment><comment><USER3> I sell a paid Chrome extension that scans websites for SEO, speed and security issues: [https://www.checkbot.io/](https://www.checkbot.io/)

Traffic and sales are slightly up. Maybe businesses are going to focus more on optimising what they have over launching new sites.</comment>


Inside the Military's Secretive Smartphone Program - <AUTHOR> http://gizmodo.com/inside-the-militarys-secretive-smartphone-program-1603143142 <comment><USER2> I would have left my smartphone in the car if was visiting the DARPA building myself. Who knows what they did to his phone while they had it...

</comment><comment><USER3> Boeing, of all people, are building a Government smartphone: [http://www.boeing.com/boeing/defense- space/ic/black/index.pa...](http://www.boeing.com/boeing/defense- space/ic/black/index.page)

<comment><USER4> Well since when do government contracts make any sense? Lockheed martin did the Social Security database contract that came up recently. It seems that these contracts are more directed towards those who are already on a government paycheck rather than those who can get the job done well.

</comment></comment><comment><USER5> Gizmodo's linked 2010 DAPRA article's a good read

[http://www.gizmodo.com.au/2010/10/how-darpa-invented-the- int...](http://www.gizmodo.com.au/2010/10/how-darpa-invented-the-internet/)</comment>


Neugram is a scripting language and shell written in Golang - <AUTHOR> https://github.com/neugram/ng <comment><AUTHOR> Website: [https://neugram.io](https://neugram.io)</comment>


Installing Firefox 3.6: One more reason Linux isn't ready for prime time - <AUTHOR> http://blogs.computerworld.com/15443/talling_firefox_3_6_one_more_reason_linux_isnt_ready_for_the_prime_time_mass_market

<comment><USER2> Poor Linux distros. They try so hard. Nobody ever makes installers for Linux software (they don't even provide binaries unless it costs $1000+.) So the distros do their best to compile, test and maintain neat, orderly package repositories that won't vomit all over your filesystem and don't have tons of bugs and backdoors. And for this they are chastised, because it takes time to prepare a release. Meanwhile, Apple can take their sweet time with App Store approval, reject anything they want, not even give you the _option_ of installing things the hard way, and for this they are applauded. Clearly what Linux needs is more shiny buttons and less freedom.

<comment><USER3> I don't know what it's like with Ubuntu, but certainly OpenSuse has offered one-click installs for a while, e.g.:

<http://en.opensuse.org/Firefox>

These aren't terribly difficult for developers to set up, certainly easier than creating an installer for Windows. I wish Mozilla, OpenOffice, etc. offered this sort of download as the default, with tarballs only for users who know what they're getting themselves into.

The main pain is presumably in generating these for different distros. Novell's build service is supposed to make this easier, but I haven't tried it:

<http://en.opensuse.org/Build_Service/supported_build_targets>

One more thing that would help with this is if more browsers used the distro in the user-agent string, which would help with presenting the right installer to the user. Distro-built versions of Firefox certainly include e.g. "SUSE", but not the version. Windows and Mac browsers send the OS arch and version ("Windows NT 5.2", "Intel Mac OS X 10.5") so just sending "Linux x86_64" seems silly.

</comment></comment><comment><USER4> If Ubuntu wanted to, they could make it trivially easy, and upgrade everyone to Firefox 3.6 The reason they don't is because of their update policies.

For example, Ubuntu 9.10 comes with kernel 2.6.31. If there is a bugfix or patch, they will update you to 2.6.31.whatever. They will continue those updates for as long as that release is supported. However, they will never upgrade you to 2.6.32 or above. They will just continue applying fixes to 2.6.31.

This same policy applies to Firefox. With Ubuntu 9.10 you get Firefox 3.5. They will give you 3.5.9999, but never 3.6.

To get 3.6, you will have to wait for Ubuntu 10.4.

The reason for this policy is to maintain stability. They know that one package at version X is compatible with all the other packages at version Y, so don't upgrade anything and compatability will be maintained.

This is reasonable, but I think they need to make an exception for something like Firefox. There is no reason that Firefox 3.6 won't be compatible. It just works. They are sacrificing the user experience in favor of some esoteric update policy that users are not even aware of, nor do they understand.

User experience is priority one. People care more about Firefox than every other app on the system. Upgrade it Ubuntu!

<comment><USER5> They actually think that to get the latest version of my application I should upgrade my operation system?

Really???

</comment></comment><comment><USER6> The naive belief that users will wait at least 6 months to get a simply- installed version of a software update that other platforms already have is laughable. Especially when that hardware could run two other OSs that don't have that requirements.

Nobody's sure whether this is Firefox's problem or each Linux distro's problem. But since some distros seem to advocate themselves as desktop OSs, I suggest they take responsibility for solving it - and produce up to date packages of Firefox and other essential desktop tools.

</comment><comment><USER7> There is very funny comment to this article. I sincerely believe that it is ironic.

"I've never liked Linux. Firefox is faster and more reliable. Less buggy too."

</comment><comment><USER8> The installation issue doesn't just affect novice users. The entire package management idea is utterly broken. Most of the time the packages are not created by those who create the software. They are embodyments of someone's idiosyncratic idea about what should go where.

Package maintainers keep inventing new contrived ways to distribute files all over the place. Reading the documentation of the actual software often doesn't help me find out where everything is and how it can be configured.

The default sources.list keeps falling behind the older my installation gets and there doesn't seem to be any recommended way to keep it up to date. Of course I can add package sources of more recent OS versions, but that seems like a rather more dangerous thing to do.

Package managers are supposed to help me deal with dependencies but they end up creating new dependencies of their own.

</comment><comment><USER9> Linux is not ready for the mass market because average joes are not able to use the newest version of a browser?

Righty right, because your average joe (a) does not care about the newest version, (b) does not know what a browser is (remember that video?).

Moreover, Preston Gralla does not seem to have a clue what package management is about. "Unbuntu"? Seriously?

<comment><USER10> If you're asking an end-user to care about 'package management' then you're likely proving his point.

<comment><USER11> How? Package management is simply a different model entirely. One that doesn't encourage people to go download random files and give them full privileges on their machines. It's no harder to go to System > Administration > Add/Remove Software than it is to go seeking out some software on the web, downloading it, installing it manually and making sure that you have whatever other software it needs. I dare say that asking users to care about package management is a solution to the problem of Windows installers.

<comment><USER12> _Package management is simply a different model entirely._

Heh... isn't that a bit like saying functional programming is _only_ an entirely different programming paradigm? :-)

</comment></comment></comment></comment><comment><USER13> Heh, same thing happened to me when I downloaded Thunderbird 3.0 to my Linux machine. I didn't know what to do next, and I searched the web in a bewildered fashion. Then I sent a Pidgin message to a colleague and he said "you don't install it, you just run the executable right in the directory." Oh. Thanks. Same thing with Firefox 3.6.

Funny thing is, I think Add/Remove software on Ubuntu, and its command line variant apt-get, is _excellent_ , and I find Linux very easy to use on the desktop.

Of course, to get dual monitors to work with this laptop I had to hack /etc/xorg.conf. And don't even ask me about audio or video -- I wouldn't know a codec from a driver. But for day to day coding in C and Perl, and for doing investment fund accounting, I have found a well-worn groove (rut?) within which I can thrive.

</comment><comment><USER2> Waste of bits. The article, the comments, all of it. You owe me $0.003 of electricity, ilamont.

<comment><AUTHOR> C'mon, the comments are the best part!

</comment></comment><comment><USER12> If the average Joe wants the bleeding edge, get him to try Debian unstable. I _guarantee_ that he'll go running back to the comforts of the more stable distro. I can say this because I did so as well. :-)

</comment><comment><USER14> when will chrome become mainstream for linux?</comment>


Show HN: Undiscoverable Watermarking - <AUTHOR> https://www.esenbil.com/photomark <comment><AUTHOR> Spread spectrum digital watermarks are generated randomly using a specified key. Therefore, by brute force search watermarks can be discovered. Our new application adds a second layer of security so that brute force discovery becomes practically improbable.</comment>


Google Adds Possible TCP Replacement To Chrome - <AUTHOR> http://www.conceivablytech.com/7582/products/google-adds-possible-tcp-replacement-to-chrome

<comment><USER2> Chrome+Google.com gave them a great way to short circuit the chicken and egg problem. For example SDCH, their GZip replacement is supported by 22% of my visitors already: [http://euri.ca/2011/05/what-percent-of-web-visitors- support-...](http://euri.ca/2011/05/what-percent-of-web-visitors-support-gzip- deflate-and-sdch/)

<comment><USER3> I didn't know about SDCH, looks pretty neat.

</comment></comment><comment><USER4> Bernstein is _not_ a professor at the University of Chicago, he's a professor at the University of Illinois at Chicago, completely different university!</comment>


Ask HN: Am I too late with my startup idea? - <AUTHOR>

My friend and I have been working on an idea that we believe has great potential. This was somewhat validated by hearing yesterday that a competitor is releasing their product at the end of the month which is very similar to ours. However, we've only been working on it for about 2 months and need maybe another 2-4 months to release.
One thing that's similar between both of our products is that users build up their profile with ranking/awards as they interact with the site, and since we're targeting the same group of users, we're worried that since we are going to be beat to the market, those users won't be interested in signing up with our product and building up their profile again.
What should we ask ourselves to see if we should abandon our project, or continue? Any other insight? <comment><USER2> Continue. Your only competitor is "nobody cares you exist" and the same goes for the other dudes. You'll both have beaten the odds if you reach the point where people are actually choosing between your products.

</comment><comment><USER3> Ignore the competition, it's just a distraction from finishing your product.

But that doesn't mean you don't need to pivot. For any startup, but especially a community-driven site like this, you need a Custom Acquisition strategy.

Why will people sign up for your app? << That's a question you want to have answered _before_ you start building. Then take that a step further, and start building a waiting list of signups.

If that's not practical, maybe you need to downsize your idea/pivot. Marketing is harder than building!

More here - <http://startupbook.net>

</comment><comment><USER4> This story might help: [http://www.thedailybeast.com/newsweek/2012/07/15/vince- gilli...](http://www.thedailybeast.com/newsweek/2012/07/15/vince-gilligan-on- how-breaking-bad-almost-didn-t-happen.html)

</comment><comment><USER5> I'm not a developer or a founder but I hope I can help.

My advice would be to look at the positive side of this. Watch carefully what works and what doesn't work in your competitors product.

See what problems they face and fix them through your own service. That way, when you release your product, even if it's a few months after, you're going to have all the problems they have fixed.

Long story short, you could use their product as your own "alpha testing" so you can make your own better than theirs. Hope it helps. Good luck!

</comment><comment><USER6> "The competitor to be feared is one who never bothers about you at all, but goes on making his own business better all the time" - Henry Ford. I say stay on your vision. There are a lot of variables in your competitors' execution that could affect their traction. Execute well and focus on a kick-*ss value proposition, nail your brand and price-point, and add a bit of emotional design for good measure. You could then find that they fear you, not the other way around. Best of luck!

</comment><comment><USER7> In the end I'd recommend having a great UI. That alone could be the difference of either product "winning" so to speak.

</comment><comment><USER8> Keep going. You won't attract 100% of the same users even if your MVP are similar and the long term evolution of the product will change drastically

</comment><comment><USER9> Will you be able to stay ahead of the competition in the long run? Do you feel that you have a longer term vision than them?

Our startup is in a very similar spot where around our launch date 5 other competitors launched; now there are over 40.

Most of our competitors though are stuck in the niche that for us was just the most obvious place to start. We're starting to expand to a much broader market and have a multi-year roadmap of features and functionality to add; which means that we're by no means out of the race yet.

In general, it's always a marathon. There are always others and there always will be. The real question is if you will be able to last longer and get farther than they will.

<comment><AUTHOR> See that's the thing, I know what we eventually want to do after we release and some of them are very large ideas to integrate which will take a lot of time. I believe that our product idea is way better than anyone else's, but the fact is this competitor hasn't really shown off what their product is besides in a post outlying the general "obvious place to start" as you say.

There doesn't really exist a service that we have in mind currently, so it's hard to not see it as a race. Especially if they release first, then a couple months later, we release practically the same thing and then we start work on what makes us different. But what's to stop them from copying our extended features?

<comment><USER9> It _is_ a race, but more of an unlimited time cross-country marathon.

Right now you're just two random people/teams showing up at the same starting line. They have a bit of head start, but the chances that over the course of months/years you'll be able to cover the same distance are virtually nil.

It's far more likely that either they'll be able to run circles around you or, hopefully of course, that you'll be able to execute an order of magnitude better than them.

Right now, there's absolutely no way of knowing which one it is. For all you know they could have already exhausted their runway and the team might be falling apart as we speak.

So for now don't worry too much and just focus on your ability to execute.</comment></comment></comment>


Hours, the Apple Watch, and turning an app into a business - <AUTHOR> https://medium.com/the-hours-blog/hours-the-apple-watch-and-turning-an-app-into-a-businesst-b2b218899a91

<comment><AUTHOR> More indie devs should be trying to do things like this. Shoot for sustainable businesses, not just making apps and hoping for the best. Selling a $0.99 app is never going to be sustainable forever.

<comment><USER2> Thanks! We will see how it works out over the next year. So far the downloads have been coming in HOT!</comment></comment>


6 Great Textbooks in Bioinformatics, Programming, and Data Science - <AUTHOR> http://www.drbunsen.org/home/2011/10/19/6-great-textbooks-in-bioinformatics-programming-and-data-sci.html <comment><USER2> Also, see this comment thread in a previous entry: <http://news.ycombinator.org/item?id=3112411></comment>


Wraparound tile maps with sphere topology - <AUTHOR> http://www.redblobgames.com/x/1640-hexagon-tiling-of-sphere/ <comment><USER2> Astronomy used this for very long time. Most advanced is Healpix: [http://healpix.sourceforge.net/](http://healpix.sourceforge.net/)

I really like how fast it is. For example irregular area size of Greenland at 1 meter accuracy only takes a few hundred MB. One can do joins and unions, on such areas on modest laptop.

Disclaimer: I send a few patches to this project.

<comment><USER3> HEALpix is cool. It has the same connectivity issue as with all the solutions — some locations are a little different. With hexagons a few polygons are different (polygons); with HEALpix a few vertices are different (three quads instead of four). In games we can get away with not mapping everywhere whereas in astronomy we can't :-)

</comment></comment><comment><USER4> For curiosity: It's possible to segment a sphere into equal area rectangles, plus circular caps. This is based on the arguably surprising relation between sphere area and the corresponding area on a cylinder of the same height as described in this article [1].

Paul Leopardi describes a neat 33 equal area region tiling, _Recursive Zonal Equal Area Sphere_ , in his talk [2].

[1] [http://blog.zacharyabel.com/2012/01/slicing- spheres/](http://blog.zacharyabel.com/2012/01/slicing-spheres/) Especially this animation: [http://i1.wp.com/blog.zacharyabel.com/wp- content/uploads/201...](http://i1.wp.com/blog.zacharyabel.com/wp- content/uploads/2012/01/stab-hemisphere.gif?zoom=2&resize=300%2C299)

[2] [http://maths- people.anu.edu.au/~leopardi/ORNL-2014-Leopardi-...](http://maths- people.anu.edu.au/~leopardi/ORNL-2014-Leopardi-sphere-talk.pdf) Matlab Code: [http://eqsp.sourceforge.net/](http://eqsp.sourceforge.net/)

<comment><USER5> Your link #1 is about the volume of a ball, not the surface area of a sphere.

There are hundreds of different ways of segmenting a sphere. Your link #2 a relatively obscure one which is potentially worth evaluating for some uses (e.g. you start with a fine latitude/longitude grid but want to group your data into coarser histogram bins, and you them to have equal area), but is pretty far removed from the mostly hexagonal tilings in the OP.

For a summary of some other methods, I recommend Popko's book _Divided Spheres_ , [http://www.dividedspheres.com](http://www.dividedspheres.com)

</comment></comment><comment><USER6> You can _almost_ draw a congiguous hexagon map on a subdivided icosahedron, if you subdivide each triangle edge in 3 parts on each recursive step. Adjacent triangles will form hexagons.

This will leave 20 pentagons where the vertices of the original icosahedron's vertices were located. The rest of the sphere can be covered with a regular hexagon map for a strategy game.

I've been thinking about "hiding this" in a game design element so the 20 pentagons would be "capitals" or otherwise special tiles in the game. They're nicely equidistant from each other, so it could make a nice and fair map to play on.

<comment><USER7> An icosahedron has 12 vertices, so you get 12 pentagons.

<comment><USER6> You're correct. 12 vertices, 20 triangles.

</comment></comment></comment><comment><USER8> I think I'd prefer a map where all tiles were slightly irregular, to avoid having 12 special tiles. Something like this: [http://i.imgur.com/jQwYqZB.png](http://i.imgur.com/jQwYqZB.png) You can make it by putting a bunch of point electrical charges on a sphere, letting them repulse each other, then taking a Voronoi diagram of the result.

<comment><USER3> (Author here) I had been trying to avoid the irregularities for that particular project because the storage of extremely large game maps saves a lot of space if you can use a regular grid instead of an irregular graph. (Certain algorithms like grid distance also run much faster.) If you embrace irregularity you can get some pretty neat maps, like this one from Andy Gainey: [http://experilous.com/1/blog/post/procedural-planet- generati...](http://experilous.com/1/blog/post/procedural-planet-generation)

</comment></comment><comment><USER9> The author of this material is definitely on my free beer if I ever meet them list. I've learned a lot about geometric mapping, hexagonal pathfinding and lots of other fascinating nerdy stuff from his articles over the years.

They are good enough I keep my own archive copies just in case the site ever goes away.

</comment><comment><USER10> I'm surprised there's no mention of a rather successful and efficient way of doing this in the real world: Google's S2 geometry library [1]. Basically the earth can be covered in almost aquare tiles down to about 1cm^2 with 64 bit integers.

[1] [http://blog.christianperone.com/2015/08/googles-s2-geometry-...](http://blog.christianperone.com/2015/08/googles-s2-geometry- on-the-sphere-cells-and-hilbert-curve/)

<comment><USER3> (Author here) S2 is great (and Eric is brilliant). It uses a cube projection underneath. S2 solves some problems I didn't have (equal area, curve filling) but the main problem I was looking at was the nonuniform connectivity, and as far as I can tell, it's the same with S2 as if you use a cube directly.

</comment></comment><comment><USER5> Funny enough, I was just planning to email the author of this w/r/t some of my new maps:

e.g. [http://i.imgur.com/U16RRnv.png](http://i.imgur.com/U16RRnv.png)

<comment><USER11> Those shapes look like they could be tiled with hexagons, which would create a hexagonal tiling of the sphere. Since the article mentions that this is impossible (and links to a proof), can anyone tell me what I'm missing in this image?

<comment> chad-autry Notice how the lines are stretched, Not every hexagon in the tiling represents the same area if mapped back to a sphere. The non-polar edges of the tiles pictures are larger. If you actually printed it out, and tried to wrap it around a globe, the middles would have to expand or the edges would have to shrink for the tiles to join.

Edit: Basically he hasn't actually tiled a sphere with regular hexagons (which is what the proof said was impossible. He has titled a flat projection of a sphere with regular hexagons, which would have to be morphed to irregular hexagons if tiling a sphere when the projection was reversed.

Not taking away from the tiling, which is quite interesting in itself.

<comment><USER5> It's possible to make a map projection from the sphere to a flat surface either preserve areas, or preserve angles (and local shapes), but not both. This projection preserves angles, but it could be modified to preserve area instead, or some compromise between the two.

</comment></comment></comment></comment><comment><USER12> I love seeing Red Blob Games' articles on HN. They're all excellent, recommending everybody to explore the site a bit.

My favourite article: [http://www.redblobgames.com/grids/hexagons/](http://www.redblobgames.com/grids/hexagons/)

</comment><comment><USER13> If you want the _topology_ of a sphere (rather than the _geometry_ ) all you need to do is identify pairs of adjacent edges of your rectangular map instead of opposite edges.

</comment><comment><USER14> For the record, I show all of my programming students the redblobgames website (towards the end of the semester and they are working on a final, "fun" project). It's an awesome resource!

</comment><comment><USER15> Shameless plug: I've written a hexagonal grid library [hexameter] based on Amit's (redblobgames) excellent guide for hexagon grids.[hexameter][[https://github.com/Hexworks/hexameter](https://github.com/Hexworks/hexameter)]

</comment><comment><USER16> amitp, the way you capture the arrow keys for the demo makes it so I can't use the arrow keys to scroll the text of the page.

Otherwise, I find you entire site super inspiring :)

</comment><comment><USER17> why not start players on the pentagons?</comment>


Ask YC:  Who is most likely to click on ads without even knowing they are ads? - <AUTHOR>

It seems that building a service that attracts people of this type could be quite profitable. <comment><USER2> This was just released Feb 12th: <http://www.smvgroup.com/news_popup_flash.asp?pr=1643>

"The study illustrates that heavy clickers represent just 6% of the online population yet account for 50% of all display ad clicks. While many online media companies use click-through rate as an ad negotiation currency, the study shows that heavy clickers are not representative of the general public. In fact, heavy clickers skew towards Internet users between the ages of 25-44 and households with an income under $40,000. Heavy clickers behave very differently online than the typical Internet user, and while they spend four times more time online than non-clickers, their spending does not proportionately reflect this very heavy Internet usage. Heavy clickers are also relatively more likely to visit auctions, gambling, and career services sites – a markedly different surfing pattern than non-clickers. "

<comment><USER3> some further food for thought:

[http://weblogs.hitwise.com/us-heather- hopkins/2008/02/yahoo_...](http://weblogs.hitwise.com/us-heather- hopkins/2008/02/yahoo_search_draws_younger_aud.html)

random blog with some thoughts:

[http://www.zephoria.org/thoughts/archives/2008/02/16/who_cli...](http://www.zephoria.org/thoughts/archives/2008/02/16/who_clicks_on_a_1.html)

</comment></comment><comment><USER4> I think most yc'ers know the different ad schemes and actively decide if they are going to click on them, provided they even see it because they aren't using adblock.

I think standard joe user will click on ads if they think it will get them to 'destination', which is why I think text links are very successful in creating the idea that the ad(link) is just another page within a website.

<comment><AUTHOR> Yes, but who is most likely to do this among the joe users?

<comment><USER4> you could make a game out it? People watch tv show about commercials, with commercials in between. So i guess I'm clueless.

</comment></comment></comment><comment><USER5> The very young and the very old

I saw this cited in a study years ago, it's out there somewhere</comment>


Ask HN: Will web-based email ever catch up to or replace desktop email clients? - <AUTHOR>

Web-based email clients like Gmail & Yahoo mail are highly functional, have the available-anywhere benefit, and run with the support of some serious server muscle (so things like search can be fast and awesome). Plus they don't bring your computer to a grinding halt. However, as advanced as the web has become they are arguably still clunky, and lack the Pizzaz and responsiveness of desktop mail clients like Outlook and Apple Mail. For something that we use every day, those things are important.<p>Given the convenience of web-based mail clients (and barring the obvious downsides like a full store of offline email) - have they finally come of age to replace their desktop equivalents? <comment><USER2> As I've mentioned on HN before, I'd _really_ like to see The Next Gmail. (I thought it would maybe occur as Google opened up on Gmail a bit this last June [http://googleappsdeveloper.blogspot.com/2014/06/introducing-...](http://googleappsdeveloper.blogspot.com/2014/06/introducing- new-gmail-api.html))

With time my experience with Gmail keeps degrading and I'm to the point where I notice myself browsing around the web for other options like FastMail and such. I haven't seen anything overwhelmingly better, at least not in the way that Gmail was when it first appeared.

The original Gmail, when it came out and you had to be invited in and such, was _mind-blowing_ better than the competition. I've not seen any update to any Google service since that so clearly was above the competition. Recall that it was _so good_ people thought it was one of their April Fool's Day hoaxes.

Since then, if anything, I've seen Gmail degrade with time. I get more spam now than ever. (And the spam comes in different forms such as via Gmail Chat/Hangouts), the interface is laggy to me on a MacBook Pro with 20mbit↓ connection, and new innovations like the Google Voice merging are always buggier than what they called "Beta" in Gmail circa 2005->2009.

<comment><AUTHOR> Ok, it wasn't a loaded question (promise), but seeing that you feel that way about Gmail you may be interested in a new email product we've been building over the last year called Sortd.

It tries to create a radically enhanced email experience (Email 2.0 if you will) without the necessity to switch to a new email client. We call it a Smart Skin for Gmail because it transforms the Gmail Inbox into something much more - allowing you to place emails on a set of priority lists along side your tasks, with drag and drop sorting, due dates etc.

If you are interested, you are welcome to skip the Private Beta queue by going to [http://get.sortd.com](http://get.sortd.com) \- I created an invite code for you (use HN27182818284).

Do you think there's something in this?

</comment></comment><comment><USER3> I jumped to Gmail exclusively for my personal mail in 2004 and never looked back. If my work email followed suit, I'd be thrilled.

<comment><AUTHOR> What are you currently using for your work email and why do you prefer Gmail?

We moved our company email from Outlook to Gmail roughly 2 years ago and personally I struggled at the time. Since then I have become a fan of Gmail, but it took a lot of adjusting. I have tried to convert a few Outlook and Apple Mail users but I find that most people really struggle with the move.

The most painful thing by far is the threaded view (more specifically that they put the newest message at the bottom of the thread). To someone who isn't super committed to the change it seems ludicrous - your Inbox runs top down from newest to oldest but when you open a thread it works in the exact opposite way.

Now that I think about it I don't know what the person who made that decision was smoking at the time - it's a sure way to turn people away from your product. I can only assume they did it that way to make it feel more like IM, but if they want to acquire more business users they should at least make it an option to put the most recent message at the top, like every other mail client does.</comment></comment>


The parable of Bug House. The world's toughest chess variation. - <AUTHOR> http://www.humbledmba.com/the-parable-of-bug-house-the-worlds-hardest-v <comment><USER2> I know that chess is probably the most traditional "thinking" game to play in the western world, but when I read this line:

> _I think there may be a lot of neat similarities to chess and > entrepreneurship, but ultimately chess is too controlled._

...I felt compelled to mention Go. In general, Go is much less constrained than Chess. The strategy plays on many axes: not only offense vs defense (as chess) but also territory guarding vs invasion, speed vs strength, and risk- taking vs conservative-waiting. In general, I would say Go has many more parallels with business (and life in general). I've recently been turning my passing interest in Go into a full-blown obsession, and I would highly recommend it to anyone looking for an alternative to Chess.

<comment><USER3> OP here. I love GO. For those that haven't played, it's the game showed briefly in a beautiful mind. Where Nash, the rational mind, can't figure out how he could have lost...and exclaims 'The game is flawed'

It's Othello squared. It's a fabulous game. It's intuitive, instead of rational. I lived in Japan for a year after college and played every year. It's hard to find people in the states that play and it takes a long time to play. The old saying goes, 'Two men sat down for a game of Go. That was yesterday'

If anyone plays Go and is in San Francisco, hit me up by email--would love to play!

<comment><USER2> You might try checking out the Dragon Go Server: <http://www.dragongoserver.net/>

As opposed to the live-play servers, Dragon Go is intended for a much more measured pace of play (the FAQ claims the average player makes 4 moves per game per week). As an added bonus, there's also an iPhone app. It's definitely not the same as playing in person, but it's currently how I get my fix.

</comment></comment></comment><comment><USER4> Man, I played this back in high school when I was on the chess team. It promotes such a different level of thought than normal chess, but when you get a teammate who literally starts taking pieces so you can place them and vice- versa, it gets insane.

I think the real benefit of this game is that it teaches you to read chess boards quickly. If you get good, you can glance at your opponents board and get a quick idea of things you can do in a few moves to help them.

<comment><USER5> I came here to say exactly this. Bughouse is crazy fun when you have a teammate who is brutal.

I wonder why no one has implemented Bughouse as a massively popular webapp, I'd love to play that again.

Edit: Huh, apparently Bughouse is still 1v1, the 2v2 variant is called Crazyhouse. We never called it that back then, weird.

<comment><USER6> According to wikipedia ( <http://en.wikipedia.org/wiki/Crazyhouse>) Crazyhouse is a 1v1 version of Bughouse. They say 2 players opposed to 4 players, not 2 players by team.

</comment></comment></comment><comment><USER7> This is quite similar to Shogi, a Japanese variant of chess where you can put down any of your opponent's captured pieces. From what I know, that game is highly strategic; since all of your potential pieces come directly from your opponent, it's probably less chaotic than this variant.

<http://en.wikipedia.org/wiki/Shogi>

<comment><USER8> The two player variant of Bughouse is called Crazyhouse. You can play it on the chess servers (freechess.org, chessclub.com etc).

There are also some chess engines that can do it, including the one in Mac OS X, though I don't know if Apple's GUI offers access to it.

</comment></comment><comment><USER9> This game has been around for a while. We used to play in my chess club after people got bored at a practice session or fooling around waiting for the next tournament game. It's a fun game to play but it's much more difficult to plan ahead when your opponent can drop any piece on you anywhere. I found that it didnt really promote the deep rational thinking that comes naturally with chess and is fundamentally different.

</comment><comment><USER10> Just a clarification on the rules. You can't place all pieces "anywhere on the board." Pawns can't be placed in the first or last rows so no illegal placements and no instant promotion.

<comment><USER11> Can you place a piece to put someone in check?

It's been at least a couple of decades since I've played bug house, so my memories are pretty hazy.

<comment><USER9> >Can you place a piece to put someone in check?

Yes you can. Very often the game ends when a player uses a new piece to checkmate.

More details here <http://en.wikipedia.org/wiki/Bughouse_chess>

</comment></comment></comment><comment><USER12> Also fun is the version where pieces "respawn". There are 6 respawn points. Every minute, a dice is rolled and the piece captured earliest (of all captured pieces) is placed at the respawn point indicated by the dice (knocking off any piece that happens to be there, of course).

There are no stalemates in this version.

</comment><comment><USER13> My son plays it. But the way it was conveyed to me, it sounds like "The Secret". The whole point is to learn to wish for pieces. If you wished loudly enough, for example "I could checkmate if I had a pawn in my next move", then it could magically appear out of no where.

</comment><comment><USER14> Back in high school we played Bug House during lunch and at the end of chess practice. This is easily some of the most fun that can be had with a chess board.

</comment><comment><USER15> you guys are all missing something: the money factor. This is why none of these games will mirror startuping adequatly.

Poker, with its structural luck factor and money factor is by far the closest match. I think the variant that best mirrors it is tournament poker, MTTs especially. If you look at PNL graphs from MTT players, you will see they mirror startup PNL very well.

</comment><comment><USER16> I think Fischer Random is much more challenging...

<comment><USER8> Based on what? Fischer Random is _exactly_ like normal chess in complexity, and only cancels out the opening books.

Bughouse and crazyhouse are significantly more complex games (branching factor over 100 for Crazyhouse, even more for bughouse).

<comment><USER16> Based on my own personal opinion and experiences? Fischer random creates a lot of uncertainty in my mind when I play. Regardless of what obscure opening is played in a traditional game I still have a sense of what spaces are likely to be controlled by rooks, where I can anticipate a knight showing up and so forth.

As far as your statement regarding branching factor increase can you point me to some references? Its not that I do not believe you I'm curious at what point the complexity begins to take off.

<comment><USER17> As a serious player with a reasonable amount of experience with both variants I have to say I disagree with you profoundly on this. FischerRandom/Chess960 is just chess with a twist (familiar openings and opening setups aren't available). Bughouse/Transfer is a completely different game that's based on chess rules and conventions. It's major characteristic is a massive injection of chaos that's quite foreign to the game of chess.</comment></comment></comment></comment>


Launch HN: Tress (YC W17) – Online community for black women's hairstyles - <AUTHOR> Tress (https://www.tressapp.co) is an online community for black women to discover and share hairstyle inspiration, information and tips. Women upload photos of their hairstyles and share information about their style. Users can discuss how to replicate the look, which products were used and where to get similar hairstyles.
We are 3 software engineers who have built health social networks, mobile apps for farmers in Africa, and worked on marketing consumer brands like Nike. We started Tress because this is a challenge that personally affects us and because it's a big market that is still relatively untapped by technology.
Hair is a big deal for black women. We are constantly changing our hairstyles and spend 9 times more on our hair than any other demographic. We don't just get a regular cut or color our hair. We get drastic! We go from braids to weaves to cornrows and then to our own hair and then back again. Size, length, style, color, volume of hair, weaves and extensions all differ each time we change our hairstyle. And we do that often because of the nature of our hair. To give you an idea, these photos are all of the same woman - https://www.dropbox.com/s/52ew0d8hsxwx0k4/JodianHairstyles.p... - It's an image from  our YC demo day slides.
The process of figuring all this out to actually getting a style done is long and broken. Many women spend a ton of time searching for their next hairstyle, then more time figuring out how to replicate the style via tutorial articles/videos or search for a stylist and so on. Tress aims to be the dedicated platform to fix all of this and connect a community of women who often socialize around their unique hair needs.
One thing that excites us as software engineers is exploring how to use computer vision to tell if a user has 4a, 4b or 4c natural hair curl pattern or if a hairstyle is a Senegalese twists or Havana mambo twists.  We are equally excited to be gathering hair products data and usage patterns around our hairstyles in such an informal sector that technology has barely gotten started in yet. We dream of things like an API that has all the data about the hair products black women have used in the past 5 years.
We're looking forward to answering your questions about Tress and discussing startups, software, and of course hair! <comment><USER2> This seems like a tremendously clever idea. To me the most relevant phrase from the text posted above is: "...and worked on marketing consumer brands like Nike"

Because I think that's what this really is: the launch of a new premium consumer brand. Tress is capturing consumers at _exactly_ the right time, they all have purchase intent and it seems targeted really really well.

They can make serious money recommending local stylists, products, etc. and then turn around and also sell their own branded products.

This is really far outside of what I'm familiar with, but I look at past things I scoffed at and that are now worth billions [1] and think this might have a real shot at getting huge.

It all comes down to execution and work, but a really interesting idea even now.

1 - [http://investor.lululemon.com/releasedetail.cfm?releaseid=96...](http://investor.lululemon.com/releasedetail.cfm?releaseid=962616)

<comment><AUTHOR> Thanks for the feedback. You have captured the essence of Tress and what we are working towards.

</comment></comment><comment><USER3> Cool!

Sounds like you have many interesting problems, on top of the usual fun challenges of running a social network+cross platform app. Computer vision, recommenders for hairstyles, products, stylists, and probably many more. Then you have usage information about all of those you could use in a bunch of ways.

And you can monetise with simple, relevant, products ads, or get a commission off booking a stylist, or collaborate with a booking platform like TresseNoire (although that's NYC only for now I guess). So that's a lot more options than many YC backed startups.

A few questions. Feel free to ignore them if there are too many.

It says you're hiring engineers and designers on your website. Care to go to into more specifics about what kind of positions you're hiring for?

Semi-OT in the "only care about users" YC world, but just curious, what's your stack?

It says on your website that you're based in Ghana. Do you plan on going back there after YC, or staying in SV to make it easier to find tech workers+VC money, or have a foot in both places?

<comment><USER4> Hi, I'm the Engineering Lead at Tress and we're a lean team of 3. Right now, we're looking to hire 1 Front End Engineer as we want to launch our web version for SEO (we realised that Google App Indexing is not enough and we're missing a lot of SEO opportunities on the web), 1 iOS engineer and 1 UI/UX designer.

Our top level stack is Ruby on Rails, Postgresql, Redis, AWS, Heroku, Java, Objective C & Swift.

We initially tested our product in Ghana. But our user base has grown since and our users are from all over the world with a significant majority from Africa and the US. We are and will be based in Silicon Valley going forward. It's a global app and our goal is to have our foot placed globally

</comment></comment><comment><USER5> _Hair is a big deal for black women. We are constantly changing our hairstyles and spend 9 times more on our hair than any other demographic. We don 't just get a regular cut or color our hair. We get drastic! We go from braids to weaves to cornrows and then to our own hair and then back again. Size, length, style, color, volume of hair, weaves and extensions all differ each time we change our hairstyle. And we do that often because of the nature of our hair._

As a white guy whose approach to hair basically amounts to "I want to be able to ignore it as much as possible", I'd love to understand this better. What is it about black (womens'?) hair which lends itself to a wide range of hair styles?

<comment><USER6> Recommend this:

[https://en.wikipedia.org/wiki/Good_Hair](https://en.wikipedia.org/wiki/Good_Hair)

<comment><USER7> Interesting clip from Good Hair: [https://www.youtube.com/watch?v=vCEX34-1o6M](https://www.youtube.com/watch?v=vCEX34-1o6M)

</comment></comment></comment><comment><USER8> Great idea. You mention how much time is spent on looking at/for styles (incl. members of my family) but I'm not sure everyone here is aware of the average spend on hair and hair-related products: Mintel estimates the 2016 spend on black haircare products is about $2.5BB.

Not included in this number (and typically underreported because many services are rendered in non-official salons) hairstyling services. When family members go to the 'salon' it often involves many hours and hundred(s) of dollars for a single visit. Haircare expenditures are a significant budget item - no matter how wealthy.

I'll pass the app on to my family. Let's see what they say.

<comment><AUTHOR> Thanks, apart from the amount of time we spend on our hair, we spend a lot of money as well just to get our desired hairstyle. Hair is definitely huge part of the monthly family /individual budget. We'll love to hear their feedback on Tress. Our email is firstname.lastname@example.com

</comment></comment><comment><USER9> I'm a little skeptical in terms of whether this will be a scaleable business, but I love that you're targeting a demographic that SV doesn't usually pay attention to.

You should totally work with black beauty YouTubers like Jackie Aina and Alissa Ashley!

<comment><AUTHOR> Thanks for the feedback. We didn't go into detail about our business model. For us, we see the social community as the first step to driving social commerce. We intend to leverage on the community to drive product sales for brands/products that target black women's hair. It's definitely scalable. Jackie Aina and Alissa Ashley are great suggestions, definitely intend to work with them.

</comment></comment><comment><USER10> Excellent job, this has the potential to be huge. I told my girlfriend about you guys last week and she seemed impressed. The first self made female millionaire in the US was in the hair buisness [1], I think it's a market that is underserved by traditional companies because it requires such a specialized touch. Good luck.

[1] [https://en.m.wikipedia.org/wiki/Madam_C._J._Walker](https://en.m.wikipedia.org/wiki/Madam_C._J._Walker)

</comment><comment><USER11> This is brilliant - your target market is passionate and spends serious money on a pain point you are solving. And while I'm sure you are well connected in Accra, I can't help but mention Ashesi University. Super talented engineers coming out of that school

<comment><AUTHOR> Thanks for the feedback. Yes we do know of Ashesi University and yes they do have talented engineers coming out of there.

</comment></comment><comment> purple-dragon Congrats and good luck!

One minor issue I noticed with your website: most users will expect that clicking on the page indicator in your carousel (where you feature testimonials) will trigger the appropriate content change. Nothing happens when I click on these indicators and there's no obvious way for me to flip through the testimonials other than to wait with my mouse hovering over an adjacent section (since it seems the carousel is paused when the mouse hovers in that section).

<comment><USER4> Good catch! Thanks for the feedback. Will be fixed shortly.

</comment></comment><comment><USER12> The computerized detection of hair type and style sounds really interesting. How far down this path are you now, are you planning on a deep-neural-net (e.g. CNN's) or something simpler?

Would certainly make for a unique image-classification problem, with its own interesting challenges; a collection of images of black women with different hairstyles will be a lot more visually similar than a collection of dogs/cars/mountains.

<comment><USER4> Yup, it's interesting! We're in the early stage of this, currently experimenting with [Keras]([https://keras.io/](https://keras.io/)) and focusing on the inception pre-trained network. Our goal is to retrain the top layer of the network using the tags/hair types/categories we're collecting on the app as labels.

</comment></comment><comment><USER13> Why are you launching here and not on a facebook group dedicated to such market? There are also instagram micro influencers (less than 10k followers) you could also leverage...

Not being a hater but launching here seems silly from the POV of marketing. This seems like something that would get traction rather quickly if pushed in the right context.

Trust me. Put ads on facebook with your target demographics and search IG for women of color with a good amount of followers. That stuff works like magic.

Edit:

If you email me I can introduce you to one such group that has a lot of active users and is led by a black lady. You can pivot from there.

\---

Just realized my comment makes me sound like a huge dick. Not my intention. Im excited about the product and wish you the best of luck. I do feel strongly about marketing it (even if not my own project) and that made te words come out too strong.

<comment><USER14> YC startups are doing Launch HNs these days, which is a new mechanism that we intend eventually to replace some of the job ads that appear on the front page. It's all a work in progress. But we would have invited Tress to post even apart from that, because it's so off-the-beaten-track for HN, and that's what keeps things interesting.

You're right that HN isn't the best place to launch consumer products for customer acquisition, but there are other reasons to launch on HN, such as discussing ideas, product feedback, and getting on users' radar for future hiring. No reason not to do all the launches!

p.s. As a local professional in the 'omg that's bad' department I can assure you that it's always the good users who worry about sounding like a dick :) Your comment shows how an excess of enthusiasm can sometimes come out the wrong way temporarily, but explaining it as nicely as you did makes it all ok.

<comment><USER13> Thank you, dang. Last thing I want to do is rain on someones parade. Startups are hard enough already.

</comment></comment></comment><comment><USER15> The "Address" you listed on your website is very interesting how does it work?

Their address by the way:

Banana Street, Off American House, East Legon, Accra, Ghana

<comment><USER16> I used to live in Ghana. Addresses are landmark-based as nobody knows street names. In this case the landmark is "American house". So it is a proper address in Ghanaian terms.

<comment><USER17> India is another place where this is fairly common. Addresses in the US are ridiculously simple and easy compared to many other countries.

</comment></comment></comment><comment><USER18> This is an awesome idea — forwarded to a few friends.

<comment><AUTHOR> Thanks, we'll love to hear their feedback. Our email is firstname.lastname@example.com

</comment></comment><comment><USER19> Interesting topic and I can see how this is a daily issue for some, but I don't get the startup angle. What's the eventual monetization angle? Referrals for hair stylists? Paid membership to get new lists of or customized styles?

Which of the pictures of the girl (linked to the dropbox share) is closest to her natural hair? The styles are so varied it's impossible to tell! On the aesthetic front (obviously IMHO) it's a toss up between Oct 2016 and Dec 2016 for best (though all look very nice!).

<comment><AUTHOR> We will monetize through product sales, stylists booking/referrals like you mentioned and native ads targeted at specific hair types within the black hair-care community.

With regards to your second question, the closest to her natural hair is the 1st pic (Nov 2016). Hers will be much shorter and will have to be straightened to look like this. It's surprising that none of the styles show her own hair.

<comment><USER15> I would avoid trying to charge for bookings. You will be the victim of Disintermediation because the stylist will tell give the client their number and say to not use trees to book.

I would suggest charging stylist to attached their searchable location and phone numbers to picture of hair styles. In other words charge them for advertising.

<comment><AUTHOR> Thanks for the feedback and suggestion. Will look into that option as well.

</comment></comment></comment></comment><comment><USER15> A way for hairstylist to market their work and a way for black women to find hairstylist is a problem. Especially when "sistas" relocate to a new area.

<comment><USER20> Funny story: Rachel Dolezal is apparently one of the few women in Spokane, WA who knows how to style black hair, and she's been able to keep herself afloat by doing black girls' hair.

</comment></comment><comment><USER21> This is so cool. Also what convinced you to go Android-first? Any discoveries that were especially surprising there?

<comment><AUTHOR> We initially tested Tress in Ghana and Nigeria and android devices are more predominant because they are more affordable and not as restrictive.

</comment></comment><comment><USER22> This feels relevant, although only somewhat:

[https://www.google.com/?q=Amasunzu+hairstyle](https://www.google.com/?q=Amasunzu+hairstyle)

"Amasunzu is an elaborate hairstyle traditionally worn by Rwandan worn by men and unmarried women."

</comment><comment><USER23> Couldn't someone just do a hashtag search on Instagram?

Why not just go big and do a social network for hairstyling in general?

I think the social commerce angle could be great for revenue, esp now Instagram are starting to launch it.

<comment><AUTHOR> Could you download and check out the app? There are a lot of nuances and specificity that can not be achieved via a hashtag on Instagram. On why not a social network for hair styling in general; same reason - nuances and specificity of our hair textures.

<comment><USER23> Just taken a look. I see what you mean, lots of nuances. Nice product!

</comment></comment></comment><comment><USER24> For other companies looking to get into YC, what do you think were the main factors that helped you get into the accelerator?

</comment><comment><USER25> I had a black girlfriend once and she he told me to watch the movie Good Hair. It was eye opening and I recommend the movie for everyone to watch.

</comment><comment><USER26> Is there a plan to expand to a larger/more heterogeneous demographic?

<comment><USER27> There's way less of a market in other demographics. For example, white women: we have less interesting hair. There simply aren't as many things we can do with it, because the structure of the individual hairs is less complex. Plus we have every women's magazine in the US and Europe assuming our hair is the "default." I'd say they know exactly what they're doing aiming at their own demographic.

</comment></comment><comment><USER28> It sounds trivial, but it could actually be an important stepping stone towards ending poverty and world hunger. Less time wasted on hair == more time for earning money. Well played.</comment>


Cor 0.3.0 released - <AUTHOR> http://yosbelms.github.io/cor <comment><USER2> _Cor does not has a keyword to declare variables, instead, Cor declares it for you the first time it is used. If a variable with equal name is declared in outer scope the compiler will assume you are using the declared outside. Unless you write the variable as a simple statement. This technique is called variable announcing._

Sadly, it's the same mistake that CoffeeScript made: you cannot just introduce a variable, to be completely sure you didn't break anything, you'll have to search for all uses of it in outer scope above and inner scopes below.

[https://donatstudios.com/CoffeeScript- Madness](https://donatstudios.com/CoffeeScript-Madness)

<comment><AUTHOR> "Variable announcing" solves that issue, please see the example in the following link:

[http://yosbelms.github.io/cor/docs/playground/index.html#lin...](http://yosbelms.github.io/cor/docs/playground/index.html#link:---%0Aexample%20of%20announcing%20variable%0A---%0A%0AsomeVar%20%3D%200%0A%0A%0A%2F%2F%20see%20how%20to%20use%20outer%0A%0Afunc%20usingOuter\(\)%20%7B%0A%20%20%20%20someVar%20%3D%200%0A%7D%0A%0A%0A%2F%2F%20see%20the%20compiled%20code%20in%20the%20right%2C%0A%2F%2F%20notice%20the%20declaration%20inside%20the%20scope%0A%0Afunc%20avoidingOuter\(\)%20%7B%0A%20%20%20%20someVar%0A%20%20%20%20someVar%20%3D%200%0A%7D)

<comment><USER2> I understand that you can announce variable, but to be save, you'll have to announce it in every scope you want to declare it, so why not just use "var" or ":=" to declare and assign?

<comment><AUTHOR> Looking for simplicity. One of the goals of Cor is to have few keywords, to make it easy to learn, to get involved, and to work with. I had three possible solutions to solve the variable scoping problem.

1- `var` keyword. Like javascript. It assumes all variables are global if not declared with `var`. 2- `global` keyword. Like PHP. It assumes all variables are local unlike that is annotated with `global`. 3- Ruby-like, Coffeescript- like.

A mixing of options number 1 and 3 was chosen.

I will open an issue regarding this subject, considering your proposal for future versions.

<comment><USER2> Thank you. Actually, what I think the best way is to make it an error to use undeclared variable, unlike in JavaScript. If it's a global, is should be declared in global scope. I really like this way of declaring variables, so please consider it:

      someVar := 123 //declared and assigned
      someVar = 456 // reassigned
      anotherVar = 777 // error: undeclared variable

</comment></comment></comment></comment></comment><comment><USER3> Not sure I really see the point of this. The syntax seems to offer little beyond what's possible already in ES6, and is missing several features, such as generators, destructuring, rest and spread operators and template strings that are very useful in modern JS development.

<comment><AUTHOR> Most of the design of ES6 is like this due to backward compatibility. I'm very sure if the comunity behind ES6 specs designs a language for the web regardless backward compatibility, ES would be very different to what it actually is. These features you are mentioning are awesome, for sure. But ES6 is bloated for sake of having features plus backward compatibility. Cor is different, it is simple but modern, it is going in the opposite direction.

</comment></comment><comment><AUTHOR> Release notes: [http://ost.io/@yosbelms/cor/topics/5](http://ost.io/@yosbelms/cor/topics/5)

</comment><comment><USER4> This is the first transcompiled JS language I've seen that I have wanted to use. It's as strait forward as JS, but adds a lot of features I wished the language had.</comment>


Ask HN: Is Perl 6 / Raku worth learning? - <AUTHOR> I have an old script updating some DNS record of mine which is buggy and starting to show its age. I have two options:
1) Fix it
2) Rewrite it and learn a new language
My choice was leaning towards 2). What do you think about Perl 6 / Raku? <comment><USER2> Raku would be an excellent choice for that, because programming in Raku can be fun, see e.g.: [https://medium.com/linux-plus-plus/linux- may-10-2020-c095b66...](https://medium.com/linux-plus-plus/linux- may-10-2020-c095b6650af5#e2c6)

Don't expect to be able find a full-time job in Raku just yet. But more experienced developers will always be better paid than developers that haven't looked beyond their side of the hill.

<comment><AUTHOR> Thanks for the reference. I'm not looking for a job, it's just for scratching my own itch.

</comment></comment><comment><USER3> Definitely it's worth a shot.

You'll love the language.

It's very expressive and flexible. The community is super friendly.

If you're into more serious things, there are some projects you might like.

For example cro - framework to develop web APIs.

As for production readiness - I have used the language at my devops @job for a couple of years.

Best.

Aleksei

</comment><comment><USER4> Interesting and +1 to the question, what do you guys think?

I'm still planning to look into Perl 6. What I like about Perl 5.x is its high out-of-the box availability (ie: no need to ask sysadmin to allow/install Ruby, Node etc..), so I find ideal for some basic automation scripts.

However, I have never really managed to get used to its (Perl 5's) syntax. I can create, initialize and iterate through a map/'hash table' in C++ without looking up the docs. Perl... is different, I have a hard time making its idioms stick. I am curious as to whether Perl 6 brings big changes syntax-wise and whether I can expect it to be overall more intuitive (not in general, but for this one programmer that is.)

<comment><USER5>
        my %hash-table = (
          abc => 1,
          def => 2,
        );

        for %hash-table {
          say .key, ' => ', .value;
        }

You can also use sub-signature deparsing.

        for %hash-table -> $ (:$key, :$value) {
          say "$key => $value"
        }

That may take a while to get used to.

You don't have to use it, but it is a very powerful feature so it is definitely worth learning.

\---

Really the most difficult thing seems to be that people aren't expecting Raku to be as consistent as it is. I think that is because most languages aren't.

For example you may expect this to work

        for @array -> $element {
          say $element
        }

but you wouldn't necessarily expect this to work

        if $var.method() -> $result {
          say $result
        }

In fact all keywords of the form `KEYWORD CONDITION {BLOCK}` will work with a pointy block.

You can also create a lambda using the same exact pointy block syntax.

        my &multiply = -> $a, $b { $a * $b }

        say multiply 4, 5; # 20

\---

Also the signature part of a pointy block is exactly the same as a subroutine signature, and a method signature.

You can even create an anonymous signature object.

        :( $foo, $bar )

(There aren't a lot of uses for it though.)

\---

I still get surprised sometimes with how consistent Raku is.

<comment><USER4> This is a really good explanation, thank you.

</comment></comment></comment><comment><USER6> Raku is cool if you want to learn some new paradigms that other languages might copy too. Perl would be a more suitable choice if you were looking for a language that might be used for job search right now.

</comment><comment><USER7> My strategy for deciding whether a language is worth learning is to ask yourself what problems is the language solving. My understanding is that Perl 6 has no major advantages over the other general-purpose languages and is fairly niche and I expect it to remain so.

From a profitability standpoint, your time is better invested into getting better at whatever language you'er currently using or learn a new language that will give you more career opportunities. Learning a niche language that has no major selling points over the major existing languages is a pure waste of time that will never pay off.

<comment><USER2> > Perl 6 has no major advantages

\- proper support for Unicode graphemes for example, a CRLF is a single grapheme in Raku

\- lots of syntax for handling parallelisation and concurrency promises, start blocks, react whenever, supplies

\- improved regular expressions and grammars whitespace insignificant, grammars are subclassable modules

\- improved maintainability in production envirionments multiple versions of a library can be installed at the same time and can be addressed from code separately, since all imports are always lexical

To name but a few features that most other languages do _not_ have.</comment></comment>